United States GAO General Accounting Office Washington, D.C. 20548 Accounting and Information Management Division B-281270 June 11,1999 The Honorable Togo D. West The Secretary of Veterans Affairs Subject: Year 2000 Computing Crisis: Actions Needed to Ensure Continued Delivery of Veterans Benefits and Health Care Services Dear Mr. Secretary: On April l&1999, we testified before the Subcommittee on Oversight and Investigations, House Committee on Veterans’ Affairs, on the readiness of the Department of Veterans Affairs (VA) to deliver benefits and health care services through the turn of the century.’ In our testimony we reported that, while VA continues to make progress, key actions remain to be performed. Specifically, (1) the Veterans Benefits Administration (VBA) and Veterans Health Administration (IHA) have not yet completed testing of their mission-critical systems to ensure that the systems can reliably accept future dates, (2) VHA has not yet completed assessments of its facility systems, (3) VHA’s pharmaceutical operations are at risk because the automated systems supporting its consolidated mail outpatient pharmacies (CMOP) are not yet Y2K compliant, (4) VHA does not yet include the CMOP systems in its quarterly report of mission-critical systems to the Office of Management and Budget (OMB), and (5) VHA does not yet know if its medical facilities will have a sufficient supply of pharmaceutical and medical-surgical supplies on hand because it does not have complete information on the YtZK-readiness of these manufacturers. This report transmits our recommendations to VA for completing key actions necessary to ensure the continued delivery of benefits and health care services to veterans beyond January 1,200O. Our testimony, reprinted as enclosure 1, contains a description of our objectives, scope, and methodology. As you know, we incorporated VA’s comments into our April 15 testimony. We performed our work in accordance with generally accepted government auditing standards. ‘Year 2000 Computing Crisis: Action Needed to Ensure Continued Deliverv of Veterans &n&its and Health Care Services(GAOfl-AIMD-99-136,April 15,1999). GAO/AIh!lD-99-190R Veterans Benefits and Health Care Services B-281270 a Recommendations to the Secretary of Veterans Affairs Based on our April 15,1999, testimony, we recommend that the Secretary of Veterans Affairs ensure that the following specific actions are taken: CompleteY2K testing of VBA and VHA mission-critical systems-including systems acceptance testing, full future-date testing, end-to-end testing, and business process simulation testing on compliant platforms. Set deadlines to complete assessment, renovation, validation, and implementation of VHA facility systems. Develop business continuity and contingency plans for VHA CMOPs to ensure an uninterrupted supply of medications to veterans in the event of Y2K problems at these facilities. ReassessVA’s decision not to report CMOP systems as mission-critical. Reporting these systems as mission-critical to VA top management and OMB wilI help ensure that necessary attention is paid and action taken. Seek the assistance of the Food and Drug Administration and industry trade associations in obtaining information on the Y2K readiness of specific pharmaceutical and medical-surgical suppliers that did not respond to WA’s survey, and publicize the results in a single data clearinghouse. Apencv Comments and Our Evaluation In commenting on a draft of this report, the Department of Veterans Affairs generally concurred with our recommendations. VA also provided additional information on its efforts to assure confidence in its ability to continue delivering services to veterans and their beneficiaries. For example, it noted that all VA applications, including those supporting benefits delivery and health care, have completed the renovation, verification, and implementation phases. VA noted that it still needs to complete post-implementation testing and said that testing is scheduled to be complete by September 1,1999. VA further noted that it has completed business contingency and continuity plans for benefits delivery and health care and that these are in place at each of VA’s regional offkes and medical facilities. VA’s written comments are reprinted in their entirety as enclosure 2. This report contains recommendations to you. As you know, the head of a federal agency is required by 31 U.S.C. 720 to submit a written statement on actions taken on these recommendations to the Senate Committee on Governmental Affairs and the House Committee on Government Reform not later than 60 days after the date of this report. A written statement must also be sent to the House and Senate Committees on Appropriations with the agency’s first request for appropriations made more than 60 days after the date of this report. Page2 GAOMMD-99-190R Veterans Benefits and Health Care Services r B-281270 We are sending copies of this report to Senator Christopher S. Bond, Senator Robert Byrd, Senator Tom Harkin, Senator Barbara Mikrdski, Senator John D. Rockefeller, Senator Arlen Specter, Senator Ted Stevens, Representative Michael Bilirakis, Representative Corrine Brown, Representative Sherrod Brown, Representative Lane Evans, Representative Terry Everett, Representative Bob Filner, Representative Luis Gutierrez, Representative Ron Klink, Representative Alan B. Mollohan, Representative Jack Quinn, Representative Clifford Stearns, Representative Bob Stump, Representative Fred Upton, and Representative James T. Walsh in their capacities as Chairmen and Ranking Minority Members of Senate and House Committees and Subcommittees. We are also sending copies to the Honorable Jane E. Henney, Commissioner of the Food and Drug Administration; the Honorable Jacob J. Lew, Director of the Office of Management and Budget; and the Honorable John Koskinen, Chair of the President’s Council on Year 2000 Conversion. Copies will also be made available to others upon request. Should you or your staff have any questions concerning this report, please contact me at (202) 512-6253. I can also be reached by e-mail at firstname.lastname@example.org Major contributors to this report are listed in enclosure 3. Sincerely yours, Director, Civil Agencies Information Systems Page 3 GAO/AIMD99-190R Veterans Benefits and Health Care Services Enclosure 1 GAO Testimony Dated April 15,1999 United States General Acconnting Office GAO Testimony Before the Subcommittee on Oversight and Investigations, Committee on Veterans’Affairs, House of Representatives YEAR2OO0COMPUTING CRISIS Action Needed to Ensure Continued Delivery of Veterans Benefits and Health Care Services Statement of Joel C. W2lemssen Director, Civil Agencies Information Systems Accounting and Information Management Division j&$&g&& GAO/T-m-99-136 Page 4 GAO/AIMD-99-190R Veterans Benefits and Health Care Services Enclosure 1 GAO Testimony Dated April 15,1999 Page 5 GAO/AIMD-99-190R Veterans Benefits and Health Care Services Enclosure 1 GAO Testimony Dated April 15,1999 Mr. Chairman and Members of the Subcommittee: We appreciate the opportunity to participate in today’s hearing on the readiness of the Department of Veterans Affairs (VA) to deliver benefits and health care services through the turn of the century. We will focus on the Year2000 (Y2K) readiness of automated systems that support such delivery, the compliance status of biomedical equipment used in patient care. and the Y2K readiness of the pharmaceutical and medical-surgical manufacturers upon which VA relies. In discussing biomedical equipment and pharmaceutical products, we will also share with you information on the Food and Drug Adminlltion’s (FDA) Y2K effortz~~ In brief, VA continues to make progress in its Y2Kreadiness. However, key actions remain co be perfornwd. For example, the Veterans Reneiits Administration (TBA) and Veterans Health Administration (VHA) have not yet complatad testing of their missio~ca~ systems to ensure that these systems can reliably accept future dates-such as January 1,2000. Also, VHA has not completed assessments for its facility systems, which can be essential M ensuring continuing health rare. In addition, neither VA nor FDA have implemented our prior recommendation to review the test results for biomedical equipment used in critical cawlife support environments. Further, Vi-IA’s pharmaceutical operations are at risk because the automated systems supporting its consotidated mail outpatient pharmacies are not Y2K compliant. Finally, VHA does not know if its medical facilities will have a sufficient supply of pharmaceutical and medical-surgical supplies on hand because it does not have complete information on the Y2K readiness of these manufacturns. It is critical that these concerns be addressed ifVA is to continue reliily delivering benefits and health care. Key Actions Remain to Likemany o~anizations, VA faces the possibility of computer system failures at the turn of the century due to incorrect information processing Ensure That VA Can relating to dates. The reason for this is that in many systems, the year 2000 Deliver Benefits and is indistinguishable from 1900, since the year is represented only by ‘00.” Health Care Into the This could make veterans who are eligible for benefits and medical can appear ineligible. If this happens, the issuance of benefits and the Next Century Page 6 GAO/AIMD-99-190R Veterans Benefits and Health Care Services Enclosure 1 GAO Testimony Dated April 15,1999 1 provision of medical care that veterans rely on could be delayed or interrupted. As we reported last August,’ VBA had made progress in addressing the reconmwndatiow in our May 1997 report’ and making its information systems Y2K compliant. 1 reported it had renovated 75 percent of its missioncritical applications as of June 1998. At the same time, VHA reported it had assessed all and renovated the vast mqiority of its mission- critical infonw.tion systems. Despite this progress, VBA was making limited progress in renovating two key mission-critical applications-the compensation and pension online application and the Beneficiary Identification and Record Locator Sub- System. And, except for its insurance Service, VBA bad not developed business continuity and contingency plans for irs program services- Comuensation and Pension (the larzesth Education. Loan Guaranty. and Voc&onal Rehabilitation a& Cou&li$-to ens& that they would continue to operate if Y2K failures occurred. VHA’s YZK progmm likewise had areas of concern. For example, although WA’s medical facilities had hospital contingency plans. as required by the Joint Commission on Accreditation of Healthcare Organizations, they had not yet completed Y2K business continuity and contingency plans. To address these areas and to reduce the likelihood of delayed or interrupted benetits and health care services, we recommended that VA l reassess its Y2K mission-critical efforts for the compensation and pension online application and the Beneficisq Identification and Record Locator Sub-System, as well as other information technology initiatives, such as special projects, to ensure that the Y2K efforts have adequate resources, including contract support, to achieve compliance in time; l establish critical deadlines for the preparation of business continuity and contingency plans for each core business process or program service so that missionuitical functions affecting benefits delivery can be carried out even if software applications and commercial-off-the- GAO/AIMD-99-19OR Veterans Benefits and Health Care Services Enclosure 1 GAO Testimony Dated April 15,1999 shelf (COTS) products fail, including a description of resources, staff roles, procedures, and timetables needed for implementation; and l ensure rapid development of business continuity and contingency plans for each medical facility so that mission-critical functions affecting patient care can be carried out if software applications, COTS products, and/or facility-reIated systems and equipment do not function properly, including a description of resources, staff roles, procedures. and timetables needed for implementation4 VA Continues to Make VA has been responsive to our recommendations. For example, VBA Progress reassessed its missionsriticai effoas for the compensation and pension online application and the Beneficiary Identification and Record Locator SubSystem, as well as other information &xhnoIogy initiatives. it also reallocated resources to ensure that the Y2K efforts had adequate resources, including contract support, to achieve compliance. In addition, VBA completed a dmft business continuity and contingency plan in January 1999 for its core business processes, as well as a related planning template for its regional oflices. The plan provides a high-level overview of the resmrces, staff roles, procedures, and timetables for its implementation. It addresses risks, includii mitigation~actions to reduce the impact of Y2K:mduced business failures, and analyzes the effect on each business line of a number of potential Y2K disasters-such as loss of electrical power, loss of communications, loss of datilprocessing capabilities, and failure of internal inlrastructurc. According to VBA, the plan, which it expects to test this August, is an evolving document, to be revised and updated periodically untilJanuary 1.2000. VBAk plan makes no reference to contingencies for the failure of three of VB& benefit payment systems-Compensation and Pension, Education, and Vocational Rehabilitation and Counseliw. However. it is currentlv developing a payment contingency plan for these systams and expects this to be completed in May 1999. A VBA o~cial told us that the payment contingency plan should have beenraferencedin VU’s business continuity and contingency plan and will be in future versions. The current plan also does not contain the designation of an infmmation technotogv security coordinator and a physical security coordinator-individualsthat VBA acknowledges are essential to the agency’s Y2K efforts-with responsibility Page 8 GAOIAIMD-99-19OR Veterans Benefits and Health Care Services Enclosure 1 GAO Testimony Dated April 15,1999 for ensuring overall security for VBAs network and web site and backing up data storage before, during, and following January 1,2CC0. This type of information will be necessary if security-related failures occur. According to VBA, it expects to designate these individuals by August 1999. VHA has also made progress in developing business contfnui~ and contingency plans for its medical facilities. Last month. VHA issued its Patient-Focused Year 2000 Contingency Planning Guidehook to its medical facilities describing actions they can take to minindze Y2K-related disruptions to patient care. The guidebook discusses how the facilities should develop contingency plans for each major hospital function-such as radiology, pharmacy, and laboratory+s well as each major support function-such as telecommunications, facility systems, medical devices, and automated information systems. The guidebook also contains examples of plans, policies, and solutions for problems that a medical faciiity may face and provides Y2K templates describing the areas a facility should address by specific hospital function. VA provided this guidebook to the medical facilities early last month and expects the facilities to use it to prepare their individual business continuity and contingcncyplans, set to be completed by April 30. The guidebook stresses that these plans should be tested and suggesrs that the medical facilities be&t testing in June. The guidebook addresses external emergency preparedness se weIl as int.emal operations. Specifically, it discusses three functions that medical facilities should perform in order to ensure thal potential external hazards are considered and planned for. Theseare (1) performing an assessment of hazard vulnerabilities-that is, the types and kinds of Y2Kproblems that are anticipated within the community, (2) conducting an inventory of conununity resources-people. money, clinical space, supplies, and equipment-available to address these hazards, and (3) closing the gap between vulnerabihties and capabilities by putting into place measures that will mitigate potential diiptions in critical servicers by developing new working relationships with Various government agencies, non-VA he&h care organizations, and vendors of crhical auppliis. 1x1addition to implementing our recommendations, VA continues to make progress renovating, validating, and implementing its systems. On March 31.1999, VA reported to the Office of Management and Budget (OMB) that the department has renovated and implemented all of the mission-critical applications supporting its 11 .systems areas. As shown in table 1, VBA has six of these areas, and VHA has two. GAOIAIMD-99-19OR Veterans Benefits and Health Care Services Enclosure 1 GAO Testimony Dated April 15,1999 Table 1: Reported status of VA’s Mirsion-Clitisel Cornput& Systems Amas kd ” Their Appllcattona Number of applications renovated DI **Placed Veterans Benefits Compensattm and Pension 30 Administration (6) Fd,nwnn 74 Loan Guaranty 19 Vocational Rehabilitatiin 4 Administmtiue 27 V’dlerans Health v*temns Hs*th 1”tommtion Admtntstrabn (2) Systems and Technolagy Archttectur.3 Vet%ms Health Administration Corporate Syslems Total National Cemetety Burial opeatians support S~Srn/ System (1) Automated Monument Application System Reengineer mtat Ollice 01 Financial Petsannel and Accounting fdanegement (2) tntegrated Data Ftnamial Management System Total v* total II -3 mir Wtal.316 appllcatiDnswere re”wat8d snd two welo mpaw3. Source: “A. We hm not independen~vsrifipdthlrfn~rmatl~n. Testing of Mission-Critical Complete and thorough Y2K testing is essential to providing reasonable Systems Not Yet Complete assurance that new or modified systems will process dates correctly and will not jeopardize an organization’s ability to perform core business operations.~ Because the YZK problem is so pewasive, potentially affecting an organization’s systems software, applications soffnrare, databases, hardware, firmware, embedded processops, tekcommunicaticns, and Page 10 GAO/AIMD-99-19OR Veterans Benefits and Health Care Services Enclosure 1 GAO Testimony Dated April 15,1999 interfaces, the requisite testing can be extensive and expensive. Experience is showing that YZK testing is consuming between 60 and 70 percent of a YZK project’s time and resources. According to our Y2K guide, to be done effectively, testing should be planned and conducted in a shuctured and disciplined fashion. Our guide describes a step-by-step framework for managing MK testing, which includes the following key processes: * Software unit testingto verify that the smallest defined module of software (individual subprograms or procedures) continues to work as intended. l Sotham integration tcscingto verify that units of sofhvare, when combined, contiiue to work togetheras intended. ?srpicalJy,integration testing focuses on ensuring that the interfaces work correctly and that the integrated softwsre meetS requirements. l System acceptance testing to verify that the complete system-that is, the full complement ofapplication software running on the target hardware and systems software infrastructure-satisfies specific requirements and is acceptable to users. This testing can be run separately or in some combiition in an operational environment factual or simulated) and collectively veiifles that the entire system performs as expected. According to VBA and VHA officials, their testing criteria were based on theirsoftware development life cycle guidance documents. They said that upon completion of software unit and integration testing, a system is considered Y2K compliant. They said this type of testing had been completed for all of their mission-critical systems. As of March 31,1999, neither VBA nor VHA had completed systems acceptance testing-which requires that each system be tested, includii full forward-date testing, on a compliant platform-for all their mission- critical systems. Specifically, according to VBA officials, the agency had completed systems acceptance testing for half of its mission-critical systems-Insurance, Loan Guaranty, and Vocational Rehabilitation and Counseling. According to VW’s Man% 1999 draft test plan, systems acceptance testing of the Compensation and Pension and most of the Education systems was to start in mid-April 1999. According to a VBA official. one of the reasons for the late systems testing was that the IBM platfom at its Hines, Illinois, data center was not made Year 2000 GAOfAIMD-99-190R Veterans Benefits and Health Care Services Enclosure 1 GAO Testimony Dated April 15,1999 compliant until the compiler’ was upgraded in February 1339. According to VBA, the Compensation and Pension and most of the Education systems will be future-date tested throughout April. VHA also plyls to begin system acceptance testing of its missioncritical systems this month and complete it this June. According to VHA officiaLs, they could not perform thii type of testing before March of this year because VHA did not have a separate YZK-compliant test environment to isolate the testing from the hospital systems in use. In addition to testing of individual systems, end-to-end testing of multiple systems GGalso critical. End-m-end testing, as defined lo our test guide, verities that a defined set of interrelated systems, which collectively support an organizational core business area or function, continues to work as intended inan operational environment, either actual orsimulated. For example, in order to successfully process a compensation benefit payment to aveteran, VBXs Compensation and Pension System must work correctly with its Beneficimyldentitication and Records Locator Sub- System. Treasury’s Financial Management System, the Federal Reserve System, and fmancial institution systems. VBA and VHA plan to conduct end-mend testing between now and this July. VBA is defining end-to-end testing as verification that core mission- critical business functions, including benefit payments and vendor and payroll payments, process correctly. The interfaces behveen VBA’s benefits system and ~easu& Financial Management System are to be tested in May. VBA also plans to test transactions that interface with WA syxems, such as infomratian related toveteran eligibility. VITA is defining end-t- end testing as verification that core missionaitical business fununctions, includii patientcare transactions and vendor and payroll payments, process correctly. Once these tests are completed. VBA and VHAplan to conduct a %usiness process simulation” during the July 4,1999, weekend. This simulation of day-today work at VA is to include users at the VBA regional offkes and VHA test laboratories, who wlIl simulate various transactions and process them through a set of interrelated systems necessary to complete a core business function. VBA expects to pretest the business process simulation during May. Page 12 GAO/AIMD-99-190R Veterans Benefits and Health Care Services Enclosure 1 GAO Testimony Dated April Xi,1999 Assessment of VHAk VAk facility systems are essential to the continued delivery of health care Facility Systems Not Yet sctices. For example, heating, ventilating. and air conditioning equipment is used by hospitals to ensure that contaminated air is confined to a Complete specified area such as an isolation room or patient ward. If computer systems used to maintain these syst~s were to fail, any resulting climate fluctuations could affect patient safety. Despite their importance, WA has not yet completed its ascssment of facility systems. As of February 28,1939, VHA medical facilities reporccd that they had assessed 55 percent of their facility systems. According to VHKs Director of Safety and Technical Programs, the remaining 45 percent have not been folly assessed primarily because (1) facility systems tend to be a combination of unique elements that have to be separately assessed for compliance-a timecousumingproce-and (2) WA is still awaiting compliance status information from facility systemmanufacturers. VHA has not established milestones for completing its assessment and implementation of compliant facility systems. To help ensure that sufficient time remains to complete these activities, we recommend that VHA consider setting such deadlines. In the event that facility-related systems and equipment do not function properly due to Y2K problems. VHA medical facilities will need to ensure that they have business continuity and contingency plans addressing how mission-critical functions affecting patient care will be carried out. According to WA’s Director of Safety and Technical Programs, most of its facility systems have some kid of manu.s.loverride or reset that will allow them to continue functioning after a YZK problem. He agreed, however, with the importance of developing contingency plans lhat fully document continued delivery of essential services in the event of a facility system failure. WA medical facilities expect to have individual business continuity and contingency plans completed by April 30. On April 14.1999, VA informed us that its February 28,13Q9.report contained an error. The corrected numbers for facility systems at the end of February were 91 percent assessed and 3 percent not assessed. Page 8 GAOIAIMD-99-190R Veterans Benefits and Health Care Services Enclosure 1 GAO Testimony Dated April 15,1999 BiomedicalEquipment: The question of whether medical devices such as magnetic r&onance imaging (MRi) systems, x-ray machines. pacemakers, and cardiac Additional Status monitoring equipment can be counted on to work reliably on and after Information Available, January 1,2000, is also critical toVHA To the extent that biomedical But Test Results Not equipment uses embedded computerchips, it is vulnerable to the Y2K problem. Such vulnerability carries with it possible safety risks. This could Reviewed range from the more benign-such as incorrect formatting of a printout-to the most serious-such as incorrect operationof equipment with the potential to adversely affect the patient. The degree of risk depends in laq$e pat on the role the equipment playsin a patient’care. s Additional Biomedical Last September we testified before this Subcommittee that VHAwas Equipment Status making progress in assessing its biomedical equipment, but that it did not Information Available know the full extent of the Y2K problem with this equipment because it had not received compliance information from 398 manufacturers (26.7 perccnt).7 According to WA, as ofMarch 16, 1999, the number of nonresponsive manufacturers had been reduced to 126 (3.5 per~ent).~ As shown in tile 2, about 19 percent of the manufacturers in VIWs database of suppliers had at least one biomedical equipment item that was either noncompliant or conditionally compliant. Page 14 GAO/AIMD-99-190R Veterans Benefits and Health Care Services Enclosure 1 GAO Testimony Dated April 15,1999 Table 2: Status of Hanufactwer Responses to VHA 8% of March I&“1999 Category Compliant manuladurersa 816 55.2 Noncompliant manufacture& 126 6.5 Conditinalcompliant manufacturersc 156 10.5 Pending manulactumrsd 29 2.0 Manufadurers mergedar bought cd 226 15.3 Nonresponsive manuIadurers’ 126 a.5 Total 1,479 100.0 *For i”duSim inthlscatsgory. IW pe”xnt 01 the tnmyIB”“rer’s products hadlo be c&dwed mmptiant. To identify specific biomedical equipment in the inventories of WAS medical facilities that still require Y2K compliance status information from manufacturers, V?Ws Chief Network Oflker sent a letter to the directors of VEiA’s 22 Veterans Integrated Service Networks (VISN). This letter requested that they (1) review VIWs list of manufactw.?rs that have yet to respond and compare it with a list of manufacturers from whom their medical facilities still require compli~e information and (2) indicate the equipment item that the facility owns for each matmfacturer. According to VHA’s YZK project director, as of mid-March-with 136 of 147 medical reporting sites-47 biomedical equipment items involving 35 manofactorers were identified as still requiring compliance stauis information. The project diitar told us that VHA medical facilities have been instructed to replace or eliminate equipment in their inventories for which they do not know the compliance status by June 30. According to WA’s February 1999 status report on medical devices, medical facilities &mated that the total cost of renovations will be about $41 million. Page 15 GAOIAIMD-99-190R Veterans Benefxts and Health Care Services Enclosure 1 GAO Testimony Dated April 15,1999 We have previously reported that most manufacturers citing noncompliant producti listed incorrect display of date and/or tie as the Y2K problanY According to VA, these cases do not present a risk to patient safety because health care providers, such as physicians and numes, can work around the problem. Of more setious concern are situations in which devices depend on date calculation.+the results of which can be incorrect One manufacturer cited the example of a product used for plawing delivay of radiation treatment using a radioactiie isotope zs the source. An error in calculating the strength ofthe radiation source on the day of treatment could result in a dose that is too high or too low, which could have an adverse effect on the patient. Other examples of equipment presenting a risk to patient safety identified by manufacturers to FDA include hemodiiysis delivery systems, therapeutic apheresis system~,‘~ alpha- fetoprotein kits for neural tube defects;” various types of medical imaging equipment; and systems that store, track. and recall images in chronological order. To track the compliance status of its biomedical equipment, WA uses a monthly status report on medical devices based on information provided by the VISNs. According to the February 1999 report, appmximatcly 426,000 o1531.000medical devices in VIIA medic& facilities are compliant. Of the remaining devices, 86,452were identified as conditional-compliant or were not assessed for Y2K compliance because the manufacturers certified that the equipment contained no software or embedded chips, and 19,073were reported as being noncompliant Of the noncompliant devices identified, 15,621are to be repaired, 1,582 are to be replaced, 757 are to be used as is. 255 are to be retired, and 855 are still awaiting a decision on the remedy. According to WA’s Chief Biomedical Engineer, most of the noncompliant devices identif%edincorrectly displayed date/time. As we reported last September, FDA was also trying to determine the Y2K compliance status of biomedical equipment.‘” Its goal is to provide a pal .._ s.l”mn~ K?40/.4lMD98240, September LB.Pxe). Page 16 GAOIAIMD-99-190R Veterans Benefits and Health Care Services Enclosure 1 GAO Testimony Dated April 15,1999 comprehensive, centralized source of information on the Y2K compliance status of biomedical equipment used in the United States and make this information publicly available on a web site. At the time, however, FDA had a disappointing response mte from manufacturers to its letter requesting compliance information. And, while FDA made thii information available to the public, it-was not detailed enough to be useful. Specifically, FDAS lii of compliant equipment lacked information on particular make and model. To provide more detailed information on the compliance status of biomedical equipment, as well as to intsgratc more detailed compliance information gathered by K-X, we recommended that VA and the Department of Health and Human Services @HS) jointly develop a single data clearinghouse that provides such information to all users. We said development of the clearinghouse should involve representatives from the health care industry, such as the Department of Dcfcnse and the Health Industry Manufacturers Association. We recommended that the clearinghouse contain such information as (1) the compliance status of all biomedical equipment by make and model and (2) the identity of manufacturers that are no longer in busins%%.We also recommended that VHA and FDA dctcnnine what actions should be taken regarding biomedical equipment manufacturers that have not provided compliance infoItnation. In response to our recommendation, FDA-in cor(iunction with VI&%-has established the Federal Year 2OKJBiomedical Equipment Clearinghouse. With the assisrance of VHA, the Department of Defense, and the Health Industry Manufacturers Association, FDA has made progress in obtaining compliance-status information from manufacturers. For exampie, according to FDA, as of April 5,1999,4,261 biomedical equipment manufacturers had submitted data to the clearinghouse. As shown in f@ue 1, about 64 percent of the manufacturers reported hating products that do not employ a date, while about 16 percent reported having date- related problems such as incorxct display of date/time. FDA is still awaiting responses from 399 manufachuers. L GAO/AIMD-99-190R Veterans Benefits and Health Care Services Enclosure 1 GAO Testimony Dated April 15,1999 Figurel: Biomedical EquIpmentCompliance-S~~sIntDrma;ion Reportedto FDAby t&n”‘aCtUrers as ot April 5.1999 FDA has &o expanded the information in the cletinghouuse. For example, users can now find information on manufaausers that have merged with or have been bought out by other tims In collaboration with the National Patient Safety Partneahip,” FDA is in the process of obtaining more detailed information from manufacturers on noncompIian& products, such as make and model and descriptions of tbe impact of the YZK problem on products MtuncoHected. Page 18 GAO/AI&ID-99-19OR Veterans Benefits and Health Care Services Enclosure 1 GAO Testimony Dated April 15,1999 Review of Biomedical We reported last September that VHA and FDA r&cd on manufacturers to Equipment Test Results validate, test, and certify that equipment is YZK compliant’” We also reported that there wss no awxance that the msnufacturers adequately Lacking addressed the Y2K emblem for noncompliant equipment because F’IIA did not require medi&dsvice manufacture& to submit test results to it certifying compliance. Accordingly, we recommended that VA and HHS take prudent steps fo jointly review manutacturem’ compliance test results for critical careA& support biomedical equipment. We were especially concerned that VA and FDA review test results for equipment previously detcnnined to be noncompliant but now deemed by manufacturers to be compliant, or equipment for which concen~ about compliice remain. We also recommended that VA and HHS determine what legislative, regulatory or other changes were ncc~sary to obtain assursnccs that the manufacturers’ equipment was compliant, including performing independent vezitication and validation of the manufacturers’ certiflications. At the time, VA stated that it had no legislative or regulatory authority to impk.ment the recommendation to review test results from manufacturers. in its response, HHS stated that it did not concur with OLUrecommendation to review test results supporting medical device equipment manufacturers’ certifications that their equipment is compliant. It believed that the submission of appropriate certTfications of compliance was sufficient to ensure that the certifying manufacturers are in compliance. HHS also stated thar it did not have the resources to undertake such a review, yet we are not aware of HHS’requesting resources from the Congress for this Purp==. More recently, VHAk Chief Biomedical Engineer told us that VB.A medical facilities are not mque9ting test results for critical ca&life support biomedical equipment; they aiso are not curently reviewing the test results available on manufacturers’ web sitcs. He said that VHA’s priority is determining the compliance status of its biomedical equipment inventory and replacing noncompliant equipment. The director of FDAk Division of Electronics and Computer Science likewise said FDA sees no need ta question manufacturers’ certifications. Page 19 GAO/AIMD-99-190R Veterans Benefits and Health Care Services Enclosure 1 GAO Testimony Dated April 15,1999 In contrast to WA’s and FDXs ~ositiors. some hospitals in the private sector believe that testing hio&edical eq&ment i.~ncceesary to prove that they have exercised due diligence in the pmtection of patient health and safety. Officials at three hospitals told us that their biomedical engineers established their own test programs for biomedical equipment, and in many cases contacted the manufacturers for their tat protocols. Several of these engineers informed us that their testing identified some noncompliant equipment that the manufacturers had certified as compliant. Accordiig to these engineers, to date, the equipment found to be noncompliant all had diibxy problems and was not critical care/life support equipment. We were told that equipment found to bc incorrectly certified as compliant included a cardiac catheterization unit, a pulse oxymeter, medical imaging equipment, and ultrasound equipment. WA, FDA, and the Emergency Care Research Institute” continue to believe that manufacturers are best qualified to analyze embedded systems or software to determine YZK compliance. They further believe that manufacturers are the ones with full access to all design and operating parameters contained in the internal software or embedded chips in the equipment VHA believes that such testing can potentially cause irreparable damage to expensive health care equipment, causing it to lock up or otherwise cease functioning. Further, a number of manufacturers also hwe recommended that users not conduct veriliration and validation testing. We continue to believe that rather than relying solely on manufacturers’ certifications, organizations such as VfL4 or FDA can provide users of medical devices with a greater level of confidence that the devices are YZK compliant through independent reviews of manufacturers’ compliance test results. The question of whether to independently verify and validate biomedical equipment that manufacturers have certified as compliant is one that must be addressed jointly by medical fac!Mies clinical sti, biomedical engineers, and corporate management. The overriding crimion should be ensuring patient health and safety. Page 20 GAOIAIMD-99-19OR Veterans Benefits and Health Care Services Enclosure 1 GAO Testimony Dated April 15,1999 VHA Pharmaceutical Another critical component to VA’s ability to deliver health care at the turn of the century is ensuring that the automated systems supporting VHA’s Operations Also Face medical faciliQ pharmacies and its consolidated mail outpatient YZK Risks pharmacies (CMOP) are Y2K compliant. VEXAreported that in 1998. itfmed about 72 million prescriptions for3.4 million veterans, at an estimated cost of about $2 billion. About half of the prescriptions were tilled by the over 200 pharmacies located in%% medical centers, clinics, and nursing homes. These pharmacies rely on the pharmaceutical applications in the Veterans Health Information Systems Architecture (VIST.4) for (1) drug distribution and inventory management, (2) dispensing of drugs to inpatients and outpatients, (3) patient medication information, and (4) an electronic connection between the pharmacies and the CMOPs. Y2K failures in these applications could impair the pbarnmcies ability to fill prescriptions. The remaining 50 percent of VHA’s prescriptions are tilled by seven CMOPs, geographically located throughout the United States. These facilities are supported by automated systems provided by one of two contractors- SUBaker, Inc. and Siemens ElectroCom. ” For example, the CMOP electronically receives a prescription for a veteran through the medical center. The prescription is downloaded to highly automated dispensing equipment to he filled. The tilled prescription is then validated by a pharmacist who compares the medication against a computerized image of the prescribed medication. Afterward, the prescription is packaged and an automatically generated mailing label is applied for delivery to the veteran. Finally, the medical center is electronically notified that the prescription has been Jilled. Because of the reliance on automation, the CMOPs’ abiity to ffl prescriptions could be delayed or interrupted if a YZK failure occurred. VHA has determined that the automated systems supporting its CMOPs are not Y2K compliant. Specifically, neither of the systems provided by their contractors are Y2K compliant. According to the Y2K coordinator for the SI/Baker facilities, failure to make the SyBaker systems Y2K compliant may delay the fu of outpatient prescriptions. The SI/Baker systems are used by three of VI-I& CMOPs-Hines, IUinois; Charleston, South Carolina; and Mmfreesboro, Tennessee; they handle about 58 percent of all prescriptions filled by CMOPs. In contrast to the SUBalter systems, according to a contractor hid by the CMOPs that use these sysrems, Page 21 GAO/AIMD-99-190R Veterans Benefits and Health Care Services Enclosure 1 GAO Testimony Dated April 15,1999 failure to make tbe Siemens ElecPoCom systems YZK compliant may result in delays in processing management reports for prescriptions filled, but not the actual tilling of prescriptions. Although the CMOPs plan to replacetheir noncompliant systemswith compliant ones, these systems are nbt scheduled to be implemented until mid- to late-1999. As shown in table 3, the earliest estimaed completion date for implementing a compliant system is June 30.1999. while the latest is December 1.1999. This leaves little time to address any unexpected implementation problems. 15.000 June 30.1999 16,000 June 30.1999 14.ow July 31.1999 16.000 septemmr 1. 1999 23,000 September SO, 1999 3B.000 December 1.1999 21.000 Given the late schedule for implementing compliant sy#ms, it is crucial that the CMOPs develop business continuity and contingency plans to enswe that veterans will continue to receive their medications if these systems are not implemented in time or fail to operate properly. AS of March 31. VA had not completed a business continuity and contingency plan for the GMOPs. The YZK coordinator for the Siemens ElectroCon~ system has been tasked with developing this plan. which is to be completed by the end of thii month. Further, VA did not include the CMOP systems in its quarterly reports of missioncritical systems to OMB. According to Ws Y2K project direcror, VHA considered the GMOP systems to be COTS products and, therefore, Page 22 GAOIAIMD-99-190R Veterans Benefits and Health Care Services Enclosure 1 GAO Testimony Dated April 15,1999 did not report them as mission-critical systems. Given the criticality of these systems to VHA’s ability to ffi prescriptions at thetorn of the century, we believe VA should reassess this decision, reportiog CMOPs as mission- critical to VA top management and OMB to help ensure ti-& neefssaxy attention is paid to and action is taken on them. VA Taking Action to VA, like otber users of pharmaceutical and medical-surgical products. ~~~~ YAK ~~~~~~~ ,,f needs to know whether it will have a sumdent supply of these items for its Pharmaceutical and customers. Themfore, it has taken a leadership role in lhe federal gowmment in determining whether manufacturers supplying these Medical-Surgical productsto VHA are Y2K-ready. This information is essentii to VII& Manufacturers medical faciiities and CMOPs because of their “just-in-tin&t7 inventory policy. Accordiigly, they must know whether theirmarmfacturers’ processes, which are highly automat.ed,‘8 ace at risk, as well as whether the rest Of the supply chain will function properly. To determine the Y2K readiness of their suppliers, on January 8,1999, VA’s National Acquisition Center (NAC)” sent a survey to 334 phatmaceutical firms and 459 medicalsurgical firms with which it does business. The survey contained questions on the fums’ overall YZX status and inquired about actions taken to assess. inventory, and plan for any perceived impact that tbe century tomover would have on their ability to operate at normal levels. In addition, the tirms were asked to provide status information on progress made to become Y2K compliant and a reliable estimated data when compliance will be achieved for business processes such as (1) ordering and receipt of raw materials, (2) mixing and processing product, (3) comph?ting fiial product processing, (4) packaging and labeling product, and (5) distributing fmished product to distributors/ wholesalers and end customers. According to NAC ofEci&, of the 465 firms that responded to the survey as of March 31.1999, about 55 percent completed all or part of the survey. The remainder provided general information on their Y2K readiness stahrs Page 23 GAO/AIMD-99-19OR Veterans Benefits and Health Care Services Enclosure 1 GAO Testimony Dated April 15,1999 or litemtwem on their efforts. As shown in table 4, more than half of the pharmaceutical fums surveyed responded (52 percent), with just less than one-third (37.percent) of those respondents reporting that they are compliant. Among the pharmaceutical fkms that had not responded as of March 31, however, were two of VA’s five largest sup~Iiem.~ The three large pharmaceutical suppliers that did respond provided general informaticm on their Y2K readiness status, rather ihan answering the survey, and enimated thatthey will be compliant by June 30,1999. Table4: Status of CompaniesSutvsycd by “Ii* as of March31.1999 Table 4 also shows that 54 percent of the medical~wgical tkms surveyed responded, with about two-thirds of them (166) repating that they are Y2K compliant. All five of Vlis lzugea medicalsurgical suppliers have responded. Spec’fically, two reported being compliiant, two reported they would be compliant by June 30,1999, and the remaining supplier did not report an expected compliance date. On March 17,1999, NAC sent a second letter to its pharmaceutical and medical-surgical fums, infaming them of VA’s plans to make YZK readiness information previously provided to VA available to the public through a web site (wwxva.gov/cx&m1tina/nady2k). VAmade the survey results available an its web site on April 13, 1999. The letter also requested that Page 24 GAOIAIMD-99-190RVeterans Benefits and Health Care Services Enclosure 1 GAO Testimony Dated April X,1999 manufacturers that had not previously responded provide information on their readiness. NAG Executive Director said that he would personally contact any major VA supplier that does not respond. On a broader 1~4 VHA has taken a leadership role in obtaining and sharing information on the YZX readiness of the oharmaceutical industw. Suecif~caW. VHA chairs the Year 2000 Pharmace&cals Acquisitions andDi&ibution~ Subcommittee, which reports to the Chair of the President’s Council on Year 2000 Conversion. The purpose of this subcommittee is to bring together federal and pharmaceutical representatives to address issues concerning supply and distribution as they relate to the yew 2000. The subcommittee consists of FDA, federal health care providers, and industry trade associationssuch as the Pharmaceutical Research and Manufacturers of America (PhRMA), the National Association of Chain Drug Stores, and the National Wholesale Drug&w’ Association. Several of these trade associations have surveyed their members on their Y2K readiness and made the results available to the public. Ilowever. the information is not manufacturer-specific or as detailed as VHA’s survey results. FDA’s Y2K Efforts for FDA’s oversight and regulatory responsibility for pharmaceutical and Pharmaceutical and biological produc@ is to ensure that they are safe and effective for public Biological Products use. Because of its concern about the Y2K impact on manufactun?rs of these products, FDA has taken several actions to raise the Y2K awareness Industries Were Initially of the pharmaceutical and biological products industries. In addition. it is Focused on Awareness thinking about conducting a survey to determine the industry’s Y?.K readiness. One of FDA’s actions to raise industry awareness was the danwry 1998 issuance of indus!ay guidance by the Center for Biologics Evaluation and Research (CBER) on the Y2K impact of computer systems and software applications used in the manufacture of blood products. In addition, as shown in table 5, FDA has issued several letters to pharmaceutical and biological trade associations and sole-source drug manufacturers. Page 25 GAO&MD-99-190R Veterans Benefits and Health Care Services Enclosure 1 GAO Testimony Dated April l&l999 Table 5: FDA Letters to Msnutacturerc Regarding YZK Purpose To relay to msrnbers FDA% axpectaticm that the pharmawticat industry would (1) make resolution of YZK a htgh priority. (2) ensure that prOduction SWemS were tixed and tested prior in January 1.2000. and (3) ume menufacturew to dB”e.lW YZK rn”ti”oe”cv da”*. October Center for Siologics Bidogtcs manufacturer trade Same as above. ,898 Evaluatim and Research a.ssDclatiDns January 1999 centerior Sole-source drug Same as above. Also (1) noted thal the impact of YZK Drug Evaluation and manutacturers w, pharmaceutical sat&y, efllcaoy, and availability Research merits special attention fw lirms who are the sole mnufachrmrs af drug mmponants bulk ingredients. and Cmitwd prcdwts and (2) statedthat pharmaceutical indusby suppEers must have YZK- mmpliint systems to protect agatnst diiruptkm in the ROWof pmduct camponenb. packaging materials. and equipment to pharmaceutical manufacturers Further, ort February 11,1999, FDA’s director of emergency and investigation operations sent a memorandum on FDA!s interim inspection policy for the YZK problem to the directors of FDA’s investigations branch. The policy emphasizes FDA’s Y2K awareness efforts for manufacturers. It states that FDA inspectors are to (1) inform the firm of FDA’s Y2K web page (URL hnp:/~~dagov/cdr~rgO~4e~gOOO.h~I~, (2) provide the fum with copies of theappropriate FDA Y2K awareness lettex, (3) explain that Y2K problem could potentially affect aspefts of the firm’s operations, includinn some areas not reeulated by FDA. nnd that FDA anticipates that fums will take prudent steps to ens&c that’they are not adversely affected by YZK, and (4) provide fvms with a copy of FTNe compliance policy guide *Year 2000 (YZK) ComputerProblems.” In addition, FDA and PbRMA jointly held a governmentlindustrg forum on the Y2K preparedness of the pharmaceutical and biotech industries on February 22.1999. The objectives of t&is forum ‘Ivenv to (1) share information on Y2K programs conducted by health care providers, phmmceutical companies, FDA, and other federal agencies. (2) provide a vehicle for networkin!& and (3) raise awareness. On March 231999, FDA revised its February 1 I, 1999, interim inspection policy. The revision states that field inspectors are now to inquire about manufactuxem’ efforts to ensure that their computer-conWoUed or date- Page 26 GAOMMD-99-190R Veterans Benefits and Health Care Service: Enclosure 1 GAO. Testimony Dated April 15,1999 sensitive manufacturing processes and distribution systems are Y2K compliant. Inspectors are to include this information in their reports, along with a determination of activities that fums have completed or started to ensure that they will be Y‘ZK compliant. Further, FDA inspectors may review~diocumcntation in cases in which firms have made changes to their computerized production or manufacturing control srjtems to address WK problems, The purpose of this review is to ensure Chatthe changes were made in accordance with the firms’ procedures and applicable regulations. If inspectors determine that a firm has not taken steps to ensure YZK compliance, they are to notify their district managers and the responsible FDA center. FDA’s interim policy describes steps inspectors an to take in reviewing manufacturers’Y2K compliance. However. FDA stated that the primary focus of its inspections for the remainder of 1999 will be to ensure that products sold in the United States arc safe and effective for public use and comply with federal statutes and regulations, including “good manufacturing practice” (GMP).23 FDA ofticiale explained that the agency does not have sufficient resources to perform both regulatory oversight of the manufacturers and in-depth evaiuations of firms XX compliance activities. Nevertheless, according to the March 29,1999, memorandum, field inspecton are to note any concerns they may have with a fii’s Y2K readiness in the admiitrative remarks section of their inspection reports. These reports are to be reviewed by FDA district managers. If the Y2K concern appears to present a serious problem to a Grm’s ability to produce safe, effective medication, the district manager can discuss this issue with FDAk Offke of Regulatory Affairs and determine a course of action. However, FDA offIcizds have stressed that the agency cannot take any regulatory action toward the fum until a Y2K-related problem affects a pharmaceutical or biological product. LikeVHA. FDA is interested in the impact of Y2K readiness of pharmaceutical and biological products on the availability of products for health care facilities and individual patients. FDA3 Acting Deputy Commissioner for Policy informed us on bfarch 24,1999. that the agency is Page 27 GAO/AIMD-99-190R Veterans Benefits and Health Care Services Enclosure 1 GAO Testimony Dated April 15,1999 thinking about surveying pharmaceutical and biological products manufacturers, distributors, product repackagers, and others in the drug dhensine chain. on their Y2Kreadiness and contingency planning. In an&zip&n of a &ssible survey, the agency has publish&a notice in the March !z2, 1999, -regarding this matter. The Acting Deputy Commissioner said that potential survey questions on contingency planning would include steps the manufacturers are taking to ensure an . adequate supply of bulk manufacturing materials from overseas suppliem. l’hk is a key issue because, as we reported in March 1998.” according to FDA. as much as 80 percent of the bulk pharmaceutical chemicals used by U.S. manufacturers to produce prescription drugs is imported. In summary, VBA and VHA continue to make progress in preparing their missioncritical systems for the year 2000. However, key actions remain to be taken in the ereas of mission-critical systems testing, VHA facility systems compliance, and CMOPsystems compliance. We also reiterate the need for vH?L and FDA to take prudent steps to ensure that the tesf results of critical care/life support biomedical equipment are obtained and reviewed. Finally, VHA needs information on the Y2R readiness of specific pharmaceutical and medic&surgical manufacturers. Until this information is obtained and publicized, VHA medical facilities and veterans will remain in doubt as to whether an adequate supply of pharmaceutical and biological products will be available. FDA and the pharmaceutical and biological trade aswciations can play key roles in helping VHA obtain thii information and publicize the results in a single data clearinghouse. In carrying out this assignment, we reviewed and analwed VA’s Y2K documents and plans, comparing them against our guidance on Y2.K activities. We also reviewed and analyzed FDA documentation relating to its Y2K efforts on biomedical devices and pharmaceutical manufacturers. In addition. we visited selected VHA medical centers. VA data centerS and WA consolidated mail outpatient pharmacies to dis~oss their Y2K activities, and interviewed VA and FDA officials on those activities. We also interviewed ofiXals of the Emergency Care Research Institute regarding their statements on biomedical equipment testing. Finally, we interviewed selected private hospital oftXals about their Y2K actions and GAO/AIMD-99-19OR Veterans Benefits and Health Care Services Enclosure 1 GAO Testimony Dated April l&l999 pharmaceutical trade associations on their Y2K readiness surveys of pham~aceuticalmanufacturers. Mr. Chairman, thii concludes my statement. I would be pleased to respond to any questions that you or other members of the Subcommittee may have at this time. Page 29 GAOIAIMD-99-190R Veterans Benefits and Health Care Services Enclosure 1 GAO Testimony Dated April 15,1999 The fvst copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a ckeck or money order made out to the Superintendent of Docoments, when necessarg VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 26 percent. Orders by maib U.S. General Accounting Office P.O. Box 37060 Washington, DC 20013 or visit: Boom 1100 700 4th St. NW (comer of 4th and G Sts. NW) U.S. General Accounting Oftlee Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 612-2537. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu will provide information on how to obtain these lists. For information on how to access GAO reports on the INTERNET, send an e-mail message with “iofo” io the body to: info%www.gao.gov or visit GAO’s World Wide Web Home Page at: httpJ/www.gao.gov PRlNTEOON ?j$ RECYCLED PAPER Page 30 GAOIAIMD-99-190R Veterans Benefits and Health Care Servic Enclosure 1 GAO Testimony Dated April l&l999 United States General AccomMng OfXice Wahington, D.C. 20548-0001 OfPicial Business Peaalty for Private Use $300 Address Correction Requested Page 31 GAO/AIMD-99-19OR Veterans Benefits and Health Care Services Enclosure 2 Comments From the DeDartment of Veterans Affairs DEPARTMENT OF VETERANS AFFAIRS ASSISTANT SECRIXARY FOR POLICY AND PLANNING WASHINGTON DC 20420 JLN 3 1999 Mr. Gene Dodaro Assistant Comptroller General Accounting and Information Management Division U. S. General Accounting Office 441 G Street, NW Washington, DC 20548 Dear Mr. Dodaro: This is in response to your draft report, YEAR 2000 COMPUTlNG CRISIS: Actions Needed to Ensure Continued Delivery of Veterans Benefits and ffealfh Care Services (GAO/AlMD-99-190). This report was based on the April 15. 1999, Congressional Testimony on the readiness of the Department of Veterans Affairs (VA) to deliver benefits and health care services through the turn of the century. While we generally agree with GAO’s statement, we believe that additional perspective on VA’s progress is warranted to assure stakeholder confidence in VA’s ability to continue delivering services to our nation’s veterans and their beneficiaries. In its testimony, GAO stated that forward-date systems acceptance testing on VA computer platforms had not been completed. However, VA has conducted extensive forward-date testing of our software applications. We view the testing that GAO is concerned about as post-implementation testing. Post-implementation testing is the additional step of actually moving the dates forward on our platforms to ensure that commercial-off-the-shelf, vendor-certified compliant hardware and software will actually work. Further, we required compliant products from manufacturers to forward-date test our systems, and some of those products were not available at the time the applications were corrected. The vendor has now provided those products, and VA is conducting this additional post-implementation testing. It is important to note that all VA applications, including those supporting benefits delivery and health care, have completed the renovation, verification, and implementation phases and are successfully processing Year 2000 dates today. In addition, VA has completed the business contingency and continuity plans for benefits delivery and health care. These are in place at each of VA’s regional offices and medical facilities. In addition, on April 21, 1999, the Veterans Health Administration (VHA) issued Directive 99-016, Facility Review and Approval of Medical Devices for Year 2000 Compliance. This directive requires all facilities to document by June 1999, the continued use and proposed disposition of medical devices that are not yet assessed or Page 32 GAO/AI&ID-99-190RVeterans Benefits and Health Care Services Enclosure 2 2. Mr. Gene Dodaro that are assessed as non-compliant. In addition, all conditionally compliant medical devices must be evaluated for disposition no later than September 1999. VHA has assured GAO of its commitment to complete this review process and has kept GAO apprised of its efforts in this regard. We also share GAO’s concern that all of VA’s medical facilities and Consolidated Mail Outpatient Pharmacies (CMOPs) are Y2K compliant. VHA designated the VISTA (Veterans Health Information Systems Architecture) CMOP software application as being mission-critical and has renovated and implemented that application per OMB guidelines as of March 31, 1999. We have accelerated the schedule for the upgrade and replacement of noncompliant vendor-supplied components of the CMOP automated systems. We anticipate completing the upgrades and replacements by August 1999. We will continue to work with FDA to ensure that all suppliers of pharmaceutical and medical-surgical products are Y2K compliant and that all of our medical facilities will have sufftcient inventories at the turn of the century. The enclosure describes our actions taken and planned to implement your recommendations. I appreciate the opportunity to review the draft of your report. Enclosure Page 33 GAO/AIMD-99-190R Veterans Benefits and Health Care Services Enclosure 2 Enclosure DEPARTMENT OF VETERANS AFFAIRS COMMENTS TO GAO DRAFT REPORT, YEAR 2000 COMPUTING CRISIS: Actions Needed to Ensure Continued Deffvefy of Veterans Benefits and Health Care Services (GAOIAIMD-99-190) Based on its April 15, 1999, testimony, GAO recommends that the Secretary of Veterans Affairs ensure that the following specific actions are taken: l Complete YZK testing of VBA and VHA mission-critical systems including systems acceptance testing, full future-date testing, end-to- end testing, and business process simulation testing on compliance platforms Concur - VA has completed the renovation, validation, and implementation phases as defined by the Office of Management and Budget. As discussed in our cover letter, GAO’s above recommended actions are identified as post-implementation testing and are well underway. These actions will ensure that vendor-certified Y2K compliant hardware and software will work correctly. The VBA’s Compensation and Pension system has undergone forward-date testing. End-to-end testing with the Department of Treasury began on May 17,1999, as scheduled. The business process simulation is on schedule for the July 4”’weekend. VHA is completing the additional post- implementation testing of its VISTA system, which is scheduled for completion by September 1, 1999. It is important to note that all VA applications, including those supporting benefits delivery and health care, are Y2K compliant and in production successfully processing Year 2000 dates. In addition, VA has completed the business continuity and contingency plans for benefits delivery and health care. These are in place at each of VA’s regional offices and medical facilities. l Set deadlines to complete assessment, renovation, validation, and implementation of VHA facility systems Concur - VHA is developing a policy directive for facility systems similar to the existing policy for medical devices concerning the disposition of non-compliant devices. This policy will require VA facilities to establish or identify a committee to review utility systems’ components with an unknown or non-compliant Year 2000 status and determine what action needs to be taken. Action includes replace, retire, or use-as-is. The facility director must approve the proposed disposition of the device. The facility systems policy will also require a documented plan of action for systems that are identified as non-compliant or unknown by a specified completion date. We anticipate completing this directive by July 31, 1999. In addition, the OMB defined phases of assessment, renovation, validation and implementation do not apply to facility systems as they do to software applications. 1 Page 34 GAO/AIMD-99-190R Veterans Benefits and Health Care Services Enclosure 2 Enclosure DEPARTMENT OF VETERANS AFFAIRS COMMENTS TO GAO DRAFT REPORT, YEAR 2000 COMPUTING CRISIS: Actions Needed to Ensure Continued Delivery of Veterans Benefits and iiealfh Care Services (GAOIAIMD-99-I 90) (Continued) l Develop business continuity and contingency plans for VHA ClVlOPs to ensure an uninterrupted supply of medication to veterans in the event of Y2K problems in these facilities; Concur - VHA completed the business continuity and contingency plans for each of the seven CMOPs by April 30,1999. l Reassess VA’s decision to not report CNlOP systems as mission- critical. Reporting these systems as mission-critical to VA top management and OMB will help ensure that necessary attention is paid to and action taken on them. Concur in Princiole - As stated in the cover letter, we have accelerated the schedule for the upgrade and replacement of noncompliant vendor-supplied components of the CMOP automated systems. VVe anticipate completing the upgrades and replacements by August 1999. VHA has completed the renovation, validation and implementation of the mission-critical VISTA CMOP application. It is implemented as compliant. The following functions in the VW-A CMOP application have always been identified as mission-critical, and were tracked and reported to OMB as such: Pharmacist order entry Electronic transmission of prescription data to CMOP facility Transfer of prescription data to the automated dispensing equipmeni Return of release information to medical center files Integration with Outpatient Pharmacy application Automatic screening of prescriptions prior to transmission to the CMOP facility Status tracking of prescriptions Interface to prescription co-payment billing Complete inventory control, order tracking and operational data for the CMOPs. l Seek the assistance of the Food and Drug Administration and industry trade associations to obtain information on the Y2K readiness of specific pharmaceutical and medical-surgical suppliers who did not respond to VHA’s survey to suppliers, and publicize the results in a single data clearinghouse. 2 - Palge 35 GAO/AIMD-99-190R Veterans Benefits and Health Care Services Enclosure 2 Enclosure DEPARTMENT OF VETERANS AFFAIRS COMMENTS TO GAO DRAFT REPORT, YEAR 2000 COMPUTING CRISIS: Actions Needed to Ensure Continued Delivery of Veterans Benefits and Health Care Services (GAO/AI MD-99-l 90) (Continued) Concur - VA is working with FDA and various industry associations to obtain and share information on the Y2K readiness of specific pharmaceutical and medical-surgical suppliers, especially those who have not responded to VA’s supplier survey. VA has surveyed all of its VA pharmaceutical and medical-surgical suppliers in all aspects of the Y2K issue. FDA is cognizant of all pharmaceutical and medical-surgical suppliers doing business federally and publicly in the United States. VA results are published and available on VA’s Homepage on the Internet (hti@/www.va.gov). We update this information periodically. VA will continue to query industry and tiork hand-in-hand with the FDA as their survey results become available. After June 30, 1999, VA will be contacting all survey respondents to determine whether system remediation and testing deadlines have been met as indicated. 3 Page 36 GAO/AIMD-99-190RVeterans Benefits and Health Care Services Enclosure 3 GAO Contacts and Staff Acknowledgements GAO Contact Helen Lew, (202) 512-9396 Acknowledplements In addition to the person named above, Nabajyoti Barkakati, Tonia Johnson, Barbara Oliver, John Riley, and Michael Resser made key contributions to this report. Page 37 GAO/AIMD-99-190RVeterans Benefits and Health Care Services Related GAO Products Year 2000 Comnutinn Crisis: Readiness of Medicare and the Health Care Sector (GAO/T-AIMD-99-160, April 27,1999). Year 2000 Comnutinn Crisis: Kev Actions Remain to Ensure DeIiverv of Veterans Benefits and HeaIth Services (GAO/T-AIMD-99-152,April 20,1999). Year 2000 Comnutin~ Crisis: Leadershin Needed to Collect and Disseminate Critical Biomedical Eauipment Information (GAO/T-AIMD-98-310, September 24, 1998). Year 2000 Commuting Crisis: ComnIiance Status of Manv Biomedical Eauipment Items Still Unknown (GAO/AIMD-98-240, September l&1998). Year 2000 Commuting Crisis: Progress Made in Compliance of VA Svstems, But Concerns Remain (GAO/AIMD-98-237, August 21,1998). (511259) Page 38 GAO/AIMD-99-190RVeterans Benefits and Health Care Services Ordering Information The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the foIlowing address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and Mastercard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. Orders by mail: U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 or visit: Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu w-ill provide information on how to obtain these lists. For information on how to access GAO reports on the INTERNET, send an e-mail message with “info” in the body to: email@example.com or visit GAO’s World Wide Web Home Page at: http&vvvw.gao.gov PRINTED ON && RECYCLED PAPER United States General Accounting Office Washington, D.C. 20548-0001 Official Bwiuess Penalty for Private Use $300 Address Correction Requested
Year 2000 Computing Crisis: Actions Needed to Ensure Continued Delivery of Veterans Benefits and Health Care Services
Published by the Government Accountability Office on 1999-06-11.
Below is a raw (and likely hideous) rendition of the original report. (PDF)