United States General Accounting Office GAO Testimony Before the Subcommittee on Oversight and Investigations, Committee on Veterans’ Affairs, House of Representatives For Release on Delivery Expected at 10 a.m. YEAR 2000 COMPUTING Thursday, October 28, 1999 CHALLENGE Update on the Readiness of the Department of Veterans Affairs Statement of Joel C. Willemssen Director, Civil Agencies Information Systems Accounting and Information Management Division GAO/T-AIMD-00-39 Mr. Chairman and Members of the Subcommittee: Thank you for inviting us to participate in today’s hearing on the Department of Veterans Affairs’ (VA) efforts to address the Year 2000 (Y2K) computer problem.1 My testimony today will focus on the Y2K readiness of automated systems that support the delivery of veterans’ benefits and health care services, the compliance status of biomedical equipment used in patient care, and the Y2K readiness of the pharmaceutical and medical-surgical manufacturers on which VA relies. I will also share with you information on the Food and Drug Administration’s (FDA) Y2K efforts to address biomedical equipment and pharmaceutical products.2 In brief, VA continues to make progress in addressing the Y2K problem. It has established a moratorium on software changes and has developed a Day One plan to minimize risks associated with the rollover period. However, some critical tasks remain to be completed. For example, only about 10 percent of the Veterans Benefits Administration’s (VBA) 58 regional offices have tested their business continuity and contingency plans. And inaccuracies in monthly reports submitted by the Veterans Health Administration’s (VHA) medical facilities make it difficult to determine their progress in renovating facility systems, telecommunications systems, commercial-off-the-shelf (COTS) software, computer platforms, and medical devices. Further, VHA has not implemented our prior recommendation to review the test results for biomedical equipment used in critical care/life support environments. It is crucial that VA address these issues if the department is to continue to reliably deliver benefits and other health care services through the turn of the century. FDA, for its part, has made progress in making compliance information on biomedical equipment available to users through its Federal Y2K 1 As is widely known by now, for the past several decades computer systems have often used two digits to represent the year, such as “98” for 1998, in order to conserve electronic data storage and reduce operating costs. In this format, however, 2000 is indistinguishable from 1900 because both are represented as “00.” As a result, if not modified, systems or applications that use dates or perform date- or time-sensitive calculations may generate incorrect results beyond 1999. 2 Biomedical equipment refers to both medical devices regulated by FDA, within the Department of Health and Human Services, and scientific and research instruments, which are not subject to FDA regulation. Pharmaceutical products also fall under FDA’s regulatory authority. Page 1 GAO/T-AIMD-00-39 Biomedical Equipment Clearinghouse. It is also conducting surveys to determine the Y2K readiness of pharmaceutical, biological, and consumable medical3 products manufacturers. FDA has also recently addressed our concern about the lack of independent verification and validation of critical care/life support biomedical equipment certified compliant by manufacturers. Specifically, it has reviewed a sample of these manufacturers’ Y2K activities, including risk management, test planning and procedures, implementation, and contingency planning. In the limited time remaining, FDA still needs to issue its final report to the Department of Health and Human Services (HHS) summarizing the results of its review of manufacturers’ Y2K activities and make these results available to the public. VA Is Making Progress Like many organizations, VA faces the possibility of computer systems failures at the turn of the century due to incorrect information processing on Systems But Critical relating to dates. This could make veterans who are eligible for benefits Tasks Remain and medical care appear ineligible. If this happens, the issuance of benefits and the provision of medical care that veterans rely on could be delayed or interrupted. At your request, Mr. Chairman, we have been monitoring and evaluating VA’s actions to address the Y2K problem since 1996.4 We have also made many recommendations to reduce the risk associated with Y2K failures, and VA has been responsive to these recommendations. For example, VBA changed its strategy from relying on new Y2K-compliant systems to fixing the current systems in order to address the risk that the new systems would 3 Consumable medical products are expendable, disposable, or nondurable supplies used for the treatment or diagnosis of a patient’s specific illness, injury, or condition. Examples include surgical gloves and intravenous tubing. 4 See Year 2000 Computing Crisis: Actions Needed to Ensure Continued Delivery of Veterans Benefits and Health Care Services (GAO/AIMD-99-190R, June 11, 1999), Year 2000 Computing Crisis: Action Needed to Ensure Continued Delivery of Veterans Benefits and Health Care Services (GAO/T-AIMD-99-136, April 15, 1999), Year 2000 Computing Crisis: Compliance Status of Many Biomedical Equipment Items Still Unknown (GAO/AIMD-98-240, September 18, 1998), Year 2000 Computing Crisis: Progress Made in Compliance of VA Systems, But Concerns Remain (GAO/AIMD-98-237, August 21, 1998), Veterans Affairs Computer Systems: Action Underway Yet Much Work Remains to Resolve Year 2000 Crisis (GAO/T-AIMD-97-174, September 25, 1997), Veterans Benefits Computer Systems: Risks of VBA’s Year-2000 Efforts (GAO/AIMD-97-79, May 30, 1997), and Veterans Benefits Modernization: Management and Technical Weaknesses Must Be Overcome If Modernization Is To Succeed (GAO/T-AIMD-96-103). Page 2 GAO/T-AIMD-00-39 not be completed in time. In 1998, VBA also reassessed its mission-critical efforts for the compensation and pension on-line application and the Beneficiary Identification and Record Locator Sub-System, as well as other technology initiatives to help ensure that these critical undertakings were completed in time. Simultaneously, VHA issued its Patient-Focused Year 2000 Contingency Planning Guidebook to its medical facilities, describing actions they could take to minimize Y2K-related disruptions to patient care. More recently, both VBA and VHA developed business continuity and contingency plans that address mission-critical systems, core business processes, regional offices, and medical facilities. In addition, VA has reported to the Office of Management and Budget (OMB) that it completed renovating and implementing the mission-critical applications supporting its 11 systems areas as of March 31, 1999. As shown in table 1, VBA has six of these areas, and VHA has two. Page 3 GAO/T-AIMD-00-39 Table 1: Reported Status of VA’s Mission-Critical Computer Systems Areas and Their Applications Component/office Number of applications (number of systems) Systems area renovated or replaced Veterans Benefits Compensation and Pension Administration (6) 30 Education 24 Insurance 3 Loan Guaranty 19 Vocational Rehabilitation 4 Administrative 27 Total 107 Veterans Health Veterans Health Information Administration (2) Systems and Technology Architecture 105 Veterans Health Administration Corporate Systems 95 Total 200 National Cemetery Burial Operations Support Administration (1) System/Automated Monument Application System 1 Reengineer 1 Total 2 Office of Financial Personnel and Accounting Management (2) Integrated Data 8 Financial Management System 1 Total 9 VA total 318a a Of this total, 316 applications were renovated and two were replaced. Source: VA. We have not independently verified this information. Page 4 GAO/T-AIMD-00-39 Although VA has made progress, when we testified5 this past April, the department still had numerous Y2K issues to address. Specifically, (1) VBA and VHA had not completed testing of their mission-critical systems to ensure that they could reliably accept future dates, (2) VHA had not completed assessments of its facility systems,6 (3) VHA’s pharmaceutical operations were at risk because the automated systems supporting its consolidated mail outpatient pharmacies (CMOP) were not Y2K compliant, (4) VHA had not defined the CMOP systems as mission-critical in its quarterly report to OMB, and (5) VHA did not know whether its medical facilities would have a sufficient supply of pharmaceutical and medical/surgical supplies on hand because it did not have complete information on the Y2K readiness of these manufacturers. To address these issues, we made the following recommendations to the Secretary of Veterans Affairs:7 • complete Y2K testing of VBA and VHA mission-critical systems— including systems acceptance testing,8 full forward-date testing,9 end-to-end testing, and business process simulation testing on compliant platforms; • set deadlines to complete assessment, renovation, validation, and implementation of VHA’s facility systems; • develop business continuity and contingency plans for VHA CMOPs to ensure an uninterrupted supply of medications to veterans in the event of Y2K problems at these facilities; • reassess VA’s decision not to report CMOP systems as mission-critical; and • seek the assistance of FDA and industry trade associations in obtaining information on the Y2K readiness of specific pharmaceutical and 5 GAO/T-AIMD-99-136, April 15, 1999. 6 Facility systems include building-related equipment such as elevators, heating, ventilating, and air conditioning equipment, lighting systems, security systems, and disaster recovery systems. 7 GAO/AIMD-99-190R, June 11, 1999. 8 Systems acceptance testing verifies that the complete system—the full component of applications software running on the target hardware and system software—satisfies specific requirements and is acceptable to users. 9 Forward-date testing verifies that the system is able to process using future dates in 2000 and beyond. Page 5 GAO/T-AIMD-00-39 medical/surgical suppliers10 that did not respond to VHA’s survey, and publicize the results in a single data clearinghouse. VA Has Been Responsive to VA generally agreed with our recommendations, and actions to implement Recommendations them have either been taken or are underway. • Both VBA and VHA have completed systems acceptance and forward-date testing. VBA completed systems acceptance testing of its benefits delivery applications and also tested its payment systems’ ability to process benefits in January 2000, in conjunction with the Department of the Treasury’s Financial Management Service and the Federal Reserve System. This testing was completed in July 1999. Likewise, VHA completed Y2K systems acceptance testing of its mission-critical hospital systems. In addition, in August 1999, VHA’s independent verification and validation test group forward-date tested 56 hospital applications.11 • VHA issued a policy directive on July 30, 1999, stating that its medical facilities had to make a decision on renovation strategies by September 1, 1999, for those facility systems components and interfaces whose Y2K status was noncompliant, conditionally compliant, or unknown. The directive also required these facilities to establish specific contingency plans for each of these systems. According to the Y2K project office, all of the medical facilities have met this requirement. • VHA’s CMOPs have developed business continuity and contingency plans that address important issues such as the loss of electrical power, telecommunications with the medical centers, and their automated dispensing machines. These plans should reduce the risk that Y2K disruptions will impair the CMOPs’ ability to continue filling and delivering veterans’ prescriptions. • In its August 1999 report to OMB, VA said that renovation of the vendor-supplied CMOP dispensing systems were on schedule to make all seven CMOPs Y2K compliant by September 30, 1999. • VA has worked with FDA and various other industry associations to obtain and share Y2K-readiness information on the Y2K compliance 10 These include manufacturers and distributors. 11 These 56 applications, which run at most VA health facilities, were chosen for their date intensiveness and business criticality. Included among the applications tested were inpatient and outpatient pharmacy, radiology, laboratory, and surgery. Page 6 GAO/T-AIMD-00-39 status of pharmaceutical and medical-surgical manufacturers. It has posted results on its Internet home page (www.va.gov). VA Established a To minimize possible disruptions to agencies’ Y2K readiness resulting from Moratorium on Software system changes, OMB, in a May 14, 1999, memorandum to heads of departments and agencies, requested that agencies establish a process to Changes ensure that the effect on Y2K readiness is considered prior to establishing new requirements or changes to information technology systems.12 We had previously testified that agencies should institute such a process to ensure that software changes do not negatively affect Y2K readiness.13 In response to OMB’s memorandum, VA issued a October 14, 1999, memorandum to department heads imposing a moratorium on implementing new systems, changes to existing systems, or third-party upgrades to VA’s information technology systems between October 15, 1999, and March 31, 2000. The intent of the memorandum was to ensure that the department incorporates Y2K change management procedures. It further stated that in those instances in which software changes were necessary—such as when compliant software had to be modified due to legislative or other agency requirements—it would be necessary to test all changes and recertify the software’s compliance.14 VA has also defined a process for requesting waivers for software changes or upgrades during this time. Specifically, waivers must be justified by the VA administration requesting them and concurred with by that administration’s chief information officer (CIO), architecture review board, or senior information technology official. The request is then submitted to VA’s Principal Deputy Assistant Secretary for Information and Technology for approval. Prior to the department’s issuing this moratorium, VBA had developed and issued a similar moratorium to all VBA offices on July 29, 1999. This 12 OMB Memorandum M-99-17: Minimizing Regulatory and Information Technology Requirements that Could Affect Progress Fixing the Year 2000 Problem, May 14, 1999. 13 Year 2000 Computing Crisis: Readiness Improving, But Much Work Remains to Avoid Major Disruptions (GAO/T-AIMD-99-50, January 20, 1999). 14 Examples of software that will be modified include applications affected by cost-of-living adjustments that usually take effect in January. Page 7 GAO/T-AIMD-00-39 memorandum imposed a moratorium on the deployment of new application changes or third-party product upgrades between September 1, 1999, and April 1, 2000, and stated that exceptions to the moratorium included emergency fixes and legislatively mandated changes such as cost-of-living adjustments. VHA has not yet issued specific instructions on how it will implement the department’s moratorium. However, according to VHA’s Y2K project office, it plans to issue guidance to its offices and medical centers based on VA’s memorandum. According to VHA’s Y2K project manager, this guidance was not developed earlier because VHA was waiting for the department to issue its memorandum. VA Has Developed a Day As we note in our business continuity and contingency planning guide,15 One Strategy developing a Day One risk reduction strategy and procedures for the period between late December 1999 and early January 2000 is a key element in contingency planning. Earlier this month, we issued a more specific guide on Day One planning.16 In addition, on October 13, 1999, OMB issued a memorandum to the heads of selected departments and agencies17 instructing them to develop Day One plans and encouraging them to use our guide in the development of these plans. OMB required that the plans address seven areas: (1) schedule of activity, (2) personnel on call or duty, (3) contractor availability, (4) workforce communication, (5) facilities and services to support workforce, (6) security, and (7) public communications. VA and its agencies have developed a high-level Day One strategy that should help the department manage risks associated with the January 1 rollover and better position it to address any potential disruptions. This strategy addresses each of the seven areas required by OMB: • a time line of events between December 31 and January 1; 15 Year 2000 Computing Crisis: Business Continuity and Contingency Planning (GAO/AIMD-10.1.19, August 1998). 16 Y2K Computing Challenge: Day One Planning and Operations Guide (GAO/AIMD-10.1.22, October 1999). 17 OMB Memorandum M-00-01: Day One Planning and Request for Updated Business Continuity and Contingency Plans, October 13, 1999. Page 8 GAO/T-AIMD-00-39 • a personnel strategy and leave policy that identifies key managerial and technical personnel available to support Day One operations; • a statement that its administrations reviewed vendor service agreements and revised them to ensure that contractor support and other needs for the rollover period are met; • a communications structure for workforce reporting during the rollover period. Under this structure, VBA regional offices plan to report to regional representatives, who plan to report to a national VBA information coordination center, located at VBA headquarters in Washington, D.C.; VHA medical centers plan to report to their Veterans Information Service Network (VISN)18 representative, who plans to report to a national VHA information coordination center located in Martinsburg, West Virginia. The VBA and VHA national information coordination centers plan to report to the VA national information coordination center, also located in Martinsburg; • a statement that its facilities have addressed facility and support services for its workforce in their business continuity and contingency plans. In addition, the Day One plan requires regular “health” checks to ensure that these services remain available during the rollover period; • a statement that the VA computer systems and data centers are being secured and additional security has been extended to the networks to increase protection during the rollover period; and • a VA Office of Public Affairs information communications center to support the VA national information coordination center and direct public communications through the Joint Public Information Center that the President’s Council on Year 2000 Conversion plans to set up for the rollover period. VA’s Day One plan also describes preparation activities that VA has completed or plans to complete in order to help minimize potential Year 2000 disruptions to benefits delivery and health care. For example, VBA plans to process most of its regular, recurring benefits payments so that they will be available to veterans on December 30, 1999. This, according to the plan, will greatly mitigate possible Y2K interruptions of benefits payments. 18 VISNs are 22 regional organizations encompassing medical centers, nursing homes, and domiciliaries. Page 9 GAO/T-AIMD-00-39 VA Has Developed Business According to VA’s August 1999 report to OMB, its regional offices and Continuity and Contingency medical facilities have completed business continuity and contingency plans. In addition, according to VA, a selected number of these plans have Plans been reviewed by their respective Y2K project offices. Specifically, VBA’s Y2K project office reviewed the plans of its regional offices and found that they met VBA requirements. We reviewed 15 of the 58 VBA regional plans and found that they address resources, staff roles, procedures, and timetables for implementation, as well as risks and risk mitigation. In reviewing the 58 medical facilities’ business continuity and contingency plans, VHA’s Y2K project office concluded that while overall the plans adequately addressed contingency planning, the plans of 14 facilities were deficient. These deficiencies included the lack of a schedule of critical events; lack of a policy statement describing the authority, responsibility, and procedures for Y2K contingency planning; and missing contingencies for specific functional areas, such as intensive care or operating rooms. The project office asked the 14 facilities to address these deficiencies and submit revised plans, which it is currently reviewing. We reviewed the plans of 29 medical facilities to determine their completeness,19 and found that, in some cases, the schedule of critical events and execution timelines were not specific to the medical facility. Additional specificity, such as time lines relevant to the medical facility and specific dates for accomplishing tasks contained in the time lines, would help make it easier for facility staff to implement the plan, and help minimize confusion that might result if plans needed to be activated. A second issue concerned the lack of medical facility coordination with VHA’s seven CMOPs. This is especially important since the seven CMOPs supply about 50 percent of VA’s prescriptions to veterans. VHA’s guidance, however, only required sites that were co-located with a CMOP to coordinate their plans with that CMOP alone. We discussed these issues with representatives of VHA’s Y2K project office. They agreed with our concern regarding the time lines and said that the sites had been advised to ensure that these were sufficiently specific. In addition, the VHA Y2K project manager told us that all CMOPs had been advised to discuss their business continuity and contingency plans with the medical facilities that they support so that they are aware of them. 19 The plans chosen for review included 19 medical facilities in the three VISNs that we have been monitoring, and four facilities that are co-located with a CMOP. Page 10 GAO/T-AIMD-00-39 VA Has Not Completed Testing of business continuity and contingency plans is key to determining Testing of Its Business whether the contingencies are capable of providing the needed level of support to core business functions and whether they can be implemented Continuity and Contingency in a reasonable amount of time. In addition, testing can show where plans Plans need to be updated or changed. We previously testified that testing of plans should be completed by September 30, 1999.20 As of October 22, 1999, only five of VBA’s 58 regional offices had completed testing of their business continuity and contingency plans. VBA initially asked that each regional office complete a “desktop” exercise21 of its plan by September 30, 1999, during which the business continuity and contingency plan team and other critical staff would simulate an emergency situation. According to VBA’s Y2K project manager, the project office is now requiring the regional offices to complete this exercise by November 15, 1999. It is critical that VBA regional offices test their plans to ensure that their contingencies are sufficient to maintain an acceptable level of service and that the contingencies can be implemented in a feasible time frame. All of VHA’s medical facilities reportedly have completed emergency drills. These drills, conducted under controlled conditions to ensure no impact on patient safety, required each facility to turn off its local electric supply and rely on backup generators. The medical facilities identified deficiencies in their plans as a result of these drills. For example, one site found that its generator was not capable of powering the entire hospital. It has now contracted for an additional backup generator to ensure that all critical areas can be powered. Other sites found that some of their mission- critical areas were not linked to the backup generator, and have since contracted for additional work to link them. While VHA’s medical centers have tested their facilities’ ability to handle power outages, other portions of their business continuity and contingency plans, such as dealing with potential water and gas shortages, have not been tested. Losses in these areas can have an impact on patient care. Specifically, a VHA medical facility recently suffered a loss of water, 20 GAO/T-AIMD-99-50, January 20, 1999. 21 VBA’s “desktop” simulation was not to include the actual establishment of an emergency operations center or emergency backup sites. Page 11 GAO/T-AIMD-00-39 resulting in a loss of the steam plant, cooling towers, and fire suppression system. This facility suggested that other facilities reevaluate their contingencies in view of these losses. Monthly Reports Do Not All of VHA’s VISNs/medical facilities are required to prepare monthly Accurately Reflect Y2K reports on their Y2K progress in assessing, renovating, validating, and implementing compliant systems. Specifically, they report on their Y2K Status of Noncompliant status in six areas: locally developed software, COTS software, computer Systems platforms, telecommunications systems, facility systems, and medical devices. These reports are used by VHA to monitor progress in addressing Y2K issues and to identify problem areas. VHA’s summary report for August 1999 indicated that the medical centers had made limited progress in renovating their remaining noncompliant facility systems and telecommunications systems. Specifically, it showed that overall, only 43 percent of the facility systems and 41 percent of the telecommunications systems at the medical facilities had completed renovation. The numbers were somewhat higher for COTS software, at 55 percent, and computer platforms, at 65 percent. The highest renovation number was for locally developed software products, at 94 percent. We discussed these renovation statistics with VHA’s Y2K project manager, who told us that the summary report may not be accurate because facilities are not clear on whether to report on systems or on the components that make up the systems. During visits to selected medical facilities we confirmed that their individual and summary reports did contain errors. For example, some of the VISN percentages in the August report exceeded 100. The Y2K office has also contacted selected medical facilities and acknowledged that the reports have errors. To address this issue, the Y2K office is currently contacting and visiting sites to discuss these reporting issues. It is critical that the medical facilities accurately report their Y2K progress in renovating their noncompliant systems so that top management within VA can identify problem areas and take prompt and appropriate action. Page 12 GAO/T-AIMD-00-39 VHA Has Made The question of whether VHA’s medical devices such as magnetic resonance imaging (MRI) systems, x-ray machines, pacemakers, and Progress in cardiac monitoring equipment can be counted on to work reliably on and Determining Y2K after January 1, 2000, is critical to VHA. To the extent that biomedical equipment uses computer chips, it is vulnerable to the Y2K problem. In the Compliance Status of medical arena, such vulnerability carries with it possible safety risks. Biomedical Equipment VA Continues to Collect In April, we testified before this Subcommittee that VHA was continuing to Compliance Information on collect information from biomedical equipment manufacturers on the Y2K compliance status of equipment in its inventory.22 As shown in table 2, a Biomedical Equipment little over half of the manufacturers in VA’s database reported directly to the department that their products are compliant as of October 25, 1999. Since we last testified, VA has created a new compliance category to capture the increasing number of manufacturers that have web sites with Y2K information. VA reported that about 24 percent of the manufacturers in its database (1,393) are in this new category. 22 GAO/T-AIMD-99-136, April 15, 1999. Page 13 GAO/T-AIMD-00-39 Table 2: Status of Manufacturer Responses to VHA as of October 25, 1999 Number of Percentage of Manufacturer response manufacturers manufacturers Manufacturers with web site information 340 24 Compliant manufacturersa 720 52 b Noncompliant manufacturers 33 2 Conditional-compliant manufacturersc 40 3 Pending manufacturersd 11 1 Manufacturers merged or bought out 241 17 Nonresponsive manufacturerse 8 1 Total 1,393 100 a For inclusion in this category, 100 percent of a manufacturer’s products had to be considered compliant. b For inclusion in this category, only one of a manufacturer’s products had to be considered noncompliant. c For inclusion in this category, the manufacturer had to have no noncompliant devices, no pending devices, and at least one conditional-compliant device. d For inclusion in this category, the manufacturer had to have no noncompliant devices and at least one device that is pending. e For inclusion in this category, VHA had to have not received compliance information from the manufacturer. Source: Veterans Health Administration. We did not independently verify these data. For nonresponsive manufacturers, VHA’s Y2K project manager told us that the project office had contacted the facilities that reported devices in their inventories from these manufacturers and instructed them to make a decision on their disposition. The project manager further stated that none of these devices was used in critical care or life support functions, and that the facilities with this equipment had been instructed to plan for contingencies in the event any of them experience a Y2K-related failure. In April 1999, VHA issued a policy establishing (1) a review process for medical devices whose compliance status was unknown, noncompliant, or conditionally compliant and (2) options for what action should be taken on these devices. Options included replacing or retiring the equipment, or using it as-is.23 Medical facilities were to complete these reviews by June 1, 1999, for equipment whose Y2K compliance status was either unknown or noncompliant, and September 1 for equipment whose status was conditionally compliant. In each case, the medical facility director’s approval of the disposition decision was required. For noncompliant Page 14 GAO/T-AIMD-00-39 equipment, the medical center was required to assess the level of risk if it continued to use the equipment, and determine what risk such use posed to patient health and safety. To make this assessment, medical facilities were to consider such questions as whether the device is used for critical care, or if the device used date-sensitive data, such as sequencing patient data results. To track the compliance status of its biomedical equipment, VHA uses a monthly status report on medical devices based on information provided by the VISNs/medical facilities. According to the August 1999 report, about 97 percent of the 568,000 medical devices in VHA medical facilities are compliant. The report indicated that, of about 18,000 noncompliant devices, about 14,000 will be repaired, and about 1,400 will be replaced. The report did not discuss the renovation status of the remaining 2,200 noncompliant devices. We were unable to accurately determine the status of medical facilities’ efforts to renovate noncompliant devices. As we discussed previously, the individual monthly reports submitted by the VISNs/medical facilities were inaccurate. Specifically, we determined that the June 1999 summary showed that about 21 percent of medical devices had been renovated was incorrect. However, according to several medical centers, their renovation percentages were higher than the numbers reflected in the report. We pointed this out to the Y2K project manager, who acknowledged that the percentages were incorrect. He added that the Y2K project office is in the process of following up with its medical centers to confirm their status on renovation of biomedical equipment. 23 Conditionally compliant equipment requires user intervention to function in all aspects upon the Year 2000 change. These changes include manufacturer software or hardware updates, or a one-time user action, such as turning the equipment on/off. Noncompliant equipment means a medical device will not function properly in all aspects upon the Year 2000 change and no manufacturer remedy is available. Unknown equipment means VHA has not been able to determine the compliance status of equipment because it has not received compliance status information from the manufacturer. Page 15 GAO/T-AIMD-00-39 VHA Position on Not Testing As we reported last September, VHA relies on manufacturers to validate, Biomedical Equipment test, and certify that equipment is Y2K compliant.24 We also reported that there was no assurance that the manufacturers adequately addressed the Unchanged Y2K problem for noncompliant equipment because FDA did not require medical device manufacturers to submit test results to it certifying compliance. Accordingly, we recommended that VA and HHS take prudent steps to jointly review manufacturers’ compliance test results for critical care/life support biomedical equipment. We were especially concerned that VA and FDA review test results for equipment previously determined to be noncompliant but now deemed compliant by manufacturers, or equipment for which concerns about compliance remain. We also recommended that VA and HHS determine what legislative, regulatory, or other changes were necessary to obtain assurances that manufacturers’ equipment was compliant, including performing independent verification and validation of the manufacturers’ certifications. At that time, VA stated that it had no legislative or regulatory authority to implement the recommendation to review test results from manufacturers. VA and the Emergency Care Research Institute (ECRI)25 have stated that manufacturers are best qualified to analyze embedded systems or software to determine Y2K compliance. Accordingly, they do not encourage user testing of biomedical equipment for Y2K compliance. ECRI guidelines, however, suggest that health care facilities should consider testing interfaces between medical devices in cases where the facility cannot determine the Y2K compliance of the interface from the device manufacturer. FDA also agrees with the ECRI position on testing biomedical equipment and interface testing. Specifically, FDA has taken the position that manufacturers’ submissions of Y2K compliance certifications provide sufficient assurance of product compliance, and that such testing on the part of users is not necessary. According to VHA’s chief biomedical engineer, VHA guidance to the VISNs and medical facilities is not to conduct stand-alone compliance testing of biomedical equipment in their inventories. VHA’s Y2K project manager told us that VHA relies on the manufacturers’ certifications; therefore, there is 24 GAO/AIMD-98-240, September 18, 1998. 25 This institute is an international, nonprofit health services research agency. It believes that superficial testing of biomedical equipment by users may provide false assurances, as well as create legal liability exposure for health care institutions. Page 16 GAO/T-AIMD-00-39 no need for such testing. However, he stated, in cases in which one medical device interacts with other systems or devices, the medical facilities should test these to ensure proper operation. In contrast to VHA’s and FDA’s positions, some hospitals in the private sector believe that testing biomedical equipment is necessary to prove that they have exercised due diligence in the protection of patient health and safety. As we have previously testified, officials at three hospitals told us that their biomedical engineers established their own test programs for biomedical equipment and, in many cases, contacted the manufacturers for their test protocols.26 Several of these engineers informed us that their testing identified some noncompliant equipment that the manufacturers had earlier certified as compliant. According to these engineers, the equipment found to be noncompliant all had display problems; none was critical care/life support equipment. We were told that equipment found to be incorrectly certified as compliant included a cardiac catheterization unit, a pulse oxymeter, medical imaging equipment, and ultrasound equipment. Our review of manufacturers’ web sites disclosed that manufacturers’ opinions vary on whether users should test their biomedical equipment.27 We noted that at least 37 manufacturers provided information on their web sites about Y2K testing. Of these, 30 encouraged testing, and 15 of these 30 provided end-users with information such as test protocols and instructions. Fifteen of the 30 manufacturers also encouraged users to test their devices in configuration with related equipment to ensure that the device operated as intended. For example, the web site of a manufacturer of audiometers stated that “if your equipment is used in a critical application, we strongly advise you to test the equipment by simulating the millennium date change yourself.” Seven of the 37 manufacturers did not encourage testing; two of these stated that such testing could disrupt operation of software. Since some biomedical equipment manufacturers encourage end-user testing for Y2K compliance of their products, VA should reconsider its decision not to test equipment in those instances in which the 26 GAO/T-AIMD-99-136, April 15, 1999. 27 Year 2000 Computing Challenge: Compliance Status Information on Biomedical Equipment (GAO/T-AIMD-00-26, October 21, 1999). Page 17 GAO/T-AIMD-00-39 manufacturer encourages users to test. Such action can provide greater assurance of Y2K compliance for those items. From an overall perspective, as we testified in April, the question of whether to independently verify and validate biomedical equipment that manufacturers have certified as compliant is one that must be addressed jointly by medical facilities’ clinical staff, biomedical engineers, and corporate management.28 The overriding criterion should be ensuring patient health and safety. VHA Pharmaceutical Another critical component to VA’s ability to deliver health care at the turn of the century is ensuring that the automated systems supporting VHA’s Operations Have Made medical facility pharmacies and its CMOPs are Y2K compliant. VHA Progress in Addressing reported that in 1998 it filled about 72 million prescriptions for 3.4 million veterans, at an estimated cost of about $2 billion. About half of the Y2K Problem prescriptions were filled by the over 200 pharmacies located at VA’s medical centers, clinics, and nursing homes. These pharmacies rely on the pharmaceutical applications in their hospital information system for (1) drug distribution and inventory management, (2) dispensing of drugs to inpatients and outpatients, (3) patient medication information, and (4) an electronic connection between the pharmacies and the CMOPs. The remaining half of VHA’s prescriptions are filled by seven CMOPs, geographically dispersed throughout the United States. These facilities are supported by automated systems provided by one of two contractors— SI/Baker, Inc. and Siemens ElectroCom.29 For example, the CMOP electronically receives a prescription for a veteran through the medical center. The prescription is downloaded to highly automated dispensing equipment to be filled. The filled prescription is then validated by a pharmacist who compares the medication against the prescription and a computerized image of the prescribed medication. Afterward, the prescription is packaged and an automatically generated mailing label is applied for delivery to the veteran. Lastly, the medical center is electronically notified that the prescription has been filled. 28 GAO/T-AIMD-99-136, April 15, 1999. 29 These include operating systems, databases, and pharmacy fulfillment application software. Page 18 GAO/T-AIMD-00-39 As we testified this past April,30 VHA had determined that the automated systems supporting its CMOPs were not Y2K compliant. Accordingly, the CMOPs’ ability to fill prescriptions and process management reports could be delayed or interrupted if a Y2K failure occurred. At that time, we also expressed concern about the mid- to late-1999 scheduled implementation of compliant systems. Since our April testimony, VA’s contractors have installed and tested compliant systems at all seven CMOPs. As shown in table 3, as of September 30, 1999, all seven CMOPs have reported their automated systems as compliant. Table 3: Actual Completion Dates for Implementing Compliant Systems and Current Daily Workload by Consolidated Mail Outpatient Pharmacies Actual completion Current daily workload Location date (prescriptions filled) Bedford, Massachusettsa August 10, 1999 15,000 Dallas, Texasa August 10, 1999 14,000 West Los Angeles, Californiaa September 8, 1999 15,000 a Leavenworth, Kansas September 30, 1999 16,000 Murfreesboro, Tennesseeb September 22, 1999 38,000 b Charleston, South Carolina September 26, 1999 23,000 Hines, Illinoisb September 26, 1999 21,000 a Siemens ElectroCom automation. b SI/Baker, Inc. automation. Source: VA. We also testified in April that it was crucial that the CMOPs develop business continuity and contingency plans to ensure that veterans will continue to receive their medications should the CMOPs experience a Y2K-related failure. On September 3, 1999, the national CMOP director approved the Consolidated Mail Outpatient Pharmacy Year 2000 Contingency Plan, which (1) defines the responsibilities of the national director, the local CMOP director, the national Y2K coordinators, the local 30 GAO/T-AIMD-99-136, April 15, 1999. Page 19 GAO/T-AIMD-00-39 Y2K coordinators, and the business resumption team, (2) establishes procedures for preparing and implementing the contingency plan and implementing it during the execution phase, and (3) provides a schedule of critical events and a time line for actions to be taken during the execution phase. In addition, each of the seven CMOPs drafted contingency plans addressing core business processes. These plans, along with the Y2K Mail Transfer Contingency Test Procedures, which are the necessary steps relating to loss of the wide area network, were forwarded to the medical centers serviced by each CMOP during July and August of this year. Each medical center was asked to certify that the CMOP contingency plan had been reviewed and will be incorporated into the medical center’s Y2K contingency plan. However, according to the national CMOP Y2K coordinator, as of October 25, 1999, about half of the medical facilities had not returned their certifications. According to the CMOP Y2K plan, the CMOPs are expected to completely test their plans by the end of October. Five CMOPs participated in a live test last month. Specifically, anticipating a direct hit from Hurricane Floyd, the Charleston CMOP reallocated the prescriptions for its 21 medical centers to four other CMOPs—Bedford, Dallas, Hines, and West Los Angeles. The Charleston CMOP lost 36 hours of production time, and 55,683 prescriptions had to be processed by the other CMOPs. VA Continues Efforts to Like other users of pharmaceutical and medical-surgical products, VA Determine Y2K Readiness of needs to know whether it will have a sufficient supply of these items for its customers. Therefore, it has taken a leadership role in the federal Pharmaceutical and government in determining whether manufacturers supplying these Medical-Surgical products to VHA are Y2K-ready. This information is essential to VHA’s Manufacturers medical facilities and CMOPs because of their “just-in-time”31 inventory policy. Accordingly, they must know whether their manufacturers’ processes, which are highly automated,32 are at risk, as well as whether the rest of the supply chain will function properly. 31 This term refers to maintaining a limited inventory on hand. 32 Many pharmaceutical manufacturers rely on automated systems for production, packaging, and distribution of their products, as well as for ordering of raw materials and supplies. Page 20 GAO/T-AIMD-00-39 We testified in April that VA’s National Acquisition Center33 sent a survey on January 8, 1999, to 384 pharmaceutical firms and 459 medical-surgical firms with which it does business to determine their Y2K readiness.34 The survey contained questions on the firms’ overall Y2K status and inquired about actions taken to assess, inventory, and plan for any perceived impact that the century turnover would have on their ability to operate at normal levels. In addition, the firms were requested to provide status information on progress made to become Y2K compliant, and a reliable estimated date when compliance would be achieved for business processes such as (1) ordering and receipt of raw materials, (2) mixing and processing product, (3) completing final product processing, (4) packaging and labeling product, and (5) distributing finished product to distributors/wholesalers and end customers. In March the acquisition center sent a second letter to its pharmaceutical and medical-surgical firms, informing them of VA’s plans to make Y2K readiness information previously provided to VA available to the public through a web site (www.va.gov/oa&mm/nac/y2k ). VA made the survey results available on its web site on April 13, 1999.35 The letter also requested that manufacturers that had not previously responded provide information on their readiness. The acquisition center’s executive director said that he would personally contact any major VA supplier that did not respond. According to an August 1, 1999, briefing report on their survey, the acquisition center reclassified the 517 companies that responded to the survey into three categories: “pharmaceutical firms,’’36 “pharmaceutical, other firms,”37 and “medical-surgical firms.” As shown in table 4, as of August 1, 1999, the latest available date from VA, about one-third of the 33 This organization is responsible for supporting VHA’s health care delivery system by providing an acquisition program for items such as medical, dental, and surgical supplies and equipment; pharmaceuticals; and chemicals. The National Acquisition Center is part of VA’s Office of Acquisition and Materiel Management. 34 Five additional firms were identified from survey responses received after April 1999. 35 This site identified the firms that were sent surveys and those that responded. 36 Firms that manufacture and distribute both pharmaceuticals and medical/surgical equipment are included in the pharmaceutical category. 37 Pharmaceutical firms that also manufacture and distribute medical gases and reagents (substances used in chemical reactions to detect, measure, examine, or produce other substances). Page 21 GAO/T-AIMD-00-39 pharmaceutical firms, a little over one-third of the “pharmaceutical, other” and almost 44 percent of the medical-surgical firms had not responded to the survey. Table 4: Status of Companies Surveyed by VHA as of August 1, 1999 Pharmaceutical, Medical- Responses Pharmaceutical other surgical Y2K compliant 55 28 146 a Will be compliant by 1/1/2000 or earlier 92 30 79 Provided no compliance date 39 14 34 Total number of responses 186 72 259 Nonresponses 90 40 201 Total number of firms surveyed 276 112 460 a Estimated compliance status date ranged from 3/31/99 through 1/1/2000; about 72 percent of all respondents estimated they would be compliant by 7/31/99. One firm responded that it would be compliant by 1/01/2000. Source: VA. We did not independently verify these data. To determine if all respondents who had initially provided an anticipated compliance date of July 31, 1999, or earlier had met this date, a follow-up survey was sent to 140 firms on July 20, 1999. As shown in table 5, as of October 26, 1999, about two-thirds (64 percent) responded to the survey. A little over half of the respondents (52 percent) completed the survey, while the remaining respondents forwarded company letters, Year 2000 readiness disclosure statements, and company financial statements with disclosures on Y2K readiness. Table 5 also shows that about half of the respondents did not meet the targeted date of July 31, 1999; almost 84 percent, however, anticipate full compliance by September 30, 1999. The results of this follow-up survey are not currently available on VA’s web site. Page 22 GAO/T-AIMD-00-39 Table 5: Status of Companies With July 31, 1999, or Earlier Anticipated Compliance Dates as of October 26, 1999 Number of firms Percentage Total number of surveys distributed 140 100 Number of responses 90 64 Firms completing survey 47 52 Were compliant by 7/31/99 25 53 Anticipate compliance by 9/30/99 19 40 Anticipate compliance by fourth quarter 3 6 Firms forwarding company letters, etc. 43 48 Were compliant by 7/31/99 17 40 Anticipate compliance by 9/30/99 14 32 Anticipate compliance by fourth quarter 3 7 No date furnished 9 21 Source: VA. We did not independently verify these data. On a broader level, VHA has taken a leadership role in obtaining and sharing information on the Y2K readiness of the pharmaceutical industry. Specifically, VHA chairs the Year 2000 Pharmaceuticals Acquisitions and Distributions Subcommittee, which reports to the Chair of the President’s Council on Year 2000 Conversion. The purpose of this subcommittee is to bring together federal and pharmaceutical representatives to address issues concerning supply and distribution as it relates to the year 2000. The subcommittee consists of representatives of FDA, federal health care providers, and industry trade associations such as the Pharmaceutical Research and Manufacturers of America, the National Association of Chain Drug Stores, and the National Wholesale Druggists’ Association. Several of these trade associations have surveyed their members on their Y2K readiness and have made the results available to the public. Further, the Pharmaceutical Alliance for Y2K Readiness38 announced on September 22, 1999, that consumers will have access to a substantial supply of medications during the Y2K date change and there should be no need for consumers to overbuy medications in preparation for Y2K. 38 A coalition of drug manufacturers, wholesale distributors, pharmacies, and health care organizations that are working closely with government agencies to ensure a continued and substantial supply of pharmaceuticals through January 1, 2000. Page 23 GAO/T-AIMD-00-39 The executive director of the National Acquisition Center told us that, based on his interactions with the trade associations, as well as results received from manufacturers, he is confident that there will be no shortage of medication and medical-surgical supplies. He explained that the major companies with unique drugs that VA relies on have responded that they will be ready and have provided the necessary resources and management attention. Further, he said, all 10 of VA’s largest pharmaceutical and medical-surgical suppliers have responded to the survey and have taken actions to address the Y2K problem at their firms. Accordingly, the executive director does not plan to take any further action, including following up with those manufacturers that did not meet their anticipated compliance date of July 31, 1999, or September 30, 1999. We believe that VHA needs to continue to follow up with pharmaceutical and medical-surgical firms that anticipated having compliant systems by July 31, 1999, and September 30, 1999, to determine whether these firms have addressed the Y2K problem. This information should also be made available on VHA’s web site. FDA’s Y2K Activities on Another key player in determining the Year 2000 compliance of biomedical equipment and pharmaceutical, biological, and consumable medical Biomedical Equipment products is FDA, which has oversight and regulatory authority in these and Pharmaceutical, areas. FDA’s role is to ensure that these products are safe and effective for public use. In an effort to provide users with Y2K compliance information Biological, and on their equipment, FDA has established the Federal Y2K Biomedical Consumable Medical Equipment Clearinghouse. In addition, it has surveyed manufacturers of Products Industries pharmaceutical, biological, and consumable medical products, to provide users with information on their Y2K readiness. Are Focused on Readiness Biomedical Equipment We reported in September 1998 that FDA was working to determine the Status Information Available compliance status of biomedical equipment; provide a comprehensive, centralized source of information on the Y2K compliance status of Through FDA biomedical equipment used in the United States; and make this information Clearinghouse publicly available on a web site.39 However, we also reported that FDA’s 39 GAO/AIMD-98-240, September 18, 1998. Page 24 GAO/T-AIMD-00-39 database did not include product compliance information from many manufacturers that had already provided such information to VHA, and also that VHA was not making this information available to the public. We therefore recommended that HHS and VHA jointly develop a single data clearinghouse containing information on the Y2K compliance status of biomedical equipment, and make this information publicly available. In response to our recommendation, FDA—in conjunction with VHA— established the Federal Y2K Biomedical Equipment Clearinghouse. In obtaining compliance status information from manufacturers, VHA, the Department of Defense, and the Health Industry Manufacturers Association all assisted FDA. We testified last week that, according to FDA, 4,288 biomedical equipment manufacturers had submitted data to the clearinghouse as of October 4, 1999.40 Based on the data submitted, FDA places a manufacturer into one of four categories: • Products that do not employ a date—manufacturer that reported Y2K status to be “All Products Do Not Use a Date.” • Products that are all compliant—manufacturer that reported products as Y2K compliant. • Products with date-related problems—manufacturer that reported its Y2K status to be “Products With Date Related Problem.” • Product status is on the manufacturer’s web page—manufacturer that reported its Y2K status to be “Product Status Specified on a (Web) Page.” As shown in figure 1, as of October 4, 1999, 61 percent of the manufacturers reported having products that do not employ a date, while 8 percent (342 manufacturers) reported having date-related problems such as incorrect display of date/time. According to FDA, the 342 manufacturers reported 1,035 specific products with date-related problems. 40 GAO/T-AIMD-00-26, October 21, 1999. Page 25 GAO/T-AIMD-00-39 Figure 1: Biomedical Equipment Compliance-Status Information Reported to FDA by Manufacturers as of October 4, 1999 Note: Total number of manufacturers = 4,288. Source: FDA. Also, according to FDA, as of October 4, 1999, 132 manufacturers had not responded to the agency’s request for product compliance information. A senior FDA official told us that most of these manufacturers have gone out of business, do not make computerized products, or just cannot be located. The official added that FDA continues to follow up with these manufacturers nevertheless, through letters and telephone contact. The clearinghouse lists the names of these manufacturers that have not responded to FDA’s requests for product compliance information. Page 26 GAO/T-AIMD-00-39 In our September 1998 report, we also noted that information on the FDA web site was not detailed enough to be useful.41 Specifically, the list of compliant equipment contained no information on the equipment’s make and model. We therefore recommended that VA and HHS include in the clearinghouse information on the compliance status of all biomedical equipment by make and model. FDA agreed with this recommendation, and subsequently requested this information from manufacturers; users can now find specific information on the make and model of compliant medical devices on the FDA web site. As an alternative to obtaining biomedical equipment product compliance information from manufacturers and posting it to the Federal Y2K Biomedical Equipment Clearinghouse, FDA accepts equipment manufacturers’ references to their own web sites for compliance information. The clearinghouse provides users with a link directly to these web sites. As of October 4, 429 manufacturers had chosen this option. While FDA is aware of the number of products and their reported compliance status for those manufacturers providing this information to the Federal Y2K Biomedical Equipment Clearinghouse, in testimony this past May FDA officials stated that they did not know the total number of biomedical equipment products reported by manufacturers on their web sites, or how many of them were noncompliant. We subsequently reviewed information available through these web sites and reported in June that the quality of information available through them varied significantly.42 Specifically, we found that while most sites contained compliance information on at least one product, some sites contained insufficient information or did not clearly distinguish biomedical equipment from nonbiomedical products. We subsequently updated our analysis of the web sites as of October 1, 1999, and found the following for the 429 manufacturers in FDA’s clearinghouse that refer users to their web sites: 41 GAO/AIMD-98-240, September 18, 1998. 42 Year 2000 Computing Challenge: Concerns About Compliance Information on Biomedical Equipment (GAO/T-AIMD-99-209, June 10, 1999). Page 27 GAO/T-AIMD-00-39 • 354 manufacturers reported compliance status information for at least 33,598 individual biomedical equipment products;43 • 71 manufacturers’ web sites either contained insufficient information on the number of products and their compliance status, or did not clearly distinguish biomedical equipment from nonbiomedical products; • 3 web sites were those of vendors or distributors, not manufacturers; and • 1 manufacturer’s web site link in FDA’s clearinghouse did not work.44 Because of the limitations cited above for many of the manufacturers’ web sites, our ability to determine the total number of biomedical equipment products reported and their compliance status was limited. Accordingly, the actual number of products reported by these manufacturers could be higher than the 32,598 that we counted. As shown in figure 2, of the 32,598 products we identified on manufacturers’ web sites, about 54 percent reportedly do not employ a date, about 29 percent of the products are considered compliant, and about 12 percent are reportedly noncompliant. The compliance status of the remaining 5 percent of products was unknown for reasons such as the manufacturer’s ongoing assessment of the product. 43 This includes medical devices and scientific and research instruments, and other supporting products, such as printers and software. 44 According to FDA, the contractor assisting it with the clearinghouse verified that this web site link was operable. Page 28 GAO/T-AIMD-00-39 Figure 2: Biomedical Equipment Compliance-Status Information Reported on Manufacturers’ Web Sites as of October 1, 1999 Note: Total number of products = 32,598. Source: GAO analysis of manufacturers’ web sites. The 4,053 noncompliant products that we identified were from the web sites of 214 manufacturers. This number of products is about four times the number reported directly by FDA in its clearinghouse (1,035). Examples of these noncompliant products included a bedside monitor, film digitizer, ultrasound systems, radiology information systems, and laboratory information systems. Included among noncompliant potentially high-risk devices reported were ventricular assist devices and hemodialysis equipment.45 45 A ventricular assist device is a small electromechanical pump that helps maintain blood circulation in patients suffering from end-stage heart disease. Hemodialysis equipment cycles blood from a patient’s body to filter out body waste before returning the blood to the patient. Page 29 GAO/T-AIMD-00-39 In addition to supplying information on noncompliant products, most of the manufacturers with noncompliant products also provided solutions to correct the problem. Most (190) of the 214 manufacturers identified with noncompliant products provided at least one solution to correcting the problem. The solutions generally involved upgrades to hardware or software, manual action (such as turning the equipment on and off on January 1, 2000), or workarounds.46 FDA Is Now Reviewing While compliance information is available through FDA’s Federal Y2K Manufacturers’ Y2K Biomedical Equipment Clearinghouse, we have raised concerns in the past year about the lack of independent verification and validation of Activities biomedical equipment that manufacturers have certified as compliant. In addition to making sure that manufacturers provide detailed information on their products, we believe that it is essential that FDA provide some level of confidence that critical care and life support medical devices will work as intended. In response to our recommendation to conduct independent verification and validation of biomedical equipment that manufacturers have certified as compliant, FDA is taking action to review a sample of biomedical equipment manufacturers’ Y2K activities, such as risk management, test planning and procedures, and implementation and contingency planning. Specifically, FDA’s acting deputy commissioner for policy testified in May 1999 that FDA proposed reviewing manufacturers’ test results supporting their compliance certifications for a sample of critical devices. FDA’s proposal consisted of two phases. In the first phase FDA would • develop a list of the manufacturers of computer-controlled, potentially high-risk devices (PHRD);47 • from this list of manufacturers, select a sample of 80 manufacturers for review; and • hire a contractor to develop a program to assess manufacturers’ activities to identify and correct Y2K problems with PHRDs. 46 An example of a workaround is noting on the printout of an EKG machine the year “2000” instead of “1900.” 47 These medical devices are characterized by their potential for immediate and serious adverse health consequences for a patient if they fail to function as designed or expected, including a failure to initiate or continue operations. Page 30 GAO/T-AIMD-00-39 The goal of the first phase of the survey is to extrapolate from the 80 assessments a level of overall confidence in the biomedical equipment industry’s Y2K compliance activities. According to FDA, the second phase of the evaluation would be undertaken only if the results of the first phase indicated a need for further review of manufacturer Y2K activities because of concerns over how manufacturers are addressing product compliance. In carrying out its plan to assess manufacturers’ Y2K activities, FDA identified 90 types of PHRD products, and issued a task order on July 1, 1999, for a contractor, assisted by two subcontractors, to perform assessments of the Y2K compliance activities for a sample of PHRD manufacturers. FDA identified 803 PHRD manufacturing sites that produce equipment sold in the United States.48 These were composed of 726 biomedical equipment manufacturing sites and 77 manufacturing sites of blood and blood products equipment. FDA’s contractor then randomly selected 325 of the 803 sites for possible assessment. These manufacturing sites were then contacted and asked if they would volunteer to participate in the process. As of October 4, 1999, of the 325 randomly selected sites, • 197 were identified as producing no computer-controlled equipment, • 80 agreed to participate, • 26 declined to participate,49 • 18 were duplicates,50 and • 4 did not respond. To carry out the on-site assessments of manufacturing sites, the contractor developed a guide for its examiners. This guide focused on the firm’s Y2K activities in six areas: (1) executive leadership and control, (2) risk management, (3) corrective and preventive actions, (4) test planning and 48 The 803 consisted of those manufacturers that had registered PHRD products with FDA that were among the 90 types of PHRDs identified. 49 Reasons given by manufacturers for declining to participate included scheduling or resource limitations, and recent regular FDA site inspections. Five manufacturing sites declined without giving a reason. 50 These sites involved large, multisite manufacturers where the FDA contractor had already selected two or more of the manufacturer’s sites. According to FDA, the contractor did not assess duplicates if they came up in later samples. Page 31 GAO/T-AIMD-00-39 procedures, (5) communication with the consignee (user of the products), and (6) implementation and contingency planning. After completing these assessments, examiners were required to prepare a report of concerns in each of the six areas reviewed at each manufacturing site. Concerns were identified as high, medium, or low, as defined below: • high—relates to actions that are not timely, inadequate planning, inadequate or incomplete resources, incomplete or inaccurate deliverables, unable to validate results, and/or inadequate due diligence; • medium—relates to actions that are somewhat late, incomplete planning, insufficient or incomplete resources, deficiencies in deliverables, and/or incomplete validation of results; and • low—relates to actions that are on schedule and have adequate resources. According to FDA’s PHRD survey project manager, as of October 15, 1999, examiners had completed all 80 manufacturer site assessment visits, and had prepared 62 assessment reports. We reviewed the 25 manufacturer site visit reports that were completed by the examiners and available to us as of September 10, 1999. For 20 of these assessments, concern was low. At the five remaining sites, the examiner assessed at least one concern as moderate in one of the six areas, such as test planning and procedures. According to the FDA PHRD survey project manager, the areas identified in the site visit reports as medium risks do not constitute a risk to patient health or safety. Until recently, none of the site visit reports submitted to FDA contained a concern assessed as high. However, last week, the PHRD survey project manager informed us that FDA had received a site visit report with concerns accessed as high in two areas—leadership and control, and test planning and procedures. The report stated that the manufacturer’s polices and procedures were found to be inconsistent, ambiguous, and were not followed in a manner that would meet due diligence requirements. It also noted that the qualifications of the manufacturer’s personnel for specified tasks were not well defined, and that some personnel assigned to tasks identified in the policies and procedures were not qualified to perform those tasks. The report concluded that the manufacturer’s procedures for Y2K assessment and corrective and preventive action were less than adequate, and that assessment procedures had not been applied Page 32 GAO/T-AIMD-00-39 consistently. The manufacturer subsequently told the examiner that action would be taken on the issues raised. Late last week, FDA’s Senior Associate Commissioner for Policy, Planning, and Legislation testified that FDA sent an inspector to follow up with this manufacturer. The FDA official said the inspector determined that the deficiencies noted would not affect patient safety. He also stated that FDA would continue to monitor the situation at this site. Regarding the overall planned phase one report, the project manager told us that FDA’s contractor is in the process of preparing a final report summarizing the findings from the 80 site visit assessment reports, detailing any problems encountered during the project and recommending whether the second phase should be performed. Although FDA initially expected to submit a final report to HHS by October 1, it has not yet established a revised deadline. Accordingly, it does not know when this information will be made available to the public. We believe that this information should be made available as soon as possible. To assess how the contractor was executing FDA’s task order, we observed selected site visit assessments. At the five manufacturing site assessments we observed, the examiners generally followed the contractor-developed audit guide, and were knowledgeable about information technology management, Y2K testing, and risk assessment. During our two initial visits, we noted that the examiners sometimes could not answer questions from the manufacturers relating to the FDA clearinghouse and the processing of the final report on the site assessments. We subsequently shared these observations with FDA official, who agreed to consider our suggestions, such as better communicating to the firms the final reporting process and how the FDA Federal Y2K Biomedical Clearinghouse works. During the later three visits, we did not observe any similar areas of concern. Page 33 GAO/T-AIMD-00-39 FDA’s Activities to FDA’s oversight and regulatory responsibility for pharmaceutical, Determine Y2K Readiness of biological, and consumable medical products51 is to ensure that they are safe and effective for public use. Since our April testimony,52 FDA has taken Manufacturers of action to determine the Y2K readiness of these industries. Specifically, FDA Pharmaceutical, Biological, is conducting voluntary surveys of manufacturers of pharmaceutical, and Consumable Medical biological, and consumable medical products for Y2K readiness. These Products surveys assess manufacturers’ plans and preparations to continue operations after January 1, 2000. According to FDA’s Senior Associate Commissioner for Policy, Planning, and Legislation, information obtained from these surveys thus far indicates that there will likely be no significant disruption of necessary supplies of pharmaceuticals, biologicals, or consumable medical products as a result of Y2K. FDA believes that essential medical supplies will be available, and that the drug supply will be safe and adequate. To obtain information on the Y2K readiness of the pharmaceutical industry, on April 21, 1999, the FDA Commissioner sent a letter to the presidents and CEOs of approximately 4,228 pharmaceutical manufacturers that produce prescription drugs, over-the-counter medication, bulk drugs, and also to drug distributors and repackagers, and medical gas manufacturers. In the letter, the Commissioner requested the assistance of these firms in assuring the American public that the firms had addressed the Y2K problem as it affects the adequacy, safety, and effectiveness of the supply of pharmaceuticals in the United States. According to FDA’s Senior Associate Commissioner for Policy, Planning, and Legislation, as of October 8, 1999, 3,132 (74 percent) of the firms had responded to the survey. Of these, 95 percent stated that they would be Y2K ready by October 31, 1999. According to the senior associate commissioner, FDA is committed to maximizing the response, especially from the 274 priority manufacturers who produce sole source, orphan drugs,53 or the top 200 prescribed medications. 51 Biological products include vaccines, blood, and blood products. 52 GAO/T-AIMD-99-136, April 15, 1999. 53 Orphan drugs are those produced under provisions of the Orphan Drug Act (P.L. 97-414, § 983, as amended). The act provides incentives for manufacturers to produce drugs that are used by a small number of patients to treat a specific, but not widespread, medical condition. Page 34 GAO/T-AIMD-00-39 This FDA official testified on October 21, 1999, that, in addition to conducting the survey of pharmaceutical manufacturers, distributors, etc., FDA is taking the additional step of obtaining independent assurance of these firms’ Y2K assessments and corrections. The agency has obtained a contractor that is auditing each of 160 highest priority pharmaceutical firms, as well as a random sample of other firms. As of October 8, 1999, 88 percent of these assessments have been completed. The report stated that the results of their audits to date are positive and confirmed FDA’s expectation that the pharmaceutical industry has taken the necessary steps to prepare for the year 2000. The interim report54 is available on FDA’s web site.55 FDA is also assessing the Y2K readiness of the biologics industry. In June, the Center for Biologics Evaluation and Research mailed a survey on Y2K readiness to 1,576 licensed biologics manufacturers and registered blood establishments. FDA also sent letters to biologics trade organizations requesting their assistance in encouraging their members to participate in the survey. According to FDA’s senior associate commissioner, as of October 15, 1999, it had received responses from 1,483 (94 percent) of the licensed manufacturers and blood establishments. In addition, as with the pharmaceutical industry, FDA is conducting follow-up audits of 110 high-priority firms to assess their Y2K readiness. To date, FDA reports finding no problems with the audited firms. In addition, FDA is conducting random audits of other firms, and has completed audits of 48 of these with no problems identified as of October 14, 1999. FDA told us on October 27 that it plans to publicize the survey and audit results of the biologics manufacturers, although it has not established a date when this information will be available. We believe that this information should be made available as soon as possible. FDA also mailed Y2K readiness surveys to 3,070 manufacturers of consumable medical supplies in June.56 This survey focused on 54 Center for Drug Evaluation and Research’s Interim Report: Assessment of the Pharmaceutical Industry’s Readiness for Year 2000, FDA, October 18, 1999. 55 The site is located at http://www.fda.gov/cder/y2k. 56 Consumable medical supplies include such items as intravenous tubing, kidney dialysis filter units, and blood and blood product bags. Page 35 GAO/T-AIMD-00-39 manufacturers that produce critical devices that are used and consumed on a recurring basis during the delivery of essential health care services, as well as those whose availability is critical to the uninterrupted delivery of health care and patient welfare. As of October 14, 1999, FDA had received 2,074 responses (68 percent) to its survey. According to FDA’s senior associate commissioner, approximately 90 percent of these respondents report that they will be ready for Y2K by October 31, 1999. FDA is also conducting audits of firms that supply medical consumables. It has given highest priority to 225 firms that produce devices that are only manufactured by a handful of those firms, as well as 57 manufacturers that are sole-source suppliers. According to FDA’s senior associate commissioner, to date, 197 of the high-priority firms have responded, and 48 of the 57 sole-source firms have responded. On October 27, 1999, FDA told us that it plans to make the detailed survey and audit results for consumable medical products manufacturers available to the public, but it has not yet determined the date when this will be done. We believe that it is critical to make this information available. In summary, VA has made much progress in addressing the Y2K computer problem. However, some critical tasks remain in the areas of testing business continuity and contingency plans and reporting Y2K compliance status of key components such as facility systems at VHA medical facilities. VHA should also reassess its decision not to test biomedical equipment in those instances in which the manufacturer encourages such testing. Additionally, VA needs to continue to follow up with pharmaceutical and medical-surgical firms that anticipated having compliant systems by July 31, 1999, and September 30, 1999, respectively, and make this information available to the public through its web site. Compliance status information on biomedical equipment can now be found in FDA’s clearinghouse or on manufacturers’ web sites. Also, to its credit, FDA has assessed the Y2K compliance activities of some PHRD manufacturing sites. This information should provide the American public with a higher level of confidence that medical devices will work as intended. FDA now needs to finalize its overall report on the results of its review of the PHRD manufacturing sites, and make this information available to HHS and the public through its web site. We performed this assignment in accordance with generally accepted government auditing standards, from May through October 1999. In Page 36 GAO/T-AIMD-00-39 carrying out this assignment, we reviewed and analyzed VA’s Y2K documents and plans, comparing them against our guidance on Y2K activities. More specifically, we observed VBA’s “dry run” testing of its benefits payment systems, VHA’s forward-date tests of its hospital information systems, and tests of CMOP Y2K fixes. We reviewed the test plans, selected test scripts, and test results for each Y2K test. We also reviewed business continuity and contingency plans for a sample of for VHA medical centers and VBA regional offices, as well as VBA data centers. In addition, we reviewed and analyzed FDA documentation relating to its Y2K efforts on biomedical devices and pharmaceutical manufacturers. More specifically, we identified the amount and quality of information on product compliance information available on biomedical equipment manufacturers’ web sites, reviewed information from those sites to identify the total number of biomedical equipment products reported, and categorized their compliance status.57 We also reviewed manufacturers’ web sites to assess the clarity and completeness of the information reported. In addition, we visited selected VHA medical centers, VBA regional offices, VA data centers, and VHA CMOPs to discuss their Y2K activities, and interviewed VA and FDA officials about those activities. Finally, we interviewed selected private hospital officials about their Y2K actions and pharmaceutical trade associations on their Y2K readiness surveys of pharmaceutical manufacturers. Mr. Chairman, this concludes my statement. I would be pleased to respond to any questions that you or other members of the Subcommittee may have at this time. Contact and For information about this testimony, please contact Joel Willemssen at (202) 512-6253 or by e-mail at email@example.com. Individuals Acknowledgments making key contributions to this testimony included Dr. Nabajyoti Barkakati, Michael Fruitman, Tonia Johnson, Helen Lew, Barbara Oliver, Mike Resser, and Henry Sutanto. 57 We summarized the results of our review in four compliance categories—products that do not employ a date, products that are compliant, products that are noncompliant, and products whose compliance status is currently unknown. This last category includes those manufacturers who reported that they have not completed an assessment of their products, have discontinued a product, or have a product that is now obsolete. (511757) Leter Page 37 GAO/T-AIMD-00-39 Ordering Information The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary, VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. Orders by mail: U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 or visit: Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu will provide information on how to obtain these lists. For information on how to access GAO reports on the INTERNET, send an e-mail message with “info” in the body to: firstname.lastname@example.org or visit GAO’s World Wide Web Home Page at: http://www.gao.gov United States Bulk Mail General Accounting Office Postage & Fees Paid Washington, D.C. 20548-0001 GAO Permit No. GI00 Official Business Penalty for Private Use $300 Address Correction Requested
Year 2000 Computing Challenge: Update on the Readiness of the Department of Veterans Affairs
Published by the Government Accountability Office on 1999-10-28.
Below is a raw (and likely hideous) rendition of the original report. (PDF)