oversight

Year 2000 Computing Challenge: Update on the Readiness of the Department of Veterans Affairs

Published by the Government Accountability Office on 1999-10-28.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                          United States General Accounting Office

GAO                       Testimony
                          Before the Subcommittee on Oversight and Investigations,
                          Committee on Veterans’ Affairs, House of Representatives




For Release on Delivery
Expected at
10 a.m.
                          YEAR 2000 COMPUTING
Thursday,
October 28, 1999          CHALLENGE

                          Update on the Readiness of
                          the Department of Veterans
                          Affairs
                          Statement of Joel C. Willemssen
                          Director, Civil Agencies Information Systems
                          Accounting and Information Management Division




GAO/T-AIMD-00-39
Mr. Chairman and Members of the Subcommittee:

Thank you for inviting us to participate in today’s hearing on the
Department of Veterans Affairs’ (VA) efforts to address the Year 2000 (Y2K)
computer problem.1 My testimony today will focus on the Y2K readiness of
automated systems that support the delivery of veterans’ benefits and
health care services, the compliance status of biomedical equipment used
in patient care, and the Y2K readiness of the pharmaceutical and
medical-surgical manufacturers on which VA relies. I will also share with
you information on the Food and Drug Administration’s (FDA) Y2K efforts
to address biomedical equipment and pharmaceutical products.2

In brief, VA continues to make progress in addressing the Y2K problem. It
has established a moratorium on software changes and has developed a
Day One plan to minimize risks associated with the rollover period.
However, some critical tasks remain to be completed. For example, only
about 10 percent of the Veterans Benefits Administration’s (VBA)
58 regional offices have tested their business continuity and contingency
plans. And inaccuracies in monthly reports submitted by the Veterans
Health Administration’s (VHA) medical facilities make it difficult to
determine their progress in renovating facility systems,
telecommunications systems, commercial-off-the-shelf (COTS) software,
computer platforms, and medical devices. Further, VHA has not
implemented our prior recommendation to review the test results for
biomedical equipment used in critical care/life support environments. It is
crucial that VA address these issues if the department is to continue to
reliably deliver benefits and other health care services through the turn of
the century.

FDA, for its part, has made progress in making compliance information on
biomedical equipment available to users through its Federal Y2K


1
 As is widely known by now, for the past several decades computer systems have often used
two digits to represent the year, such as “98” for 1998, in order to conserve electronic data
storage and reduce operating costs. In this format, however, 2000 is indistinguishable from
1900 because both are represented as “00.” As a result, if not modified, systems or
applications that use dates or perform date- or time-sensitive calculations may generate
incorrect results beyond 1999.
2
 Biomedical equipment refers to both medical devices regulated by FDA, within the
Department of Health and Human Services, and scientific and research instruments, which
are not subject to FDA regulation. Pharmaceutical products also fall under FDA’s regulatory
authority.




Page 1                                                                    GAO/T-AIMD-00-39
                          Biomedical Equipment Clearinghouse. It is also conducting surveys to
                          determine the Y2K readiness of pharmaceutical, biological, and
                          consumable medical3 products manufacturers. FDA has also recently
                          addressed our concern about the lack of independent verification and
                          validation of critical care/life support biomedical equipment certified
                          compliant by manufacturers. Specifically, it has reviewed a sample of these
                          manufacturers’ Y2K activities, including risk management, test planning
                          and procedures, implementation, and contingency planning. In the limited
                          time remaining, FDA still needs to issue its final report to the Department
                          of Health and Human Services (HHS) summarizing the results of its review
                          of manufacturers’ Y2K activities and make these results available to the
                          public.



VA Is Making Progress     Like many organizations, VA faces the possibility of computer systems
                          failures at the turn of the century due to incorrect information processing
on Systems But Critical   relating to dates. This could make veterans who are eligible for benefits
Tasks Remain              and medical care appear ineligible. If this happens, the issuance of benefits
                          and the provision of medical care that veterans rely on could be delayed or
                          interrupted.

                          At your request, Mr. Chairman, we have been monitoring and evaluating
                          VA’s actions to address the Y2K problem since 1996.4 We have also made
                          many recommendations to reduce the risk associated with Y2K failures,
                          and VA has been responsive to these recommendations. For example, VBA
                          changed its strategy from relying on new Y2K-compliant systems to fixing
                          the current systems in order to address the risk that the new systems would


                          3
                           Consumable medical products are expendable, disposable, or nondurable supplies used for
                          the treatment or diagnosis of a patient’s specific illness, injury, or condition. Examples
                          include surgical gloves and intravenous tubing.
                          4
                           See Year 2000 Computing Crisis: Actions Needed to Ensure Continued Delivery of Veterans
                          Benefits and Health Care Services (GAO/AIMD-99-190R, June 11, 1999), Year 2000
                          Computing Crisis: Action Needed to Ensure Continued Delivery of Veterans Benefits and
                          Health Care Services (GAO/T-AIMD-99-136, April 15, 1999), Year 2000 Computing Crisis:
                          Compliance Status of Many Biomedical Equipment Items Still Unknown
                          (GAO/AIMD-98-240, September 18, 1998), Year 2000 Computing Crisis: Progress Made in
                          Compliance of VA Systems, But Concerns Remain (GAO/AIMD-98-237, August 21, 1998),
                          Veterans Affairs Computer Systems: Action Underway Yet Much Work Remains to Resolve
                          Year 2000 Crisis (GAO/T-AIMD-97-174, September 25, 1997), Veterans Benefits Computer
                          Systems: Risks of VBA’s Year-2000 Efforts (GAO/AIMD-97-79, May 30, 1997), and Veterans
                          Benefits Modernization: Management and Technical Weaknesses Must Be Overcome If
                          Modernization Is To Succeed (GAO/T-AIMD-96-103).




                          Page 2                                                                 GAO/T-AIMD-00-39
not be completed in time. In 1998, VBA also reassessed its mission-critical
efforts for the compensation and pension on-line application and the
Beneficiary Identification and Record Locator Sub-System, as well as other
technology initiatives to help ensure that these critical undertakings were
completed in time. Simultaneously, VHA issued its Patient-Focused Year
2000 Contingency Planning Guidebook to its medical facilities, describing
actions they could take to minimize Y2K-related disruptions to patient care.
More recently, both VBA and VHA developed business continuity and
contingency plans that address mission-critical systems, core business
processes, regional offices, and medical facilities.

In addition, VA has reported to the Office of Management and Budget
(OMB) that it completed renovating and implementing the mission-critical
applications supporting its 11 systems areas as of March 31, 1999. As shown
in table 1, VBA has six of these areas, and VHA has two.




Page 3                                                      GAO/T-AIMD-00-39
Table 1: Reported Status of VA’s Mission-Critical Computer Systems Areas and
Their Applications


Component/office                                                        Number of applications
(number of systems)             Systems area                             renovated or replaced
Veterans Benefits               Compensation and Pension
Administration (6)                                                                         30
                                Education                                                  24
                                Insurance                                                   3
                                Loan Guaranty                                              19
                                Vocational Rehabilitation                                   4
                                Administrative                                             27
                                Total                                                     107
Veterans Health                 Veterans Health Information
Administration (2)              Systems and Technology
                                Architecture                                              105
                                Veterans Health
                                Administration Corporate
                                Systems                                                    95
                                Total                                                     200
National Cemetery               Burial Operations Support
Administration (1)              System/Automated
                                Monument Application
                                System                                                      1
                                Reengineer                                                  1
                                Total                                                       2
Office of Financial             Personnel and Accounting
Management (2)                  Integrated Data                                             8
                                Financial Management
                                System                                                      1
                                Total                                                       9
VA total                                                                                  318a


a
Of this total, 316 applications were renovated and two were replaced.
Source: VA. We have not independently verified this information.




Page 4                                                                       GAO/T-AIMD-00-39
Although VA has made progress, when we testified5 this past April, the
department still had numerous Y2K issues to address. Specifically, (1) VBA
and VHA had not completed testing of their mission-critical systems to
ensure that they could reliably accept future dates, (2) VHA had not
completed assessments of its facility systems,6 (3) VHA’s pharmaceutical
operations were at risk because the automated systems supporting its
consolidated mail outpatient pharmacies (CMOP) were not Y2K compliant,
(4) VHA had not defined the CMOP systems as mission-critical in its
quarterly report to OMB, and (5) VHA did not know whether its medical
facilities would have a sufficient supply of pharmaceutical and
medical/surgical supplies on hand because it did not have complete
information on the Y2K readiness of these manufacturers. To address these
issues, we made the following recommendations to the Secretary of
Veterans Affairs:7

• complete Y2K testing of VBA and VHA mission-critical systems—
  including systems acceptance testing,8 full forward-date testing,9
  end-to-end testing, and business process simulation testing on
  compliant platforms;
• set deadlines to complete assessment, renovation, validation, and
  implementation of VHA’s facility systems;
• develop business continuity and contingency plans for VHA CMOPs to
  ensure an uninterrupted supply of medications to veterans in the event
  of Y2K problems at these facilities;
• reassess VA’s decision not to report CMOP systems as mission-critical;
  and
• seek the assistance of FDA and industry trade associations in obtaining
  information on the Y2K readiness of specific pharmaceutical and



5
GAO/T-AIMD-99-136, April 15, 1999.
6
 Facility systems include building-related equipment such as elevators, heating, ventilating,
and air conditioning equipment, lighting systems, security systems, and disaster recovery
systems.
7
GAO/AIMD-99-190R, June 11, 1999.
8
 Systems acceptance testing verifies that the complete system—the full component of
applications software running on the target hardware and system software—satisfies
specific requirements and is acceptable to users.
9
 Forward-date testing verifies that the system is able to process using future dates in
2000 and beyond.




Page 5                                                                     GAO/T-AIMD-00-39
                                   medical/surgical suppliers10 that did not respond to VHA’s survey, and
                                   publicize the results in a single data clearinghouse.


VA Has Been Responsive to   VA generally agreed with our recommendations, and actions to implement
Recommendations             them have either been taken or are underway.

                            • Both VBA and VHA have completed systems acceptance and
                              forward-date testing. VBA completed systems acceptance testing of its
                              benefits delivery applications and also tested its payment systems’
                              ability to process benefits in January 2000, in conjunction with the
                              Department of the Treasury’s Financial Management Service and the
                              Federal Reserve System. This testing was completed in July 1999.
                              Likewise, VHA completed Y2K systems acceptance testing of its
                              mission-critical hospital systems. In addition, in August 1999, VHA’s
                              independent verification and validation test group forward-date tested
                              56 hospital applications.11
                            • VHA issued a policy directive on July 30, 1999, stating that its medical
                              facilities had to make a decision on renovation strategies by
                              September 1, 1999, for those facility systems components and interfaces
                              whose Y2K status was noncompliant, conditionally compliant, or
                              unknown. The directive also required these facilities to establish
                              specific contingency plans for each of these systems. According to the
                              Y2K project office, all of the medical facilities have met this
                              requirement.
                            • VHA’s CMOPs have developed business continuity and contingency
                              plans that address important issues such as the loss of electrical power,
                              telecommunications with the medical centers, and their automated
                              dispensing machines. These plans should reduce the risk that Y2K
                              disruptions will impair the CMOPs’ ability to continue filling and
                              delivering veterans’ prescriptions.
                            • In its August 1999 report to OMB, VA said that renovation of the
                              vendor-supplied CMOP dispensing systems were on schedule to make
                              all seven CMOPs Y2K compliant by September 30, 1999.
                            • VA has worked with FDA and various other industry associations to
                              obtain and share Y2K-readiness information on the Y2K compliance

                            10
                                 These include manufacturers and distributors.
                            11
                              These 56 applications, which run at most VA health facilities, were chosen for their date
                            intensiveness and business criticality. Included among the applications tested were
                            inpatient and outpatient pharmacy, radiology, laboratory, and surgery.




                            Page 6                                                                    GAO/T-AIMD-00-39
                              status of pharmaceutical and medical-surgical manufacturers. It has
                              posted results on its Internet home page (www.va.gov).


VA Established a         To minimize possible disruptions to agencies’ Y2K readiness resulting from
Moratorium on Software   system changes, OMB, in a May 14, 1999, memorandum to heads of
                         departments and agencies, requested that agencies establish a process to
Changes
                         ensure that the effect on Y2K readiness is considered prior to establishing
                         new requirements or changes to information technology systems.12 We had
                         previously testified that agencies should institute such a process to ensure
                         that software changes do not negatively affect Y2K readiness.13

                         In response to OMB’s memorandum, VA issued a October 14, 1999,
                         memorandum to department heads imposing a moratorium on
                         implementing new systems, changes to existing systems, or third-party
                         upgrades to VA’s information technology systems between
                         October 15, 1999, and March 31, 2000. The intent of the memorandum was
                         to ensure that the department incorporates Y2K change management
                         procedures. It further stated that in those instances in which software
                         changes were necessary—such as when compliant software had to be
                         modified due to legislative or other agency requirements—it would be
                         necessary to test all changes and recertify the software’s compliance.14

                         VA has also defined a process for requesting waivers for software changes
                         or upgrades during this time. Specifically, waivers must be justified by the
                         VA administration requesting them and concurred with by that
                         administration’s chief information officer (CIO), architecture review board,
                         or senior information technology official. The request is then submitted to
                         VA’s Principal Deputy Assistant Secretary for Information and Technology
                         for approval.

                         Prior to the department’s issuing this moratorium, VBA had developed and
                         issued a similar moratorium to all VBA offices on July 29, 1999. This


                         12
                          OMB Memorandum M-99-17: Minimizing Regulatory and Information Technology
                         Requirements that Could Affect Progress Fixing the Year 2000 Problem, May 14, 1999.
                         13
                          Year 2000 Computing Crisis: Readiness Improving, But Much Work Remains to Avoid Major
                         Disruptions (GAO/T-AIMD-99-50, January 20, 1999).
                         14
                          Examples of software that will be modified include applications affected by cost-of-living
                         adjustments that usually take effect in January.




                         Page 7                                                                   GAO/T-AIMD-00-39
                         memorandum imposed a moratorium on the deployment of new
                         application changes or third-party product upgrades between
                         September 1, 1999, and April 1, 2000, and stated that exceptions to the
                         moratorium included emergency fixes and legislatively mandated changes
                         such as cost-of-living adjustments.

                         VHA has not yet issued specific instructions on how it will implement the
                         department’s moratorium. However, according to VHA’s Y2K project office,
                         it plans to issue guidance to its offices and medical centers based on VA’s
                         memorandum. According to VHA’s Y2K project manager, this guidance was
                         not developed earlier because VHA was waiting for the department to issue
                         its memorandum.


VA Has Developed a Day   As we note in our business continuity and contingency planning guide,15
One Strategy             developing a Day One risk reduction strategy and procedures for the period
                         between late December 1999 and early January 2000 is a key element in
                         contingency planning. Earlier this month, we issued a more specific guide
                         on Day One planning.16 In addition, on October 13, 1999, OMB issued a
                         memorandum to the heads of selected departments and agencies17
                         instructing them to develop Day One plans and encouraging them to use
                         our guide in the development of these plans. OMB required that the plans
                         address seven areas: (1) schedule of activity, (2) personnel on call or duty,
                         (3) contractor availability, (4) workforce communication, (5) facilities and
                         services to support workforce, (6) security, and (7) public communications.

                         VA and its agencies have developed a high-level Day One strategy that
                         should help the department manage risks associated with the
                         January 1 rollover and better position it to address any potential
                         disruptions. This strategy addresses each of the seven areas required by
                         OMB:

                         • a time line of events between December 31 and January 1;


                         15
                            Year 2000 Computing Crisis: Business Continuity and Contingency Planning
                         (GAO/AIMD-10.1.19, August 1998).
                         16
                            Y2K Computing Challenge: Day One Planning and Operations Guide
                         (GAO/AIMD-10.1.22, October 1999).
                         17
                          OMB Memorandum M-00-01: Day One Planning and Request for Updated Business
                         Continuity and Contingency Plans, October 13, 1999.




                         Page 8                                                                 GAO/T-AIMD-00-39
• a personnel strategy and leave policy that identifies key managerial and
  technical personnel available to support Day One operations;
• a statement that its administrations reviewed vendor service
  agreements and revised them to ensure that contractor support and
  other needs for the rollover period are met;
• a communications structure for workforce reporting during the rollover
  period. Under this structure, VBA regional offices plan to report to
  regional representatives, who plan to report to a national VBA
  information coordination center, located at VBA headquarters in
  Washington, D.C.; VHA medical centers plan to report to their Veterans
  Information Service Network (VISN)18 representative, who plans to
  report to a national VHA information coordination center located in
  Martinsburg, West Virginia. The VBA and VHA national information
  coordination centers plan to report to the VA national information
  coordination center, also located in Martinsburg;
• a statement that its facilities have addressed facility and support
  services for its workforce in their business continuity and contingency
  plans. In addition, the Day One plan requires regular “health” checks to
  ensure that these services remain available during the rollover period;
• a statement that the VA computer systems and data centers are being
  secured and additional security has been extended to the networks to
  increase protection during the rollover period; and
• a VA Office of Public Affairs information communications center to
  support the VA national information coordination center and direct
  public communications through the Joint Public Information Center
  that the President’s Council on Year 2000 Conversion plans to set up for
  the rollover period.

VA’s Day One plan also describes preparation activities that VA has
completed or plans to complete in order to help minimize potential Year
2000 disruptions to benefits delivery and health care. For example, VBA
plans to process most of its regular, recurring benefits payments so that
they will be available to veterans on December 30, 1999. This, according to
the plan, will greatly mitigate possible Y2K interruptions of benefits
payments.




18
 VISNs are 22 regional organizations encompassing medical centers, nursing homes, and
domiciliaries.




Page 9                                                               GAO/T-AIMD-00-39
VA Has Developed Business    According to VA’s August 1999 report to OMB, its regional offices and
Continuity and Contingency   medical facilities have completed business continuity and contingency
                             plans. In addition, according to VA, a selected number of these plans have
Plans
                             been reviewed by their respective Y2K project offices. Specifically, VBA’s
                             Y2K project office reviewed the plans of its regional offices and found that
                             they met VBA requirements. We reviewed 15 of the 58 VBA regional plans
                             and found that they address resources, staff roles, procedures, and
                             timetables for implementation, as well as risks and risk mitigation.

                             In reviewing the 58 medical facilities’ business continuity and contingency
                             plans, VHA’s Y2K project office concluded that while overall the plans
                             adequately addressed contingency planning, the plans of 14 facilities were
                             deficient. These deficiencies included the lack of a schedule of critical
                             events; lack of a policy statement describing the authority, responsibility,
                             and procedures for Y2K contingency planning; and missing contingencies
                             for specific functional areas, such as intensive care or operating rooms.
                             The project office asked the 14 facilities to address these deficiencies and
                             submit revised plans, which it is currently reviewing.

                             We reviewed the plans of 29 medical facilities to determine their
                             completeness,19 and found that, in some cases, the schedule of critical
                             events and execution timelines were not specific to the medical facility.
                             Additional specificity, such as time lines relevant to the medical facility and
                             specific dates for accomplishing tasks contained in the time lines, would
                             help make it easier for facility staff to implement the plan, and help
                             minimize confusion that might result if plans needed to be activated. A
                             second issue concerned the lack of medical facility coordination with
                             VHA’s seven CMOPs. This is especially important since the seven CMOPs
                             supply about 50 percent of VA’s prescriptions to veterans. VHA’s guidance,
                             however, only required sites that were co-located with a CMOP to
                             coordinate their plans with that CMOP alone.

                             We discussed these issues with representatives of VHA’s Y2K project office.
                             They agreed with our concern regarding the time lines and said that the
                             sites had been advised to ensure that these were sufficiently specific. In
                             addition, the VHA Y2K project manager told us that all CMOPs had been
                             advised to discuss their business continuity and contingency plans with the
                             medical facilities that they support so that they are aware of them.

                             19
                              The plans chosen for review included 19 medical facilities in the three VISNs that we have
                             been monitoring, and four facilities that are co-located with a CMOP.




                             Page 10                                                                 GAO/T-AIMD-00-39
VA Has Not Completed         Testing of business continuity and contingency plans is key to determining
Testing of Its Business      whether the contingencies are capable of providing the needed level of
                             support to core business functions and whether they can be implemented
Continuity and Contingency
                             in a reasonable amount of time. In addition, testing can show where plans
Plans                        need to be updated or changed. We previously testified that testing of plans
                             should be completed by September 30, 1999.20

                             As of October 22, 1999, only five of VBA’s 58 regional offices had completed
                             testing of their business continuity and contingency plans. VBA initially
                             asked that each regional office complete a “desktop” exercise21 of its plan
                             by September 30, 1999, during which the business continuity and
                             contingency plan team and other critical staff would simulate an
                             emergency situation. According to VBA’s Y2K project manager, the project
                             office is now requiring the regional offices to complete this exercise by
                             November 15, 1999. It is critical that VBA regional offices test their plans to
                             ensure that their contingencies are sufficient to maintain an acceptable
                             level of service and that the contingencies can be implemented in a feasible
                             time frame.

                             All of VHA’s medical facilities reportedly have completed emergency drills.
                             These drills, conducted under controlled conditions to ensure no impact on
                             patient safety, required each facility to turn off its local electric supply and
                             rely on backup generators. The medical facilities identified deficiencies in
                             their plans as a result of these drills. For example, one site found that its
                             generator was not capable of powering the entire hospital.

                             It has now contracted for an additional backup generator to ensure that all
                             critical areas can be powered. Other sites found that some of their mission-
                             critical areas were not linked to the backup generator, and have since
                             contracted for additional work to link them.

                             While VHA’s medical centers have tested their facilities’ ability to handle
                             power outages, other portions of their business continuity and contingency
                             plans, such as dealing with potential water and gas shortages, have not
                             been tested. Losses in these areas can have an impact on patient care.
                             Specifically, a VHA medical facility recently suffered a loss of water,


                             20
                                  GAO/T-AIMD-99-50, January 20, 1999.
                             21
                              VBA’s “desktop” simulation was not to include the actual establishment of an emergency
                             operations center or emergency backup sites.




                             Page 11                                                               GAO/T-AIMD-00-39
                         resulting in a loss of the steam plant, cooling towers, and fire suppression
                         system. This facility suggested that other facilities reevaluate their
                         contingencies in view of these losses.


Monthly Reports Do Not   All of VHA’s VISNs/medical facilities are required to prepare monthly
Accurately Reflect Y2K   reports on their Y2K progress in assessing, renovating, validating, and
                         implementing compliant systems. Specifically, they report on their Y2K
Status of Noncompliant
                         status in six areas: locally developed software, COTS software, computer
Systems                  platforms, telecommunications systems, facility systems, and medical
                         devices. These reports are used by VHA to monitor progress in addressing
                         Y2K issues and to identify problem areas.

                         VHA’s summary report for August 1999 indicated that the medical centers
                         had made limited progress in renovating their remaining noncompliant
                         facility systems and telecommunications systems. Specifically, it showed
                         that overall, only 43 percent of the facility systems and 41 percent of the
                         telecommunications systems at the medical facilities had completed
                         renovation. The numbers were somewhat higher for COTS software, at
                         55 percent, and computer platforms, at 65 percent. The highest renovation
                         number was for locally developed software products, at 94 percent. We
                         discussed these renovation statistics with VHA’s Y2K project manager, who
                         told us that the summary report may not be accurate because facilities are
                         not clear on whether to report on systems or on the components that make
                         up the systems.

                         During visits to selected medical facilities we confirmed that their
                         individual and summary reports did contain errors. For example, some of
                         the VISN percentages in the August report exceeded 100. The Y2K office
                         has also contacted selected medical facilities and acknowledged that the
                         reports have errors. To address this issue, the Y2K office is currently
                         contacting and visiting sites to discuss these reporting issues. It is critical
                         that the medical facilities accurately report their Y2K progress in
                         renovating their noncompliant systems so that top management within VA
                         can identify problem areas and take prompt and appropriate action.




                         Page 12                                                        GAO/T-AIMD-00-39
VHA Has Made                The question of whether VHA’s medical devices such as magnetic
                            resonance imaging (MRI) systems, x-ray machines, pacemakers, and
Progress in                 cardiac monitoring equipment can be counted on to work reliably on and
Determining Y2K             after January 1, 2000, is critical to VHA. To the extent that biomedical
                            equipment uses computer chips, it is vulnerable to the Y2K problem. In the
Compliance Status of        medical arena, such vulnerability carries with it possible safety risks.
Biomedical Equipment

VA Continues to Collect     In April, we testified before this Subcommittee that VHA was continuing to
Compliance Information on   collect information from biomedical equipment manufacturers on the Y2K
                            compliance status of equipment in its inventory.22 As shown in table 2, a
Biomedical Equipment
                            little over half of the manufacturers in VA’s database reported directly to
                            the department that their products are compliant as of October 25, 1999.
                            Since we last testified, VA has created a new compliance category to
                            capture the increasing number of manufacturers that have web sites with
                            Y2K information. VA reported that about 24 percent of the manufacturers in
                            its database (1,393) are in this new category.




                            22
                                 GAO/T-AIMD-99-136, April 15, 1999.




                            Page 13                                                    GAO/T-AIMD-00-39
Table 2: Status of Manufacturer Responses to VHA as of October 25, 1999
                                                                 Number of            Percentage of
Manufacturer response                                         manufacturers           manufacturers
Manufacturers with web site information                                    340                      24
Compliant manufacturersa                                                   720                       52
                                b
Noncompliant manufacturers                                                   33                      2
Conditional-compliant manufacturersc                                         40                      3
Pending manufacturersd                                                       11                      1
Manufacturers merged or bought out                                         241                      17
Nonresponsive manufacturerse                                                 8                        1
Total                                                                    1,393                      100


a
 For inclusion in this category, 100 percent of a manufacturer’s products had to be considered
compliant.
b
 For inclusion in this category, only one of a manufacturer’s products had to be considered
noncompliant.
c
 For inclusion in this category, the manufacturer had to have no noncompliant devices, no pending
devices, and at least one conditional-compliant device.
d
 For inclusion in this category, the manufacturer had to have no noncompliant devices and at least one
device that is pending.
e
For inclusion in this category, VHA had to have not received compliance information from the
manufacturer.
Source: Veterans Health Administration. We did not independently verify these data.


For nonresponsive manufacturers, VHA’s Y2K project manager told us that
the project office had contacted the facilities that reported devices in their
inventories from these manufacturers and instructed them to make a
decision on their disposition. The project manager further stated that none
of these devices was used in critical care or life support functions, and that
the facilities with this equipment had been instructed to plan for
contingencies in the event any of them experience a Y2K-related failure.

In April 1999, VHA issued a policy establishing (1) a review process for
medical devices whose compliance status was unknown, noncompliant, or
conditionally compliant and (2) options for what action should be taken on
these devices. Options included replacing or retiring the equipment, or
using it as-is.23 Medical facilities were to complete these reviews by
June 1, 1999, for equipment whose Y2K compliance status was either
unknown or noncompliant, and September 1 for equipment whose status
was conditionally compliant. In each case, the medical facility director’s
approval of the disposition decision was required. For noncompliant



Page 14                                                                           GAO/T-AIMD-00-39
equipment, the medical center was required to assess the level of risk if it
continued to use the equipment, and determine what risk such use posed to
patient health and safety. To make this assessment, medical facilities were
to consider such questions as whether the device is used for critical care,
or if the device used date-sensitive data, such as sequencing patient data
results.

To track the compliance status of its biomedical equipment, VHA uses a
monthly status report on medical devices based on information provided
by the VISNs/medical facilities.

According to the August 1999 report, about 97 percent of the
568,000 medical devices in VHA medical facilities are compliant. The report
indicated that, of about 18,000 noncompliant devices, about 14,000 will be
repaired, and about 1,400 will be replaced. The report did not discuss the
renovation status of the remaining 2,200 noncompliant devices.

We were unable to accurately determine the status of medical facilities’
efforts to renovate noncompliant devices. As we discussed previously, the
individual monthly reports submitted by the VISNs/medical facilities were
inaccurate. Specifically, we determined that the June 1999 summary
showed that about 21 percent of medical devices had been renovated was
incorrect. However, according to several medical centers, their renovation
percentages were higher than the numbers reflected in the report. We
pointed this out to the Y2K project manager, who acknowledged that the
percentages were incorrect. He added that the Y2K project office is in the
process of following up with its medical centers to confirm their status on
renovation of biomedical equipment.




23
 Conditionally compliant equipment requires user intervention to function in all aspects
upon the Year 2000 change. These changes include manufacturer software or hardware
updates, or a one-time user action, such as turning the equipment on/off. Noncompliant
equipment means a medical device will not function properly in all aspects upon the Year
2000 change and no manufacturer remedy is available. Unknown equipment means VHA has
not been able to determine the compliance status of equipment because it has not received
compliance status information from the manufacturer.




Page 15                                                                GAO/T-AIMD-00-39
VHA Position on Not Testing   As we reported last September, VHA relies on manufacturers to validate,
Biomedical Equipment          test, and certify that equipment is Y2K compliant.24 We also reported that
                              there was no assurance that the manufacturers adequately addressed the
Unchanged
                              Y2K problem for noncompliant equipment because FDA did not require
                              medical device manufacturers to submit test results to it certifying
                              compliance. Accordingly, we recommended that VA and HHS take prudent
                              steps to jointly review manufacturers’ compliance test results for critical
                              care/life support biomedical equipment. We were especially concerned that
                              VA and FDA review test results for equipment previously determined to be
                              noncompliant but now deemed compliant by manufacturers, or equipment
                              for which concerns about compliance remain. We also recommended that
                              VA and HHS determine what legislative, regulatory, or other changes were
                              necessary to obtain assurances that manufacturers’ equipment was
                              compliant, including performing independent verification and validation of
                              the manufacturers’ certifications.

                              At that time, VA stated that it had no legislative or regulatory authority to
                              implement the recommendation to review test results from manufacturers.
                              VA and the Emergency Care Research Institute (ECRI)25 have stated that
                              manufacturers are best qualified to analyze embedded systems or software
                              to determine Y2K compliance. Accordingly, they do not encourage user
                              testing of biomedical equipment for Y2K compliance. ECRI guidelines,
                              however, suggest that health care facilities should consider testing
                              interfaces between medical devices in cases where the facility cannot
                              determine the Y2K compliance of the interface from the device
                              manufacturer. FDA also agrees with the ECRI position on testing
                              biomedical equipment and interface testing. Specifically, FDA has taken the
                              position that manufacturers’ submissions of Y2K compliance certifications
                              provide sufficient assurance of product compliance, and that such testing
                              on the part of users is not necessary.

                              According to VHA’s chief biomedical engineer, VHA guidance to the VISNs
                              and medical facilities is not to conduct stand-alone compliance testing of
                              biomedical equipment in their inventories. VHA’s Y2K project manager told
                              us that VHA relies on the manufacturers’ certifications; therefore, there is


                              24
                                   GAO/AIMD-98-240, September 18, 1998.
                              25
                               This institute is an international, nonprofit health services research agency. It believes that
                              superficial testing of biomedical equipment by users may provide false assurances, as well
                              as create legal liability exposure for health care institutions.




                              Page 16                                                                     GAO/T-AIMD-00-39
no need for such testing. However, he stated, in cases in which one medical
device interacts with other systems or devices, the medical facilities should
test these to ensure proper operation.

In contrast to VHA’s and FDA’s positions, some hospitals in the private
sector believe that testing biomedical equipment is necessary to prove that
they have exercised due diligence in the protection of patient health and
safety. As we have previously testified, officials at three hospitals told us
that their biomedical engineers established their own test programs for
biomedical equipment and, in many cases, contacted the manufacturers for
their test protocols.26 Several of these engineers informed us that their
testing identified some noncompliant equipment that the manufacturers
had earlier certified as compliant. According to these engineers, the
equipment found to be noncompliant all had display problems; none was
critical care/life support equipment. We were told that equipment found to
be incorrectly certified as compliant included a cardiac catheterization
unit, a pulse oxymeter, medical imaging equipment, and ultrasound
equipment.

Our review of manufacturers’ web sites disclosed that manufacturers’
opinions vary on whether users should test their biomedical equipment.27
We noted that at least 37 manufacturers provided information on their web
sites about Y2K testing. Of these, 30 encouraged testing, and 15 of these
30 provided end-users with information such as test protocols and
instructions. Fifteen of the 30 manufacturers also encouraged users to test
their devices in configuration with related equipment to ensure that the
device operated as intended. For example, the web site of a manufacturer
of audiometers stated that “if your equipment is used in a critical
application, we strongly advise you to test the equipment by simulating the
millennium date change yourself.” Seven of the 37 manufacturers did not
encourage testing; two of these stated that such testing could disrupt
operation of software.

Since some biomedical equipment manufacturers encourage end-user
testing for Y2K compliance of their products, VA should reconsider its
decision not to test equipment in those instances in which the


26
     GAO/T-AIMD-99-136, April 15, 1999.
27
   Year 2000 Computing Challenge: Compliance Status Information on Biomedical Equipment
(GAO/T-AIMD-00-26, October 21, 1999).




Page 17                                                              GAO/T-AIMD-00-39
                         manufacturer encourages users to test. Such action can provide greater
                         assurance of Y2K compliance for those items. From an overall perspective,
                         as we testified in April, the question of whether to independently verify and
                         validate biomedical equipment that manufacturers have certified as
                         compliant is one that must be addressed jointly by medical facilities’
                         clinical staff, biomedical engineers, and corporate management.28 The
                         overriding criterion should be ensuring patient health and safety.



VHA Pharmaceutical       Another critical component to VA’s ability to deliver health care at the turn
                         of the century is ensuring that the automated systems supporting VHA’s
Operations Have Made     medical facility pharmacies and its CMOPs are Y2K compliant. VHA
Progress in Addressing   reported that in 1998 it filled about 72 million prescriptions for 3.4 million
                         veterans, at an estimated cost of about $2 billion. About half of the
Y2K Problem              prescriptions were filled by the over 200 pharmacies located at VA’s
                         medical centers, clinics, and nursing homes. These pharmacies rely on the
                         pharmaceutical applications in their hospital information system for
                         (1) drug distribution and inventory management, (2) dispensing of drugs to
                         inpatients and outpatients, (3) patient medication information, and (4) an
                         electronic connection between the pharmacies and the CMOPs.

                         The remaining half of VHA’s prescriptions are filled by seven CMOPs,
                         geographically dispersed throughout the United States. These facilities are
                         supported by automated systems provided by one of two contractors—
                         SI/Baker, Inc. and Siemens ElectroCom.29 For example, the CMOP
                         electronically receives a prescription for a veteran through the medical
                         center. The prescription is downloaded to highly automated dispensing
                         equipment to be filled. The filled prescription is then validated by a
                         pharmacist who compares the medication against the prescription and a
                         computerized image of the prescribed medication. Afterward, the
                         prescription is packaged and an automatically generated mailing label is
                         applied for delivery to the veteran. Lastly, the medical center is
                         electronically notified that the prescription has been filled.




                         28
                              GAO/T-AIMD-99-136, April 15, 1999.
                         29
                          These include operating systems, databases, and pharmacy fulfillment application
                         software.




                         Page 18                                                               GAO/T-AIMD-00-39
As we testified this past April,30 VHA had determined that the automated
systems supporting its CMOPs were not Y2K compliant. Accordingly, the
CMOPs’ ability to fill prescriptions and process management reports could
be delayed or interrupted if a Y2K failure occurred. At that time, we also
expressed concern about the mid- to late-1999 scheduled implementation
of compliant systems.

Since our April testimony, VA’s contractors have installed and tested
compliant systems at all seven CMOPs. As shown in table 3, as of
September 30, 1999, all seven CMOPs have reported their automated
systems as compliant.



Table 3: Actual Completion Dates for Implementing Compliant Systems and Current
Daily Workload by Consolidated Mail Outpatient Pharmacies
                                  Actual completion       Current daily workload
Location                          date                      (prescriptions filled)
Bedford, Massachusettsa           August 10, 1999                          15,000
Dallas, Texasa                    August 10, 1999                          14,000
West Los Angeles,
Californiaa                       September 8, 1999                        15,000
                        a
Leavenworth, Kansas               September 30, 1999                       16,000
Murfreesboro, Tennesseeb          September 22, 1999                       38,000
                              b
Charleston, South Carolina        September 26, 1999                       23,000
Hines, Illinoisb                  September 26, 1999                       21,000


a
Siemens ElectroCom automation.
b
SI/Baker, Inc. automation.
Source: VA.


We also testified in April that it was crucial that the CMOPs develop
business continuity and contingency plans to ensure that veterans will
continue to receive their medications should the CMOPs experience a
Y2K-related failure. On September 3, 1999, the national CMOP director
approved the Consolidated Mail Outpatient Pharmacy Year 2000
Contingency Plan, which (1) defines the responsibilities of the national
director, the local CMOP director, the national Y2K coordinators, the local


30
     GAO/T-AIMD-99-136, April 15, 1999.




Page 19                                                        GAO/T-AIMD-00-39
                             Y2K coordinators, and the business resumption team, (2) establishes
                             procedures for preparing and implementing the contingency plan and
                             implementing it during the execution phase, and (3) provides a schedule of
                             critical events and a time line for actions to be taken during the execution
                             phase.

                             In addition, each of the seven CMOPs drafted contingency plans addressing
                             core business processes. These plans, along with the Y2K Mail Transfer
                             Contingency Test Procedures, which are the necessary steps relating to
                             loss of the wide area network, were forwarded to the medical centers
                             serviced by each CMOP during July and August of this year. Each medical
                             center was asked to certify that the CMOP contingency plan had been
                             reviewed and will be incorporated into the medical center’s Y2K
                             contingency plan. However, according to the national CMOP Y2K
                             coordinator, as of October 25, 1999, about half of the medical facilities had
                             not returned their certifications.

                             According to the CMOP Y2K plan, the CMOPs are expected to completely
                             test their plans by the end of October. Five CMOPs participated in a live
                             test last month. Specifically, anticipating a direct hit from Hurricane Floyd,
                             the Charleston CMOP reallocated the prescriptions for its 21 medical
                             centers to four other CMOPs—Bedford, Dallas, Hines, and West Los
                             Angeles. The Charleston CMOP lost 36 hours of production time, and
                             55,683 prescriptions had to be processed by the other CMOPs.


VA Continues Efforts to      Like other users of pharmaceutical and medical-surgical products, VA
Determine Y2K Readiness of   needs to know whether it will have a sufficient supply of these items for its
                             customers. Therefore, it has taken a leadership role in the federal
Pharmaceutical and
                             government in determining whether manufacturers supplying these
Medical-Surgical             products to VHA are Y2K-ready. This information is essential to VHA’s
Manufacturers                medical facilities and CMOPs because of their “just-in-time”31 inventory
                             policy. Accordingly, they must know whether their manufacturers’
                             processes, which are highly automated,32 are at risk, as well as whether the
                             rest of the supply chain will function properly.


                             31
                                  This term refers to maintaining a limited inventory on hand.
                             32
                              Many pharmaceutical manufacturers rely on automated systems for production,
                             packaging, and distribution of their products, as well as for ordering of raw materials and
                             supplies.




                             Page 20                                                                   GAO/T-AIMD-00-39
We testified in April that VA’s National Acquisition Center33 sent a survey on
January 8, 1999, to 384 pharmaceutical firms and 459 medical-surgical firms
with which it does business to determine their Y2K readiness.34 The survey
contained questions on the firms’ overall Y2K status and inquired about
actions taken to assess, inventory, and plan for any perceived impact that
the century turnover would have on their ability to operate at normal
levels. In addition, the firms were requested to provide status information
on progress made to become Y2K compliant, and a reliable estimated date
when compliance would be achieved for business processes such as
(1) ordering and receipt of raw materials, (2) mixing and processing
product, (3) completing final product processing, (4) packaging and
labeling product, and (5) distributing finished product to
distributors/wholesalers and end customers.

In March the acquisition center sent a second letter to its pharmaceutical
and medical-surgical firms, informing them of VA’s plans to make Y2K
readiness information previously provided to VA available to the public
through a web site (www.va.gov/oa&mm/nac/y2k ). VA made the survey
results available on its web site on April 13, 1999.35 The letter also requested
that manufacturers that had not previously responded provide information
on their readiness. The acquisition center’s executive director said that he
would personally contact any major VA supplier that did not respond.

According to an August 1, 1999, briefing report on their survey, the
acquisition center reclassified the 517 companies that responded to the
survey into three categories: “pharmaceutical firms,’’36 “pharmaceutical,
other firms,”37 and “medical-surgical firms.” As shown in table 4, as of
August 1, 1999, the latest available date from VA, about one-third of the


33
 This organization is responsible for supporting VHA’s health care delivery system by
providing an acquisition program for items such as medical, dental, and surgical supplies
and equipment; pharmaceuticals; and chemicals. The National Acquisition Center is part of
VA’s Office of Acquisition and Materiel Management.
34
     Five additional firms were identified from survey responses received after April 1999.
35
     This site identified the firms that were sent surveys and those that responded.
36
 Firms that manufacture and distribute both pharmaceuticals and medical/surgical
equipment are included in the pharmaceutical category.
37
 Pharmaceutical firms that also manufacture and distribute medical gases and reagents
(substances used in chemical reactions to detect, measure, examine, or produce other
substances).




Page 21                                                                      GAO/T-AIMD-00-39
pharmaceutical firms, a little over one-third of the “pharmaceutical, other”
and almost 44 percent of the medical-surgical firms had not responded to
the survey.



Table 4: Status of Companies Surveyed by VHA as of August 1, 1999
                                                                    Pharmaceutical, Medical-
Responses                                       Pharmaceutical               other surgical
Y2K compliant                                                  55                   28            146
                                           a
Will be compliant by 1/1/2000 or earlier                       92                   30             79
Provided no compliance date                                    39                   14             34
    Total number of responses                                 186                   72            259
Nonresponses                                                   90                   40            201
    Total number of firms surveyed                            276                  112            460


a
 Estimated compliance status date ranged from 3/31/99 through 1/1/2000; about 72 percent of all
respondents estimated they would be compliant by 7/31/99. One firm responded that it would be
compliant by 1/01/2000.
Source: VA. We did not independently verify these data.


To determine if all respondents who had initially provided an anticipated
compliance date of July 31, 1999, or earlier had met this date, a follow-up
survey was sent to 140 firms on July 20, 1999. As shown in table 5, as of
October 26, 1999, about two-thirds (64 percent) responded to the survey. A
little over half of the respondents (52 percent) completed the survey, while
the remaining respondents forwarded company letters, Year 2000 readiness
disclosure statements, and company financial statements with disclosures
on Y2K readiness. Table 5 also shows that about half of the respondents did
not meet the targeted date of July 31, 1999; almost 84 percent, however,
anticipate full compliance by September 30, 1999. The results of this
follow-up survey are not currently available on VA’s web site.




Page 22                                                                        GAO/T-AIMD-00-39
Table 5: Status of Companies With July 31, 1999, or Earlier Anticipated Compliance
Dates as of October 26, 1999
                                                          Number of firms    Percentage
Total number of surveys distributed                                  140             100
Number of responses                                                   90               64
Firms completing survey                                               47               52
     Were compliant by 7/31/99                                        25               53
     Anticipate compliance by 9/30/99                                 19               40
     Anticipate compliance by fourth quarter                           3                6
Firms forwarding company letters, etc.                                43               48
     Were compliant by 7/31/99                                        17               40
     Anticipate compliance by 9/30/99                                 14               32
     Anticipate compliance by fourth quarter                           3                7
     No date furnished                                                 9               21


Source: VA. We did not independently verify these data.


On a broader level, VHA has taken a leadership role in obtaining and
sharing information on the Y2K readiness of the pharmaceutical industry.
Specifically, VHA chairs the Year 2000 Pharmaceuticals Acquisitions and
Distributions Subcommittee, which reports to the Chair of the President’s
Council on Year 2000 Conversion. The purpose of this subcommittee is to
bring together federal and pharmaceutical representatives to address
issues concerning supply and distribution as it relates to the year 2000. The
subcommittee consists of representatives of FDA, federal health care
providers, and industry trade associations such as the Pharmaceutical
Research and Manufacturers of America, the National Association of Chain
Drug Stores, and the National Wholesale Druggists’ Association. Several of
these trade associations have surveyed their members on their Y2K
readiness and have made the results available to the public. Further, the
Pharmaceutical Alliance for Y2K Readiness38 announced on
September 22, 1999, that consumers will have access to a substantial
supply of medications during the Y2K date change and there should be no
need for consumers to overbuy medications in preparation for Y2K.


38
 A coalition of drug manufacturers, wholesale distributors, pharmacies, and health care
organizations that are working closely with government agencies to ensure a continued and
substantial supply of pharmaceuticals through January 1, 2000.




Page 23                                                                GAO/T-AIMD-00-39
                               The executive director of the National Acquisition Center told us that,
                               based on his interactions with the trade associations, as well as results
                               received from manufacturers, he is confident that there will be no shortage
                               of medication and medical-surgical supplies. He explained that the major
                               companies with unique drugs that VA relies on have responded that they
                               will be ready and have provided the necessary resources and management
                               attention. Further, he said, all 10 of VA’s largest pharmaceutical and
                               medical-surgical suppliers have responded to the survey and have taken
                               actions to address the Y2K problem at their firms. Accordingly, the
                               executive director does not plan to take any further action, including
                               following up with those manufacturers that did not meet their anticipated
                               compliance date of July 31, 1999, or September 30, 1999.

                               We believe that VHA needs to continue to follow up with pharmaceutical
                               and medical-surgical firms that anticipated having compliant systems by
                               July 31, 1999, and September 30, 1999, to determine whether these firms
                               have addressed the Y2K problem. This information should also be made
                               available on VHA’s web site.



FDA’s Y2K Activities on        Another key player in determining the Year 2000 compliance of biomedical
                               equipment and pharmaceutical, biological, and consumable medical
Biomedical Equipment           products is FDA, which has oversight and regulatory authority in these
and Pharmaceutical,            areas. FDA’s role is to ensure that these products are safe and effective for
                               public use. In an effort to provide users with Y2K compliance information
Biological, and                on their equipment, FDA has established the Federal Y2K Biomedical
Consumable Medical             Equipment Clearinghouse. In addition, it has surveyed manufacturers of
Products Industries            pharmaceutical, biological, and consumable medical products, to provide
                               users with information on their Y2K readiness.
Are Focused on
Readiness

Biomedical Equipment           We reported in September 1998 that FDA was working to determine the
Status Information Available   compliance status of biomedical equipment; provide a comprehensive,
                               centralized source of information on the Y2K compliance status of
Through FDA
                               biomedical equipment used in the United States; and make this information
Clearinghouse                  publicly available on a web site.39 However, we also reported that FDA’s


                               39
                                    GAO/AIMD-98-240, September 18, 1998.




                               Page 24                                                      GAO/T-AIMD-00-39
database did not include product compliance information from many
manufacturers that had already provided such information to VHA, and
also that VHA was not making this information available to the public. We
therefore recommended that HHS and VHA jointly develop a single data
clearinghouse containing information on the Y2K compliance status of
biomedical equipment, and make this information publicly available. In
response to our recommendation, FDA—in conjunction with VHA—
established the Federal Y2K Biomedical Equipment Clearinghouse. In
obtaining compliance status information from manufacturers, VHA, the
Department of Defense, and the Health Industry Manufacturers
Association all assisted FDA.

We testified last week that, according to FDA, 4,288 biomedical equipment
manufacturers had submitted data to the clearinghouse as of
October 4, 1999.40 Based on the data submitted, FDA places a manufacturer
into one of four categories:

• Products that do not employ a date—manufacturer that reported Y2K
  status to be “All Products Do Not Use a Date.”
• Products that are all compliant—manufacturer that reported products
  as Y2K compliant.
• Products with date-related problems—manufacturer that reported its
  Y2K status to be “Products With Date Related Problem.”
• Product status is on the manufacturer’s web page—manufacturer that
  reported its Y2K status to be “Product Status Specified on a (Web)
  Page.”

As shown in figure 1, as of October 4, 1999, 61 percent of the manufacturers
reported having products that do not employ a date, while 8 percent
(342 manufacturers) reported having date-related problems such as
incorrect display of date/time. According to FDA, the 342 manufacturers
reported 1,035 specific products with date-related problems.




40
     GAO/T-AIMD-00-26, October 21, 1999.




Page 25                                                     GAO/T-AIMD-00-39
Figure 1: Biomedical Equipment Compliance-Status Information Reported to FDA by
Manufacturers as of October 4, 1999




Note: Total number of manufacturers = 4,288.
Source: FDA.


Also, according to FDA, as of October 4, 1999, 132 manufacturers had not
responded to the agency’s request for product compliance information. A
senior FDA official told us that most of these manufacturers have gone out
of business, do not make computerized products, or just cannot be located.
The official added that FDA continues to follow up with these
manufacturers nevertheless, through letters and telephone contact. The
clearinghouse lists the names of these manufacturers that have not
responded to FDA’s requests for product compliance information.




Page 26                                                        GAO/T-AIMD-00-39
In our September 1998 report, we also noted that information on the FDA
web site was not detailed enough to be useful.41 Specifically, the list of
compliant equipment contained no information on the equipment’s make
and model. We therefore recommended that VA and HHS include in the
clearinghouse information on the compliance status of all biomedical
equipment by make and model. FDA agreed with this recommendation, and
subsequently requested this information from manufacturers; users can
now find specific information on the make and model of compliant medical
devices on the FDA web site.

As an alternative to obtaining biomedical equipment product compliance
information from manufacturers and posting it to the Federal Y2K
Biomedical Equipment Clearinghouse, FDA accepts equipment
manufacturers’ references to their own web sites for compliance
information. The clearinghouse provides users with a link directly to these
web sites. As of October 4, 429 manufacturers had chosen this option.

While FDA is aware of the number of products and their reported
compliance status for those manufacturers providing this information to
the Federal Y2K Biomedical Equipment Clearinghouse, in testimony this
past May FDA officials stated that they did not know the total number of
biomedical equipment products reported by manufacturers on their web
sites, or how many of them were noncompliant. We subsequently reviewed
information available through these web sites and reported in June that the
quality of information available through them varied significantly.42
Specifically, we found that while most sites contained compliance
information on at least one product, some sites contained insufficient
information or did not clearly distinguish biomedical equipment from
nonbiomedical products.

We subsequently updated our analysis of the web sites as of
October 1, 1999, and found the following for the 429 manufacturers in
FDA’s clearinghouse that refer users to their web sites:




41
     GAO/AIMD-98-240, September 18, 1998.
42
 Year 2000 Computing Challenge: Concerns About Compliance Information on Biomedical
Equipment (GAO/T-AIMD-99-209, June 10, 1999).




Page 27                                                           GAO/T-AIMD-00-39
• 354 manufacturers reported compliance status information for at least
  33,598 individual biomedical equipment products;43
• 71 manufacturers’ web sites either contained insufficient information on
  the number of products and their compliance status, or did not clearly
  distinguish biomedical equipment from nonbiomedical products;
• 3 web sites were those of vendors or distributors, not manufacturers;
  and
• 1 manufacturer’s web site link in FDA’s clearinghouse did not work.44

Because of the limitations cited above for many of the manufacturers’ web
sites, our ability to determine the total number of biomedical equipment
products reported and their compliance status was limited. Accordingly,
the actual number of products reported by these manufacturers could be
higher than the 32,598 that we counted.

As shown in figure 2, of the 32,598 products we identified on
manufacturers’ web sites, about 54 percent reportedly do not employ a
date, about 29 percent of the products are considered compliant, and about
12 percent are reportedly noncompliant. The compliance status of the
remaining 5 percent of products was unknown for reasons such as the
manufacturer’s ongoing assessment of the product.




43
 This includes medical devices and scientific and research instruments, and other
supporting products, such as printers and software.
44
  According to FDA, the contractor assisting it with the clearinghouse verified that this web
site link was operable.




Page 28                                                                   GAO/T-AIMD-00-39
Figure 2: Biomedical Equipment Compliance-Status Information Reported on
Manufacturers’ Web Sites as of October 1, 1999




Note: Total number of products = 32,598.
Source: GAO analysis of manufacturers’ web sites.


The 4,053 noncompliant products that we identified were from the web
sites of 214 manufacturers. This number of products is about four times the
number reported directly by FDA in its clearinghouse (1,035). Examples of
these noncompliant products included a bedside monitor, film digitizer,
ultrasound systems, radiology information systems, and laboratory
information systems. Included among noncompliant potentially high-risk
devices reported were ventricular assist devices and hemodialysis
equipment.45



45
 A ventricular assist device is a small electromechanical pump that helps maintain blood
circulation in patients suffering from end-stage heart disease. Hemodialysis equipment
cycles blood from a patient’s body to filter out body waste before returning the blood to the
patient.




Page 29                                                                   GAO/T-AIMD-00-39
                       In addition to supplying information on noncompliant products, most of
                       the manufacturers with noncompliant products also provided solutions to
                       correct the problem. Most (190) of the 214 manufacturers identified with
                       noncompliant products provided at least one solution to correcting the
                       problem. The solutions generally involved upgrades to hardware or
                       software, manual action (such as turning the equipment on and off on
                       January 1, 2000), or workarounds.46


FDA Is Now Reviewing   While compliance information is available through FDA’s Federal Y2K
Manufacturers’ Y2K     Biomedical Equipment Clearinghouse, we have raised concerns in the past
                       year about the lack of independent verification and validation of
Activities
                       biomedical equipment that manufacturers have certified as compliant. In
                       addition to making sure that manufacturers provide detailed information
                       on their products, we believe that it is essential that FDA provide some
                       level of confidence that critical care and life support medical devices will
                       work as intended.

                       In response to our recommendation to conduct independent verification
                       and validation of biomedical equipment that manufacturers have certified
                       as compliant, FDA is taking action to review a sample of biomedical
                       equipment manufacturers’ Y2K activities, such as risk management, test
                       planning and procedures, and implementation and contingency planning.
                       Specifically, FDA’s acting deputy commissioner for policy testified in May
                       1999 that FDA proposed reviewing manufacturers’ test results supporting
                       their compliance certifications for a sample of critical devices. FDA’s
                       proposal consisted of two phases. In the first phase FDA would

                       • develop a list of the manufacturers of computer-controlled, potentially
                         high-risk devices (PHRD);47
                       • from this list of manufacturers, select a sample of 80 manufacturers for
                         review; and
                       • hire a contractor to develop a program to assess manufacturers’
                         activities to identify and correct Y2K problems with PHRDs.



                       46
                         An example of a workaround is noting on the printout of an EKG machine the year “2000”
                       instead of “1900.”
                       47
                         These medical devices are characterized by their potential for immediate and serious
                       adverse health consequences for a patient if they fail to function as designed or expected,
                       including a failure to initiate or continue operations.




                       Page 30                                                                   GAO/T-AIMD-00-39
The goal of the first phase of the survey is to extrapolate from the
80 assessments a level of overall confidence in the biomedical equipment
industry’s Y2K compliance activities. According to FDA, the second phase
of the evaluation would be undertaken only if the results of the first phase
indicated a need for further review of manufacturer Y2K activities because
of concerns over how manufacturers are addressing product compliance.

In carrying out its plan to assess manufacturers’ Y2K activities, FDA
identified 90 types of PHRD products, and issued a task order on
July 1, 1999, for a contractor, assisted by two subcontractors, to perform
assessments of the Y2K compliance activities for a sample of PHRD
manufacturers. FDA identified 803 PHRD manufacturing sites that produce
equipment sold in the United States.48 These were composed of
726 biomedical equipment manufacturing sites and 77 manufacturing sites
of blood and blood products equipment.

FDA’s contractor then randomly selected 325 of the 803 sites for possible
assessment. These manufacturing sites were then contacted and asked if
they would volunteer to participate in the process. As of October 4, 1999, of
the 325 randomly selected sites,

•    197 were identified as producing no computer-controlled equipment,
•    80 agreed to participate,
•    26 declined to participate,49
•    18 were duplicates,50 and
•    4 did not respond.

To carry out the on-site assessments of manufacturing sites, the contractor
developed a guide for its examiners. This guide focused on the firm’s Y2K
activities in six areas: (1) executive leadership and control, (2) risk
management, (3) corrective and preventive actions, (4) test planning and



48
 The 803 consisted of those manufacturers that had registered PHRD products with FDA
that were among the 90 types of PHRDs identified.
49
 Reasons given by manufacturers for declining to participate included scheduling or
resource limitations, and recent regular FDA site inspections. Five manufacturing sites
declined without giving a reason.
50
 These sites involved large, multisite manufacturers where the FDA contractor had already
selected two or more of the manufacturer’s sites. According to FDA, the contractor did not
assess duplicates if they came up in later samples.




Page 31                                                                  GAO/T-AIMD-00-39
procedures, (5) communication with the consignee (user of the products),
and (6) implementation and contingency planning.

After completing these assessments, examiners were required to prepare a
report of concerns in each of the six areas reviewed at each manufacturing
site. Concerns were identified as high, medium, or low, as defined below:

• high—relates to actions that are not timely, inadequate planning,
  inadequate or incomplete resources, incomplete or inaccurate
  deliverables, unable to validate results, and/or inadequate due diligence;
• medium—relates to actions that are somewhat late, incomplete
  planning, insufficient or incomplete resources, deficiencies in
  deliverables, and/or incomplete validation of results; and
• low—relates to actions that are on schedule and have adequate
  resources.

According to FDA’s PHRD survey project manager, as of October 15, 1999,
examiners had completed all 80 manufacturer site assessment visits, and
had prepared 62 assessment reports.

We reviewed the 25 manufacturer site visit reports that were completed by
the examiners and available to us as of September 10, 1999. For 20 of these
assessments, concern was low. At the five remaining sites, the examiner
assessed at least one concern as moderate in one of the six areas, such as
test planning and procedures. According to the FDA PHRD survey project
manager, the areas identified in the site visit reports as medium risks do not
constitute a risk to patient health or safety.

Until recently, none of the site visit reports submitted to FDA contained a
concern assessed as high. However, last week, the PHRD survey project
manager informed us that FDA had received a site visit report with
concerns accessed as high in two areas—leadership and control, and test
planning and procedures. The report stated that the manufacturer’s polices
and procedures were found to be inconsistent, ambiguous, and were not
followed in a manner that would meet due diligence requirements. It also
noted that the qualifications of the manufacturer’s personnel for specified
tasks were not well defined, and that some personnel assigned to tasks
identified in the policies and procedures were not qualified to perform
those tasks. The report concluded that the manufacturer’s procedures for
Y2K assessment and corrective and preventive action were less than
adequate, and that assessment procedures had not been applied




Page 32                                                       GAO/T-AIMD-00-39
consistently. The manufacturer subsequently told the examiner that action
would be taken on the issues raised.

Late last week, FDA’s Senior Associate Commissioner for Policy, Planning,
and Legislation testified that FDA sent an inspector to follow up with this
manufacturer. The FDA official said the inspector determined that the
deficiencies noted would not affect patient safety. He also stated that FDA
would continue to monitor the situation at this site.

Regarding the overall planned phase one report, the project manager told
us that FDA’s contractor is in the process of preparing a final report
summarizing the findings from the 80 site visit assessment reports,
detailing any problems encountered during the project and recommending
whether the second phase should be performed. Although FDA initially
expected to submit a final report to HHS by October 1, it has not yet
established a revised deadline. Accordingly, it does not know when this
information will be made available to the public. We believe that this
information should be made available as soon as possible.

To assess how the contractor was executing FDA’s task order, we observed
selected site visit assessments. At the five manufacturing site assessments
we observed, the examiners generally followed the contractor-developed
audit guide, and were knowledgeable about information technology
management, Y2K testing, and risk assessment. During our two initial
visits, we noted that the examiners sometimes could not answer questions
from the manufacturers relating to the FDA clearinghouse and the
processing of the final report on the site assessments. We subsequently
shared these observations with FDA official, who agreed to consider our
suggestions, such as better communicating to the firms the final reporting
process and how the FDA Federal Y2K Biomedical Clearinghouse works.
During the later three visits, we did not observe any similar areas of
concern.




Page 33                                                     GAO/T-AIMD-00-39
FDA’s Activities to           FDA’s oversight and regulatory responsibility for pharmaceutical,
Determine Y2K Readiness of    biological, and consumable medical products51 is to ensure that they are
                              safe and effective for public use. Since our April testimony,52 FDA has taken
Manufacturers of
                              action to determine the Y2K readiness of these industries. Specifically, FDA
Pharmaceutical, Biological,   is conducting voluntary surveys of manufacturers of pharmaceutical,
and Consumable Medical        biological, and consumable medical products for Y2K readiness. These
Products                      surveys assess manufacturers’ plans and preparations to continue
                              operations after January 1, 2000.

                              According to FDA’s Senior Associate Commissioner for Policy, Planning,
                              and Legislation, information obtained from these surveys thus far indicates
                              that there will likely be no significant disruption of necessary supplies of
                              pharmaceuticals, biologicals, or consumable medical products as a result
                              of Y2K. FDA believes that essential medical supplies will be available, and
                              that the drug supply will be safe and adequate.

                              To obtain information on the Y2K readiness of the pharmaceutical industry,
                              on April 21, 1999, the FDA Commissioner sent a letter to the presidents and
                              CEOs of approximately 4,228 pharmaceutical manufacturers that produce
                              prescription drugs, over-the-counter medication, bulk drugs, and also to
                              drug distributors and repackagers, and medical gas manufacturers. In the
                              letter, the Commissioner requested the assistance of these firms in assuring
                              the American public that the firms had addressed the Y2K problem as it
                              affects the adequacy, safety, and effectiveness of the supply of
                              pharmaceuticals in the United States.

                              According to FDA’s Senior Associate Commissioner for Policy, Planning,
                              and Legislation, as of October 8, 1999, 3,132 (74 percent) of the firms had
                              responded to the survey. Of these, 95 percent stated that they would be Y2K
                              ready by October 31, 1999. According to the senior associate commissioner,
                              FDA is committed to maximizing the response, especially from the 274
                              priority manufacturers who produce sole source, orphan drugs,53 or the top
                              200 prescribed medications.


                              51
                                   Biological products include vaccines, blood, and blood products.
                              52
                                   GAO/T-AIMD-99-136, April 15, 1999.
                              53
                               Orphan drugs are those produced under provisions of the Orphan Drug Act (P.L. 97-414, §
                              983, as amended). The act provides incentives for manufacturers to produce drugs that are
                              used by a small number of patients to treat a specific, but not widespread, medical
                              condition.




                              Page 34                                                                 GAO/T-AIMD-00-39
This FDA official testified on October 21, 1999, that, in addition to
conducting the survey of pharmaceutical manufacturers, distributors, etc.,
FDA is taking the additional step of obtaining independent assurance of
these firms’ Y2K assessments and corrections. The agency has obtained a
contractor that is auditing each of 160 highest priority pharmaceutical
firms, as well as a random sample of other firms. As of October 8, 1999,
88 percent of these assessments have been completed. The report stated
that the results of their audits to date are positive and confirmed FDA’s
expectation that the pharmaceutical industry has taken the necessary steps
to prepare for the year 2000. The interim report54 is available on FDA’s web
site.55

FDA is also assessing the Y2K readiness of the biologics industry. In June,
the Center for Biologics Evaluation and Research mailed a survey on Y2K
readiness to 1,576 licensed biologics manufacturers and registered blood
establishments. FDA also sent letters to biologics trade organizations
requesting their assistance in encouraging their members to participate in
the survey.

According to FDA’s senior associate commissioner, as of October 15, 1999,
it had received responses from 1,483 (94 percent) of the licensed
manufacturers and blood establishments. In addition, as with the
pharmaceutical industry, FDA is conducting follow-up audits of
110 high-priority firms to assess their Y2K readiness. To date, FDA reports
finding no problems with the audited firms. In addition, FDA is conducting
random audits of other firms, and has completed audits of 48 of these with
no problems identified as of October 14, 1999. FDA told us on
October 27 that it plans to publicize the survey and audit results of the
biologics manufacturers, although it has not established a date when this
information will be available. We believe that this information should be
made available as soon as possible.

FDA also mailed Y2K readiness surveys to 3,070 manufacturers of
consumable medical supplies in June.56 This survey focused on


54
 Center for Drug Evaluation and Research’s Interim Report: Assessment of the
Pharmaceutical Industry’s Readiness for Year 2000, FDA, October 18, 1999.
55
     The site is located at http://www.fda.gov/cder/y2k.
56
  Consumable medical supplies include such items as intravenous tubing, kidney dialysis
filter units, and blood and blood product bags.




Page 35                                                                GAO/T-AIMD-00-39
manufacturers that produce critical devices that are used and consumed on
a recurring basis during the delivery of essential health care services, as
well as those whose availability is critical to the uninterrupted delivery of
health care and patient welfare. As of October 14, 1999, FDA had received
2,074 responses (68 percent) to its survey. According to FDA’s senior
associate commissioner, approximately 90 percent of these respondents
report that they will be ready for Y2K by October 31, 1999.

FDA is also conducting audits of firms that supply medical consumables. It
has given highest priority to 225 firms that produce devices that are only
manufactured by a handful of those firms, as well as 57 manufacturers that
are sole-source suppliers. According to FDA’s senior associate
commissioner, to date, 197 of the high-priority firms have responded, and
48 of the 57 sole-source firms have responded. On October 27, 1999, FDA
told us that it plans to make the detailed survey and audit results for
consumable medical products manufacturers available to the public, but it
has not yet determined the date when this will be done. We believe that it is
critical to make this information available.


In summary, VA has made much progress in addressing the Y2K computer
problem. However, some critical tasks remain in the areas of testing
business continuity and contingency plans and reporting Y2K compliance
status of key components such as facility systems at VHA medical facilities.
VHA should also reassess its decision not to test biomedical equipment in
those instances in which the manufacturer encourages such testing.
Additionally, VA needs to continue to follow up with pharmaceutical and
medical-surgical firms that anticipated having compliant systems by
July 31, 1999, and September 30, 1999, respectively, and make this
information available to the public through its web site.

Compliance status information on biomedical equipment can now be found
in FDA’s clearinghouse or on manufacturers’ web sites. Also, to its credit,
FDA has assessed the Y2K compliance activities of some PHRD
manufacturing sites. This information should provide the American public
with a higher level of confidence that medical devices will work as
intended. FDA now needs to finalize its overall report on the results of its
review of the PHRD manufacturing sites, and make this information
available to HHS and the public through its web site.

We performed this assignment in accordance with generally accepted
government auditing standards, from May through October 1999. In



Page 36                                                      GAO/T-AIMD-00-39
                   carrying out this assignment, we reviewed and analyzed VA’s Y2K
                   documents and plans, comparing them against our guidance on Y2K
                   activities. More specifically, we observed VBA’s “dry run” testing of its
                   benefits payment systems, VHA’s forward-date tests of its hospital
                   information systems, and tests of CMOP Y2K fixes. We reviewed the test
                   plans, selected test scripts, and test results for each Y2K test. We also
                   reviewed business continuity and contingency plans for a sample of for
                   VHA medical centers and VBA regional offices, as well as VBA data centers.
                   In addition, we reviewed and analyzed FDA documentation relating to its
                   Y2K efforts on biomedical devices and pharmaceutical manufacturers.
                   More specifically, we identified the amount and quality of information on
                   product compliance information available on biomedical equipment
                   manufacturers’ web sites, reviewed information from those sites to identify
                   the total number of biomedical equipment products reported, and
                   categorized their compliance status.57 We also reviewed manufacturers’
                   web sites to assess the clarity and completeness of the information
                   reported.

                   In addition, we visited selected VHA medical centers, VBA regional offices,
                   VA data centers, and VHA CMOPs to discuss their Y2K activities, and
                   interviewed VA and FDA officials about those activities. Finally, we
                   interviewed selected private hospital officials about their Y2K actions and
                   pharmaceutical trade associations on their Y2K readiness surveys of
                   pharmaceutical manufacturers.

                   Mr. Chairman, this concludes my statement. I would be pleased to respond
                   to any questions that you or other members of the Subcommittee may have
                   at this time.



Contact and        For information about this testimony, please contact Joel Willemssen at
                   (202) 512-6253 or by e-mail at willemssenj.aimd@gao.gov. Individuals
Acknowledgments    making key contributions to this testimony included Dr. Nabajyoti
                   Barkakati, Michael Fruitman, Tonia Johnson, Helen Lew, Barbara Oliver,
                   Mike Resser, and Henry Sutanto.


                   57
                    We summarized the results of our review in four compliance categories—products that do
                   not employ a date, products that are compliant, products that are noncompliant, and
                   products whose compliance status is currently unknown. This last category includes those
                   manufacturers who reported that they have not completed an assessment of their products,
                   have discontinued a product, or have a product that is now obsolete.




(511757)   Leter   Page 37                                                               GAO/T-AIMD-00-39
Ordering Information

The first copy of each GAO report and testimony is free.
Additional copies are $2 each. Orders should be sent to the
following address, accompanied by a check or money order made
out to the Superintendent of Documents, when necessary, VISA and
MasterCard credit cards are accepted, also.

Orders for 100 or more copies to be mailed to a single address are
discounted 25 percent.

Orders by mail:

U.S. General Accounting Office
P.O. Box 37050
Washington, DC 20013

or visit:

Room 1100
700 4th St. NW (corner of 4th and G Sts. NW)
U.S. General Accounting Office
Washington, DC

Orders may also be placed by calling (202) 512-6000
or by using fax number (202) 512-6061, or TDD (202) 512-2537.

Each day, GAO issues a list of newly available reports and
testimony. To receive facsimile copies of the daily list or any list
from the past 30 days, please call (202) 512-6000 using a touchtone
phone. A recorded menu will provide information on how to obtain
these lists.

For information on how to access GAO reports on the INTERNET,
send an e-mail message with “info” in the body to:

info@www.gao.gov

or visit GAO’s World Wide Web Home Page at:

http://www.gao.gov
United States                       Bulk Mail
General Accounting Office      Postage & Fees Paid
Washington, D.C. 20548-0001           GAO
                                 Permit No. GI00
Official Business
Penalty for Private Use $300

Address Correction Requested