VA Information Systems: Computer Security Weaknesses Persist at the Veterans Health Administration
AIMD-00-232
Published: Sep 08, 2000. Publicly Released: Sep 08, 2000.
Skip to Highlights
Highlights
Pursuant to a legislative requirement, GAO reviewed information system general controls over financial and sensitive veteran medical information maintained by the Veterans Health Administration (VHA), focusing on: (1) specific computer security weaknesses GAO identified at the New Mexico and North Texas health care systems in conjunction with the audit of the Department of Veterans Affairs (VA) fiscal year (FY) 1997 financial statements; and (2) departmentwide computer security initiatives that GAO reported in October 1999.
Recommendations
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Department of Veterans Affairs | The Acting Secretary of Veterans Affairs should direct the acting VA Chief Information Officer (CIO) to work with the VHA CIO and medical facility directors as appropriate to ensure that the remaining computer security weaknesses at each health care system GAO visited, which are summarized, are corrected in accordance with the action plans developed by each of the medical facilities and detailed in GAO's separate reports to the facility directors. |
Closed – Implemented
In November 2003, VHA's security office provided GAO with a list of actions taken to correct the computer security weaknesses GAO identified in connection with its review of information system controls at VA's medical facilities in Albuquerque, New Mexico, Baltimore, Maryland, and Dallas, Texas. Based on GAO's review of the actions reported, independent work performed by the VA's Inspector General, and GAO's own review, GAO determined that VA had taken sufficient action to remediate the computer security weaknesses reported.
|
| Department of Veterans Affairs | The Acting Secretary of Veterans Affairs should direct the acting VA CIO to work with the VHA CIO and medical facility directors as appropriate to provide security oversight resources as prescribed in VHA policy to effectively implement and oversee VA's computer security management program through assessing risk, implementing policies and controls, promoting awareness, and evaluating the effectiveness of information system controls at VHA facilities. |
Closed – Implemented
In March 2001, the VA's Office of Information and Technology reported that all VHA facilities had designated information security officers to work on security activities full-time or at least as a primary duty, as prescribed in VHA policy. These information security officers are to work on information security issues to include assessing risk, implementing policies and controls, promoting security awareness, and evaluating the effectiveness of information system controls.
|
| Department of Veterans Affairs | To facilitate the development of detailed departmentwide guidance and oversight processes relating to key aspects of computer security programs, such as assessing risk, monitoring system and user access activity, and evaluating the effectiveness of information system controls, the Acting Secretary of Veterans Affairs should direct the acting VA CIO to implement a cooperative process across all VA component offices that would identify and, where appropriate, integrate security guidance developed by VA components. |
Closed – Implemented
In February 2002, the VA's Office of Cyber Security established a process to identify and, where appropriate, integrate security guidance already developed by VA components to facilitate department-wide efforts to update its security requirements. This process was implemented in January 2002.
|
| Department of Veterans Affairs | The Acting Secretary of Veterans Affairs should direct the acting VA CIO to monitor and report to issues, such as an administration's lack of commitment of resources to the departmentwide program, that could affect the development and implementation of VA's departmentwide computer security program. |
Closed – Implemented
In October 2000, the VA's Office of Information and Technology reported that it had established a process for briefing the VA Secretary and senior Information Technology executives quarterly on the status of information security issues department-wide. This would include highlighting the lack of resource commitment by any VA component. In April 2001, this reporting requirement was reemphasized by the VA Secretary with the appointment of the VA security czar.
|
Full Report
GAO Contacts
Office of Public Affairs
Topics
Computer resourcesComputer securityComputer security policiesConfidential communicationsControlled accessData integrityFinancial statement auditsInformation resources managementInternal controlsMedical information systemsVeterans benefitsVeterans hospitalsComputer resources management