Veterans Health Administration: Action Needed to Address Persistent Control Weaknesses and Related Risks in Employee Screening Processes
GAO-23-104296
Published: Feb 23, 2023. Publicly Released: Feb 23, 2023.
Fast Facts
The Veterans Health Administration provides health care to over 9 million veterans. It is responsible for ensuring that its providers are qualified, competent, and suitable to provide care.
The Drug Enforcement Administration requires VHA medical centers to get a waiver before employing anyone with a controlled substance-related felony conviction whose job gives them access to such substances. But VHA doesn't have a waiver policy and didn't consistently request them, so VHA's screening process may overlook individuals who may pose risks to veterans.
We recommended VHA implement a policy regarding these employment waivers to protect veterans.
Highlights
What GAO Found
The Veterans Health Administration (VHA) received adverse information regarding some employees but lacked control procedures to ensure it responded as required. For example, VHA received information about some employees' controlled substance-related felony convictions and actions taken against certain employees by the Drug Enforcement Administration (DEA). VHA was required to obtain waivers from DEA for any of these employees whose job involved access to controlled substances.
aDEA registrations are required for certain health care practitioners licensed to dispense, administer, or prescribe controlled substances.
GAO identified 12,569 VHA employees with indications of controlled substance-related criminal history. Of these, GAO obtained further information about a generalizable sample of 305 employees and found 50 of them had one or more controlled substance-related felony convictions. However, VHA has no policy regarding DEA employment waivers, including guidance for determining whether an employee has access to controlled substances. VHA confirmed that it did not request waivers for 48 of the 50 employees GAO identified and did not confirm whether it requested waivers for the remaining two. VHA officials said they are developing an employment waiver policy. They did not provide a timeline for when the policy is to be approved and implemented. Without such a policy, including guidance for determining whether an employee has access to controlled substances, VHA cannot assess whether its employees, such as those identified by GAO, need waivers. Without a waiver policy, VHA risks a continued lack of assurance that its facilities are complying with DEA regulations that help control against theft and diversion of controlled substances.
GAO also identified vulnerabilities in VHA's process for completing employee background investigations. For example, GAO found that 13 of the 305 employees in the generalizable sample did not have background investigations as required by regulation and policy. Without adequate control procedures to ensure employee background investigations are completed as required, VHA lacks assurance that its personnel are properly vetted and suitable to provide care to veterans.
Why GAO Did This Study
The Department of Veterans Affairs (VA) operates one of the largest health care systems in the nation, with over 9 million veterans enrolled in the VHA health care program. VHA is responsible for ensuring that its more than 400,000 health care providers and support staff are qualified, competent, and suitable to provide safe care.
GAO was asked to review VHA's employment and suitability procedures. This report examines the extent to which (1) VHA responded to adverse information regarding employees' criminal history or DEA registrations and (2) vulnerabilities exist in VHA's processes for completing and documenting background investigations.
GAO analyzed a generalizable sample of 305 VHA employees employed as of January and June 2020 with indications of controlled substance-related criminal history. GAO examined court records and other documentation, reviewed regulations and policies, and interviewed officials from VHA, DEA, and other agencies.
Recommendations
GAO is making 14 recommendations to VA, including that VHA establish a timeline for finalizing and implementing a policy regarding DEA employment waivers. Such a policy should include guidance for determining whether employees have access to controlled substances. GAO also recommends that VHA establish control procedures to ensure background investigations are completed and documented. VA agreed with GAO's recommendations.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Department of Veterans Affairs | The Under Secretary for Health should establish a timeline for finalizing and implementing a policy regarding DEA employment waivers. (Recommendation 1) |
In February 2023, VA informed GAO they were developing a DEA waiver policy and provided various estimated completion dates during development of the policy. In October 2024, VHA provided supporting documentation on the completion and issuance of their DEA employment waiver policy. VHA published VHA Directive 5005.03, DEA Registration and Employment Waivers in September 2024. This directive was issued with VHA-wide communication between September 24 and October 8, 2024, to include frequently asked questions, a covered positions identification tool, guidance on the preparation of waiver requests, a template memorandum to communicate covered position determinations, and a template memorandum to request a DEA employment waiver. By establishing this policy, VHA has taken important steps to ensure VHA facilities comply with DEA regulations that help control against theft and diversion of controlled substances.
|
| Department of Veterans Affairs | As the Veterans Health Administration develops a DEA employment waiver policy, the Under Secretary for Health should ensure that the policy includes guidance for determining whether employees have access to controlled substances. (Recommendation 2) |
VHA Directive 5005.03 assigns responsibilities for determining which positions have access to controlled substances to each Pharmacy Director, Consolidated Mailout Outpatient Pharmacy (CMOP), and VA Medical Facility Director. The directive also provides policy guidance on determining which positions have access to controlled substances. Additionally, VHA provided a tool to identify covered positions that have access to controlled substances, and a template memorandum to communicate covered position determinations. By including guidance and tools to identify positions with access to controlled substances, VHA took steps to help ensure it can evaluate which employees have access to controlled substances and may need DEA employment waivers.
|
| Department of Veterans Affairs | As the Veterans Health Administration develops a DEA employment waiver policy, the Under Secretary for Health should ensure that the policy specifies that an employment waiver is required to employ any individual in a position with access to controlled substances who, at any time, has been convicted of a felony offense related to controlled substances, had an application for a DEA registration denied, or had a DEA registration revoked or surrendered for cause, and does not presently hold an active DEA registration. (Recommendation 3) |
In VHA Directive 5005.03, VHA included policy specific to DEA employment waivers and when an employment waiver may be required. Specifically, the policy states that any position that requires access to controlled substances is restricted to individuals who have had no felony convictions related to controlled substances or have not had an application for a registration with the DEA denied, had a DEA registration revoked, or surrendered a DEA registration for cause, unless a DEA waiver has been approved in accordance with provisions in the directive. The policy also states that any employee or applicant who has been convicted of a felony offense relating to controlled substances or who, at any time, has had an application for a DEA registration denied, had a DEA registration revoked, or has surrendered a DEA registration for cause and does not currently hold an active DEA registration, may not be appointed to or hold a position that has access to controlled substances, unless a DEA waiver has been approved. By establishing this policy, VHA has taken important steps to ensure VHA facilities comply with DEA regulations that help control against theft and diversion of controlled substances.
|
| Department of Veterans Affairs | After implementing a DEA employment waiver policy, the Under Secretary for Health should review the individuals still employed at VHA among the 50 we confirmed had controlled substance-related criminal history to determine whether they have access to controlled substances as part of their assigned duties and thus need DEA employment waivers. (Recommendation 4) |
In April 2024 VA stated The review of the identified sample list provided by GAO will take place after publication of the DEA employment waiver policy as stated in the recommendation. VHA is currently planning for this review, so it is ready for the field upon publication of the directive. In July 2024 VA stated an action item was distributed to the field on June 24, 2024, to determine whether the employees on the identified sample list are encumbering positions with access to controlled substances. Subsequent reviews of individual DEA registration and felony conviction status will be conducted, as necessary, to determine whether a DEA employment waiver is required. The target completion date for this recommendation in March 2025.
|
| Department of Veterans Affairs | After implementing a DEA employment waiver policy, the Under Secretary for Health should review the approximately 12,500 employees we identified with indications of controlled substance-related criminal history—but for whom we did not confirm controlled substance-related felony convictions—to determine whether they need DEA employment waivers. (Recommendation 5) |
In April 2024 VA stated the review of the identified sample list provided by GAO will take place after publication of the DEA employment waiver policy as stated in the recommendation. VHA is currently planning for this review, so it is ready for the field upon publication of the directive. Pre-positioning work (for example, review for presence of OF-306s and other background information) for the 12,519 cases identified by GAO is in progress with 7,127 (63%) complete. In July 2024 VA stated an action item was distributed to the field on June 24, 2024, to determine whether the employees on the identified sample list are encumbering positions with access to controlled substances. Subsequent reviews of individual DEA registration and felony conviction status will be conducted, as necessary, to determine whether a DEA employment waiver is required. The target completion date for this recommendation is March 2025.
|
| Department of Veterans Affairs | The Under Secretary for Health should implement control procedures to ensure that suitability adjudicators use information regarding undisclosed criminal history in compliance with OPM regulations and VA policy, including policies requiring that adjudicators document their assessments of the materiality and intent of undisclosed information and their rationale for not referring cases involving nondisclosure to OPM. (Recommendation 6) |
In July 2023, VHA revised the Personnel Security Advisory requiring adjudicators to document in VA-Centralized Adjudication Background Investigation System (VA-CABS) their assessments of the materiality and intent related to undisclosed information and the rationale for referring or not referring cases involving nondisclosure to OPM. Relevant documents should be uploaded into VA-CABS. Further, in February 2024, VHA developed the Personnel Security Oversight and Compliance plan which includes a requirement for a second level of review of cases. Specifically, VHA will randomly select two cases per adjudicators per month for a second level review to ensure the cases have been adjudicated according to regulation. According to VHA, this second level review will include cases of undisclosed criminal history. By doing this, the agency has taken steps to ensure to that suitability adjudicators use information regarding undisclosed criminal history in compliance with OPM regulations and VA policy.
|
| Department of Veterans Affairs | The Under Secretary for Health should establish oversight procedures to ensure that adjudicators follow up on applicants' active warrants before hiring and notify the appropriate VISN suitability coordinator on the active warrant before rendering a favorable determination. (Recommendation 7) |
In July 2023, VHA updated its Adjudicator Consistency Advisory that instructs adjudicators to follow up on applicants' active warrants before hiring and to notify the appropriate VISN Suitability Coordinator on any active warrants before rendering a favorable determination. Further, in February 2024, VHA developed the Personnel Security Oversight & Compliance plan which includes a requirement for a second level of review of cases. Specifically, VHA will randomly select two cases per adjudicators per month for a second level review to ensure the cases have been adjudicated according to regulation. According to VHA, this second level review will include cases of active warrants for proper documentation and follow up. By doing this, the agency has taken steps to ensure that adjudicators follow up on applicants' active warrants before hiring.
|
| Department of Veterans Affairs | As VA implements the Rap Back Program, the Secretary of Veterans Affairs should develop control procedures to ensure that PAA notifications are routed and resolved appropriately. (Recommendation 8) |
In October 2023, VA developed the Rap Back Action Plan which includes the development of control procedures and required actions that must be completed to ensure that Rap Back notifications, which were formerly called PAA notifications, are resolved appropriately. Specifically, the Rap Back Action plan notes that administrators can pull reports on Continuous Evaluation Rap Back to ensure Rap Back notifications are reviewed and appropriate issues are resolved. According to VHA, it receives continuous evaluation Rap Back alerts on the individuals that are enrolled in VA Centralized Adjudication and Background Investigation System (VA-CABS). By doing this, the agency has taken a step to ensure that there is an action plan for processing Rap Back notifications.
|
| Department of Veterans Affairs | As VA implements the Rap Back Program, the Secretary of Veterans Affairs should develop control procedures to document follow-up work conducted on a PAA notification in a VA system such as VA-CABS. (Recommendation 9) |
In October 2023, VA developed the Rap Back Action Plan which includes the development of control procedures and required actions that must be completed to ensure that Rap Back notifications, which was formerly called PAA notifications, are resolved appropriately. Specifically, the Rap Back Action plan notes that administrators can pull reports on Continuous Evaluation Rap Back to ensure Rap Back notifications are reviewed and appropriate issues are resolved. Further, VA-CABS' upgrades will allow VA's Personnel Security Specialist to upload documents and include an adjudicative decision related to the Rap Back alert in VA-CABs. By doing this, the agency has taken a step to ensure that there is an action plan for processing Rap Back notifications and actions taken in response to notifications are documented.
|
| Department of Veterans Affairs | The Under Secretary for Health should establish control procedures to ensure that employee background investigations are completed as required by OPM regulation and VA policy. (Recommendation 10) |
In April 2024 VA stated VHA has fully implemented the Oversight & Compliance (O&C) plan with all 18 Veterans Integrated Service Networks and VHA HR Offices. The implementation occurred in a phased approach beginning in January and concluded on February 28, 2024. The Oversight & Compliance Plan includes control procedures to ensure that employee background investigations are completed as required. Specifically, it includes report tools where VHA can check the timeliness of investigations, Special Agreement Check adjudicated and adjudication timeliness, the uploading of the certificate of investigation, performing adjudicated quality review, among other things. VHA Personnel Security Program Office (PERSEC) submit monthly compliance reports to a centralized database which are then analyzed for trends and compliance by the Workforce Management and Consulting Office (WMC). VHA PERSEC offices also submit mitigation action plans on findings which are reviewed and validated by WMC staff. WMC has also created a Power BI and a SharePoint site. The Power BI sorts and filters data received from the recruitment tracker based on specific criteria. The SharePoint provides key links for support and a library for referencing policy, advisories, and job aids. In August 2024, the WMC HR Center of Excellence (COE) PERSEC completed the administrative audit of the 12,520 employees that we identified with controlled substance-related criminal history, but whom we did not examine to ensure that employee background investigations were completed. By implementing the Oversight & Compliance plan and control procedures, VHA has taken a step to ensure that employee background investigations are completed as required by OPM regulations and VA policy.
|
| Department of Veterans Affairs | The Assistant Secretary for Human Resources and Administration/Operations, Security and Preparedness should develop and implement policies that establish who is responsible for documenting employee background investigations in eOPF in accordance with OPM guidance and VA policy and control procedures to ensure that these policies are followed. (Recommendation 11) |
In January 2024, VA stated that VA Human Resources Administration/Operations Security and Preparedness, Personnel Security (HRA/OSP PERSEC) will develop and publish a policy advisory outlining that VA personnel security specialists will be responsible for documenting employee background investigations in the employee Electronic Official Personnel Folder (eOPF), in accordance with OPM's Guide to Personnel Recordkeeping' Chapter 3, Section 3-E Investigative Process. The Policy Advisory will also define the control procedure to ensure the guidance in the policy advisory is being followed. In August 2024, VA stated that Office of Identity, Credential, and Access Management (OICAM/PVCM) issued an advisory (VAPERSEC 24-02 Advisory) regarding the documenting of employee background investigations in an employee's eOPF in January of 2024. VHA places the responsibility to ensure a background investigation is documented in an employee's eOPF on the facility Human Resource Officers (VHA Directive 0710(1) (Amended June 24, 2024)). The Veterans Benefits Administration (VBA) places the responsibility to ensure a background investigation is documented in an employee's eOPF on VBA's personnel security staff. The VA National Cemetery Administration (NCA) places the responsibility to ensure a background investigation is documented in an employee's eOPF on NCA's Human Resources Center staff. NCA has a small human resources staff, and the process is exclusively their responsibility. In November 2024, VA provided supporting documentation on their actions taken. We are currently assessing the information provided.
|
| Department of Veterans Affairs | The Under Secretary for Health should ensure that background investigations are completed and documented as required for the employees among the 329 we examined (i.e., those from our sample and those we identified with DEA registration actions or active warrants) and who we found did not have completed investigations or whose investigations were not documented in eOPF. (Recommendation 12) |
As part of our review, we sent VA a list of 97 employees among the 329 we examined and who we found did not have completed background investigations or whose investigations were not documented in the electronic Official Personnel Folder (eOPF). In August 2024, VHA provided supporting documentation demonstrating the completion of its review of the 97 employees to ensure that all the employees' background investigations are completed and documented as required. Out of the 97 employees included in the review, 68 contained evidence of a completed background investigation documented by a Certificate of Investigation (COI) or Certificate of Reciprocity in the eOPF. According to VHA, out of the 97 employees, 29 had inactive eOPFs due to resignations, retirements, transfers, and terminations. A COI was created at the time of VHA's review and placed in the folder in the event one was not identified during VA's review. By reviewing the employees that we found that did not have documentation of a background investigation, VHA has ensured that these employees background investigations are completed and documented as required.
|
| Department of Veterans Affairs | The Under Secretary for Health should review the approximately 12,200 employees we identified with indications of controlled substance-related criminal history—but whom we did not examine—to ensure that employees who may require DEA employment waivers have completed background investigations. (Recommendation 13) |
In August 2024, VHA provided supporting documentation on the completion of their review of the employees we identified with indications of controlled substance-related criminal history, but whom we did not examine, to ensure these employees have completed background investigations. Specifically, VHA completed the review of all 12,250 records GAO identified. Of the 12,250 records, 4,103 employees have separated, 8,147 employees are current. Of the 8,147 current employees, 8,140 employees have a valid background investigation on file or an accepted proof of a background investigation was added to the file and 7 employees require investigation. According to VHA, the VISNs have been notified of the employees who need an investigation and are currently working to mitigate this deficiency. By reviewing the employees we identified with indications of controlled substance-related criminal history, VHA has taken steps to ensure that these employees have completed background investigations.
|
| Department of Veterans Affairs | The Under Secretary for Health should review the approximately 12,200 employees we identified with indications of controlled substance-related criminal history—but whom we did not examine—to ensure that background investigations were documented in eOPF for employees who may require DEA employment waivers. (Recommendation 14) |
In August 2024, VHA provided supporting documentation demonstrating the completion of its review of the employees we identified with indications of controlled substance-related criminal history, but whom we did not examine, to ensure that background investigations were documented in the Electronic Personnel Folder (eOPF). Specifically, VHA reviewed12,250 records GAO identified. Of the 12,250 records, VHA found that 475 employees did not have evidence of a certificate of investigation (COI) or a Certificate of Eligibility uploaded in the employee's eOPF. Of the 475, VHA is responsible for 471 employees. According to the VHA, of the 471, VHA added evidence of a background investigation in eOPF of 464 employees. For the other 7 employees, VHA is working to complete the background investigation. The remaining four are employed by VA's other Administrations. According to the VHA, it provided those names to its VA counterparts and have received confirmation that the four cases have completed a background investigation and have a COI in their eOPF. By conducting a review of the employees we identified with indications of a controlled substance-related criminal history, but whom we did not examine, VHA has taken steps to ensure that these employees background investigations were documented in eOPF.
|
Full Report
GAO Contacts
Public Inquiries
Topics
Background investigationsControlled substancesConvictionsCriminal investigationsFederal employmentGovernment employeesHuman capital managementVeteransHealth careHealth care administration