United States Government Accountability Office Report to Congressional Requesters VETERANS AFFAIRS June 2017 Improved Management Processes Are Necessary for IT Systems That Better Support Health Care GAO-17-384 June 2017 VETERANS AFFAIRS Improved Management Processes Are Necessary for IT Systems That Better Support Health Care Highlights of GAO-17-384, a report to congressional requesters Why GAO Did This Study What GAO Found VHA, an administration within VA, The Department of Veterans Affairs (VA) has established information technology provides a broad range of primary (IT) management processes that are partially consistent with leading practices. care, specialized care, and related VA has issued strategic plans that identify goals and objectives related to health medical and social support services to IT; established investment review boards at the department-level and within the veterans. In doing so, VHA operates Veterans Health Administration (VHA) that are responsible for selecting IT one of the nation’s largest health care investments aligned to VHA priorities; and documented VHA’s core business systems through 168 VA medical functions within an enterprise architecture. However, the IT strategic plans do not centers and more than 1,000 include performance measures and targets for their defined objectives, VA’s outpatient facilities. The administration department-level IT investment board has been inactive and its investment managed total budget resources selection guidance lacks criteria, and the department has not fully identified reported at nearly $91 billion in fiscal year 2016. metrics aligned to core business functions to inform investment decisions. Until VA can improve these processes, it risks having IT systems that may not fully Based on interest in VHA’s ability to support VHA’s mission. oversee its health care system and provide timely care, GAO reviewed IT IT systems at VA are generally aligned to core business functions defined by management at VHA. Specifically, VHA; however, among new service requests, which identify unmet needs of GAO determined the extent to which business owners, 817 out of a total of 2,772 IT needs identified for VHA since VA’s (1) IT management processes are 1998 had not been met as of October 2016. About 39 percent of these open consistent with leading practices and requests had been open for more than 5 years. (2) current IT systems support VHA’s core business functions. To do so, Breakdown of the Veterans Health Administration’s Information Technology New Service Requests GAO analyzed documentation and interviewed officials about VA’s approach to IT management processes related to strategic planning, investment management, and enterprise architecture, and compared VA’s processes to leading practices. In addition, GAO reviewed data related to VA’s IT systems and VHA’s IT business needs. GAO further reviewed IT needs from three key VHA program areas. What GAO Recommends GAO is recommending that VA address the deficiencies identified with IT strategic planning, investment management, and enterprise architecture; and ensure that the three programs’ IT needs are addressed. VA agreed with GAO’s recommendations GAO’s review of the business needs identified in three key program areas— and described actions planned to Pharmacy Benefits Management, Veterans Access to Care, and Community address them by the end of fiscal year Care—showed a number of long-standing needs. According to VA officials, their 2018. need to balance the resources for IT needs across the department is a reason View GAO-17-384. For more information, that business needs have remained unresolved. Until VA prioritizes resources to contact David A. Powner at (202) 512-9286 or address these needs, VHA’s programs may not be well supported by IT systems pownerd@gao.gov. capable of delivering health care services consistent with its objectives. United States Government Accountability Office Contents Letter 1 Background 4 Key IT Management Processes Are Partially Consistent with Leading Practices 15 VHA’s Core Business Functions Are Not Fully Supported by Current IT Systems 26 Conclusions 30 Recommendations for Executive Action 31 Agency Comments and Our Evaluation 32 Appendix I Objectives, Scope, and Methodology 34 Appendix II Comments from the Department of Veterans Affairs 39 Appendix III GAO Contact and Staff Acknowledgments 43 Figures Figure 1: Breakdown of the Department of Veterans Affairs (VA) Proposed Information Technology (IT) Budget for Fiscal Year 2017 7 Figure 2: Simplified Department of Veterans Affairs (VA) Organization (shaded areas are discussed in this report) 8 Figure 3: Veterans Health Administration Information Technology (IT) Governance Structure 22 Figure 4: Breakdown of the Veterans Health Administration’s Information Technology New Service Requests 28 Page i GAO-17-384 Veterans Affairs Abbreviations CIO chief information officer DOD Department of Defense HISP Health Information Strategic Plan IRM Information Resources Management IT information technology NCA National Cemetery Administration NSR new service request OI&T Office of Information and Technology OMB Office of Management and Budget VA Department of Veterans Affairs VASI VA Systems Inventory VBA Veterans Benefits Administration VHA Veterans Health Administration VistA Veterans Health Information Systems and Technology Architecture This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Page ii GAO-17-384 Veterans Affairs Letter 441 G St. N.W. Washington, DC 20548 June 21, 2017 The Honorable Phil Roe Chairman The Honorable Tim Walz Ranking Member Committee on Veterans’ Affairs House of Representatives The Honorable Derek Kilmer House of Representatives The Honorable Mark Takano House of Representatives The Department of Veterans Affairs’ (VA) Veterans Health Administration (VHA) provides a broad range of primary care, specialized care, and related medical and social support services that are related to veterans’ health or special needs. VHA operates one of the nation’s largest health care systems through its 168 VA medical centers and more than 1,000 outpatient facilities. 1 The administration managed total budget resources reported at about $91 billion in fiscal year 2016. The demand for VHA’s services is expected to grow in the future. Due to changes in the veteran population, including increases in the number of women veterans, the health care needs of veterans may also change. These and other changes, such as innovations in technology and health care delivery, may affect VHA’s current strategies for accomplishing its mission to provide care to the nation’s veterans. At the same time, VA faces serious and long-standing problems with veterans’ access to health care and management failures, including ongoing appointment scheduling problems, unreliable appointment wait-time data, and inadequate coordination of veteran care between VA and non-VA medical providers. 2 1 Outpatient facilities include community-based outpatient clinics and health care centers. 2 These issues were highlighted in our 2015 High-Risk Report, GAO, High-Risk Series: An Update, GAO-15-290 (Washington, D.C.: Feb. 11, 2015) and 2017 update, GAO, High- Risk Series: Progress on Many High-Risk Areas, While Substantial Efforts Needed on Others, GAO-17-317 (Washington, D.C.: Feb. 15, 2017). Page 1 GAO-17-384 Veterans Affairs We and others have expressed significant concerns about VHA’s management of its health care system, including VHA’s ability to effectively provide and oversee timely access to health care for veterans. Further, over many years, VA has experienced challenges in managing its information technology (IT) resources, raising questions about the effectiveness of its operations and its ability to deliver high-quality health care to veterans and other outcomes needed to help advance the department’s mission. Based on interest in VHA’s ability to oversee its health care system and provide timely care, you asked us to conduct a management review of VHA that encompassed several key organizational components, including IT management. 3 This report presents the results of our review that examined the extent to which VA’s (1) IT management processes are consistent with leading practices and (2) current IT systems support VHA’s core business functions. To address the first objective, we identified VA’s management processes that are intended to ensure that IT investments meet the business needs of the organization (i.e., IT strategic planning, investment management, and enterprise architecture). We then compared those processes to leading practices that we and the Office of Management and Budget 3 Other areas of this request focused on organizational structure, strategic planning, and human capital processes. See for example, GAO, VA Health Care: Processes to Evaluate, Implement, and Monitor Organizational Structure Changes Needed, GAO-16-803 (Washington, D.C.: Sept. 27, 2016); Veterans Health Care: Improvements Needed in Operationalizing Strategic Goals and Objectives, GAO-17-50 (Washington, D.C.: Oct. 21, 2016); and Veterans Health Administration: Management Attention Is Needed to Address Systemic, Long-standing Human Capital Challenges, GAO-17-30 (Washington, D.C.: Dec. 23, 2016). Page 2 GAO-17-384 Veterans Affairs (OMB) previously identified to assist organizations with improving their management processes. 4 To accomplish our second objective, we reviewed data in the VA Systems Inventory (VASI) to identify current IT systems and their relationships to VHA’s core business functions, as described in VHA’s business architecture. We then analyzed data from VHA’s new service request (NSR) database, which serves as a repository for identified IT needs submitted by VHA programs and business owners. This allowed us to identify the total number of service requests, when requests were entered, and the number of requests that remained unresolved. We reviewed documentation related to both databases, such as the data dictionary; examined data for unusual or missing entries; and interviewed cognizant officials about data reliability and internal control procedures. We determined the VASI and NSR data were reliable for the purposes of our reporting objectives and used the data, among other sources of evidence, to support our findings, conclusions, and recommendations. We also conducted additional analyses of new service requests identified by three VA programs related to health service delivery and on which we have previously reported—Pharmacy Benefits Management Services, Veterans Access to Care (scheduling and consults), and Community Care—to determine the extent to which business needs have been addressed over time. We interviewed VHA officials regarding the IT systems used by the three programs, the process for identifying and managing VHA business needs, and the current status of unmet needs, to understand the extent to which current systems support VHA’s core 4 Leading practices were identified using prior GAO guidance including, for example: GAO, Information Technology Investment Management: A Framework for Assessing and Improving Process Maturity (Version 1.1), GAO-04-394G (Washington, D.C.: March 2004); Organizational Transformation: A Framework for Assessing and Improving Enterprise Architecture Management (Version 2.0) (Supersedes GAO-03-584G), GAO-10-846G (Washington, D.C.: August 2010); Standards for Internal Control in the Federal Government, GAO-14-704G (Washington, D.C.: September 2014); and Social Security Administration: Improved Planning and Performance Measures Are Needed to Help Ensure Successful Technology Modernization, GAO-12-495 (Washington, D.C.: Apr. 26, 2012). In addition, key elements were identified related to strategic planning from the Office of Management and Budget, Circular No. A-11: Preparation, Submission, and Execution of the Budget, July 2013; OMB Circular No. A-130: Managing Information as a Strategic Resource, (Washington, D.C.: July 28, 2016); and OMB Memorandum M-13-09 Fiscal Year 2013 PortfolioStat Guidance: Strengthening Federal IT Portfolio Management (Washington, D.C.: Mar. 27, 2013). Page 3 GAO-17-384 Veterans Affairs business functions. A full description of our objectives, scope, and methodology can be found in appendix I. We conducted this performance audit from January 2016 to June 2017 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. VA’s mission is to promote the health, welfare, and dignity of all veterans Background in recognition of their service to the nation by ensuring that they receive medical care, benefits, social support, and lasting memorials. In addition to its central office located in Washington, D.C., VA has field offices located throughout the United States, as well as the U.S. territories and the Philippines. The department’s three major components—VHA, the Veterans Benefits Administration (VBA), and the National Cemetery Administration (NCA)— are primarily responsible for carrying out its mission. More specifically, VHA provides health care services, including primary care and specialized care, and it performs research and development to improve veterans’ needs. VBA provides a variety of benefits to veterans and their families, including disability compensation, educational opportunities, assistance with home ownership, and life insurance. Lastly, NCA provides burial and memorial benefits to veterans and their families. VA Relies Extensively on The use of IT is critically important to VA’s efforts to provide benefits and IT services to veterans. As such, the department relies extensively on IT to meet the day-to-day operational needs of its medical centers, provide veteran-facing systems, and otherwise support the department’s mission. According to OI&T data as of October 2016, there were 576 active or in- Page 4 GAO-17-384 Veterans Affairs development systems in VA’s inventory of IT systems. 5 These systems are intended to be used for the determination of benefits, benefits claims processing, and access to health records, among other services. VHA is the parent organization for 319 of these systems. 6 Of the 319 systems, 244 were considered mission-related and provide capabilities related to veteran health care delivery. VHA’s systems provide, for example, capabilities to support electronic health records that health care providers and other clinical staff use to view patient information in inpatient, outpatient, and long-term care settings, as well as patient admission to hospitals and clinics, and patient care through telehealth. 7 The remaining systems support corporate or non-mission related IT functions. For fiscal year 2017, the department’s budget request included nearly $4.28 billion for IT. 8 Specifically, VA requested approximately $2.53 billion for sustainment, 9 approximately $1.27 billion for payroll and administration, 10 and approximately $471 million for new systems development or modernization efforts. 11 5 According to VA Directive 6404, a system in the department inventory must (1) contain a combination of IT hardware, software, or information management capabilities; (2) be funded and operationally managed by VA; (3) be hosted in a shared computing environment (e.g., data center, cloud facility, medical center); (4) not be an infrastructure or software subcomponent (e.g., servers, network routers, storage) required to support a system; and (5) not be a medical device (e.g., cardiology equipment, medical lasers, and endoscope) categorized under the VA Medical Device Nomenclature System. 6 The parent organization is the highest level functional organization within VA that is associated with the business sponsor for a system. 7 Telehealth includes telemedicine, which is the use of medical information exchanged from one site to another via electronic communications, and telemental health, which is the provision of mental health services to patients living in remote locations or otherwise underserved areas. 8 VA has a single, consolidated IT appropriation that is submitted and managed by OI&T. 9 According to OI&T, the sustainment funding was requested to provide operations and maintenance of existing infrastructure systems, activate medical facilities, protect veterans’ personal information, and implement an enhanced security strategy. 10 According to OI&T, the payroll and administrative budget is for salaries, benefits, contracts and other administrative expenses associated with OI&T full-time employees. The OI&T payroll account is not used to support VHA, VBA, or NCA staff. 11 According to OI&T, the development funding was requested to address the IT needs across the department. Page 5 GAO-17-384 Veterans Affairs According to OI&T, of the $471 million requested for VA development and modernization, approximately $166.6 million (about 35 percent) was requested to support VHA development projects such as the Veterans Health Information Systems and Technology Architecture, known as VistA Evolution, 12 and other clinical systems development. In addition, $276.7 million (about 11 percent) of the $2.53 billion in sustainment funding was allocated to VHA-specific projects to support existing systems. The remaining amounts of requested funds support the other VA administrations as well as overall IT infrastructure that are not necessarily aligned to any single administration. Figure 1 provides the breakdown of VA’s proposed IT budget for fiscal year 2017. 12 VistA began operation in 1983 as the Decentralized Hospital Computer Program. In 1996, the name of the system was changed to the Veterans Health Information Systems and Technology Architecture. In 2013, VA began a new program, VistA Evolution, to enhance and modernize its existing VistA system through incrementally deploying capabilities through fiscal year 2018. Page 6 GAO-17-384 Veterans Affairs Figure 1: Breakdown of the Department of Veterans Affairs (VA) Proposed Information Technology (IT) Budget for Fiscal Year 2017 The Office of Information and Since 2007, VA has been operating a centralized organization in which Technology Manages VA’s IT most key functions intended for effective management of IT are Functions performed by OI&T and led by the Assistant Secretary for Information and Technology/Chief Information Officer (CIO). Figure 2 presents a simplified organizational chart for VA. Page 7 GAO-17-384 Veterans Affairs Figure 2: Simplified Department of Veterans Affairs (VA) Organization (shaded areas are discussed in this report) OI&T has responsibility for managing the majority of VA’s IT-related functions. The office provides strategy and technical direction, guidance, and policy related to how IT resources are to be acquired and managed for the department. According to VA, OI&T’s mission is to collaborate with its business partners (such as VHA) and provide a seamless, unified veteran experience through the delivery of state-of-the-art technology. The CIO serves as the head of OI&T and is responsible for providing leadership for the department’s IT activities. The CIO reports to the Office of the Secretary of Veterans Affairs through the Deputy Secretary and advises the Secretary regarding the execution of the IT appropriation. In addition, the CIO is expected to serve as the principal advisor to top management officials, such as the Under Secretaries of each of the three administrations, on matters relating to IT management in the department. This official is also tasked with reviewing and approving investments, as well as overseeing the performance of IT programs and evaluating them to determine whether to continue, modify, or terminate them. Page 8 GAO-17-384 Veterans Affairs Although VA centralized its key IT functions in order to maintain better control over resources, we have previously reported that the office has faced challenges in fully implementing and managing IT under its centralized organizational structure. 13 In addition, independent assessments of the department’s efforts in 2013 and 2015 showed that OI&T has had difficulty in preventing IT activities from occurring outside its control. 14 According to the assessments, it has also been challenged in effectively collaborating with the department’s various business units and in efficiently and cost-effectively delivering new IT capabilities. Recognizing these challenges, the CIO initiated an effort in January 2016 to transform OI&T focus and functions. Among other things, the transformation focused on reorganizing the units within OI&T. Beginning in April 2016, VA established five organizational units within OI&T with responsibility for performing and managing specific IT-related functions. 15 • Enterprise Program Management Office. This office began initial operations in April 2016, and is intended to serve as OI&T’s portfolio management and project tracking organization. 16 According to OI&T, its goals are to align IT portfolios with the department’s strategic objectives; enhance visibility and governance; analyze and report on portfolio performance metrics; ensure the overall health of the IT portfolio; and optimize resources for projects, people, and timelines. The Enterprise Program Management Office includes the following six functional areas: (1) Intake and Analysis of Alternatives is to work with the VA administrations and other staff offices to develop requirements 13 In February 2015, we designated VA health care as a high-risk area based on our concerns about the department’s ability to ensure the quality and safety of veterans’ health care in five broad areas, one of which was IT challenges. 14 Centers for Medicare and Medicaid Services’ Alliance to Modernize Healthcare Federally Funded Research and Development Center, Independent Assessment of the Health Care Delivery Systems and Management Processes of the Department of Veterans Affairs: Volume I: Integrated Report (Sept. 1, 2015) and VA Office of the Inspector General: Department of Veterans Affairs Review of Alleged System Duplication in the Virtual Office of Acquisition Software Development Project, 12-02708-301 (Washington, D.C.: Sept. 18, 2013). 15 In addition to these offices, the Department of Defense (DOD)/VA Interagency Program Office resides in OI&T. This office is supposed to function as the single point of accountability for ensuring that electronic health records systems or capabilities allow for full interoperability of health care-related information between DOD and VA. 16 An IT portfolio consists of the combination of all IT assets and investments owned or planned by an organization in order to achieve its strategic goals, objectives, and mission. Page 9 GAO-17-384 Veterans Affairs to meet the needs of veterans, provide analysis of alternative approaches to meeting those requirements, and integrate information security; (2) IT Portfolios is to consolidate programs and projects under five portfolios (Health, Benefits, Cemeteries, Corporate, and Enterprise services); (3) Project Special Forces is to mitigate issues that put projects at risk of failure; (4) Demand Management is responsible for metrics gathering and analysis, development of process tools, human resources, and training; (5) Transition Release and Support is to manage OI&T’s integrated calendar supporting VA’s Veteran-focused Integration Process; 17 and (6) Application Management is responsible for IT implementation efforts, including testing, design, and data management. • Account Management. This function, led by four account managers, 18 is responsible for managing the IT needs of OI&T’s business partners—VA’s administrations and staff offices, including VHA. Account managers are to interface directly with their customers to understand their needs, help identify and define the solutions to meet those needs, and represent their interests by reporting directly to the CIO. In this regard, account managers are to submit their customers’ IT requirements to the Enterprise Program Management Office, ensure that their business needs are understood by OI&T, and ensure that business solutions are designed to meet their customers’ specifications. This function is also tasked with advocating for the customers in the budget process. OI&T intends for this function to address the challenge of effectively collaborating with business units. As of December 2016, all four account managers were in place. • Quality and Compliance. This function is responsible for establishing effective policy governance and standards and ensuring adherence to the policies and standards. In addition, the quality and compliance function is charged with identifying, monitoring, and measuring risks across OI&T. • Data Management Organization. The organization is intended to improve both service delivery and the veteran experience by engaging 17 The Veteran-focused Integration Process is the current project management process used by VA that is intended to manage system development and deliver new IT capabilities. It replaced the Project Management Accountability System in December 2015. 18 The four account managers are: Account Manager for Health; Account Manager for Benefits and Veteran Experience; Account Manager for Corporate IT; and Account Manager for the Enterprise Portfolio. The Account Manager for Health is responsible for collaborating with VHA on the health IT portfolio. Page 10 GAO-17-384 Veterans Affairs with data stewards to ensure the accuracy and security of the information collected by VA. 19 The organization is to institute a data governance strategy; engage with VA staff to ensure the accuracy and security of collected data; analyze data sources to form an enterprise data architecture; 20 and establish metrics for data efficiency, access, and value. OI&T also intends for the organization to identify trends in the data collected on each veteran that could improve their health care by providing predictive care and anticipating needs. • Strategic Sourcing. This function is responsible for establishing an approach to fulfilling the department’s requirements with vendors that provide solutions to those requirements, managing vendor selection, tracking vendor performance and contract deliverables, and sharing insights on new technologies and capabilities to improve the workforce knowledge base. VHA Has Responsibility for the The VA Under Secretary for Health is the head of VHA and is supported Identification of Its IT Needs by the Principal Deputy Under Secretary for Health, four Deputy Under Secretaries for Health, and nine Assistant Deputy Under Secretaries for Health. Among these, the Deputy Under Secretary for Health for Policy and Services oversees the work of the Assistant Deputy Under Secretary for Health for the Office of Informatics and Information Governance within VHA. The Strategic Investment Management office, a division of the Office of Informatics and Information Governance, was established to support the IT needs of VHA by providing information on health-related information systems that senior managers need to make sound decisions. There are four organizational services within this office: Business Architecture, Investment Governance Services, Open Source Management, and Requirements Development and Management. Among other things, this office advocates for VHA’s IT needs within the Planning, Programming, 19 According to VA, data stewards are representatives within VA who assist with the development of data-related requirements for the department. 20 An enterprise data architecture is a perspective of the overall department enterprise architecture that provides information about baseline and target data elements. For example, data elements may include dictionaries, taxonomies, inventories, exchanges, messaging formats, etc. Page 11 GAO-17-384 Veterans Affairs Budgeting, and Execution process 21 and coordinates with VHA business owners and other VA organizations to support, document, analyze, and evaluate clinical and business needs and requirements for IT development. The Strategic Investment Management office works closely with business owners and program offices within VHA to assist with the IT governance and budgeting processes, IT needs identification, requirements development, and investment oversight. For example, the Strategic Investment Management office works with program offices such as Pharmacy Benefits Management Services, Veterans Access to Care (scheduling and consults), and Community Care. These offices are responsible for key functions and IT systems related to health service delivery: • Pharmacy Benefits Management Services. This program office is responsible for providing organizational guidance on a broad range of pharmacy activities to the 260 pharmacies located in VA’s medical centers and outpatient clinics. The office also has operational responsibility for all aspects of the department’s seven consolidated mail outpatient pharmacies, with the exception of IT. 22 The Executive Director of this office is responsible for identifying functional needs for medical center pharmacies and consolidated mail outpatient pharmacies and communicating those needs to OI&T for prioritization and planning to acquire pharmacy IT capabilities. • Veterans Access to Care (scheduling and consults). This program office is responsible for standardizing and coordinating system-wide administrative clinic operations and management. Specifically, the Executive Director serves as VHA’s business owner and manager in collaboration with OI&T on matters regarding scheduling, including the department’s electronic outpatient scheduling system. • Community Care. This program office is responsible for overseeing all VHA community care programs and business processes, such as 21 According to VA documentation, the Planning, Programming, Budgeting, and Execution process is instituted by O&IT in an effort to define O&IT’s vision, describe program assumptions, align IT investments to VA strategy, capture the overall IT requirements of the department, and ensure that the IT appropriation is being directed to those investments that satisfy VA’s most pressing IT mission requirements. The process is used to develop the department’s budget submission to OMB. 22 VA provides medication for its patients using a mail delivery service through the consolidated mail outpatient pharmacy facilities. Page 12 GAO-17-384 Veterans Affairs determining veterans’ eligibility to receive health care benefits and purchasing care from non-VA providers. Specifically, it is structured around six functional areas: eligibility, referral and authorization, a tiered network of community providers, care coordination, provider payment, and customer service. VA’s and VHA’s IT As previously mentioned, an independent assessment recently noted that Environment Faces Challenges VHA and OI&T faced a number of challenges in collaborating to execute health IT improvements and developing new and modernized capabilities. 23 Specifically, in response to The Veterans Access, Choice, and Accountability Act of 2014 (Choice Act), 24 the assessment was released in September 2015, stating that VHA and OI&T did not collaborate effectively. The assessment found that VHA and OI&T often did not agree on priorities for executing their strategic plans and have struggled to identify, prioritize, and translate clinical goals and strategic initiatives reflected in the department’s overarching planning documents into buildable, testable health IT requirements that resulted in measurable health care outcomes for the veteran. In addition, the report stated that VA’s ability to deliver new capabilities for VistA had stalled and as a result the VA health care system was in danger of becoming obsolete. The Choice Act also established the Commission on Care (the Commission). This independent entity evaluated veterans’ access to VA health care and assessed how veterans’ care should be organized and delivered during the next 20 years. 25 In its final June 2016 report, the commission acknowledged that, although VHA provided health care that was, in many ways, comparable or better in clinical quality to that generally available in the private sector, the care was inconsistent from 23 Centers for Medicare and Medicaid Services’ Alliance to Modernize Healthcare Federally Funded Research and Development Center, Independent Assessment of the Health Care Delivery Systems and Management Processes of the Department of Veterans Affairs Volume I: Integrated Report (Sept. 1, 2015). 24 Pub. L. No. 113-146, § 201(a)(1), 128 Stat. 1754, 1769 (2014). The Choice Act required VA to contract with a private entity to conduct an independent assessment of 12 areas of its health care delivery system and management processes (Pub. L. No. 113-146, § 201(a)(1), 128 Stat. 1769). VHA contracted with the Centers for Medicare and Medicaid Services’ Alliance to Modernize Healthcare (operated by MITRE Corporation, a not-for- profit company that operates multiple federally funded research and development centers) and the Institute of Medicine to conduct the assessment. Parts of the evaluation were subcontracted to other organizations, including McKinsey & Company and the RAND Corporation. 25 Pub.L. No. 113-146, § 202, 128 Stat. 1754, 1773 (2014). Page 13 GAO-17-384 Veterans Affairs facility to facility. According to the commission, health care also could be compromised by poorly functioning operational systems and processes. The commission’s recommendations were intended to serve as a foundation for organizational transformation at VA. We have also issued numerous reports that highlighted challenges facing VA’s efforts to improve IT management. For example, in May 2010, we reported that, after spending an estimated $127 million over 9 years on its outpatient scheduling system project, VA had not implemented any of the planned system’s capabilities and was essentially starting over by beginning a new initiative to build or purchase another scheduling system. 26 We also noted that VA had not developed a project plan or schedule for the new initiative; department officials stated that VA intended to do so after determining whether to build or purchase the new application. We recommended that the department take six actions to improve key systems development and acquisition processes essential to the second outpatient scheduling system effort. The department generally concurred with our recommendations, but has not provided information about its actions to implement four of the six recommendations. In May 2016, we reported that VA’s expenditures for its care in the community programs, the number of veterans for whom VA has purchased care, and the number of claims processed by VHA have all grown considerably in recent years. 27 Due to recent increases in utilization of VA care in the community, the department has had difficulty processing claims in a timely manner. We reported that VA officials and claims processing staff had indicated that IT limitations, manual processes, and staffing challenges delayed claims processing. The department had implemented interim measures to address certain system challenges, but did not expect to deploy solutions to address all challenges, including those related to IT, until fiscal year 2018 or later. Further, VA did not have a sound plan for modernizing its claims processing system, which we recommended it develop. The department concurred with this recommendation and stated that it intended to 26 GAO, Information Technology: Management Improvements Are Essential to VA’s Second Effort to Replace Its Outpatient Scheduling System, GAO-10-579 (Washington, D.C.: May 27, 2010). 27 GAO, Veterans’ Health Care: Proper Plan Needed to Modernize System for Paying Community Providers, GAO-16-353 (Washington, D.C.: May 11, 2016). Page 14 GAO-17-384 Veterans Affairs address the recommendation through the planned consolidation of its care. 28 We have also recently reported on VHA’s efforts to provide outpatient pharmacy services to approximately 6.7 million veterans. 29 Specifically, in June 2017, we reported that pharmacists cannot always efficiently view and share necessary patient data among VHA medical sites and cannot transfer prescriptions to other VHA pharmacies or process prescription refills received from other VHA medical sites through the system. As a result, pharmacists do not have the necessary data to efficiently make clinical decisions about prescriptions, which could negatively affect patient safety. In addition, we noted that VA’s pharmacy system lacks certain capabilities, such as the capability for exchanging prescriptions with non-VHA providers; the system also does not maintain a perpetual inventory capability. Among other actions, we recommended that VA update its pharmacy system to view and receive complete medication data, assess the impact of interoperability, and implement additional industry practices. VA generally concurred with our recommendations. VA has established IT management processes that are partially Key IT Management consistent with leading practices. For example, the department has Processes Are developed multiple IT strategic plans and related documents that identify its goals. However, these plans and documents do not include Partially Consistent performance metrics that the department could use to track progress with Leading toward achieving its goals. Additionally, although VHA has an IT investment management process that is consistent with leading practices, Practices VA’s department-level IT investment board has been inactive and investment selection criteria have not been defined. Further, while VHA has defined a business architecture that identifies its core business functions, measurement of the extent to which those functions are supported by IT investments is incomplete. 28 GAO-16-762T. 29 GAO, VA Information Technology: Pharmacy System Needs Additional Capabilities for Viewing, Exchanging, and Using Data to Better Serve Veterans, GAO-17-179 (Washington, D.C.: June 14, 2017). Page 15 GAO-17-384 Veterans Affairs IT Strategic Plans Identify Strategic planning is essential to help an organization define what it seeks Goals, but Lack to accomplish and identify the strategies it will use to achieve desired results. 30 Our research and experience at federal agencies has shown Performance Metrics That that an agency must align IT goals with its strategic goals as part of an Are Needed to Track institutionalized set of management capabilities. An IT strategic plan Progress outlines the agency’s goals and identifies performance metrics that permit the agency to determine whether IT is making a difference in improving performance. The resulting plan effectively guides modernization efforts by serving as an agency’s vision, or road map, and helps align its information resources with its business strategies and investment decisions. 31 OMB has issued guidance for agencies to use in developing and maintaining a strategic plan that describes the agency’s technology and information resource goals, defines the level of performance to be achieved, and demonstrates how the goals align with the agency’s mission and organizational priorities. 32 VA has also issued a directive that 30 GAO has a body of work on effectively managing performance under the Government Performance and Results Act, Pub L. No. 103-62, 107 Stat. 285 (1993) and the GPRA Modernization Act of 2010, Pub. L. No. 111-352, 124 Stat. 3866 (2011). These acts require, among other things, that federal agencies develop strategic plans that include agency wide goals and strategies for achieving those goals. We have reported that these requirements also can serve as leading practices for planning at lower levels within federal agencies, such as individual programs or initiatives. For example, see GAO, Executive Guide: Effectively Implementing the Government Performance and Results Act, GAO/GGD-96-118 (Washington, D.C.: June 1996); Managing for Results: Critical Issues for Improving Federal Agencies’ Strategic Plans, GAO/GGD-97-180 (Washington, D.C.: Sept. 16, 1997); Foreign Aid Reform: Comprehensive Strategy, Interagency Coordination, and Operational Improvements Would Bolster Current Efforts, GAO-09-192 (Washington, D.C.: Apr. 17, 2009); and Social Security Administration: Improved Planning and Performance Measures Are Needed to Help Ensure Successful Technology Modernization, GAO-12-495 (Washington, D.C.: Apr. 26, 2012). 31 GAO, Social Security Administration: Improved Planning and Performance Measures Are Needed to Help Ensure Successful Technology Modernization, GAO-12-495 (Washington, D.C.: Apr. 26, 2012); Defense Business Transformation: Status of Department of Defense Efforts to Develop a Management Approach to Guide Business Transformation, GAO-09-272R (Washington, D.C.: Jan. 9, 2009); GAO-10-846G; and Library of Congress: Strong Leadership Needed to Address Serious Information Technology Management Weaknesses, GAO-15-315 (Washington, D.C.: Mar. 31, 2015). 32 OMB, Managing Information as a Strategic Resource, Circular A-130 (Washington, D.C.: July 28, 2016); Preparation, Submission, and Execution of the Budget, Circular No. A-11 (Washington, D.C. July 2013); and OMB Memorandum M-13-09 (Washington, D.C.: Mar. 27, 2013). Page 16 GAO-17-384 Veterans Affairs requires IT strategic planning to include outcome-oriented performance measures. 33 In accordance with leading practices, the department has produced multiple strategic plans, road maps, and supplementary guidance that describe the strategic direction for IT across the department. For example, OI&T has issued the following documents and guidance, which describe, among other things, the strategic goals and objectives, transformation priorities, and the future vision for VA IT. • The Fiscal Year 2013 through 2015 Information Resources Management (IRM) Strategic Plan and an associated Enterprise Roadmap. 34 Together, these documents describe the department’s IT strategic goals and objectives. VA has taken steps to show alignment between the IT strategic goals and objectives and the VA Strategic Plan. For example, the objectives in the IRM Strategic Plan include, among other things, managing the IT portfolio and utilizing performance metrics for informed decision making. In addition, the Enterprise Roadmap describes additional OI&T goals and priorities, as well as select programs that are intended to support those priorities between 2016 and 2018. For example, the roadmap identifies health care modernization as one of VA’s key IT investments. • Enterprise Technology Strategic Plan, Fiscal Years 2017 through 2021. 35 OI&T has issued a strategy to achieve VA’s IT vision, which is to lead the department as “a world-class organization that provides a seamless, unified veteran experience through the delivery of state-of- the-art technology.” It sets priorities that are intended to guide decision making at the department. According to the plan, its priorities are in alignment with the MyVA continuous improvement initiative. 36 33 VA, Information Technology Strategic Planning, VA Directive 6052 (Apr. 23, 2009). 34 VA Office of Information and Technology, Department of Veterans Affairs FY 2013-2015 Information Resources Management Strategic Plan (March 28, 2014) and the Department of Veterans Affairs FY2016-2018 Enterprise Roadmap (September 30, 2016). 35 VA, Office of Information and Technology, Enterprise Technology Strategic Plan, Fiscal Year 2017-2021 (Mar. 8, 2016). 36 See VA, MyVA Integrated Plan (MIP) (July 30, 2015).This VA-wide initiative was launched in July 2015 and is aimed toward transforming the veterans’ experience. VA has developed five priorities for this initiative: (1) improving the veteran’s experience, (2) improving the employee experience, (3) improving internal support services, (4) establishing a culture of continuous improvement, and (5) enhancing strategic partnerships. Page 17 GAO-17-384 Veterans Affairs Further, the plan describes the current technical environment. It also details a vision for a future IT environment that plans to utilize new and emerging technologies to improve information availability, information security, reusable shared services, modern applications, and scalable infrastructure. • Multi-Year Programming guidance. OI&T has issued annual guidance for the IT Multi-Year Programming process, which is intended to ensure that the IT appropriation is being directed to those investments that satisfy the most pressing mission requirements of the department. 37 This guidance describes a number of strategic challenges faced by OI&T. For example, the guidance from recent years noted that the retirement of legacy systems and the increasing cost of sustaining those systems were two challenges that should be taken into consideration during the Multi-Year Programming cycle for decisions on IT investments. While OI&T produced these strategic plans, road maps, and supplementary guidance related to IT, none of the documents includes specific results-oriented performance metrics that are called for by VA’s IT strategic planning directive and leading practices. For example, while the IRM Strategic Plan includes a strategic objective related to aligning investments with mission needs, it does not describe or point to a specific target to be achieved, and related performance metrics for how progress against this target will be measured. In addition, VHA has taken steps to define a strategic direction for health IT by issuing its Health Information Strategic Plan for Veterans Health Administration Supporting VA Health Care Version 4.3 (HISP). 38 According to the HISP, this strategy is to inform OI&T’s IRM Strategic Plan. The HISP identifies strategic goals and objectives related to health IT within VHA. For example, one strategic goal included in the plan is to enhance health information processes and practices to ensure that VA health systems are efficient and cost effective, and have the capability needed to deliver quality medical care to veterans. According to the plan, two objectives for achieving this goal are to implement IT innovations that 37 IT Multi-Year Programming is an annual process and serves as the programming phase of OI&T’s Planning, Programming, Budgeting, and Execution process, which is intended to define OI&T’s vision, align IT investments to VA strategy, and capture overall IT requirements of the department. 38 VA, Veterans Health Administration, Health Information Strategic Plan for Veterans Health Administration Supporting VA Health Care (Version 4.3), (March 2017). Page 18 GAO-17-384 Veterans Affairs support efficiency in business operations, such as digitalization of business processes through the use of sensors or other monitoring and automation systems, and to implement a performance measurement capability to monitor and drive a culture of quality and safety. However, VHA’s HISP does not identify corresponding performance targets and metrics for strategic goals and objectives identified in the plan. Further, this lack of performance targets and metrics has been a longstanding issue. For example, a previous version of the plan stated that a workgroup was established in October 2012 to identify performance goals and to create an initial report by May 2013. According to VHA officials, while VHA established a workgroup in October 2012 to identify performance metrics, the workgroup’s recommendations were not adopted. OI&T officials acknowledged that the department’s strategic plans and related documents do not contain performance targets and metrics, but said that VA does report outcome-based operational performance metrics for each major IT investment to OMB’s IT Dashboard. 39 However, these metrics are not specific to the IT goals and objectives outlined in the IRM Strategic Plan and, thus, do not help report how VA is progressing toward achieving its strategic goals and objectives. Further, according to VHA officials, VHA offices are not staffed to identify, track, and report on IT performance measures. Because VA’s IT strategic plans do not identify performance metrics that could be used to track progress toward strategic goals and objectives, VA and VHA lack the ability to accurately track progress toward providing IT systems that address VHA’s business needs and support the performance of its mission. 39 The IT Dashboard is a public website launched by OMB in 2009 to provide visibility into the performance of IT investments at federal agencies. The IT Dashboard displays federal agencies’ cost, schedule, and performance data for major federal IT investments at 26 federal agencies. Page 19 GAO-17-384 Veterans Affairs VHA’s IT Investment According to leading practices for IT investment management, 40 Management Process Is establishing and following a systematic and organized approach to Consistent with Leading investment management helps lay the foundation for successful, predictable, and repeatable investment decisions. Critical elements Practices, but a include instituting an IT investment board and ensuring that an Department-level Board organization develops the process by which IT investments are selected, Has Been Inactive and reselected, and integrated with the process of identifying projects for Clear Investment funding. Depending on its size, structure, and culture, an organization may have more than one IT investment board and each investment board Selection Criteria Have may operate in accordance with its assigned authority and responsibility. Not Been Defined In addition, the investment selection process should include structured reviews of IT proposals, the use of predetermined criteria for analyzing and prioritizing proposals, and analysis and documentation of decisions made to fund some proposals and not others. VA has taken steps to establish a systematic and organized approach to IT investment management. Specifically, the department has integrated its investment management approach with its IT Multi-Year Programming cycle, which is the process used by OI&T to identify and prioritize business needs over a 5-year programming horizon. With the VA budget submission and data collected from the prior Multi-Year Programming cycle as the starting point for the annual process, OI&T uses the list of priorities from VHA, VBA, and NCA to develop an initial IT Program. 41 VA has also instituted multiple levels of investment management, including establishing IT governance and a selection approach in VHA, in addition to department-level IT investment review boards. 42 Within VHA, the administration has developed a governance structure for prioritizing business needs and selecting its IT investments based on those needs. This structure, formally established in November 2015, includes the following components. • Capability management boards: These four boards generally meet monthly to engage with program offices and assess and rank the 40 GAO-04-394G. 41 The IT Program is the list of approved programs and their associated requirements and funding levels. 42 The IT governance approaches used by the VBA and NCA were not within the scope of this review. Page 20 GAO-17-384 Veterans Affairs priority of various business needs by scoring them with weighted criteria 43 related to, for example, how the proposal aligns with VHA mission priorities and the expected benefits as well as the impact of risk to VHA, the maturity of requirements, the complexity of the issue, and the dependencies between individual investments. 44 • Integration Board: The co-chairs of each of the capability management boards generally meet monthly as the Integration Board to ensure that the prioritized lists submitted by each capability management board are consistent and that dependencies between the proposals are assessed. The Integration Board begins to incorporate cost estimates into the process, develops alternative scenarios for prioritization that anticipate OI&T budget allocations, and recommends a consolidated list of investment priorities to the IT Committee. • IT Committee: This committee is charged with setting VHA’s IT strategic direction, 45 overseeing its IT governance and needs prioritization process, and advocating for VHA’s IT funding. Further, this committee is part of the National Leadership Council and is responsible for coordinating with the Council’s other committees to ensure that IT needs are appropriately supported with funding that is consistent with VHA goals, and resolves issues in the execution of the budget to include reprogramming, as appropriate. 46 The committee provides a final list of prioritized investments to the National Leadership Council as part of the Multi-Year Programming process. • National Leadership Council and Under Secretary for Health: The National Leadership Council is VHA’s advisory body for decision making and is comprised of senior VHA leaders, including those 43 The criteria are defined by the IT Committee. 44 The four capability management boards act as subject-matter expects on IT solutions related to specific functional areas including: (1) Clinical, (2) Business, (3) Data Resource and Analytics, and (4) Research and Education. The Clinical and Business capability management boards were operational for the fiscal year 2017 budget formulation process and all four boards participated in the fiscal year 2018 process. 45 The IT Committee has a subcommittee—the Health IT Strategy Sub-Committee—which leads the effort to provide strategic direction within VHA’s health IT by developing the Health Information Strategic Plan. 46 The National Leadership Council is composed of seven committees: (1) Healthcare Delivery Committee, (2) Healthcare Quality and Value Committee, (3) IT Committee, (4) Resource Committee, (5) Strategic Direction Committee, (6) Veteran Experience Committee, and (7) Workforce Committee. Page 21 GAO-17-384 Veterans Affairs within the Office of the Under Secretary for Health. This body is responsible for endorsing the VHA-related IT investment decisions that are submitted to OI&T. According to VHA officials, the administration negotiates with senior executives such as the Deputy Secretary of VA and the CIO in building the budget request that goes to OMB. VHA’s Architecture and Requirements Investment Work Group supports these governance boards by, for example, normalizing and analyzing the submitted IT needs and providing data and cost estimates to help the governance bodies make informed decisions. (See figure 3 for a depiction of VHA’s IT governance structure.) Figure 3: Veterans Health Administration Information Technology (IT) Governance Structure For its part, VA’s department-level IT governance is comprised of two boards that are assigned the responsibility of combining the business needs from VHA and the other business partners and formulating a final IT budget according to department-wide priorities. According to OI&T’s IT Page 22 GAO-17-384 Veterans Affairs Multi-Year Programming guidance, the initial list of programs and their associated funding levels proceeds through these boards for additional review, adjustment, and approval. • IT Leadership Board: According to its charter, VA’s highest level IT investment board is responsible for, among other things, aligning IT resources with business needs, managing the projects, and developing and approving the IT budget. • IT Planning, Programming, Budgeting and Execution Board: The charter for this board states that it is to help facilitate the Multi-Year Programming process, monitor budget execution, and make recommendations to the IT Leadership Board regarding overall long- term plans. According to VA officials, this board also is to make determinations on what projects are eligible for funding with the IT appropriation. However, the IT Leadership Board has not met since July 2015 and is not currently functioning as the department-level IT investment board. Further, VA has not documented criteria that the board could have used to weigh tradeoffs between investments, determine whether one investment is funded over another, or identify how investments are reselected once they are operational. Because the board has not met, OI&T officials stated that an ad hoc group of senior executives was delegated responsibility for making IT investment decisions for the fiscal years 2017-2021 Multi-Year Programming cycle. However, VA did not document the criteria that these groups used to make decisions, nor did the groups document their decisions. For example, there was no documentation of the department’s decision to not approve VHA’s high-priority request for $45.8 million in proposed development funding to improve pharmacy IT capabilities in the fiscal year 2017 cycle. According to OI&T officials, VA has been working to change its approach to department-level IT governance and investment selection as part of the ongoing transformation that has been occurring since January 2016. Among these changes, OI&T chartered 11 new governance boards 47 by 47 The 11 boards include the Architecture Board, the Budget and Planning Review Board, the Customer Service Board, the Enterprise Data Management Board, the Human Capital Planning Board, the Information Security Board, the Portfolio Investment Management Board, the Program Review Board, the Quality Privacy and Risk Board, the Strategic Sourcing Board, and the Transformation Board. Page 23 GAO-17-384 Veterans Affairs October 2016 that are to focus on various aspects of IT strategy, solutions, and standards. One of these boards—the Portfolio Investment Management Board—has been identified by its charter as the department-level IT investment review board to be responsible for integrating IT investment decisions with VA’s mission, strategic plan, budget, and enterprise architecture. While the Portfolio Investment Management Board has been defined as the department-level decision-making body, officials said more time is needed to determine how the board’s responsibilities will be carried out in relationship to the other 10 boards, which also are responsible for various aspects of IT projects, planning, and budgets. In addition, the Portfolio Investment Review Board and OI&T have not issued additional guidance or other documentation related to how the new IT governance structure will work to oversee management of IT across the department. 48 While the transformation of OI&T has the potential to improve the selection of IT investments going forward, the department has not yet documented criteria related to how decisions and tradeoffs will be made or fully demonstrated how the new structure will work. According to OI&T officials, the transformation of IT governance is an evolving process and they plan to continue to improve the process for selecting IT investments and the budgeting process as the department builds the upcoming fiscal year 2019 through fiscal year 2023 budget submissions. However, without using a department-level board to govern IT investments and criteria for selecting them, the department risks wasting limited resources and funding investments that may not fully support VHA’s most important business functions and priorities. 48 OI&T officials stated that the IT Leadership Board will not be included in the transformed governance structure, yet department documentation contradicts that statement. For example, the Portfolio Investment Management Board charter references the IT Leadership Board and a VA directive issued in August 2016 states that rules and standards relative to enterprise-wide management of IT resources are to be governed by the IT Leadership Board. However, the board has not been used as a governance body to make decisions regarding the IT Program since 2015. Page 24 GAO-17-384 Veterans Affairs VHA’s Business Leading enterprise architecture and investment management practices 49 Architecture Defines Its maintain that enterprise architecture can be used to link the organization’s Core Business Functions, strategic mission value (performance results and outcomes) to its technical resources. As such, organizations should implement a but Measurement of the methodology for ensuring that IT investments meet business needs and Extent to Which Functions comply with the architecture. In addition, the extent to which mission Are Supported Is value is actually realized indicates progress toward the desired state Incomplete defined in the architecture and should be periodically measured and reported. VHA has employed a methodology to identify its core business functions in its enterprise architecture and has documented guidance for aligning or mapping 50 IT needs and investments to those functions. These activities are performed to ensure that there is a link between what is reviewed during the investment-selection process and the business needs of the organization. Specifically, according to administration officials, the VHA Business Function Framework is the architectural model that describes the core business functions that are necessary to the mission of delivering health care services and supporting the needs of veterans, health care providers, and resource partners. 51 This framework defines a total of 262 core business functions as part of the VHA business architecture. 52 For example, one line of business described by the framework is “Deliver Health Care.” Under this line of business, there are 86 supporting functions, such as “Provide Clinical Decision Support” and “Provide Nursing Services,” which identify at a high level the core business functions necessary to deliver health care at VA. According to VHA, the Business Function Framework is primarily used to show how business functions map to new service requests, requirements, and IT systems, the results of which are input into the NSR database and VASI. For example, VHA maps IT needs and investments (which can 49 GAO-10-846G and GAO-04-394G. 50 Mapping shows relationships between two components of the architecture. For example, mapping shows the relationship, if it exists, between certain current IT systems and core business functions identified in VHA’s Business Function Framework (version 2.11). 51 VHA Business Function Framework version 2.11 (May 2016). 52 The 262 core business functions include seven lines of business and a hierarchy of 255 supporting core business functions. The VHA business architecture is the part of the VA enterprise architecture that includes defined functions and lower level business processes. Page 25 GAO-17-384 Veterans Affairs include multiple systems) to the Business Function Framework. VHA officials noted that every IT need and system is intended to be mapped to one or more of the defined business functions. VHA has also taken steps toward measuring and reporting the extent to which mission value is actually realized. Specifically, the administration has mapped core business functions to existing clinical, operational, and outcome measures. According to the VHA Business Architecture team, available performance metrics were aligned to a number of core business functions for the fiscal years 2017 and 2018 reviews and the results were provided to VHA capability management boards and could be viewed by board members. In instances where a metric indicated poor performance, proposed investments were assessed for their potential to help VHA improve its performance. Nevertheless, measurement of the extent to which business functions are supported is incomplete. Specifically, VHA has aligned existing metrics with 65 of the 262 core business functions for the fiscal year 2017 Multi- Year Programming cycle. For fiscal year 2018, the team reported that it aligned metrics to 64 of the core business functions. According to VHA officials, the Business Architecture team would like to identify additional operational metrics used by VHA. However, the officials stated that the Business Architecture team is not staffed to identify, track, trace, and report on IT performance metrics and that IT metrics are OI&T’s responsibility. Without aligning additional metrics to all core business functions, VHA is not positioned to effectively gauge the extent to which IT systems address its business needs and support the performance of its mission. VA’s IT systems are generally aligned to VHA core business functions, VHA’s Core Business but the administration has unaddressed needs that indicate current IT Functions Are Not systems do not fully support the functions. To have an effective internal control system, an organization should design its information systems to Fully Supported by achieve its objectives. 53 The management processes discussed in this Current IT Systems report (i.e., strategic planning, investment management, and enterprise architecture) are intended to help ensure that the department’s investment decisions for IT systems address VHA’s strategic and 53 GAO, Standards for Internal Control in the Federal Government, GAO-14-704G (Washington, D.C.: September 2014). Page 26 GAO-17-384 Veterans Affairs functional needs. VASI shows that the vast majority of VHA’s 262 core business functions are supported by the department’s current IT systems or, according to department officials, do not have a need for system support. 54 However, our review of new service requests, which are requests in the NSR database for identified IT needs submitted by VHA programs and business owners, determined that VHA’s core business functions are not fully supported by systems. The NSR database contains needs that have been submitted over time that have not been addressed by an IT system and provide an indication of functions that are not fully supported by systems. In this regard, as of October 2016, VHA had 2,772 requests for IT needs documented in the NSR database since 1998. Of these, approximately 817 were open requests—IT needs identified throughout VHA that had not been met. Further, 316, or about 39 percent, of these open needs are long-standing—they have been open for more than 5 years. Figure 4 provides a breakdown of new service requests as of October 2016. 54 A function may not need IT support if, for example, it is (1) strictly used for human resources; (2) only supported with core operational tools such as Word or Excel; (3) supported by medical equipment and therefore does not need to be aligned with an IT system; or (4) aligned to a system at a lower level subfunction. Page 27 GAO-17-384 Veterans Affairs Figure 4: Breakdown of the Veterans Health Administration’s Information Technology New Service Requests According to department officials, requests are not of equal weight and vary in level of impact and work effort required. For example, the NSR database consists of requests ranging from the creation or modification of reports to the development of new systems. Nonetheless, these requests represent business needs that have not been met, which means there is functionality that is not being provided. The fact that business functions are not fully supported is further illustrated when reviewing needs associated with three program areas— pharmacy benefits management, scheduling, and community care— which all have open requests that represent long-standing, unmet IT needs. These programs are responsible for key functions and IT systems related to health service delivery. Page 28 GAO-17-384 Veterans Affairs Pharmacy Benefits Management Services. As of November 2016, the program office tracked more than 280 open requests to meet IT needs, approximately 38 percent of which were identified 5 or more years ago. For example, the office had a request from 2000 for the development of an inpatient pharmacy order interface to share pharmacy order information with external and commercial systems. In addition, the office had a 2013 request related to a project intended to enhance and modernize VistA Evolution Pharmacy. It also had two requests from 2014 related to a project intended to develop the ability to receive inbound electronic prescriptions and a project intended to address known patient safety issues. Veterans Access to Care (scheduling and consults). As of late September 2016, the program office had more than 20 open requests. Approximately 32 percent of these requests were entered into the NSR database more than 5 years ago. For example, the program office tracked two requests from 2006 related to recommendations made by a VHA Consult Task Force group. The group was created in August 2004 to address disconnects among the consult package, the scheduling package, and the electronic wait list. In addition, the office continues to track a request made in 2007 for the development of a scheduling application to address deficiencies including wait times, resource management, and user satisfaction in order to improve coordination of patient care. This significant long-standing request remains open after a decade without plans for when and how an IT solution will be developed to address this business need. Community Care. The program office, which has been established more recently than pharmacy benefits management or scheduling, was tracking more than 50 open requests as of late September 2016. Approximately 30 percent of these requests were entered into the NSR database more than 5 years ago but were still considered relevant to the community care program. For example, the office tracked a request from 2006, related to the IT solution for flagging emergency care claims. This request had been unaddressed for more than 10 years and the absence of such a system resulted in labor-intensive and error-prone manual processes. Program officials stated that an IT solution to address this is scheduled for release by the end of 2017. Multiple factors have contributed to VHA’s core business functions not being entirely supported by the department’s IT systems. VA spends a significant amount of money on sustaining existing systems, which department officials said has limited the funds available for enhancing or Page 29 GAO-17-384 Veterans Affairs modernizing those systems or acquiring new systems to address VHA’s unmet needs. Furthermore, according to department officials, VHA is challenged because the administration has more business needs than available resources and funding. Additionally, weaknesses in IT strategic planning, investment management, and enterprise architecture processes previously discussed in this report have contributed to a lack of understanding of the extent to which VHA’s business functions require additional IT system support to meet the needs and strategic goals of the administration. As a result, the department risks continuing to make investment decisions and tradeoffs that may fail to address gaps in IT support within its resource limits and may hinder the progress VHA is able to make in improving delivery of health care services to veterans. To VA’s credit, the department’s IT strategic plans describe a vision and Conclusions identify goals and objectives related to IT in general and to health IT within VHA. VHA and OI&T also have established a governance structure responsible for prioritizing the administration’s business needs and reviewing IT investments for inclusion in the budget. In addition, VHA’s core business functions are documented in its enterprise architecture and used to align business needs to IT investments as part of selecting investments. However, VA’s partial implementation of effective IT strategic planning, investment management, and enterprise architecture has put the department at risk of being unable to fully support VHA with the information systems it needs to perform its mission of providing high- quality health care to veterans. Weaknesses in key processes leave VA unable to gauge the extent to which it is providing information systems that meet VHA’s needs. Specifically, the department has not assigned targets or established metrics for measuring performance toward achieving its strategic planning objectives. In addition, VA’s department- level IT investment management activities have lacked implementation of governance boards, application of selection criteria, and documentation of investment decisions. Also, VHA has only aligned metrics with about one quarter of the core business functions identified in its enterprise architecture. According to OI&T officials, ongoing transformation of IT governance is intended to improve the process by which investments are made. However, the results of this transformation have yet to be fully documented and demonstrated. Thus, VA is not well positioned to meet VHA’s information system needs. Page 30 GAO-17-384 Veterans Affairs Not surprisingly, VHA’s IT systems fall short of meeting the needs of clinicians and the veterans they are to serve. While the administration’s core business functions have been aligned to at least one of the department’s current information systems, unaddressed business needs remain and indicate that the functions are not fully supported. Further, within three VHA program areas—pharmacy benefits management, scheduling, and community care—many identified IT needs have been unresolved or unfunded for 5 or more years. Thus despite identifying and prioritizing needs, VHA’s core business functions have not been fully supported by the department’s current information systems and may remain unaddressed for a considerable amount of time. Until the department fully implements IT management processes in accordance with leading practices, it will lack assurance that its information systems fully support VHA’s core business functions and delivery of health care services to veterans. To assist VA in improving key IT management processes to ensure that Recommendations for investments support the delivery of health care services, we recommend Executive Action that the Secretary of Veterans Affairs direct the Under Secretary for Health and the Chief Information Officer to take the following four actions: • Identify performance metrics and associated targets for the goals and objectives in the department’s IT strategic plans, including the Information Resources Management strategic plan and the Health Information Strategic Plan, as they relate to the delivery of health IT and the VHA mission. • Ensure that the department-level investment review structure is implemented as planned and that guidance on the IT governance process is documented and identifies criteria for selecting new investments, and reselecting investments currently operational at VHA. • Identify additional performance metrics to align with VHA’s core business functions, and then use these metrics to determine the extent to which the department’s IT systems support performance of VHA’s mission. • Ensure that unmet IT needs identified by key program areas— pharmacy benefits management, scheduling, and community care— are addressed appropriately and that related business functions are supported by IT systems to the extent required. Page 31 GAO-17-384 Veterans Affairs In written comments on a draft of this report (reprinted in appendix II), VA Agency Comments agreed with our four recommendations. The department also provided and Our Evaluation information on actions it has taken or planned to implement our recommendations, including target completion dates for those actions. For example, in its comments, VA asserted that it has taken steps that fully addressed our recommendation to ensure that its department-level investment review structure is implemented as planned, and that guidance on the IT governance process is documented and identifies criteria for selecting new investments and reselecting investments that are currently operational at VHA. Specifically, the department noted that it had established a new governance process in October 2016 and implemented it as planned. Further, the department provided, as an attachment to its comments, an updated charter for the Portfolio Investment Management Board (dated March 28, 2017) as additional evidence of the board’s process for evaluating IT investments. In our follow up on the department’s implementation of our recommendations, we will assess whether the actions noted are fully responsive to this recommendation. The department also discussed planned actions for addressing our recommendation related to identifying performance metrics and targets for the goals and objectives in VA’s IT strategic plans. Specifically, the department described its intention to develop or revise and maintain performance metrics that align with strategic and health IT goals and objectives. VA also outlined steps the department intends to take in response to our recommendation that it identify additional metrics to align with VHA’s core business functions and then use these metrics to determine the extent to which the department’s IT systems support VHA’s mission. These steps include developing a set of core metrics to provide continuous input into investment portfolio decisions and establishing a methodology for ensuring that IT investments are aligned to business needs and that expected outcomes are defined prior to making the investments. Further, in response to our recommendation that it ensure that unmet IT needs for the pharmacy benefits management, scheduling, and community care program areas are addressed appropriately, the department stated that VHA leadership has recently reviewed all outstanding requests from these program areas to confirm their validity. In addition, the department stated that it plans to include the outstanding needs of these key program areas in its VHA IT Requirements Governance Process during fiscal year 2018 to ensure the needs are addressed in this multi-year planning review. Page 32 GAO-17-384 Veterans Affairs According to VA, its actions in response to our recommendations are expected to be completed by the end of fiscal year 2018. If the department ensures that these and other activities it identified are appropriately documented and effectively implemented, then VA should be better informed to make IT investment decisions that improve the delivery of health care services to veterans. We are sending copies of this report to the appropriate congressional committees, the Secretary of Veterans Affairs, the Under Secretary for Health, the Chief Information Officer, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov If you or your staffs have any questions on matters discussed in this report, please contact me at (202) 512-9286 or pownerd@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix III. David A. Powner Director Information Technology Management Issues Page 33 GAO-17-384 Veterans Affairs Appendix I: Objectives, Scope, and Appendix I: Objectives, Scope, and Methodology Methodology The objectives of this study were to determine the extent to which the Department of Veterans Affairs’ (VA) (1) information technology (IT) management processes are consistent with leading practices and (2) current IT systems support the Veterans Health Administration’s (VHA) core business functions. To address the first objective, we compared VA’s IT management processes for IT strategic planning, investment management, and enterprise architecture to leading practices that federal statutes, prior GAO reports, and the Office of Management and Budget (OMB) have identified to assist organizations with improving the management processes. This comparison focused on the specific aspects of the processes that are intended to ensure that IT investments meet the business needs of the VHA organization. 1 For example: • IT strategic planning: We identified the strategic plans and related planning guidance issued by the Office of Information and Technology (OI&T) and VHA that focused on IT systems and health care IT at VA. We reviewed the department’s assertions in these plans for how IT strategic goals align to the goals of the VA Strategic Plan. Then, we compared the contents of the plans to leading practices identified from federal statutes, prior GAO reports, guidance from OMB related to IT 1 The IT management processes used within the Veterans Benefits Administration and the National Cemetery Administration were not in the scope of our review. Page 34 GAO-17-384 Veterans Affairs Appendix I: Objectives, Scope, and Methodology strategic planning, and a relevant VA directive. 2 In particular, we determined whether VA had taken steps to include strategic goals and objectives that define the levels of performance to be achieved as they relate to ensuring that IT supports the mission needs of the department and VHA; and established related metrics that are specific, verifiable, and measurable. • IT investment management: We analyzed charters and meeting minutes establishing and demonstrating the implementation of governance structures responsible for IT investments at VHA and the department level. We then compared the existing governance structure to critical processes and activities related to governance described in GAO’s IT Investment Management framework. 3 We also analyzed department documentation and guidance related to how business needs are identified and prioritized by VHA and selected to be part of the budget for IT investments by OI&T. We examined 2 GAO has a body of work on effectively managing performance under the Government Performance and Results Act, Pub L. No. 103-62, 107 Stat. 285 (1993) and the GPRA Modernization Act of 2010, Pub. L. No. 111-352, 124 Stat. 3866 (2011). These acts require, among other things, that federal agencies develop strategic plans that include agency wide goals and strategies for achieving those goals. We have reported that these requirements also can serve as leading practices for planning at lower levels within federal agencies, such as individual programs or initiatives. For example, see GAO, Executive Guide: Effectively Implementing the Government Performance and Results Act, GAO/GGD-96-118 (Washington, D.C.: June 1996); Managing for Results: Critical Issues for Improving Federal Agencies’ Strategic Plans, GAO/GGD-97-180 (Washington, D.C.: Sept. 16, 1997); Foreign Aid Reform: Comprehensive Strategy, Interagency Coordination, and Operational Improvements Would Bolster Current Efforts, GAO-09-192 (Washington, D.C.: Apr. 17, 2009). Further, prior GAO work related to IT strategic planning and management practices includes, for example, GAO, Social Security Administration: Improved Planning and Performance Measures Are Needed to Help Ensure Successful Technology Modernization, GAO-12-495 (Washington, D.C.: Apr. 26, 2012); Organizational Transformation: A Framework for Assessing and Improving Enterprise Architecture Management (Version 2.0) (Supersedes GAO-03-584G), GAO-10-846G (Washington, D.C.: August 2010); Defense Business Transformation: Status of Department of Defense Efforts to Develop a Management Approach to Guide Business Transformation, GAO-09-272R (Washington, D.C.: Jan. 9, 2009); and Library of Congress: Strong Leadership Needed to Address Serious Information Technology Management Weaknesses, GAO-15-315 (Washington, D.C.: Mar. 31, 2015). In addition, OMB issues related guidance such as: OMB, Preparation, Submission, and Execution of the Budget, Circular No. A-11 (Washington, D.C. July 2013); Managing Information as a Strategic Resource, Circular A-130 (Washington, D.C.: July 28, 2016); and OMB Memorandum M-13-09 (Washington, D.C.: Mar. 27, 2013), and VA issued a related directive: VA, Information Technology Strategic Planning, VA Directive 6052 (Apr. 23, 2009). 3 GAO, Information Technology Investment Management: A Framework for Assessing and Improving Process Maturity (Version 1.1), GAO-04-394G (Washington, D.C.: March 2004). Page 35 GAO-17-384 Veterans Affairs Appendix I: Objectives, Scope, and Methodology results of this process for the fiscal year 2017 budget formulation process. We compared our analysis to critical processes related to investment selection described in GAO’s framework. In addition, we interviewed officials familiar with the VHA prioritization process and OI&T investment management and budget formulation processes to clarify department policies and guidance. • Enterprise architecture: We analyzed department documentation and interviewed cognizant officials about the steps taken to ensure that IT investments support the department’s business needs and compared our findings to key elements described in GAO’s Enterprise Architecture Management Maturity Framework and IT Investment Management. 4 Further, we compared the number of metrics that were aligned to business functions by VHA to the list of all business functions identified in the enterprise architecture to determine the extent to which the functions have associated metrics available to inform the investment management process. To address the second objective, we examined department data to understand how VA might demonstrate that its IT systems are designed to meet its objectives. 5 First, we analyzed the VHA Business Function Framework (Version 2.11), which documents the VHA functional operations within the business architecture, to compile a list of all core business functions that VHA has determined are necessary to deliver health care. This framework provides the basis by which the department shows relationships between various components of the enterprise architecture and is used to help view, organize, and prioritize VHA’s business activities. We then compared this list of core business functions to data in the VA Systems Inventory (VASI) 6 database, which identifies VA’s current inventory of IT systems 7 and how they are mapped 8 to the VHA core 4 GAO-10-846G and GAO-04-394G. 5 GAO, Standards for Internal Control in the Federal Government, GAO-14-704G (Washington, D.C.: September 2014). 6 VA, VA Directive 6404: Department of Veterans Affairs VA Systems Inventory (VASI) (Washington, D.C., Feb. 23, 2016). According to VA Directive 6404, VASI is the authoritative data source for VA’s IT systems. The Office of Information and Technology (OI&T) is responsible for the development and sustainment of VASI. 7 According to department officials, the current inventory of systems in VASI is composed of systems that are identified as having a status of “active” or “in development.” Page 36 GAO-17-384 Veterans Affairs Appendix I: Objectives, Scope, and Methodology business functions. VHA officials noted that VASI is the authoritative source for business function mapping. We assessed the reliability of data from VASI and determined that the data were reliable for the purposes of our reporting objectives. For any core functions initially not aligned to a current IT system, we reconciled the differences with cognizant VA officials. There were 5 functions (from a total of 262 functions) that could not be reconciled. We determined that this number, which represented less than 2 percent of the total number of functions, was not significant to our findings. While the results of this alignment showed a relationship between many current IT systems and VHA’s core business functions can be demonstrated, the results did not provide insight into how well the functions are being supported by those IT systems. We then analyzed data from VHA’s new service request (NSR) database, which captures information related to business needs such as IT enhancements submitted throughout the department. We analyzed data from the NSR database to identify the number of requests in the database, when requests were entered, and the number of requests that remain open. Our analysis allowed us to describe the number of open requests, but could not provide insight into the depth of work required for requests themselves, nor the weight the business owners assigned to each open need, because the NSR database does not include data on the importance, level of impact, and work effort required to address each request. We found the VA data from VASI and the NSR database to be sufficiently reliable for the purposes of our reporting objectives and used the data as evidence to support our findings, conclusions, and recommendations. For each data set, we reviewed documentation related to the databases, such as the data dictionary, tested the data sets to look for duplicate records and missing data in key fields, and examined the relationship between data elements. We also interviewed department officials about data reliability and internal controls procedures for the database and interviewed knowledgeable officials on the results of our findings. 8 Mapping shows relationships between two components of the architecture. In this instance, mapping showed that a relationship exists between certain current IT systems and core business functions identified in VHA’s Business Function Framework (Version 2.11). Page 37 GAO-17-384 Veterans Affairs Appendix I: Objectives, Scope, and Methodology We conducted additional analyses of three programs related to health service delivery on which we have previously reported—Pharmacy Benefits Management Services, Veterans Access to Care (scheduling and consults), and Community Care. 9 Our review of NSRs for the aforementioned program offices included verifying the open NSRs assigned to each program office and interviewing cognizant officials from VHA regarding the IT systems used by the three programs, the needs identification and management process to understand the extent to which VHA business needs are being addressed, and about the extent to which current systems supporting VHA core business functions in their respective areas. The results of this analysis are not generalizable to all functional areas, but provide insight into the extent of IT support for the three specific programs. We conducted this performance audit from December 2015 to June 2017 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. 9 Veterans Access to Care (scheduling and consults): GAO, Veterans Affairs: Sustained Management Attention Needed to Address Numerous IT Challenges, GAO-16-762T (Washington, D.C.: June 22, 2016); Information Technology: Management Improvements Are Essential to VA’s Second Effort to Replace Its Outpatient Scheduling System, GAO-10-579 (Washington, D.C.: May 27, 2010); and Veterans Affairs Information Technology: Management Attention Needed to Improve Critical System Modernizations, Consolidate Data Centers, and Retire Legacy Systems, GAO-17-408T (Washington, D.C.: Feb. 7, 2017). Pharmacy Benefits Management Services: GAO, VA Information Technology: Pharmacy System Needs Additional Capabilities for Viewing, Exchanging, and Using Data to Better Serve Veterans, GAO-17-179 (Washington, D.C.: June 14, 2017); VA Drug Formulary: Drug Review Process Is Standardized at the National Level, but Actions Are Needed to Ensure Timely Adjudication of Nonformulary Drug Requests, GAO-10-776 (Washington, D.C.: Aug. 31, 2010); and DOD and VA Outpatient Pharmacy Data: Computable Data Are Exchanged for Some Shared Patients, but Additional Steps Could Facilitate Exchanging These Data for All Shared Patients, GAO-07-554R (Washington, D.C.: Apr. 30, 2007). Community Care: GAO, Veterans’ Health Care: Improved Oversight of Community Care Physicians’ Credentials Needed, GAO-16-795 (Washington, D.C.: Sept. 19, 2016); Veterans’ Health Care: Proper Plan Needed to Modernize System for Paying Community Providers, GAO-16-353 (Washington, D.C.: May 11, 2016); VA Health Care: Actions Needed to Improve Monitoring and Oversight of Non-VA and Contract Care, GAO-15-654T (Washington, D.C.: June 1, 2015); and VA Health Care: Management and Oversight of Fee Basis Care Need Improvement, GAO-13-441 (Washington, D.C.: May 31, 2013). Page 38 GAO-17-384 Veterans Affairs Appendix II: Comments from the Department Appendix II: Comments from the Department of Veterans Affairs of Veterans Affairs Page 39 GAO-17-384 Veterans Affairs Appendix II: Comments from the Department of Veterans Affairs Page 40 GAO-17-384 Veterans Affairs Appendix II: Comments from the Department of Veterans Affairs Page 41 GAO-17-384 Veterans Affairs Appendix II: Comments from the Department of Veterans Affairs Page 42 GAO-17-384 Veterans Affairs Appendix III: GAO Contact and Staff Appendix III: GAO Contact and Staff Acknowledgments Acknowledgments David A. Powner, (202) 512-9286 or pownerd@gao.gov. GAO Contact In addition to the contact named above, Mark Bird (Assistant Director), Staff Jennifer Stavros-Turner (Analyst in Charge), Chris Businsky, Rebecca Acknowledgments Eyler, Jacqueline Mai, Dwayne Staten, and Charles Youman made key contributions to this report. (100436) Page 43 GAO-17-384 Veterans Affairs The Government Accountability Office, the audit, evaluation, and investigative GAO’s Mission arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability. The fastest and easiest way to obtain copies of GAO documents at no cost is Obtaining Copies of through GAO’s website (http://www.gao.gov). Each weekday afternoon, GAO GAO Reports and posts on its website newly released reports, testimony, and correspondence. To have GAO e-mail you a list of newly posted products, go to http://www.gao.gov Testimony and select “E-mail Updates.” Order by Phone The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO’s website, http://www.gao.gov/ordering.htm. Place orders by calling (202) 512-6000, toll free (866) 801-7077, or TDD (202) 512-2537. Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information. Connect with GAO on Facebook, Flickr, LinkedIn, Twitter, and YouTube. Connect with GAO Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts. Visit GAO on the web at www.gao.gov and read The Watchblog. Contact: To Report Fraud, Website: http://www.gao.gov/fraudnet/fraudnet.htm Waste, and Abuse in E-mail: fraudnet@gao.gov Federal Programs Automated answering system: (800) 424-5454 or (202) 512-7470 Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-4400, Congressional U.S. Government Accountability Office, 441 G Street NW, Room 7125, Relations Washington, DC 20548 Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800 Public Affairs U.S. Government Accountability Office, 441 G Street NW, Room 7149 Washington, DC 20548 James-Christian Blockwood, Managing Director, spel@gao.gov, (202) 512-4707 Strategic Planning and U.S. Government Accountability Office, 441 G Street NW, Room 7814, External Liaison Washington, DC 20548 Please Print on Recycled Paper.