The Government Accountability Office gave testimony before the House of Representatives and several veteran affairs committees on EHR modernization and cybersecurity issues that should be addressed by the Department of Veteran Affairs, according to a July 1 GAO report.
Five key takeaways:
- After 20 years, the VA began to make progress toward its modernization goals through its February EHR rollout with Cerner. The GAO recommended the VA address several critical aspects of its physical infrastructure or warned the rollout could fail. The EHR launch was soon paused for the third time in April because it caused patients and hospital staff distress.
- The VA's fiscal year 2022 budget requested $2.7 billion for its EHR modernization program, with $1.4 billion directly for its $16 billion contract with Cerner. According to the VA's chief technical officer, Cerner is expected to provide integration, testing, deployment, hosting, organizational change management, training, sustainment and the licenses necessary to deploy the system in a manner that meets the VA's needs, the report said.
- The VA has struggled to secure data on its computer systems, implement security controls and address known security vulnerabilities. GAO has made several recommendations to the VA. Many of the recommendations have been fixed, but others are not fully addressed, the report said. For example, the VA has not enhanced the authority of its CIO, which would allow the chief to approve IT budgets and contracts.
- The lack of cybersecurity management is concerning since the VA is susceptible to cyber threats, the report said. GAO recommends the VA factor cybersecurity into its cybersecurity budget.
- "We have made recommendations aimed at helping the department to achieve its goals related to these efforts," the report said. "However, if the department continues to experience the challenges that we have previously identified and does not take actions to address our recommendations, it may jeopardize its ability to effectively support the [modernization of its EHR and financial IT systems]."