Department of Veterans Affairs
 

Office of Inspector General
 

Healthcare Inspection
 

Prosthetic and Sensory Aids
 

Service Records Review
 

Durham VA Medical Center
 

Durham, North Carolina
 

Report No. 11-01416-212 July 7, 2011
 VA Office of Inspector General
 

Washington, DC 20420
 
To Report Suspected Wrongdoing in VA Programs and Operations:
 

Telephone: 1-800-488-8244
 

E-Mail: vaoighotline@va.gov
 

(Hotline Information: http://www.va.gov/oig/contacts/hotline.asp)
 
Executive Summary
 

At the request of Senator Richard Burr, Ranking Member of the Senate Committee on

Veterans’ Affairs, the Office of Inspector General conducted an inspection of the

Prosthetic and Sensory Aids Service at the facility. Specifically, we reviewed the

potential loss of veterans’ Home Improvement and Structural Alterations (HISA) grant

records that contained Personally Identifiable Information1

, which may have caused

undue delays in providing these critical modifications to veteran’s homes.

We were unable to determine the exact number of HISA records missing. We estimate

that as many as 90 records are missing. We found numerous discrepancies in the

oversight and administration of the HISA program, which contributed to the lack of

management control over this program. During our inspection, we found that some

HISA grants were paid without the required documentation and therefore, in those cases

the records and associated PII were not missing.

We found that facility managers did not place appropriate emphasis on protecting,

investigating, and reporting lost or stolen files that contained PII. The investigations

conducted by the facility did not attempt to resolve discrepancies in the number of files

lost or the number recovered. More than 3 weeks passed from the discovery of the lost

records to notification of appropriate authorities.

Since the discovery of the missing files, personnel and leadership changes in the

prosthetics department have been addressed. The facility is implementing changes to

improve the delivery of services and bring Prosthetic and Sensory Aids Service into

compliance with Veterans Health Administration (VHA) directives. The HISA

committee is functioning and other internal controls are being enforced.

We recommended that the Medical Center Director:

	 Take additional steps to ensure contact and assistance to those veterans whose

HISA consult is unfulfilled.

	 Follow VHA directive for reporting, recording, and completing patient complaints.

	 Ensure that closures of medical consults are in compliance with VHA policies.

	 Ensure protection of Personally Identifiable Information and reporting of privacy

events as required by VHA policies.

	 Proactively identify the veterans affected by the loss of their HISA records and

provide necessary assistance to them to expedite their HISA services.

1 PII is any information about an individual that can reasonably be used to identify that individual and

that is maintained by VA.

VA Office of Inspector General i 
The Veterans Integrated Service Network and Medical Center Directors concurred with

the findings and recommendations and provided acceptable action plans. We will follow

up on the planned actions until they are completed.

VA Office of Inspector General ii 
Introduction
 

Purpose 

The VA Office of Inspector General (OIG) Office of Healthcare Inspections conducted a

review of the loss of veterans’ prosthetic records at the Durham VA Medical Center (the

facility), Durham, NC. The purpose of the inspection was to determine:

 How many records were lost?

 What was the impact of the loss on veterans’ care?

 What steps were taken to inform veterans of the lost records?

 What actions were taken to ensure a similar loss would not occur again?

Background 

At the request of Senator Richard Burr, Ranking Member of the Senate Committee on

Veterans’ Affairs, the OIG Office of Healthcare Inspections conducted an inspection of

the Prosthetic and Sensory Aids Service (PSAS) at the facility. Specifically, we reviewed

the loss of veterans’ Home Improvement and Structural Alterations (HISA) grant records

that contained Personally Identifiable Information (PII),2 which may have caused undue

delays in providing critical modifications to veteran’s homes.

The facility is a 271-bed tertiary care center affiliated with Duke University School of

Medicine. The facility provides medical, surgical, and psychiatric services, and serves as

a major referral center for North Carolina, southern Virginia, northern South Carolina,

and eastern Tennessee. The facility is a regional center for radiation therapy,

neurological disorders, therapeutic endoscopy, and other specialty services. The facility

is part of Veterans Integrated Service Network (VISN) 6.

The PSAS provides prosthetic and orthotic services, sensory aids, medical equipment,

and support services for veterans. In fiscal year (FY) 2010, the Durham PSAS served

22,000 veterans and managed a budget of approximately $31 million. The HISA

program, managed by PSAS, provides funds to veterans to help defray costs associated

with structural modifications of homes to accommodate wheelchairs or other special

needs. The maximum amount of the grant is currently $6,800 for a service-connected

disability and $2,000 for a non-service-connected disability. The veteran is responsible

for structural modification costs that exceed the grant amount. Veterans Health

Administration (VHA) requires3 a medical consultation (consult) by a physician for the

HISA process to begin. The HISA consult must include the medical justification for the

2 PII is any information about an individual that can reasonably be used to identify that individual and
 

that is maintained by VA.

3 VHA Handbook 1173.14, Home Improvements and Structural Alterations (HISA) Program, April 18, 2008.
 

VA Office of Inspector General 1 
modification, the veteran’s name, address, last four digits of Social Security Number

(SSN), and phone number. When completed, the veteran’s HISA folder contains the

medical consult and the following items provided by the veteran:

1. Completed	 and signed copy of VA Form 10-0103, Veterans Application for 

Assistance in Acquiring HISA 

2. If the veteran leases or rents the home, he/she must have a written statement from

the owner of the property authorizing the project to be done.

3. The home modification requires three competitive bids from a bonded or licensed

contractor, if required by state law, which must include the following:

a.	 The contractor’s name, address, phone number, and last four digits of SSN

or Federal ID number

b. The veteran’s name, address, and phone number

c.	 A written statement and the plans of the project to be performed to include

a sketch of the work to be completed

d. An itemized list of materials, including the material and labor costs for each

part of the project

4. A signed acknowledgement from the veteran that the veteran understands that the

VA assumes no responsibility, warranty, or liability for the home modifications

HISA Program Management Oversight 

In June 2010, while performing oversight responsibilities VISN 6 identified problems

with the facility’s HISA program that involved grant payment irregularities. In July

2010, the VISN reviewer followed up by conducting an on-site review and identified

additional concerns. On September 14–17, 2010, VA Central Office (VACO), Office of

Patient Care Services conducted a program review of the facility PSAS due to the

concerns raised by the VISN and found serious lapses in internal controls, lack of

documentation in patient records, and a general disregard of policies and directives. The

office where HISA files were maintained was usually cluttered and disorganized.

However, the office was cleaned and tidied up prior to the VACO program review.

Scope and Methodology 

We conducted two site visits on February 15–18 and February 28–March 4, 2011. Prior

to our first visit, we reviewed local and VHA policies, VHA directives, references for

HISA grants and lost PII reporting requirements; AIB testimonies and conclusions; the

report of facility PSAS Program Review conducted by VACO on

September 14–17, 2010; and the Privacy Violation Tracking System report files. While

onsite, we interviewed facility police, PSAS staff, and administrative staff.

VA Office of Inspector General 2 
We conducted the review in accordance with Quality Standards for Inspection and 

Evaluation published by the Council of Inspectors General on Integrity and Efficiency.

Results and Conclusions 

Issue 1: Number of HISA Records Missing 

Missing Record Chronology 

On September 17, 2010, prosthetic employees first noticed the HISA office was less

cluttered. On Monday, September 20, when staff was unable to find HISA files in any

other location, they reported the missing records to their supervisor. The supervisor

contacted facility police later that afternoon. The police did not conduct an investigation

or file a report because there was no mention of missing records containing PII.

On September 21, 2010, the supervisor reported to facility management that there might

be missing records containing PII. Management directed the supervisor to work with

police officers and the facility Privacy Officer to investigate the circumstances

surrounding the lost records. On October 8, 2010, the supervisor informed the Privacy

Officer of missing records containing PII.

On October 4, 2010, a prosthetics staff worker contacted a second prosthetic staff worker

in an effort to find the missing HISA files. The second staff worker reported that there

were five–seven records in another office in the facility and arranged for the return of

those HISA files to PSAS on October 7, 2010.

On October 12, 2010, the Privacy Officer reported 29 HISA records missing on the

Privacy Violation Tracking System. This number of records was provided by the

prosthetics supervisor.

On November 3, 2010, the facility Director signed the charge letter to convene an AIB to

investigate allegations of improper processing of HISA grants and inappropriate removal

of related VA records in PSAS. The AIB concluded that VA records were improperly

removed, although they could not determine how many records were removed or whether

PII information was compromised.

Findings 

We estimate that as many as 90 records are missing, which is 61 more records than the

29 reported by the facility. We conducted a search of the PSAS office spaces, electronic

files, and prosthetics file boxes marked for off-site storage to identify all the HISA

records present. We performed an analysis of all HISA consults issued with

corresponding HISA grant payments made during FY 2010 in an attempt to determine all

the records that should be present. We also reviewed the record of patient complaints

VA Office of Inspector General 3 
that their HISA grants were not received that did not have any corresponding record at

the facility.

We determined that 90 HISA records were missing based on the following conditions:

	 Record of a HISA grant paid with no supporting documentation – (52 records)

	 Record of patient complaints that HISA grant was not paid – (8 records)

	 Empty folder in HISA office with patient name and a contents checklist indicating

that documentation had been present – (1 record)

	 Records reported missing by the facility – (29 records)

We found numerous discrepancies in the oversight and administration of the HISA

program, which contributed to the lack of management control over this program.

During our investigation, we found that some HISA payments were made without

required documentation or appropriate approvals. VHA directives require that the facility

Director establish a HISA committee responsible for evaluating, approving, and

disapproving HISA requests and contractor bids. The HISA committee is a key internal

control to ensure compliance with approval of HISA grant funds. PSAS did not have a

functioning HISA committee for more than a year prior to our visits.

The Privacy Officer filed a report in the Privacy Violation Tracking System for

29 missing veteran records and noted the accuracy of this number was questionable. The

case was closed with no additional findings. When interviewed by the AIB, the Privacy

Officer stated that the number of records reported missing was based on a list provided

by the supervisor and was not verified.

We reviewed HISA complaints recorded in the Patient Advocate Tracking system

(PATS) to identify veterans whose records were missing and found that veteran

complaints in PATS did not identify actions taken to resolve the complaint. We

interviewed PSAS staff, who reported that they did not keep a record of complaints that

came directly into PSAS or record them in PATS as required.

We reviewed prosthetic consults from FY 2010 and found that most consults were

marked competed prior to the work being performed, and therefore, did not comply with

VHA directive.4 We found numerous HISA payments had been made without the

required HISA medical consult that was needed to justify the receipt of a HISA grant.

Conclusion 

We found that facility managers did not place appropriate emphasis on protecting,

investigating, and reporting lost or stolen files that contained PII. The investigations

conducted by the Privacy Officer and the AIB did not go far enough to resolve

4 VHA Directive 2008-156, VHA Consult Policy, September 16, 2008.

VA Office of Inspector General 4 
discrepancies in the number of files lost or the number recovered. More than 3 weeks

passed from the discovery of the lost records to notification of appropriate authorities. A

more timely and thorough investigation may have revealed the oversight and

management problems in the PSAS.

It is difficult to determine the exact number of records that are missing without internal

controls and documentation. We found evidence that much of the required HISA

documentation was never done and therefore did not exist. The HISA committee would

have helped ensure documentation and establish an audit trail of documents present. We

estimated that up to 90 records are missing based on our analysis of the records located

and the current records that should have been on file.

Recommendation 1: We recommended that the Medical Center Director take additional

steps to ensure contact and assistance to those veterans whose HISA consult is

unfulfilled.

Recommendation 2: We recommended that the Medical Center Director ensure that

patient complaints follow VHA directive for reporting, recording, and completing the

complaint.

Recommendation 3: We recommended that the Medical Center Director ensure that

closures of medical consults are in compliance with VHA policies.

Issue 2: Affected Veterans Notified of Lost Records 

Findings 

The VA has the responsibility to protect PII at all times. A privacy violation event occurs

when PII is compromised or lost. VA Directive5 states that when notified of any

complaint, potential or actual privacy violation, the Privacy Officer will file a report

within 1 hour of discovery of the event in the PVTS. The Privacy Officer must resolve

each incident as soon as possible.

On November 17, 2010, 2 months after the first discovery of missing records and more

than 1 month after notification of the Privacy Officer, the facility notified the

29 identified veterans that prosthetic records were missing that included their PII. The

letter recommended that the veteran request a credit report and gave instructions on how

to enroll in credit monitoring. During our review, we identified 61 additional veterans

who were not identified by the facility with missing HISA records. The facility is

notifying the additional 61 identified veterans.

5 VHA Handbook 6502.1, Privacy Event Tracking, February 18, 2011.

VA Office of Inspector General 5 
Conclusion
 

We determined that the delayed Privacy Officer’s investigation was due to attempts to get

information on all veterans involved in the lost records from involved PSAS employees.

However, the facility should have been more aggressive in investigating, reporting, and

notifying veterans of a potential compromise of PII information.

Recommendation 4: We recommended that the Medical Center Director ensure

protection of PII and reporting of privacy events as required by VHA policies.

Issue 3: Effect of the Record Loss on Veterans 

Findings 

Veterans’ care is hampered when patient records are not properly secured and maintained

to ensure privacy and confidentiality. The loss of prosthetics records not only

compromised veterans’ privacy, but also delayed the approval and payment of HISA

services. We found the PSAS department was not proactive in determining the extent of

the loss of records and only attempted to investigate the issue when complaints were

made. PSAS staff told us that they knew there were more missing records than the

29 reported, but steps were not taken to identify the additional missing records.

Conclusion 

Facility managers failed to mitigate the loss of patient records and the delays imposed on

veterans waiting for HISA services.

Recommendation 5: We recommended that the Medical Center be more proactive in

identifying the veterans affected by the loss of their HISA records and provide necessary

assistance to them to expedite their HISA services.

Issue 4: Review Changes to Prevent Re-Occurrences 

Findings 

Since the discovery of the missing files, personnel and leadership changes in the

prosthetics department have been addressed. The facility is implementing changes to

improve the delivery of services and bring PSAS into compliance with VHA directives.

The HISA committee is functioning and other internal controls are being enforced.

Conclusion 

Management has recognized the improvement needed in the PSAS and appropriate

changes have been made to improve the delivery of services. Both the facility and

VACO are monitoring PSAS changes.

VA Office of Inspector General 6 
Comments 

The VISN and Medical Center Directors concurred with our findings and

recommendations (see Appendixes A and B, pages 8–12 for the full text of their

comments). The implementation plans are acceptable, and we will follow up on the

actions in six months.

JOHN D. DAIGH, JR., M.D.
 

Assistant Inspector General for
 

Healthcare Inspections
 

VA Office of Inspector General 7 
Prosthetics and Sensory Aids Service Records Review, Durham VA Medical Center; Durham, North Carolina 

Appendix A 

VISN Director Comments 

Department of 

Veterans Affairs Memorandum 

Date: June 9, 2011

From: Director, VA Mid-Atlantic Health Care Network (10N6)

Subject: Healthcare Inspection – Prosthetics and Sensory Aids Service 

Records Review, Durham VA Medical Center; Durham, 

North Carolina 

To: Director, Healthcare Financial Analysis Division (54D)

Thru: Director, VHA Management Review Service (10A4A4)

1.	 The attached subject report is forwarded for your review

and further action. I have reviewed the responses and

concur with the facility’s recommendations.

2. Please	 contact, Ralph Gigliotti, Director, Durham VA

Medical Center, at (919) 286-6903, if you have any

further questions.

(original signed by:) 

Daniel F. Hoffmann, FACHE
 

Director, VA Mid-Atlantic Health Care Network (10N6)
 

VA Office of Inspector General 8 
Prosthetics and Sensory Aids Service Records Review, Durham VA Medical Center; Durham, North Carolina 

Appendix B 

Facility Director Comments 

Department of 

Veterans Affairs Memorandum 

Date: June 9, 2011

From: Director, Durham VA Medical Center (558/00)

Subject: Healthcare Inspection –Prosthetics and Sensory Aids Service 

Records Review, Durham VA Medical Center, Durham, 

North Carolina 

To: Director, VA Mid-Atlantic Health Care Network (10N6)

This memo serves to acknowledge receipt and review of the

draft Healthcare Inspection Report for the Prosthetics and 

Sensory Aids Service Records Review, Durham VA Medical 

Center, Durham, North Carolina.

Thank you for the opportunity to comment on the

recommendations for improvement contained in this report.

If you have any questions, please contact Sara Haigh,

Assistant Director, at (919) 286-6904.

(original signed by:) 

Ralph T. Gigliotti, FACHE
 

Director, Durham VA Medical Center (558/00)
 

VA Office of Inspector General 9 
Prosthetics and Sensory Aids Service Records Review, Durham VA Medical Center; Durham, North Carolina 

Facility Director’s Comments
 

to Office of Inspector General’s Report
 

The following Director’s comments are submitted in response to the

recommendations in the Office of Inspector General’s report:

OIG Recommendations 

Recommendation 1. We recommended that the Medical Center Director

take additional steps to ensure contact and assistance to those veterans

whose HISA consult is unfulfilled.

Concur Completion Date: May 31, 2011

Facility’s Response: 

The Durham VA Medical Center systematically reviewed all HISA

applications and HISA-related documents for all veterans whose HISA

consult is unfulfilled. Follow-up was done with each veteran as needed to

determine the status of their application and related files. Some veterans no

longer required home structural alterations, so their consult and file was

closed. For open cases, Prosthetics staff contacted the veteran and/or the

contractor to check current status and provide assistance with any needed

authorizations for completion of the work. In cases where there were

incomplete or missing files, new document sets were created. All open

cases will be closely tracked to completion to ensure needed services are

received in a timely manner.

Status: The HISA program will be closely monitored and patient case files

will be tracked to ensure all program requirements are met.

Recommendation 2. We recommended that the Medical Center Director

ensure that patient complaints follow VHA directive for reporting,

recording, and completing the complaint.

Concur Completion Date: May 31, 2011 

Facility’s Response: 

VA Office of Inspector General 10 
Prosthetics and Sensory Aids Service Records Review, Durham VA Medical Center; Durham, North Carolina 

Complaints received about Prosthetics and Sensory Aids Service (PSAS)

were previously documented in the Patient Advocate Tracking System by

the medical center Patient Advocates when the issue was brought to the

attention of the facility advocate, but not by PSAS staff if they received the

complaint themselves. PSAS has now designated three employees to serve

as Patient Advocate Liaisons/Service Level Advocates. These employees

have received training in how to enter patient issues into the Patient

Advocate Tracking System (PATS), receive and respond to action

notifications, and how to enter the resolution for any issues that are initially

reported to their service as well as to the facility Patient Advocates. PSAS

participates in monthly meetings and related training for the Patient

Advocate Liaisons, where all PATS data is reviewed and tracked by the

appropriate service level advocate. General facility reports are tracked,

trended, and reported at the Customer Service Council.

Status: Training has been provided in use of PATS, and systems are in

place to monitor and track completeness of PATS entries.

Recommendation 3. We recommended that the Medical Center Director

ensure that closures of medical consults are in compliance with VHA

policies.

Concur Target Completion Date: April 7, 2011

Facility’s Response: 

The practice of marking consults as “Complete” without clear

documentation of the actual status of the requested item was discontinued

as of April 2011. Consults remain in pending status until the request item

has been issued or there is specific documentation about the reason for

closing the consult. Performance is monitored using the National

Prosthetic Patient Database (NPPD) and audits of purchasing agent

documentation. Performance standards include expected outcomes for

consult completion.

Status: Complete–new process in place, with supervisory oversight to

ensure ongoing compliance.

Recommendation 4. We recommended that the Medical Center Director

ensure protection of PII and reporting of privacy events as required by

VHA policies.

VA Office of Inspector General 11 
Prosthetics and Sensory Aids Service Records Review, Durham VA Medical Center; Durham, North Carolina 

Concur Completion Date: April 2011

Facility’s Response: 

It is recognized that the Chief, PSAS and the Privacy Officer were not

sufficiently aggressive in conducting a thorough and timely investigation

when it was determined that files could not be located

The new Privacy Officer and all management officials will ensure

protection of Personally Identifiable Information and prompt investigation

and reporting of any complaints, potential or actual privacy violations.

Status: Complete.

Recommendation 5. We recommended that the Medical Center be more

proactive in identifying the veterans affected by the loss of their HISA

records and provide necessary assistance to them to expedite their HISA

services.

Concur Target Completion Date: May 31, 2011

Facility’s Response: 

The medical center has systematically reviewed all HISA applicants

including those for whom records were missing or incomplete. Each

veteran has been contacted and assisted as needed to expedite their HISA

services. New standard operating procedures are in place to ensure careful

tracking of all HISA applications and maintenance of files.

Status: Review is complete and assistance has been offered.

VA Office of Inspector General 12 
Prosthetics and Sensory Aids Service Records Review, Durham VA Medical Center; Durham, North Carolina 

Appendix C 

OIG Contact and Staff Acknowledgments 

OIG Contact	 For more information about this report, please contact the

Office of Inspector General at (202) 461-4720.

Acknowledgments	 Anthony Murray Leigh, CPA, Team Leader

Nathan Fong, CPA

Cathleen King, RN

Thomas Seluzicki, CPA

VA Office of Inspector General 13 
Prosthetics and Sensory Aids Service Records Review, Durham VA Medical Center; Durham, North Carolina 

Appendix D 

Report Distribution 

VA Distribution 

Office of the Secretary

Veterans Health Administration

Assistant Secretaries

General Counsel

Director, VA Mid-Atlantic Health Care Network (10N6)

Director, Durham VA Medical Center (558/00)

Non-VA Distribution 

House Committee on Veterans’ Affairs

House Appropriations Subcommittee on Military Construction, Veterans Affairs, and

Related Agencies

House Committee on Oversight and Government Reform

Senate Committee on Veterans’ Affairs

Senate Appropriations Subcommittee on Military Construction, Veterans Affairs, and

Related Agencies

Senate Committee on Homeland Security and Governmental Affairs

National Veterans Service Organizations

Government Accountability Office

Office of Management and Budget

U.S. Senate: Richard Burr, Kay R. Hagan

U.S. House of Representatives: David Price

This report is available at http://www.va.gov/oig/publications/reports-list.asp.

VA Office of Inspector General 14