GAO

United States General Accounting Office

Testimony

Before the Subcommittee on Oversight and Investigations, 

Committee on Veterans’ Affairs, House of Representatives

For Release on Delivery

Expected at

10 a.m.

Thursday,

October 28, 1999

YEAR 2000 COMPUTING 

CHALLENGE

Update on the Readiness of 

the Department of Veterans 

Affairs

Statement of Joel C. Willemssen

Director, Civil Agencies Information Systems

Accounting and Information Management Division

GAO/T-AIMD-00-39

Page 1 GAO/T-AIMD-00-39

Mr. Chairman and Members of the Subcommittee:

Thank you for inviting us to participate in today’s hearing on the 

Department of Veterans Affairs’ (VA) efforts to address the Year 2000 (Y2K) 

computer problem.1

 My testimony today will focus on the Y2K readiness of 

automated systems that support the delivery of veterans’ benefits and 

health care services, the compliance status of biomedical equipment used 

in patient care, and the Y2K readiness of the pharmaceutical and 

medical-surgical manufacturers on which VA relies. I will also share with 

you information on the Food and Drug Administration’s (FDA) Y2K efforts 

to address biomedical equipment and pharmaceutical products.2

In brief, VA continues to make progress in addressing the Y2K problem. It 

has established a moratorium on software changes and has developed a 

Day One plan to minimize risks associated with the rollover period. 

However, some critical tasks remain to be completed. For example, only 

about 10 percent of the Veterans Benefits Administration’s (VBA) 

58 regional offices have tested their business continuity and contingency 

plans. And inaccuracies in monthly reports submitted by the Veterans 

Health Administration’s (VHA) medical facilities make it difficult to 

determine their progress in renovating facility systems, 

telecommunications systems, commercial-off-the-shelf (COTS) software, 

computer platforms, and medical devices. Further, VHA has not 

implemented our prior recommendation to review the test results for 

biomedical equipment used in critical care/life support environments. It is 

crucial that VA address these issues if the department is to continue to 

reliably deliver benefits and other health care services through the turn of 

the century. 

FDA, for its part, has made progress in making compliance information on 

biomedical equipment available to users through its Federal Y2K 

1

As is widely known by now, for the past several decades computer systems have often used 

two digits to represent the year, such as “98” for 1998, in order to conserve electronic data 

storage and reduce operating costs. In this format, however, 2000 is indistinguishable from 

1900 because both are represented as “00.” As a result, if not modified, systems or 

applications that use dates or perform date- or time-sensitive calculations may generate 

incorrect results beyond 1999.

2

Biomedical equipment refers to both medical devices regulated by FDA, within the 

Department of Health and Human Services, and scientific and research instruments, which 

are not subject to FDA regulation. Pharmaceutical products also fall under FDA’s regulatory 

authority.
Page 2 GAO/T-AIMD-00-39

Biomedical Equipment Clearinghouse. It is also conducting surveys to 

determine the Y2K readiness of pharmaceutical, biological, and 

consumable medical3

 products manufacturers. FDA has also recently 

addressed our concern about the lack of independent verification and 

validation of critical care/life support biomedical equipment certified 

compliant by manufacturers. Specifically, it has reviewed a sample of these 

manufacturers’ Y2K activities, including risk management, test planning 

and procedures, implementation, and contingency planning. In the limited 

time remaining, FDA still needs to issue its final report to the Department 

of Health and Human Services (HHS) summarizing the results of its review 

of manufacturers’ Y2K activities and make these results available to the 

public. 

VA Is Making Progress 

on Systems But Critical 

Tasks Remain 

Like many organizations, VA faces the possibility of computer systems 

failures at the turn of the century due to incorrect information processing 

relating to dates. This could make veterans who are eligible for benefits 

and medical care appear ineligible. If this happens, the issuance of benefits 

and the provision of medical care that veterans rely on could be delayed or 

interrupted. 

At your request, Mr. Chairman, we have been monitoring and evaluating 

VA’s actions to address the Y2K problem since 1996.4

 We have also made 

many recommendations to reduce the risk associated with Y2K failures, 

and VA has been responsive to these recommendations. For example, VBA 

changed its strategy from relying on new Y2K-compliant systems to fixing 

the current systems in order to address the risk that the new systems would 

3

Consumable medical products are expendable, disposable, or nondurable supplies used for 

the treatment or diagnosis of a patient’s specific illness, injury, or condition. Examples 

include surgical gloves and intravenous tubing.

4

See Year 2000 Computing Crisis: Actions Needed to Ensure Continued Delivery of Veterans 

Benefits and Health Care Services (GAO/AIMD-99-190R, June 11, 1999), Year 2000 

Computing Crisis: Action Needed to Ensure Continued Delivery of Veterans Benefits and 

Health Care Services (GAO/T-AIMD-99-136, April 15, 1999), Year 2000 Computing Crisis: 

Compliance Status of Many Biomedical Equipment Items Still Unknown

(GAO/AIMD-98-240, September 18, 1998), Year 2000 Computing Crisis: Progress Made in 

Compliance of VA Systems, But Concerns Remain (GAO/AIMD-98-237, August 21, 1998), 

Veterans Affairs Computer Systems: Action Underway Yet Much Work Remains to Resolve 

Year 2000 Crisis (GAO/T-AIMD-97-174, September 25, 1997), Veterans Benefits Computer 

Systems: Risks of VBA’s Year-2000 Efforts (GAO/AIMD-97-79, May 30, 1997), and Veterans 

Benefits Modernization: Management and Technical Weaknesses Must Be Overcome If 

Modernization Is To Succeed (GAO/T-AIMD-96-103).
Page 3 GAO/T-AIMD-00-39

not be completed in time. In 1998, VBA also reassessed its mission-critical 

efforts for the compensation and pension on-line application and the 

Beneficiary Identification and Record Locator Sub-System, as well as other 

technology initiatives to help ensure that these critical undertakings were 

completed in time. Simultaneously, VHA issued its Patient-Focused Year 

2000 Contingency Planning Guidebook to its medical facilities, describing 

actions they could take to minimize Y2K-related disruptions to patient care. 

More recently, both VBA and VHA developed business continuity and 

contingency plans that address mission-critical systems, core business 

processes, regional offices, and medical facilities. 

In addition, VA has reported to the Office of Management and Budget 

(OMB) that it completed renovating and implementing the mission-critical 

applications supporting its 11 systems areas as of March 31, 1999. As shown 

in table 1, VBA has six of these areas, and VHA has two.
Page 4 GAO/T-AIMD-00-39

Table 1: Reported Status of VA’s Mission-Critical Computer Systems Areas and 

Their Applications 

a

Of this total, 316 applications were renovated and two were replaced.

Source: VA. We have not independently verified this information.

Component/office

(number of systems) Systems area

Number of applications

renovated or replaced

Veterans Benefits 

Administration (6)

Compensation and Pension

30

Education 24

Insurance 3

Loan Guaranty 19

Vocational Rehabilitation 4

Administrative 27

Total 107

Veterans Health 

Administration (2)

Veterans Health Information 

Systems and Technology 

Architecture 105

Veterans Health 

Administration Corporate 

Systems 95

Total 200

National Cemetery 

Administration (1) 

Burial Operations Support 

System/Automated 

Monument Application 

System 1

Reengineer 1

Total 2

Office of Financial 

Management (2)

Personnel and Accounting 

Integrated Data 8

Financial Management 

System 1

Total 9

VA total 318a
Page 5 GAO/T-AIMD-00-39

Although VA has made progress, when we testified5 this past April, the 

department still had numerous Y2K issues to address. Specifically, (1) VBA 

and VHA had not completed testing of their mission-critical systems to 

ensure that they could reliably accept future dates, (2) VHA had not 

completed assessments of its facility systems,6

 (3) VHA’s pharmaceutical 

operations were at risk because the automated systems supporting its 

consolidated mail outpatient pharmacies (CMOP) were not Y2K compliant, 

(4) VHA had not defined the CMOP systems as mission-critical in its 

quarterly report to OMB, and (5) VHA did not know whether its medical 

facilities would have a sufficient supply of pharmaceutical and 

medical/surgical supplies on hand because it did not have complete 

information on the Y2K readiness of these manufacturers. To address these 

issues, we made the following recommendations to the Secretary of 

Veterans Affairs:7

• complete Y2K testing of VBA and VHA mission-critical systems—

including systems acceptance testing,8

 full forward-date testing,9

end-to-end testing, and business process simulation testing on 

compliant platforms;

• set deadlines to complete assessment, renovation, validation, and 

implementation of VHA’s facility systems; 

• develop business continuity and contingency plans for VHA CMOPs to 

ensure an uninterrupted supply of medications to veterans in the event 

of Y2K problems at these facilities;

• reassess VA’s decision not to report CMOP systems as mission-critical; 

and

• seek the assistance of FDA and industry trade associations in obtaining 

information on the Y2K readiness of specific pharmaceutical and 

5

GAO/T-AIMD-99-136, April 15, 1999.

6

Facility systems include building-related equipment such as elevators, heating, ventilating, 

and air conditioning equipment, lighting systems, security systems, and disaster recovery 

systems.

7

GAO/AIMD-99-190R, June 11, 1999.

8

Systems acceptance testing verifies that the complete system—the full component of 

applications software running on the target hardware and system software—satisfies 

specific requirements and is acceptable to users.

9

Forward-date testing verifies that the system is able to process using future dates in 

2000 and beyond.
Page 6 GAO/T-AIMD-00-39

medical/surgical suppliers10 that did not respond to VHA’s survey, and 

publicize the results in a single data clearinghouse.

VA Has Been Responsive to 

Recommendations

VA generally agreed with our recommendations, and actions to implement 

them have either been taken or are underway. 

• Both VBA and VHA have completed systems acceptance and 

forward-date testing. VBA completed systems acceptance testing of its 

benefits delivery applications and also tested its payment systems’ 

ability to process benefits in January 2000, in conjunction with the 

Department of the Treasury’s Financial Management Service and the 

Federal Reserve System. This testing was completed in July 1999. 

Likewise, VHA completed Y2K systems acceptance testing of its 

mission-critical hospital systems. In addition, in August 1999, VHA’s 

independent verification and validation test group forward-date tested 

56 hospital applications.11 

• VHA issued a policy directive on July 30, 1999, stating that its medical 

facilities had to make a decision on renovation strategies by 

September 1, 1999, for those facility systems components and interfaces 

whose Y2K status was noncompliant, conditionally compliant, or 

unknown. The directive also required these facilities to establish 

specific contingency plans for each of these systems. According to the 

Y2K project office, all of the medical facilities have met this 

requirement.

• VHA’s CMOPs have developed business continuity and contingency 

plans that address important issues such as the loss of electrical power, 

telecommunications with the medical centers, and their automated 

dispensing machines. These plans should reduce the risk that Y2K 

disruptions will impair the CMOPs’ ability to continue filling and 

delivering veterans’ prescriptions. 

• In its August 1999 report to OMB, VA said that renovation of the 

vendor-supplied CMOP dispensing systems were on schedule to make 

all seven CMOPs Y2K compliant by September 30, 1999. 

• VA has worked with FDA and various other industry associations to 

obtain and share Y2K-readiness information on the Y2K compliance 

10These include manufacturers and distributors.

11These 56 applications, which run at most VA health facilities, were chosen for their date 

intensiveness and business criticality. Included among the applications tested were 

inpatient and outpatient pharmacy, radiology, laboratory, and surgery.
Page 7 GAO/T-AIMD-00-39

status of pharmaceutical and medical-surgical manufacturers. It has 

posted results on its Internet home page (www.va.gov).

VA Established a 

Moratorium on Software 

Changes

To minimize possible disruptions to agencies’ Y2K readiness resulting from 

system changes, OMB, in a May 14, 1999, memorandum to heads of 

departments and agencies, requested that agencies establish a process to 

ensure that the effect on Y2K readiness is considered prior to establishing 

new requirements or changes to information technology systems.12 We had 

previously testified that agencies should institute such a process to ensure 

that software changes do not negatively affect Y2K readiness.13 

In response to OMB’s memorandum, VA issued a October 14, 1999, 

memorandum to department heads imposing a moratorium on 

implementing new systems, changes to existing systems, or third-party 

upgrades to VA’s information technology systems between 

October 15, 1999, and March 31, 2000. The intent of the memorandum was 

to ensure that the department incorporates Y2K change management 

procedures. It further stated that in those instances in which software 

changes were necessary—such as when compliant software had to be 

modified due to legislative or other agency requirements—it would be 

necessary to test all changes and recertify the software’s compliance.14

VA has also defined a process for requesting waivers for software changes 

or upgrades during this time. Specifically, waivers must be justified by the 

VA administration requesting them and concurred with by that 

administration’s chief information officer (CIO), architecture review board, 

or senior information technology official. The request is then submitted to 

VA’s Principal Deputy Assistant Secretary for Information and Technology 

for approval.

Prior to the department’s issuing this moratorium, VBA had developed and 

issued a similar moratorium to all VBA offices on July 29, 1999. This 

12OMB Memorandum M-99-17: Minimizing Regulatory and Information Technology 

Requirements that Could Affect Progress Fixing the Year 2000 Problem, May 14, 1999.

13Year 2000 Computing Crisis: Readiness Improving, But Much Work Remains to Avoid Major 

Disruptions (GAO/T-AIMD-99-50, January 20, 1999). 

14Examples of software that will be modified include applications affected by cost-of-living 

adjustments that usually take effect in January. 
Page 8 GAO/T-AIMD-00-39

memorandum imposed a moratorium on the deployment of new 

application changes or third-party product upgrades between 

September 1, 1999, and April 1, 2000, and stated that exceptions to the 

moratorium included emergency fixes and legislatively mandated changes 

such as cost-of-living adjustments. 

VHA has not yet issued specific instructions on how it will implement the 

department’s moratorium. However, according to VHA’s Y2K project office, 

it plans to issue guidance to its offices and medical centers based on VA’s 

memorandum. According to VHA’s Y2K project manager, this guidance was 

not developed earlier because VHA was waiting for the department to issue 

its memorandum. 

VA Has Developed a Day 

One Strategy

As we note in our business continuity and contingency planning guide,15

developing a Day One risk reduction strategy and procedures for the period 

between late December 1999 and early January 2000 is a key element in 

contingency planning. Earlier this month, we issued a more specific guide 

on Day One planning.16 In addition, on October 13, 1999, OMB issued a 

memorandum to the heads of selected departments and agencies17 

instructing them to develop Day One plans and encouraging them to use 

our guide in the development of these plans. OMB required that the plans 

address seven areas: (1) schedule of activity, (2) personnel on call or duty, 

(3) contractor availability, (4) workforce communication, (5) facilities and 

services to support workforce, (6) security, and (7) public communications. 

VA and its agencies have developed a high-level Day One strategy that 

should help the department manage risks associated with the 

January 1 rollover and better position it to address any potential 

disruptions. This strategy addresses each of the seven areas required by 

OMB:

• a time line of events between December 31 and January 1;

15Year 2000 Computing Crisis: Business Continuity and Contingency Planning

(GAO/AIMD-10.1.19, August 1998).

16Y2K Computing Challenge: Day One Planning and Operations Guide

(GAO/AIMD-10.1.22, October 1999).

17OMB Memorandum M-00-01: Day One Planning and Request for Updated Business 

Continuity and Contingency Plans, October 13, 1999.
Page 9 GAO/T-AIMD-00-39

• a personnel strategy and leave policy that identifies key managerial and 

technical personnel available to support Day One operations; 

• a statement that its administrations reviewed vendor service 

agreements and revised them to ensure that contractor support and 

other needs for the rollover period are met; 

• a communications structure for workforce reporting during the rollover 

period. Under this structure, VBA regional offices plan to report to 

regional representatives, who plan to report to a national VBA 

information coordination center, located at VBA headquarters in 

Washington, D.C.; VHA medical centers plan to report to their Veterans 

Information Service Network (VISN)18 representative, who plans to 

report to a national VHA information coordination center located in 

Martinsburg, West Virginia. The VBA and VHA national information 

coordination centers plan to report to the VA national information 

coordination center, also located in Martinsburg; 

• a statement that its facilities have addressed facility and support 

services for its workforce in their business continuity and contingency 

plans. In addition, the Day One plan requires regular “health” checks to 

ensure that these services remain available during the rollover period; 

• a statement that the VA computer systems and data centers are being 

secured and additional security has been extended to the networks to 

increase protection during the rollover period; and 

• a VA Office of Public Affairs information communications center to 

support the VA national information coordination center and direct 

public communications through the Joint Public Information Center 

that the President’s Council on Year 2000 Conversion plans to set up for 

the rollover period. 

VA’s Day One plan also describes preparation activities that VA has 

completed or plans to complete in order to help minimize potential Year 

2000 disruptions to benefits delivery and health care. For example, VBA 

plans to process most of its regular, recurring benefits payments so that 

they will be available to veterans on December 30, 1999. This, according to 

the plan, will greatly mitigate possible Y2K interruptions of benefits 

payments. 

18VISNs are 22 regional organizations encompassing medical centers, nursing homes, and 

domiciliaries.
Page 10 GAO/T-AIMD-00-39

VA Has Developed Business 

Continuity and Contingency 

Plans

According to VA’s August 1999 report to OMB, its regional offices and 

medical facilities have completed business continuity and contingency 

plans. In addition, according to VA, a selected number of these plans have 

been reviewed by their respective Y2K project offices. Specifically, VBA’s 

Y2K project office reviewed the plans of its regional offices and found that 

they met VBA requirements. We reviewed 15 of the 58 VBA regional plans 

and found that they address resources, staff roles, procedures, and 

timetables for implementation, as well as risks and risk mitigation.

In reviewing the 58 medical facilities’ business continuity and contingency 

plans, VHA’s Y2K project office concluded that while overall the plans 

adequately addressed contingency planning, the plans of 14 facilities were 

deficient. These deficiencies included the lack of a schedule of critical 

events; lack of a policy statement describing the authority, responsibility, 

and procedures for Y2K contingency planning; and missing contingencies 

for specific functional areas, such as intensive care or operating rooms. 

The project office asked the 14 facilities to address these deficiencies and 

submit revised plans, which it is currently reviewing. 

We reviewed the plans of 29 medical facilities to determine their 

completeness,19 and found that, in some cases, the schedule of critical 

events and execution timelines were not specific to the medical facility. 

Additional specificity, such as time lines relevant to the medical facility and 

specific dates for accomplishing tasks contained in the time lines, would 

help make it easier for facility staff to implement the plan, and help 

minimize confusion that might result if plans needed to be activated. A 

second issue concerned the lack of medical facility coordination with 

VHA’s seven CMOPs. This is especially important since the seven CMOPs 

supply about 50 percent of VA’s prescriptions to veterans. VHA’s guidance, 

however, only required sites that were co-located with a CMOP to 

coordinate their plans with that CMOP alone. 

We discussed these issues with representatives of VHA’s Y2K project office. 

They agreed with our concern regarding the time lines and said that the 

sites had been advised to ensure that these were sufficiently specific. In 

addition, the VHA Y2K project manager told us that all CMOPs had been 

advised to discuss their business continuity and contingency plans with the 

medical facilities that they support so that they are aware of them.

19The plans chosen for review included 19 medical facilities in the three VISNs that we have 

been monitoring, and four facilities that are co-located with a CMOP.
Page 11 GAO/T-AIMD-00-39

VA Has Not Completed 

Testing of Its Business 

Continuity and Contingency 

Plans

Testing of business continuity and contingency plans is key to determining 

whether the contingencies are capable of providing the needed level of 

support to core business functions and whether they can be implemented 

in a reasonable amount of time. In addition, testing can show where plans 

need to be updated or changed. We previously testified that testing of plans 

should be completed by September 30, 1999.20

As of October 22, 1999, only five of VBA’s 58 regional offices had completed 

testing of their business continuity and contingency plans. VBA initially 

asked that each regional office complete a “desktop” exercise21 of its plan 

by September 30, 1999, during which the business continuity and 

contingency plan team and other critical staff would simulate an 

emergency situation. According to VBA’s Y2K project manager, the project 

office is now requiring the regional offices to complete this exercise by 

November 15, 1999. It is critical that VBA regional offices test their plans to 

ensure that their contingencies are sufficient to maintain an acceptable 

level of service and that the contingencies can be implemented in a feasible 

time frame.

All of VHA’s medical facilities reportedly have completed emergency drills. 

These drills, conducted under controlled conditions to ensure no impact on 

patient safety, required each facility to turn off its local electric supply and 

rely on backup generators. The medical facilities identified deficiencies in 

their plans as a result of these drills. For example, one site found that its 

generator was not capable of powering the entire hospital. 

It has now contracted for an additional backup generator to ensure that all 

critical areas can be powered. Other sites found that some of their missioncritical areas were not linked to the backup generator, and have since 

contracted for additional work to link them. 

While VHA’s medical centers have tested their facilities’ ability to handle 

power outages, other portions of their business continuity and contingency 

plans, such as dealing with potential water and gas shortages, have not 

been tested. Losses in these areas can have an impact on patient care. 

Specifically, a VHA medical facility recently suffered a loss of water, 

20GAO/T-AIMD-99-50, January 20, 1999.

21VBA’s “desktop” simulation was not to include the actual establishment of an emergency 

operations center or emergency backup sites.
Page 12 GAO/T-AIMD-00-39

resulting in a loss of the steam plant, cooling towers, and fire suppression 

system. This facility suggested that other facilities reevaluate their 

contingencies in view of these losses. 

Monthly Reports Do Not 

Accurately Reflect Y2K 

Status of Noncompliant 

Systems

All of VHA’s VISNs/medical facilities are required to prepare monthly 

reports on their Y2K progress in assessing, renovating, validating, and 

implementing compliant systems. Specifically, they report on their Y2K 

status in six areas: locally developed software, COTS software, computer 

platforms, telecommunications systems, facility systems, and medical 

devices. These reports are used by VHA to monitor progress in addressing 

Y2K issues and to identify problem areas. 

VHA’s summary report for August 1999 indicated that the medical centers 

had made limited progress in renovating their remaining noncompliant 

facility systems and telecommunications systems. Specifically, it showed 

that overall, only 43 percent of the facility systems and 41 percent of the 

telecommunications systems at the medical facilities had completed 

renovation. The numbers were somewhat higher for COTS software, at 

55 percent, and computer platforms, at 65 percent. The highest renovation 

number was for locally developed software products, at 94 percent. We 

discussed these renovation statistics with VHA’s Y2K project manager, who 

told us that the summary report may not be accurate because facilities are 

not clear on whether to report on systems or on the components that make 

up the systems. 

During visits to selected medical facilities we confirmed that their 

individual and summary reports did contain errors. For example, some of 

the VISN percentages in the August report exceeded 100. The Y2K office 

has also contacted selected medical facilities and acknowledged that the 

reports have errors. To address this issue, the Y2K office is currently 

contacting and visiting sites to discuss these reporting issues. It is critical 

that the medical facilities accurately report their Y2K progress in 

renovating their noncompliant systems so that top management within VA 

can identify problem areas and take prompt and appropriate action. 
Page 13 GAO/T-AIMD-00-39

VHA Has Made 

Progress in 

Determining Y2K 

Compliance Status of 

Biomedical Equipment 

The question of whether VHA’s medical devices such as magnetic 

resonance imaging (MRI) systems, x-ray machines, pacemakers, and 

cardiac monitoring equipment can be counted on to work reliably on and 

after January 1, 2000, is critical to VHA. To the extent that biomedical 

equipment uses computer chips, it is vulnerable to the Y2K problem. In the 

medical arena, such vulnerability carries with it possible safety risks.

VA Continues to Collect 

Compliance Information on 

Biomedical Equipment

In April, we testified before this Subcommittee that VHA was continuing to 

collect information from biomedical equipment manufacturers on the Y2K 

compliance status of equipment in its inventory.22 As shown in table 2, a 

little over half of the manufacturers in VA’s database reported directly to 

the department that their products are compliant as of October 25, 1999. 

Since we last testified, VA has created a new compliance category to 

capture the increasing number of manufacturers that have web sites with 

Y2K information. VA reported that about 24 percent of the manufacturers in 

its database (1,393) are in this new category.

22GAO/T-AIMD-99-136, April 15, 1999.
Page 14 GAO/T-AIMD-00-39

Table 2: Status of Manufacturer Responses to VHA as of October 25, 1999

a

For inclusion in this category, 100 percent of a manufacturer’s products had to be considered 

compliant.

b

For inclusion in this category, only one of a manufacturer’s products had to be considered 

noncompliant.

c

For inclusion in this category, the manufacturer had to have no noncompliant devices, no pending 

devices, and at least one conditional-compliant device. 

d

For inclusion in this category, the manufacturer had to have no noncompliant devices and at least one 

device that is pending. 

e

For inclusion in this category, VHA had to have not received compliance information from the 

manufacturer.

Source: Veterans Health Administration. We did not independently verify these data.

For nonresponsive manufacturers, VHA’s Y2K project manager told us that 

the project office had contacted the facilities that reported devices in their 

inventories from these manufacturers and instructed them to make a 

decision on their disposition. The project manager further stated that none 

of these devices was used in critical care or life support functions, and that 

the facilities with this equipment had been instructed to plan for 

contingencies in the event any of them experience a Y2K-related failure.

In April 1999, VHA issued a policy establishing (1) a review process for 

medical devices whose compliance status was unknown, noncompliant, or 

conditionally compliant and (2) options for what action should be taken on 

these devices. Options included replacing or retiring the equipment, or 

using it as-is.23 Medical facilities were to complete these reviews by

June 1, 1999, for equipment whose Y2K compliance status was either 

unknown or noncompliant, and September 1 for equipment whose status 

was conditionally compliant. In each case, the medical facility director’s 

approval of the disposition decision was required. For noncompliant 

Manufacturer response

Number of

manufacturers

Percentage of

manufacturers

Manufacturers with web site information 340 24

Compliant manufacturersa 720 52

Noncompliant manufacturersb 33 2

Conditional-compliant manufacturersc 40 3

Pending manufacturersd 11 1

Manufacturers merged or bought out 241 17

Nonresponsive manufacturerse 8 1

Total 1,393 100
Page 15 GAO/T-AIMD-00-39

equipment, the medical center was required to assess the level of risk if it 

continued to use the equipment, and determine what risk such use posed to 

patient health and safety. To make this assessment, medical facilities were 

to consider such questions as whether the device is used for critical care, 

or if the device used date-sensitive data, such as sequencing patient data 

results.

To track the compliance status of its biomedical equipment, VHA uses a 

monthly status report on medical devices based on information provided 

by the VISNs/medical facilities. 

According to the August 1999 report, about 97 percent of the 

568,000 medical devices in VHA medical facilities are compliant. The report 

indicated that, of about 18,000 noncompliant devices, about 14,000 will be 

repaired, and about 1,400 will be replaced. The report did not discuss the 

renovation status of the remaining 2,200 noncompliant devices.

We were unable to accurately determine the status of medical facilities’ 

efforts to renovate noncompliant devices. As we discussed previously, the 

individual monthly reports submitted by the VISNs/medical facilities were 

inaccurate. Specifically, we determined that the June 1999 summary 

showed that about 21 percent of medical devices had been renovated was 

incorrect. However, according to several medical centers, their renovation 

percentages were higher than the numbers reflected in the report. We 

pointed this out to the Y2K project manager, who acknowledged that the 

percentages were incorrect. He added that the Y2K project office is in the 

process of following up with its medical centers to confirm their status on 

renovation of biomedical equipment.

23Conditionally compliant equipment requires user intervention to function in all aspects 

upon the Year 2000 change. These changes include manufacturer software or hardware 

updates, or a one-time user action, such as turning the equipment on/off. Noncompliant 

equipment means a medical device will not function properly in all aspects upon the Year 

2000 change and no manufacturer remedy is available. Unknown equipment means VHA has 

not been able to determine the compliance status of equipment because it has not received 

compliance status information from the manufacturer.
Page 16 GAO/T-AIMD-00-39

VHA Position on Not Testing 

Biomedical Equipment 

Unchanged

As we reported last September, VHA relies on manufacturers to validate, 

test, and certify that equipment is Y2K compliant.24 We also reported that 

there was no assurance that the manufacturers adequately addressed the 

Y2K problem for noncompliant equipment because FDA did not require 

medical device manufacturers to submit test results to it certifying 

compliance. Accordingly, we recommended that VA and HHS take prudent 

steps to jointly review manufacturers’ compliance test results for critical 

care/life support biomedical equipment. We were especially concerned that 

VA and FDA review test results for equipment previously determined to be 

noncompliant but now deemed compliant by manufacturers, or equipment 

for which concerns about compliance remain. We also recommended that 

VA and HHS determine what legislative, regulatory, or other changes were 

necessary to obtain assurances that manufacturers’ equipment was 

compliant, including performing independent verification and validation of 

the manufacturers’ certifications.

At that time, VA stated that it had no legislative or regulatory authority to 

implement the recommendation to review test results from manufacturers. 

VA and the Emergency Care Research Institute (ECRI)25 have stated that 

manufacturers are best qualified to analyze embedded systems or software 

to determine Y2K compliance. Accordingly, they do not encourage user 

testing of biomedical equipment for Y2K compliance. ECRI guidelines, 

however, suggest that health care facilities should consider testing 

interfaces between medical devices in cases where the facility cannot 

determine the Y2K compliance of the interface from the device 

manufacturer. FDA also agrees with the ECRI position on testing 

biomedical equipment and interface testing. Specifically, FDA has taken the 

position that manufacturers’ submissions of Y2K compliance certifications 

provide sufficient assurance of product compliance, and that such testing 

on the part of users is not necessary.

According to VHA’s chief biomedical engineer, VHA guidance to the VISNs 

and medical facilities is not to conduct stand-alone compliance testing of 

biomedical equipment in their inventories. VHA’s Y2K project manager told 

us that VHA relies on the manufacturers’ certifications; therefore, there is 

24GAO/AIMD-98-240, September 18, 1998. 

25This institute is an international, nonprofit health services research agency. It believes that 

superficial testing of biomedical equipment by users may provide false assurances, as well 

as create legal liability exposure for health care institutions.
Page 17 GAO/T-AIMD-00-39

no need for such testing. However, he stated, in cases in which one medical 

device interacts with other systems or devices, the medical facilities should 

test these to ensure proper operation. 

In contrast to VHA’s and FDA’s positions, some hospitals in the private 

sector believe that testing biomedical equipment is necessary to prove that 

they have exercised due diligence in the protection of patient health and 

safety. As we have previously testified, officials at three hospitals told us 

that their biomedical engineers established their own test programs for 

biomedical equipment and, in many cases, contacted the manufacturers for 

their test protocols.26 Several of these engineers informed us that their 

testing identified some noncompliant equipment that the manufacturers 

had earlier certified as compliant. According to these engineers, the 

equipment found to be noncompliant all had display problems; none was 

critical care/life support equipment. We were told that equipment found to 

be incorrectly certified as compliant included a cardiac catheterization 

unit, a pulse oxymeter, medical imaging equipment, and ultrasound 

equipment. 

Our review of manufacturers’ web sites disclosed that manufacturers’ 

opinions vary on whether users should test their biomedical equipment.27

We noted that at least 37 manufacturers provided information on their web 

sites about Y2K testing. Of these, 30 encouraged testing, and 15 of these

30 provided end-users with information such as test protocols and 

instructions. Fifteen of the 30 manufacturers also encouraged users to test 

their devices in configuration with related equipment to ensure that the 

device operated as intended. For example, the web site of a manufacturer 

of audiometers stated that “if your equipment is used in a critical 

application, we strongly advise you to test the equipment by simulating the 

millennium date change yourself.” Seven of the 37 manufacturers did not 

encourage testing; two of these stated that such testing could disrupt 

operation of software. 

Since some biomedical equipment manufacturers encourage end-user 

testing for Y2K compliance of their products, VA should reconsider its 

decision not to test equipment in those instances in which the 

26GAO/T-AIMD-99-136, April 15, 1999.

27Year 2000 Computing Challenge: Compliance Status Information on Biomedical Equipment

(GAO/T-AIMD-00-26, October 21, 1999).
Page 18 GAO/T-AIMD-00-39

manufacturer encourages users to test. Such action can provide greater 

assurance of Y2K compliance for those items. From an overall perspective, 

as we testified in April, the question of whether to independently verify and 

validate biomedical equipment that manufacturers have certified as 

compliant is one that must be addressed jointly by medical facilities’ 

clinical staff, biomedical engineers, and corporate management.28 The 

overriding criterion should be ensuring patient health and safety.

VHA Pharmaceutical 

Operations Have Made 

Progress in Addressing 

Y2K Problem

Another critical component to VA’s ability to deliver health care at the turn 

of the century is ensuring that the automated systems supporting VHA’s 

medical facility pharmacies and its CMOPs are Y2K compliant. VHA 

reported that in 1998 it filled about 72 million prescriptions for 3.4 million 

veterans, at an estimated cost of about $2 billion. About half of the 

prescriptions were filled by the over 200 pharmacies located at VA’s 

medical centers, clinics, and nursing homes. These pharmacies rely on the 

pharmaceutical applications in their hospital information system for 

(1) drug distribution and inventory management, (2) dispensing of drugs to 

inpatients and outpatients, (3) patient medication information, and (4) an 

electronic connection between the pharmacies and the CMOPs. 

The remaining half of VHA’s prescriptions are filled by seven CMOPs, 

geographically dispersed throughout the United States. These facilities are 

supported by automated systems provided by one of two contractors—

SI/Baker, Inc. and Siemens ElectroCom.29 For example, the CMOP 

electronically receives a prescription for a veteran through the medical 

center. The prescription is downloaded to highly automated dispensing 

equipment to be filled. The filled prescription is then validated by a 

pharmacist who compares the medication against the prescription and a 

computerized image of the prescribed medication. Afterward, the 

prescription is packaged and an automatically generated mailing label is 

applied for delivery to the veteran. Lastly, the medical center is 

electronically notified that the prescription has been filled. 

28GAO/T-AIMD-99-136, April 15, 1999.

29These include operating systems, databases, and pharmacy fulfillment application 

software. 
Page 19 GAO/T-AIMD-00-39

As we testified this past April,30 VHA had determined that the automated 

systems supporting its CMOPs were not Y2K compliant. Accordingly, the 

CMOPs’ ability to fill prescriptions and process management reports could 

be delayed or interrupted if a Y2K failure occurred. At that time, we also 

expressed concern about the mid- to late-1999 scheduled implementation 

of compliant systems. 

Since our April testimony, VA’s contractors have installed and tested 

compliant systems at all seven CMOPs. As shown in table 3, as of 

September 30, 1999, all seven CMOPs have reported their automated 

systems as compliant. 

Table 3: Actual Completion Dates for Implementing Compliant Systems and Current 

Daily Workload by Consolidated Mail Outpatient Pharmacies 

a

Siemens ElectroCom automation.

b

SI/Baker, Inc. automation.

Source: VA.

We also testified in April that it was crucial that the CMOPs develop 

business continuity and contingency plans to ensure that veterans will 

continue to receive their medications should the CMOPs experience a 

Y2K-related failure. On September 3, 1999, the national CMOP director 

approved the Consolidated Mail Outpatient Pharmacy Year 2000 

Contingency Plan, which (1) defines the responsibilities of the national 

director, the local CMOP director, the national Y2K coordinators, the local 

30GAO/T-AIMD-99-136, April 15, 1999.

Location

Actual completion 

date

Current daily workload

(prescriptions filled)

Bedford, Massachusettsa August 10, 1999 15,000

Dallas, Texasa August 10, 1999 14,000

West Los Angeles, 

Californiaa September 8, 1999 15,000

Leavenworth, Kansasa September 30, 1999 16,000

Murfreesboro, Tennesseeb September 22, 1999 38,000

Charleston, South Carolinab September 26, 1999 23,000

Hines, Illinoisb September 26, 1999 21,000
Page 20 GAO/T-AIMD-00-39

Y2K coordinators, and the business resumption team, (2) establishes 

procedures for preparing and implementing the contingency plan and 

implementing it during the execution phase, and (3) provides a schedule of 

critical events and a time line for actions to be taken during the execution 

phase.

In addition, each of the seven CMOPs drafted contingency plans addressing 

core business processes. These plans, along with the Y2K Mail Transfer 

Contingency Test Procedures, which are the necessary steps relating to 

loss of the wide area network, were forwarded to the medical centers 

serviced by each CMOP during July and August of this year. Each medical 

center was asked to certify that the CMOP contingency plan had been 

reviewed and will be incorporated into the medical center’s Y2K 

contingency plan. However, according to the national CMOP Y2K 

coordinator, as of October 25, 1999, about half of the medical facilities had 

not returned their certifications. 

According to the CMOP Y2K plan, the CMOPs are expected to completely 

test their plans by the end of October. Five CMOPs participated in a live 

test last month. Specifically, anticipating a direct hit from Hurricane Floyd, 

the Charleston CMOP reallocated the prescriptions for its 21 medical 

centers to four other CMOPs—Bedford, Dallas, Hines, and West Los 

Angeles. The Charleston CMOP lost 36 hours of production time, and 

55,683 prescriptions had to be processed by the other CMOPs. 

VA Continues Efforts to 

Determine Y2K Readiness of 

Pharmaceutical and 

Medical-Surgical 

Manufacturers 

Like other users of pharmaceutical and medical-surgical products, VA 

needs to know whether it will have a sufficient supply of these items for its 

customers. Therefore, it has taken a leadership role in the federal 

government in determining whether manufacturers supplying these 

products to VHA are Y2K-ready. This information is essential to VHA’s 

medical facilities and CMOPs because of their “just-in-time”31 inventory 

policy. Accordingly, they must know whether their manufacturers’ 

processes, which are highly automated,32 are at risk, as well as whether the 

rest of the supply chain will function properly. 

31This term refers to maintaining a limited inventory on hand. 

32Many pharmaceutical manufacturers rely on automated systems for production, 

packaging, and distribution of their products, as well as for ordering of raw materials and 

supplies.
Page 21 GAO/T-AIMD-00-39

We testified in April that VA’s National Acquisition Center33 sent a survey on 

January 8, 1999, to 384 pharmaceutical firms and 459 medical-surgical firms 

with which it does business to determine their Y2K readiness.34 The survey 

contained questions on the firms’ overall Y2K status and inquired about 

actions taken to assess, inventory, and plan for any perceived impact that 

the century turnover would have on their ability to operate at normal 

levels. In addition, the firms were requested to provide status information 

on progress made to become Y2K compliant, and a reliable estimated date 

when compliance would be achieved for business processes such as 

(1) ordering and receipt of raw materials, (2) mixing and processing 

product, (3) completing final product processing, (4) packaging and 

labeling product, and (5) distributing finished product to 

distributors/wholesalers and end customers.

In March the acquisition center sent a second letter to its pharmaceutical 

and medical-surgical firms, informing them of VA’s plans to make Y2K 

readiness information previously provided to VA available to the public 

through a web site (www.va.gov/oa&mm/nac/y2k ). VA made the survey 

results available on its web site on April 13, 1999.35 The letter also requested 

that manufacturers that had not previously responded provide information 

on their readiness. The acquisition center’s executive director said that he 

would personally contact any major VA supplier that did not respond.

According to an August 1, 1999, briefing report on their survey, the 

acquisition center reclassified the 517 companies that responded to the 

survey into three categories: “pharmaceutical firms,’’36 “pharmaceutical, 

other firms,”37 and “medical-surgical firms.” As shown in table 4, as of 

August 1, 1999, the latest available date from VA, about one-third of the 

33This organization is responsible for supporting VHA’s health care delivery system by 

providing an acquisition program for items such as medical, dental, and surgical supplies 

and equipment; pharmaceuticals; and chemicals. The National Acquisition Center is part of 

VA’s Office of Acquisition and Materiel Management.

34Five additional firms were identified from survey responses received after April 1999.

35This site identified the firms that were sent surveys and those that responded.

36Firms that manufacture and distribute both pharmaceuticals and medical/surgical 

equipment are included in the pharmaceutical category. 

37Pharmaceutical firms that also manufacture and distribute medical gases and reagents 

(substances used in chemical reactions to detect, measure, examine, or produce other 

substances).
Page 22 GAO/T-AIMD-00-39

pharmaceutical firms, a little over one-third of the “pharmaceutical, other” 

and almost 44 percent of the medical-surgical firms had not responded to 

the survey. 

Table 4: Status of Companies Surveyed by VHA as of August 1, 1999

a

Estimated compliance status date ranged from 3/31/99 through 1/1/2000; about 72 percent of all 

respondents estimated they would be compliant by 7/31/99. One firm responded that it would be 

compliant by 1/01/2000.

Source: VA. We did not independently verify these data.

To determine if all respondents who had initially provided an anticipated 

compliance date of July 31, 1999, or earlier had met this date, a follow-up 

survey was sent to 140 firms on July 20, 1999. As shown in table 5, as of 

October 26, 1999, about two-thirds (64 percent) responded to the survey. A 

little over half of the respondents (52 percent) completed the survey, while 

the remaining respondents forwarded company letters, Year 2000 readiness 

disclosure statements, and company financial statements with disclosures 

on Y2K readiness. Table 5 also shows that about half of the respondents did 

not meet the targeted date of July 31, 1999; almost 84 percent, however, 

anticipate full compliance by September 30, 1999. The results of this 

follow-up survey are not currently available on VA’s web site.

Responses Pharmaceutical

Pharmaceutical,

other

Medicalsurgical

Y2K compliant 55 28 146

Will be compliant by 1/1/2000 or earliera 92 30 79

Provided no compliance date 39 14 34

Total number of responses 186 72 259

Nonresponses 90 40 201

Total number of firms surveyed 276 112 460
Page 23 GAO/T-AIMD-00-39

Table 5: Status of Companies With July 31, 1999, or Earlier Anticipated Compliance 

Dates as of October 26, 1999

Source: VA. We did not independently verify these data.

On a broader level, VHA has taken a leadership role in obtaining and 

sharing information on the Y2K readiness of the pharmaceutical industry. 

Specifically, VHA chairs the Year 2000 Pharmaceuticals Acquisitions and 

Distributions Subcommittee, which reports to the Chair of the President’s 

Council on Year 2000 Conversion. The purpose of this subcommittee is to 

bring together federal and pharmaceutical representatives to address 

issues concerning supply and distribution as it relates to the year 2000. The 

subcommittee consists of representatives of FDA, federal health care 

providers, and industry trade associations such as the Pharmaceutical 

Research and Manufacturers of America, the National Association of Chain 

Drug Stores, and the National Wholesale Druggists’ Association. Several of 

these trade associations have surveyed their members on their Y2K 

readiness and have made the results available to the public. Further, the 

Pharmaceutical Alliance for Y2K Readiness38 announced on 

September 22, 1999, that consumers will have access to a substantial 

supply of medications during the Y2K date change and there should be no 

need for consumers to overbuy medications in preparation for Y2K. 

Number of firms Percentage

Total number of surveys distributed 140 100

Number of responses 90 64

Firms completing survey 47 52

Were compliant by 7/31/99 25 53

Anticipate compliance by 9/30/99 19 40

Anticipate compliance by fourth quarter 3 6

Firms forwarding company letters, etc. 43 48

Were compliant by 7/31/99 17 40

Anticipate compliance by 9/30/99 14 32

Anticipate compliance by fourth quarter 3 7

No date furnished 9 21

38A coalition of drug manufacturers, wholesale distributors, pharmacies, and health care 

organizations that are working closely with government agencies to ensure a continued and 

substantial supply of pharmaceuticals through January 1, 2000.
Page 24 GAO/T-AIMD-00-39

The executive director of the National Acquisition Center told us that, 

based on his interactions with the trade associations, as well as results 

received from manufacturers, he is confident that there will be no shortage 

of medication and medical-surgical supplies. He explained that the major 

companies with unique drugs that VA relies on have responded that they 

will be ready and have provided the necessary resources and management 

attention. Further, he said, all 10 of VA’s largest pharmaceutical and 

medical-surgical suppliers have responded to the survey and have taken 

actions to address the Y2K problem at their firms. Accordingly, the 

executive director does not plan to take any further action, including 

following up with those manufacturers that did not meet their anticipated 

compliance date of July 31, 1999, or September 30, 1999. 

We believe that VHA needs to continue to follow up with pharmaceutical 

and medical-surgical firms that anticipated having compliant systems by 

July 31, 1999, and September 30, 1999, to determine whether these firms 

have addressed the Y2K problem. This information should also be made 

available on VHA’s web site.

FDA’s Y2K Activities on 

Biomedical Equipment 

and Pharmaceutical, 

Biological, and 

Consumable Medical 

Products Industries 

Are Focused on 

Readiness 

Another key player in determining the Year 2000 compliance of biomedical 

equipment and pharmaceutical, biological, and consumable medical 

products is FDA, which has oversight and regulatory authority in these 

areas. FDA’s role is to ensure that these products are safe and effective for 

public use. In an effort to provide users with Y2K compliance information 

on their equipment, FDA has established the Federal Y2K Biomedical 

Equipment Clearinghouse. In addition, it has surveyed manufacturers of 

pharmaceutical, biological, and consumable medical products, to provide 

users with information on their Y2K readiness. 

Biomedical Equipment 

Status Information Available 

Through FDA 

Clearinghouse

We reported in September 1998 that FDA was working to determine the 

compliance status of biomedical equipment; provide a comprehensive, 

centralized source of information on the Y2K compliance status of 

biomedical equipment used in the United States; and make this information 

publicly available on a web site.39 However, we also reported that FDA’s 

39GAO/AIMD-98-240, September 18, 1998.
Page 25 GAO/T-AIMD-00-39

database did not include product compliance information from many 

manufacturers that had already provided such information to VHA, and 

also that VHA was not making this information available to the public. We 

therefore recommended that HHS and VHA jointly develop a single data 

clearinghouse containing information on the Y2K compliance status of 

biomedical equipment, and make this information publicly available. In 

response to our recommendation, FDA—in conjunction with VHA—

established the Federal Y2K Biomedical Equipment Clearinghouse. In 

obtaining compliance status information from manufacturers, VHA, the 

Department of Defense, and the Health Industry Manufacturers 

Association all assisted FDA. 

We testified last week that, according to FDA, 4,288 biomedical equipment 

manufacturers had submitted data to the clearinghouse as of 

October 4, 1999.40 Based on the data submitted, FDA places a manufacturer 

into one of four categories:

• Products that do not employ a date—manufacturer that reported Y2K 

status to be “All Products Do Not Use a Date.”

• Products that are all compliant—manufacturer that reported products 

as Y2K compliant. 

• Products with date-related problems—manufacturer that reported its 

Y2K status to be “Products With Date Related Problem.” 

• Product status is on the manufacturer’s web page—manufacturer that 

reported its Y2K status to be “Product Status Specified on a (Web) 

Page.”

As shown in figure 1, as of October 4, 1999, 61 percent of the manufacturers 

reported having products that do not employ a date, while 8 percent 

(342 manufacturers) reported having date-related problems such as 

incorrect display of date/time. According to FDA, the 342 manufacturers 

reported 1,035 specific products with date-related problems. 

40GAO/T-AIMD-00-26, October 21, 1999.
Page 26 GAO/T-AIMD-00-39

Figure 1: Biomedical Equipment Compliance-Status Information Reported to FDA by 

Manufacturers as of October 4, 1999

Note: Total number of manufacturers = 4,288.

Source: FDA.

Also, according to FDA, as of October 4, 1999, 132 manufacturers had not 

responded to the agency’s request for product compliance information. A 

senior FDA official told us that most of these manufacturers have gone out 

of business, do not make computerized products, or just cannot be located. 

The official added that FDA continues to follow up with these 

manufacturers nevertheless, through letters and telephone contact. The 

clearinghouse lists the names of these manufacturers that have not 

responded to FDA’s requests for product compliance information. 
Page 27 GAO/T-AIMD-00-39

In our September 1998 report, we also noted that information on the FDA 

web site was not detailed enough to be useful.41 Specifically, the list of 

compliant equipment contained no information on the equipment’s make 

and model. We therefore recommended that VA and HHS include in the 

clearinghouse information on the compliance status of all biomedical 

equipment by make and model. FDA agreed with this recommendation, and 

subsequently requested this information from manufacturers; users can 

now find specific information on the make and model of compliant medical 

devices on the FDA web site. 

As an alternative to obtaining biomedical equipment product compliance 

information from manufacturers and posting it to the Federal Y2K 

Biomedical Equipment Clearinghouse, FDA accepts equipment 

manufacturers’ references to their own web sites for compliance 

information. The clearinghouse provides users with a link directly to these 

web sites. As of October 4, 429 manufacturers had chosen this option. 

While FDA is aware of the number of products and their reported 

compliance status for those manufacturers providing this information to 

the Federal Y2K Biomedical Equipment Clearinghouse, in testimony this 

past May FDA officials stated that they did not know the total number of 

biomedical equipment products reported by manufacturers on their web 

sites, or how many of them were noncompliant. We subsequently reviewed 

information available through these web sites and reported in June that the 

quality of information available through them varied significantly.42

Specifically, we found that while most sites contained compliance 

information on at least one product, some sites contained insufficient 

information or did not clearly distinguish biomedical equipment from 

nonbiomedical products. 

We subsequently updated our analysis of the web sites as of 

October 1, 1999, and found the following for the 429 manufacturers in 

FDA’s clearinghouse that refer users to their web sites:

41GAO/AIMD-98-240, September 18, 1998.

42Year 2000 Computing Challenge: Concerns About Compliance Information on Biomedical 

Equipment (GAO/T-AIMD-99-209, June 10, 1999).
Page 28 GAO/T-AIMD-00-39

• 354 manufacturers reported compliance status information for at least 

33,598 individual biomedical equipment products;43

• 71 manufacturers’ web sites either contained insufficient information on 

the number of products and their compliance status, or did not clearly 

distinguish biomedical equipment from nonbiomedical products; 

• 3 web sites were those of vendors or distributors, not manufacturers; 

and

• 1 manufacturer’s web site link in FDA’s clearinghouse did not work.44

Because of the limitations cited above for many of the manufacturers’ web 

sites, our ability to determine the total number of biomedical equipment 

products reported and their compliance status was limited. Accordingly, 

the actual number of products reported by these manufacturers could be 

higher than the 32,598 that we counted.

As shown in figure 2, of the 32,598 products we identified on 

manufacturers’ web sites, about 54 percent reportedly do not employ a 

date, about 29 percent of the products are considered compliant, and about 

12 percent are reportedly noncompliant. The compliance status of the 

remaining 5 percent of products was unknown for reasons such as the 

manufacturer’s ongoing assessment of the product.

43This includes medical devices and scientific and research instruments, and other 

supporting products, such as printers and software.

44According to FDA, the contractor assisting it with the clearinghouse verified that this web 

site link was operable.
Page 29 GAO/T-AIMD-00-39

Figure 2: Biomedical Equipment Compliance-Status Information Reported on 

Manufacturers’ Web Sites as of October 1, 1999

Note: Total number of products = 32,598.

Source: GAO analysis of manufacturers’ web sites.

The 4,053 noncompliant products that we identified were from the web 

sites of 214 manufacturers. This number of products is about four times the 

number reported directly by FDA in its clearinghouse (1,035). Examples of 

these noncompliant products included a bedside monitor, film digitizer, 

ultrasound systems, radiology information systems, and laboratory 

information systems. Included among noncompliant potentially high-risk 

devices reported were ventricular assist devices and hemodialysis 

equipment.45 

45A ventricular assist device is a small electromechanical pump that helps maintain blood 

circulation in patients suffering from end-stage heart disease. Hemodialysis equipment 

cycles blood from a patient’s body to filter out body waste before returning the blood to the 

patient.
Page 30 GAO/T-AIMD-00-39

In addition to supplying information on noncompliant products, most of 

the manufacturers with noncompliant products also provided solutions to 

correct the problem. Most (190) of the 214 manufacturers identified with 

noncompliant products provided at least one solution to correcting the 

problem. The solutions generally involved upgrades to hardware or 

software, manual action (such as turning the equipment on and off on 

January 1, 2000), or workarounds.46

FDA Is Now Reviewing 

Manufacturers’ Y2K 

Activities

While compliance information is available through FDA’s Federal Y2K 

Biomedical Equipment Clearinghouse, we have raised concerns in the past 

year about the lack of independent verification and validation of 

biomedical equipment that manufacturers have certified as compliant. In 

addition to making sure that manufacturers provide detailed information 

on their products, we believe that it is essential that FDA provide some 

level of confidence that critical care and life support medical devices will 

work as intended.

In response to our recommendation to conduct independent verification 

and validation of biomedical equipment that manufacturers have certified 

as compliant, FDA is taking action to review a sample of biomedical 

equipment manufacturers’ Y2K activities, such as risk management, test 

planning and procedures, and implementation and contingency planning. 

Specifically, FDA’s acting deputy commissioner for policy testified in May 

1999 that FDA proposed reviewing manufacturers’ test results supporting 

their compliance certifications for a sample of critical devices. FDA’s 

proposal consisted of two phases. In the first phase FDA would 

• develop a list of the manufacturers of computer-controlled, potentially 

high-risk devices (PHRD);47

• from this list of manufacturers, select a sample of 80 manufacturers for 

review; and

• hire a contractor to develop a program to assess manufacturers’ 

activities to identify and correct Y2K problems with PHRDs.

46An example of a workaround is noting on the printout of an EKG machine the year “2000” 

instead of “1900.”

47These medical devices are characterized by their potential for immediate and serious 

adverse health consequences for a patient if they fail to function as designed or expected, 

including a failure to initiate or continue operations.
Page 31 GAO/T-AIMD-00-39

The goal of the first phase of the survey is to extrapolate from the 

80 assessments a level of overall confidence in the biomedical equipment 

industry’s Y2K compliance activities. According to FDA, the second phase 

of the evaluation would be undertaken only if the results of the first phase 

indicated a need for further review of manufacturer Y2K activities because 

of concerns over how manufacturers are addressing product compliance. 

In carrying out its plan to assess manufacturers’ Y2K activities, FDA 

identified 90 types of PHRD products, and issued a task order on 

July 1, 1999, for a contractor, assisted by two subcontractors, to perform 

assessments of the Y2K compliance activities for a sample of PHRD 

manufacturers. FDA identified 803 PHRD manufacturing sites that produce 

equipment sold in the United States.48 These were composed of 

726 biomedical equipment manufacturing sites and 77 manufacturing sites 

of blood and blood products equipment. 

FDA’s contractor then randomly selected 325 of the 803 sites for possible 

assessment. These manufacturing sites were then contacted and asked if 

they would volunteer to participate in the process. As of October 4, 1999, of 

the 325 randomly selected sites, 

• 197 were identified as producing no computer-controlled equipment,

• 80 agreed to participate,

• 26 declined to participate,49

• 18 were duplicates,50 and 

• 4 did not respond. 

To carry out the on-site assessments of manufacturing sites, the contractor 

developed a guide for its examiners. This guide focused on the firm’s Y2K 

activities in six areas: (1) executive leadership and control, (2) risk 

management, (3) corrective and preventive actions, (4) test planning and 

48The 803 consisted of those manufacturers that had registered PHRD products with FDA 

that were among the 90 types of PHRDs identified.

49Reasons given by manufacturers for declining to participate included scheduling or 

resource limitations, and recent regular FDA site inspections. Five manufacturing sites 

declined without giving a reason.

50These sites involved large, multisite manufacturers where the FDA contractor had already 

selected two or more of the manufacturer’s sites. According to FDA, the contractor did not 

assess duplicates if they came up in later samples. 
Page 32 GAO/T-AIMD-00-39

procedures, (5) communication with the consignee (user of the products), 

and (6) implementation and contingency planning.

After completing these assessments, examiners were required to prepare a 

report of concerns in each of the six areas reviewed at each manufacturing 

site. Concerns were identified as high, medium, or low, as defined below: 

• high—relates to actions that are not timely, inadequate planning, 

inadequate or incomplete resources, incomplete or inaccurate 

deliverables, unable to validate results, and/or inadequate due diligence;

• medium—relates to actions that are somewhat late, incomplete 

planning, insufficient or incomplete resources, deficiencies in 

deliverables, and/or incomplete validation of results; and

• low—relates to actions that are on schedule and have adequate 

resources.

According to FDA’s PHRD survey project manager, as of October 15, 1999, 

examiners had completed all 80 manufacturer site assessment visits, and 

had prepared 62 assessment reports. 

We reviewed the 25 manufacturer site visit reports that were completed by 

the examiners and available to us as of September 10, 1999. For 20 of these 

assessments, concern was low. At the five remaining sites, the examiner 

assessed at least one concern as moderate in one of the six areas, such as 

test planning and procedures. According to the FDA PHRD survey project 

manager, the areas identified in the site visit reports as medium risks do not 

constitute a risk to patient health or safety. 

Until recently, none of the site visit reports submitted to FDA contained a 

concern assessed as high. However, last week, the PHRD survey project 

manager informed us that FDA had received a site visit report with 

concerns accessed as high in two areas—leadership and control, and test 

planning and procedures. The report stated that the manufacturer’s polices 

and procedures were found to be inconsistent, ambiguous, and were not 

followed in a manner that would meet due diligence requirements. It also 

noted that the qualifications of the manufacturer’s personnel for specified 

tasks were not well defined, and that some personnel assigned to tasks 

identified in the policies and procedures were not qualified to perform 

those tasks. The report concluded that the manufacturer’s procedures for 

Y2K assessment and corrective and preventive action were less than 

adequate, and that assessment procedures had not been applied 
Page 33 GAO/T-AIMD-00-39

consistently. The manufacturer subsequently told the examiner that action 

would be taken on the issues raised. 

Late last week, FDA’s Senior Associate Commissioner for Policy, Planning, 

and Legislation testified that FDA sent an inspector to follow up with this 

manufacturer. The FDA official said the inspector determined that the 

deficiencies noted would not affect patient safety. He also stated that FDA 

would continue to monitor the situation at this site.

Regarding the overall planned phase one report, the project manager told 

us that FDA’s contractor is in the process of preparing a final report 

summarizing the findings from the 80 site visit assessment reports, 

detailing any problems encountered during the project and recommending 

whether the second phase should be performed. Although FDA initially 

expected to submit a final report to HHS by October 1, it has not yet 

established a revised deadline. Accordingly, it does not know when this 

information will be made available to the public. We believe that this 

information should be made available as soon as possible.

To assess how the contractor was executing FDA’s task order, we observed 

selected site visit assessments. At the five manufacturing site assessments 

we observed, the examiners generally followed the contractor-developed 

audit guide, and were knowledgeable about information technology 

management, Y2K testing, and risk assessment. During our two initial 

visits, we noted that the examiners sometimes could not answer questions 

from the manufacturers relating to the FDA clearinghouse and the 

processing of the final report on the site assessments. We subsequently 

shared these observations with FDA official, who agreed to consider our 

suggestions, such as better communicating to the firms the final reporting 

process and how the FDA Federal Y2K Biomedical Clearinghouse works. 

During the later three visits, we did not observe any similar areas of 

concern. 
Page 34 GAO/T-AIMD-00-39

FDA’s Activities to 

Determine Y2K Readiness of 

Manufacturers of 

Pharmaceutical, Biological, 

and Consumable Medical 

Products

FDA’s oversight and regulatory responsibility for pharmaceutical, 

biological, and consumable medical products51 is to ensure that they are 

safe and effective for public use. Since our April testimony,52 FDA has taken 

action to determine the Y2K readiness of these industries. Specifically, FDA 

is conducting voluntary surveys of manufacturers of pharmaceutical, 

biological, and consumable medical products for Y2K readiness. These 

surveys assess manufacturers’ plans and preparations to continue 

operations after January 1, 2000.

According to FDA’s Senior Associate Commissioner for Policy, Planning, 

and Legislation, information obtained from these surveys thus far indicates 

that there will likely be no significant disruption of necessary supplies of 

pharmaceuticals, biologicals, or consumable medical products as a result 

of Y2K. FDA believes that essential medical supplies will be available, and 

that the drug supply will be safe and adequate.

To obtain information on the Y2K readiness of the pharmaceutical industry, 

on April 21, 1999, the FDA Commissioner sent a letter to the presidents and 

CEOs of approximately 4,228 pharmaceutical manufacturers that produce 

prescription drugs, over-the-counter medication, bulk drugs, and also to 

drug distributors and repackagers, and medical gas manufacturers. In the 

letter, the Commissioner requested the assistance of these firms in assuring 

the American public that the firms had addressed the Y2K problem as it 

affects the adequacy, safety, and effectiveness of the supply of 

pharmaceuticals in the United States. 

According to FDA’s Senior Associate Commissioner for Policy, Planning, 

and Legislation, as of October 8, 1999, 3,132 (74 percent) of the firms had 

responded to the survey. Of these, 95 percent stated that they would be Y2K 

ready by October 31, 1999. According to the senior associate commissioner, 

FDA is committed to maximizing the response, especially from the 274 

priority manufacturers who produce sole source, orphan drugs,53 or the top 

200 prescribed medications.

51Biological products include vaccines, blood, and blood products.

52GAO/T-AIMD-99-136, April 15, 1999.

53Orphan drugs are those produced under provisions of the Orphan Drug Act (P.L. 97-414, § 

983, as amended). The act provides incentives for manufacturers to produce drugs that are 

used by a small number of patients to treat a specific, but not widespread, medical 

condition.
Page 35 GAO/T-AIMD-00-39

This FDA official testified on October 21, 1999, that, in addition to 

conducting the survey of pharmaceutical manufacturers, distributors, etc., 

FDA is taking the additional step of obtaining independent assurance of 

these firms’ Y2K assessments and corrections. The agency has obtained a 

contractor that is auditing each of 160 highest priority pharmaceutical 

firms, as well as a random sample of other firms. As of October 8, 1999, 

88 percent of these assessments have been completed. The report stated 

that the results of their audits to date are positive and confirmed FDA’s 

expectation that the pharmaceutical industry has taken the necessary steps 

to prepare for the year 2000. The interim report54 is available on FDA’s web 

site.55

FDA is also assessing the Y2K readiness of the biologics industry. In June, 

the Center for Biologics Evaluation and Research mailed a survey on Y2K 

readiness to 1,576 licensed biologics manufacturers and registered blood 

establishments. FDA also sent letters to biologics trade organizations 

requesting their assistance in encouraging their members to participate in 

the survey. 

According to FDA’s senior associate commissioner, as of October 15, 1999, 

it had received responses from 1,483 (94 percent) of the licensed 

manufacturers and blood establishments. In addition, as with the 

pharmaceutical industry, FDA is conducting follow-up audits of 

110 high-priority firms to assess their Y2K readiness. To date, FDA reports 

finding no problems with the audited firms. In addition, FDA is conducting 

random audits of other firms, and has completed audits of 48 of these with 

no problems identified as of October 14, 1999. FDA told us on 

October 27 that it plans to publicize the survey and audit results of the 

biologics manufacturers, although it has not established a date when this 

information will be available. We believe that this information should be 

made available as soon as possible. 

FDA also mailed Y2K readiness surveys to 3,070 manufacturers of 

consumable medical supplies in June.56 This survey focused on 

54Center for Drug Evaluation and Research’s Interim Report: Assessment of the 

Pharmaceutical Industry’s Readiness for Year 2000, FDA, October 18, 1999.

55The site is located at http://www.fda.gov/cder/y2k. 

56Consumable medical supplies include such items as intravenous tubing, kidney dialysis 

filter units, and blood and blood product bags.
Page 36 GAO/T-AIMD-00-39

manufacturers that produce critical devices that are used and consumed on 

a recurring basis during the delivery of essential health care services, as 

well as those whose availability is critical to the uninterrupted delivery of 

health care and patient welfare. As of October 14, 1999, FDA had received 

2,074 responses (68 percent) to its survey. According to FDA’s senior 

associate commissioner, approximately 90 percent of these respondents 

report that they will be ready for Y2K by October 31, 1999. 

FDA is also conducting audits of firms that supply medical consumables. It 

has given highest priority to 225 firms that produce devices that are only 

manufactured by a handful of those firms, as well as 57 manufacturers that 

are sole-source suppliers. According to FDA’s senior associate 

commissioner, to date, 197 of the high-priority firms have responded, and 

48 of the 57 sole-source firms have responded. On October 27, 1999, FDA 

told us that it plans to make the detailed survey and audit results for 

consumable medical products manufacturers available to the public, but it 

has not yet determined the date when this will be done. We believe that it is 

critical to make this information available.

In summary, VA has made much progress in addressing the Y2K computer 

problem. However, some critical tasks remain in the areas of testing 

business continuity and contingency plans and reporting Y2K compliance 

status of key components such as facility systems at VHA medical facilities. 

VHA should also reassess its decision not to test biomedical equipment in 

those instances in which the manufacturer encourages such testing. 

Additionally, VA needs to continue to follow up with pharmaceutical and 

medical-surgical firms that anticipated having compliant systems by 

July 31, 1999, and September 30, 1999, respectively, and make this 

information available to the public through its web site. 

Compliance status information on biomedical equipment can now be found 

in FDA’s clearinghouse or on manufacturers’ web sites. Also, to its credit, 

FDA has assessed the Y2K compliance activities of some PHRD 

manufacturing sites. This information should provide the American public 

with a higher level of confidence that medical devices will work as 

intended. FDA now needs to finalize its overall report on the results of its 

review of the PHRD manufacturing sites, and make this information 

available to HHS and the public through its web site.

We performed this assignment in accordance with generally accepted 

government auditing standards, from May through October 1999. In 
Page 37 GAO/T-AIMD-00-39

carrying out this assignment, we reviewed and analyzed VA’s Y2K 

documents and plans, comparing them against our guidance on Y2K 

activities. More specifically, we observed VBA’s “dry run” testing of its 

benefits payment systems, VHA’s forward-date tests of its hospital 

information systems, and tests of CMOP Y2K fixes. We reviewed the test 

plans, selected test scripts, and test results for each Y2K test. We also 

reviewed business continuity and contingency plans for a sample of for 

VHA medical centers and VBA regional offices, as well as VBA data centers. 

In addition, we reviewed and analyzed FDA documentation relating to its 

Y2K efforts on biomedical devices and pharmaceutical manufacturers. 

More specifically, we identified the amount and quality of information on 

product compliance information available on biomedical equipment 

manufacturers’ web sites, reviewed information from those sites to identify 

the total number of biomedical equipment products reported, and 

categorized their compliance status.57 We also reviewed manufacturers’ 

web sites to assess the clarity and completeness of the information 

reported.

In addition, we visited selected VHA medical centers, VBA regional offices, 

VA data centers, and VHA CMOPs to discuss their Y2K activities, and 

interviewed VA and FDA officials about those activities. Finally, we 

interviewed selected private hospital officials about their Y2K actions and 

pharmaceutical trade associations on their Y2K readiness surveys of 

pharmaceutical manufacturers.

Mr. Chairman, this concludes my statement. I would be pleased to respond 

to any questions that you or other members of the Subcommittee may have 

at this time.

Contact and 

Acknowledgments

For information about this testimony, please contact Joel Willemssen at 

(202) 512-6253 or by e-mail at willemssenj.aimd@gao.gov. Individuals 

making key contributions to this testimony included Dr. Nabajyoti 

Barkakati, Michael Fruitman, Tonia Johnson, Helen Lew, Barbara Oliver, 

Mike Resser, and Henry Sutanto.

57We summarized the results of our review in four compliance categories—products that do 

not employ a date, products that are compliant, products that are noncompliant, and 

products whose compliance status is currently unknown. This last category includes those 

manufacturers who reported that they have not completed an assessment of their products, 

have discontinued a product, or have a product that is now obsolete.

(511757) Letr
Ordering Information

The first copy of each GAO report and testimony is free.

Additional copies are $2 each. Orders should be sent to the 

following address, accompanied by a check or money order made 

out to the Superintendent of Documents, when necessary, VISA and 

MasterCard credit cards are accepted, also.

Orders for 100 or more copies to be mailed to a single address are 

discounted 25 percent.

Orders by mail:

U.S. General Accounting Office

P.O. Box 37050

Washington, DC 20013

or visit:

Room 1100

700 4th St. NW (corner of 4th and G Sts. NW)

U.S. General Accounting Office

Washington, DC

Orders may also be placed by calling (202) 512-6000

or by using fax number (202) 512-6061, or TDD (202) 512-2537.

Each day, GAO issues a list of newly available reports and 

testimony. To receive facsimile copies of the daily list or any list 

from the past 30 days, please call (202) 512-6000 using a touchtone 

phone. A recorded menu will provide information on how to obtain 

these lists.

For information on how to access GAO reports on the INTERNET, 

send an e-mail message with “info” in the body to:

info@www.gao.gov

or visit GAO’s World Wide Web Home Page at: 

http://www.gao.gov

United States

General Accounting Office

Washington, D.C. 20548-0001

Official Business

Penalty for Private Use $300

Address Correction Requested

Bulk Mail

Postage & Fees Paid

GAO

Permit No. GI00