U.S. GOVERNMENT PUBLISHING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Publishing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

98–628 2016

LEGISLATIVE HEARING ON H.R. 571, H.R. 593, 

H.R. 1015, H.R. 1016, H.R. 1017, H.R. 1128, AND 

H.R. 1129 

HEARING 

BEFORE THE

SUBCOMMITTEE ON OVERSIGHT AND 

INVESTIGATIONS 

OF THE

COMMITTEE ON VETERANS’ AFFAIRS 

U.S. HOUSE OF REPRESENTATIVES 

ONE HUNDRED FOURTEENTH CONGRESS 

FIRST SESSION 

THURSDAY, MARCH 19, 2015 

Serial No. 114–11 

Printed for the use of the Committee on Veterans’ Affairs 

( 


VACREP0180 with DISTILLER
(II) 

COMMITTEE ON VETERANS’ AFFAIRS 

JEFF MILLER, Florida, Chairman 

DOUG LAMBORN, Colorado 

GUS M. BILIRAKIS, Florida, Vice-Chairman 

DAVID P. ROE, Tennessee 

DAN BENISHEK, Michigan 

TIM HUELSKAMP, Kansas 

MIKE COFFMAN, Colorado 

BRAD R. WENSTRUP, Ohio 

JACKIE WALORSKI, Indiana 

RALPH ABRAHAM, Louisiana 

LEE ZELDIN, New York 

RYAN COSTELLO, Pennsylvania 

AMATA COLEMAN RADEWAGEN, American 

Samoa 

MIKE BOST, Illinois 

CORRINE BROWN, Florida, Ranking 

Minority Member 

MARK TAKANO, California 

JULIA BROWNLEY, California 

DINA TITUS, Nevada 

RAUL RUIZ, California 

ANN M. KUSTER, New Hampshire 

BETO O’ROURKE, Texas 

KATHLEEN RICE, New York 

TIMOTHY J. WALZ, Minnesota 

JERRY MCNERNEY, California 

JON TOWERS, Staff Director 

DON PHILLIPS, Democratic Staff Director 

SUBCOMMITTEE ON OVERSIGHT AND INVESTIGATION 

MIKE COFFMAN, Colorado, Chairman 

DOUG LAMBORN, Colorado 

DAVID P. ROE, Tennessee 

DAN BENISHEK, Michigan 

TIM HUELSKAMP, Kansas 

JACKIE WALORSKI, Indiana 

ANN M. KUSTER, New Hampshire, Ranking 

Member 

BETO O’ROURKE, Texas 

KATHLEEN RICE, New York 

TIMOTHY J. WALZ, Minnesota 

Pursuant to clause 2(e)(4) of Rule XI of the Rules of the House, public hearing records 

of the Committee on Veterans’ Affairs are also published in electronic form. The printed 

hearing record remains the official version. Because electronic submissions are used to prepare 

both printed and electronic versions of the hearing record, the process of converting between 

various electronic formats may introduce unintentional errors or omissions. Such occurrences 

are inherent in the current publication process and should diminish as the process is further 

refined. 


VACREP0180 with DISTILLER
(III) 

C O N T E N T S 

Thursday, March 19, 2015 

Page 

Legislative Hearing on H.R. 571, H.R. 593, H.R. 1015, H.R. 1016, H.R. 1017, 

H.R. 1128, and H.R. 1129 .................................................................................... 1 

OPENING STATEMENTS 

Mike Coffman, Chairman ........................................................................................ 1 

Prepared Statement ......................................................................................... 36 

Ann Kuster, Ranking Member ................................................................................ 3 

Jeff Miller, Chairman of the Full Committee ........................................................ 4 

Prepared Statement ......................................................................................... 37 

WITNESSES 

Ms. Meghan Flanz, Director, Office of Accountability Review Department 

of Veterans Affairs ............................................................................................... 11 

Prepared Statement ......................................................................................... 38 

Accompanied by: 

Dr. Michael Icardi, National Director of Pathology and Laboratory 

Medicine Services, VHA 

Mr. Stanley Lowe, Deputy Assistant Secretary for Information Security and Chief Information Security Officer, Department of Veteran Affairs 

Mr. Dennis Moisten, CC, Associate Executive Director, Office of Operations, Office of Construction and Facilities Management, Department of Veterans Affairs 

Ms. Diane Zumatto, National Legislative Director, AMVETS ............................. 26 

Prepared Statement ......................................................................................... 52 

Mr. Frank Wilton, Chief Executive Officer, American Association of Tissue 

Banks .................................................................................................................... 28 

Prepared Statement ......................................................................................... 58 

Mr. Daimon E. Geopfert, National Leader, Security and Privacy Consulting, 

McGladrey, LLP ................................................................................................... 29 

Prepared Statement ......................................................................................... 62 

STATEMENT FOR THE RECORD 

American Legion ...................................................................................................... 71 


VACREP0180 with DISTILLER

VACREP0180 with DISTILLER
(1) 

LEGISLATIVE HEARING ON H.R. 571, H.R. 593, 

H.R. 1015, H.R. 1016, H.R. 1017, H.R. 1128, AND 

H.R. 1129 

Thursday, March 19, 2015 

U.S. HOUSE OF REPRESENTATIVES, 

COMMITTEE ON VETERANS’ AFFAIRS, 

SUBCOMMITTEE ON OVERSIGHT AND INVESTIGATION, 

Washington, D.C. 

The committee met, pursuant to notice, at 8:10 a.m., in Room 

334, Cannon House Office Building, Hon. Mike Coffman [chairman 

of the committee] presiding. 

Present: Representatives Kuster, Lamborn, Roe, Benishek, 

Huelskamp, Walorski, O’Rourke, Rice, Walz, Miller, and Kirkpatrick. 

OPENING STATEMENT OF CHAIRMAN MIKE COFFMAN 

Mr. COFFMAN. Good morning. This hearing will come to order. 

I want to welcome everyone to today’s legislative hearing on H.R. 

571, H.R. 593, H.R. 1015, H.R. 1016, H.R. 1017, H.R. 1128, and 

H.R. 1129. The latter two, H.R. 1128 and 1129, are bills suggested 

for this hearing by the minority. So I will ask Ranking Member 

Kuster to address them in her opening remarks. 

I also welcome full committee Chairman Jeff Miller and ask 

unanimous consent that Ann Kirkpatrick, the previous Ranking 

Member of this subcommittee, be allowed to join us at the dais. 

Ms. KUSTER. No objection. 

Mr. COFFMAN. Okay. While we are at it, I would also like to ask 

unanimous consent that a statement from the American Legion be 

entered into the hearing record. 

Hearing no objection, so ordered. 

[The information follows:] 

Mr. COFFMAN. Today we will address H.R. 571, the Veterans Affairs Retaliation Prevention Act of 2015, which was introduced by 

full committee Chairman Jeff Miller. 

This bill will improve the treatment of whistleblower complaints 

by the VA by defining a set process for whistleblowers, to help correct problems at the lowest level possible, while creating necessary 

penalties for supervisors who retaliate against whistleblowers. 

Second, H.R. 593, the Aurora VA Hospital Refinancing Construction Reform Act of 2015. It is a bipartisan bill I introduced along 

with the rest of the Colorado delegation. H.R. 593 would increase 

the authorization cap to help the VA to finally finish the Aurora 

Medical Center with the much-needed help of the Army Corps of 


VACREP0180 with DISTILLER
2 

Engineers, in order to give Colorado veterans the state-of-the-art 

medical facility they deserve. Since this bill’s introduction, the VA 

has announced that the Aurora project will cost at least $1.73 billion, a full $1.4 billion over the original costs found in GAO’s report. This is simply outrageous and could very well make the hospital the most expensive in our nation’s history. 

Notably, according to GAO, the New Orleans VA Hospital con- struction project will top $1 billion as well. So mismanagement, 

cost overruns and delays are the norm of VA’s construction program. For that reason, I question whether the VA should conduct 

its own major construction at all. While it is my top priority to get 

this hospital built so that Colorado veterans get the service they 

deserve, we simply cannot authorize the nearly $1 billion authorization cap increase without VA presenting the options it has to 

correct its own poor decisions with only half of a hospital to show 

for it. 

The VA has reprogrammed a portion of the funds needed to finish the Aurora construction project, but it cannot continue to pull 

money from other projects, thereby robbing other veterans around 

the country of a timely completion of their hospital. Perhaps we 

could use VA bonuses to provide funding for this grossly mismanaged project. 

But what is absolutely clear is that before any money is given 

to the VA to bail them out of this mess they created in Aurora, VA 

construction officials responsible for this travesty must be held accountable. These individuals should not be simply taken out of the 

chain of command for VA construction, they should be fired. If anyone in the private sector allowed a project under its supervision to 

get $1 billion over budget, the decision to fire them would be simple. That should happen here and I look forward to our discussion 

today with VA on ways forward. 

Third, we will address H.R. 1015, the Protection of Business Opportunities for Veterans Act of 2015, sponsored by the Honorable 

Tim Huelskamp of Kansas. 

H.R. 1015 will make tremendous strides at holding accountable 

the bad actors that attempt to defraud veteran-owned small businesses of crucial set-asides they receive in business. 

Fourth, we will discuss H.R. 1016, the Biological Impact Tracking and Veterans’ Safety Act of 2015, introduced by the Honorable 

Phil Roe of Tennessee. 

This legislation requires the VA to implement a standard identification protocol for biological implants consistent with the FDA’s 

system, which would improve VA’s ability to prevent implantation 

of contaminated tissue, and also to notify veterans in cases of recalls. 

Fifth, we will hear about H.R. 1017, the Veterans Information 

and Security Improvement Act, which was sponsored by the Honorable Jackie Walorski from Indiana. 

This IT security directive is designed to assist VA in mitigating 

known weaknesses by identifying detailed actions that should be 

taken to address its longstanding information security challenges. 

Once again, I would like to thank all those in attendance for joining us in our discussion today. And I now recognize Ranking Member Kuster for five minutes to issue her opening statement. 


VACREP0180 with DISTILLER
3 

[THE PREPARED STATEMENT OF CHAIRMAN MIKE COFFMAN APPEARS IN THE APPENDIX] 

OPENING STATEMENT OF RANKING MEMBER ANN KUSTER 

Ms. KUSTER. Thank you very much, Mr. Chair. And I want to say 

at the outset, I am delighted to be here with you and I look forward 

to our work together on the Oversight and Investigations Subcommittee. 

Welcome our panel this morning. The subcommittee will hear the 

views of the VA and our witnesses regarding seven bills before us, 

as outlined by our chair. These bills address concerns over the VA’s 

whistleblower protections, cyber security measures, tracking biological implants, and other important matters. 

These legislative hearings are vital as the subcommittee begins 

our work to ensure that the important legislation moves forward, 

that requirements are measured, and ultimately that we are working to fix and improve the problems discussed today. None of us 

have all the answers. By hearing the opinions of many, we can better ensure that we are effectively addressing these problems at the 

VA that lend themselves to oversight and legislative fixes. 

I thank the Chairman for including two measures introduced by 

my predecessor as ranking member on this subcommittee, Representative Ann Kirkpatrick, who will be with us this morning. 

H.R. 1129 addresses the manner in which the VA investigates 

the complaints of whistleblowers, while ensuring cooperation and 

coordination with the Office of Special Counsel and the VA Inspector General. The VA has made great strides in setting up the Office 

of Accountability Review, but I am interested in exploring whether 

more needs to be done and whether the office primarily responsible 

for handling investigations outside the scope of the OSC or IG is 

better positioned outside the VHA. I am also interested in exploring whether the idea of centralizing complaints in a specific office 

could lead to better VA-wide accountability and responsiveness for 

our veterans. 

H.R. 1128 is a response to cyber security concerns within the VA 

and how best to balance the competing interests of ensuring that 

the VA has the proper tools to fulfill its mission, while also ensuring that information is kept as secure as possible. Cyber security 

is an ever growing threat and problem and new tools and tactics 

are developed daily, both by those intent on improperly collecting 

information and the efforts of the Federal Government and the private sector to protect our information. 

I look forward to working with the chairman and my colleagues 

as we look at these bills before us today and begin the process of 

matching solutions to problems in the most effective manner possible. 

Ms. KUSTER. Thank you, and I yield back. 

Mr. COFFMAN. Thank you, Ranking Member Kuster. 

We will now hear from Chairman Jeff Miller from the State of 

Florida, who will be speaking in support of H.R. 571, the Veterans 

Affairs Retaliation Prevention Act of 2015. 


VACREP0180 with DISTILLER
4 

OPENING STATEMENT OF CHAIRMAN JEFF MILLER OF THE 

FULL COMMITTEE 

Chairman Miller. 

Mr. MILLER. Thank you for the recognition, Mr. Chairman. It is 

a pleasure to be with you. 

I want to echo your comments in your opening statement as it 

relates to the fiasco at the Aurora facility. Your Denver Post yesterday aptly headlined an editorial, ‘‘Still No Accountability,’’ and 

I don’t see any on the horizon. To think that this Congress would 

raise an existing legislative cap of $800 million by almost a billion 

more without a plan and a way ahead is absolutely ludicrous. 

And we as a committee, both Republicans and Democrats, have 

been asking for an answer from VA for really months now, but the 

investigation, as you well know—and I salute you, your current 

ranking member and your former ranking member for delving into 

it deeply to try to get a solution out in front of the VA and, unfortunately, they did not heed many of the warnings that were given. 

Unfortunately, the individuals that were in charge are still employed by the VA, several of them receiving very generous bonuses 

for their ineptitude and their incompetence. And to still be employed by the taxpayers after this debacle is egregious. So I want 

to thank you for your diligence and the entire Colorado delegation 

in staying on top of the issue. 

I want to talk about H.R. 571, which is the Veterans Affairs Retaliation Prevention Act of 2015. You know, we could name it anything, the Whistleblower Protection Act, whatever it may happen 

to be. But you all know during 2014 when the scandal erupted basically around Phoenix we found it was much more systemic, that 

retaliation and bureaucrat corruption really gripped the VA because people were fearful, but there were whistleblowers that were 

trying to come forward and do the right thing and let people know 

that there were problems that existed within the VA. And the hallmark of the culture that existed there remains really rampant 

today within the VA against VA employees who speak up to try to 

fix problems that exist within the agency. 

So these problems were so widespread in 2014 that the Office of 

Special Counsel was inundated with more whistleblower complaints than all the other federal government agencies combined. 

Unfortunately, despite promises from the leadership at VA at that 

time that whistleblower retaliation would no longer be tolerated, 

occurrences continue within the agency and a lack of any meaningful accountability shows that it is really not the case. Proper oversight of any federal agency cannot be done effectively without employees within that agency informing the Congress and other oversight bodies of what is going on. Over the years, numerous federal 

statutes have been passed to provide added protection to whistleblowers, but many VA supervisors have found a way to really circumvent the law that is there to protect these individuals and 

hopefully encourage them to come forward and bring information 

to the bodies that need them to do their oversight. And this bill intends to put an end to the retribution and the repercussions. 

Specifically, H.R. 571 would provide VA employees who seek to 

report potential government waste, criminal behavior or compromised healthcare services within the VA a set process to fix 


VACREP0180 with DISTILLER
5 

problems at the lower level possible while affording them improved 

protection from retaliation. This legislation will also prohibit superiors from retaliating against employees who report or assist in reporting problems to the VA, to the Inspector General, to Congress, 

or the GAO. Employees who serve as a witness in investigations 

and those who refuse to perform illegal acts in the course of their 

employment will also be protected. To ensure accountability, this 

bill will provide meaningful penalties to VA employees who are 

found to have retaliated against another employee for filing, simply 

filing a whistleblower complaint. 

Specifically, the retaliating employee should receive a suspension 

or removal from federal service, a fine to repay the expense borne 

by the Federal Government in defending their retaliatory behavior, 

a forfeiture of bonuses received while the retaliation occurred, and 

a prohibition of receiving future bonuses for a one-year period. 

Finally, this legislation requires improved training to be provided 

to all VA employees on the protections that are afforded to employees that are making complaints and the repercussions that retaliating employees will face if they seek to suppress positive change. 

Look, our American veterans deserve no more than the quality 

services that VA provides and those benefits that they have earned. 

So improvements of those services often come in the form of suggested fixes by employees. And this commonsense legislation, we 

all do commonsense legislation, this bill certainly is one of them, 

would provide the process to safely suggest these fixes while giving 

Secretary McDonald and all secretaries in the future the tools to 

hold accountable employees who seek to prevent change within 

their agency. 

So I look forward to working with this subcommittee, our veterans service organization partners in the VA and other stakeholders on this bill, because protecting the conscientious VA employees who report waste and wrongdoing within VA must be 

among our constant priorities. 

I appreciate you, Mr. Chairman, to the ranking member, Ms. 

Kuster, for holding this hearing and for your hard work and leadership on this Subcommittee on Oversight and Investigation. I appreciate really the opportunity to be with you this morning. 

[THE PREPARED STATEMENT OF CHAIRMAN JEFF MILLER OF THE

FULL COMMITTEE APPEARS IN THE APPENDIX] 

Mr. MILLER. I yield back. 

Mr. COFFMAN. Thank you, Chairman Miller. 

Now we will hear from the Honorable Tim Huelskamp from the 

State of Kansas, who will discuss his bill, H.R. 1015, the Protecting 

Business Opportunities for Veterans Act of 2015. 

Dr. HUELSKAMP. Thank you, Mr. Chairman, for the opportunity 

to testify in support of H.R. 1015, the Protecting Business Opportunities for Veterans Act. 

Over the years, this committee has received testimony, Inspector 

General’s reports and other reports of numerous entities who illicitly took advantage of set-asides rightly reserved for service-disabled-veteran-owned small businesses. As a member of this subcommittee, as well as the House Small Business Committee, I am 

very concerned about the fraud and abuse of these programs, and 

I think they need stricter oversight and enforcement. This act 


VACREP0180 with DISTILLER
6 

would apply to those small business concerns owned and controlled 

by a veteran with a service disability, as well as small businesses 

controlled by veterans who received federal contracts from the VA. 

The bill is fairly simply. It requires that as part of the contract, 

the VA must obtain a certification the business will comply with 

the requirements already written into the law, and it will specifically specify how they intend to meet the requirement 50 percent 

of the contracted service work be performed by a veteran-owned 

business or a service-disabled-veteran-owned business with this 

certification, as well as a requirement that the Office of Small 

Business and Disadvantaged Business Utilization and the VA’s 

Chief Acquisition Officer will implement a process that will allow 

better oversight and enforcement of what we all intended in the 

law and that is to make certain these set-asides go to veterans. 

With these changes, law enforcement will have the necessary 

tools to crack down on corrupt contractors who use these passthroughs and other methods to take advantage of set-asides that 

should be and are lawfully reserved for veterans. I think the bill 

is necessary to direct the office and the VA chief acquisition officer 

to do what they should have been doing all along, and that is to 

monitor and enforce compliance. 

We have had a hearing on this last year and moved this through 

the committee, and I am bringing it back forward because, again, 

I want to make sure these contracts are accessed and are taken advantage by deserving veterans and not some of these illicit contracts, Mr. Chairman. So I appreciate the opportunity to visit very 

quickly about it. Again, we have discussed this before and hopefully we can move forward again. I yield back. 

Mr. COFFMAN. Thank you, Dr. Huelskamp. 

We will now hear from the Honorable Phil Roe from the State 

of Tennessee, who will be speaking in support of his bill, H.R. 1016, 

the Biological Implant Tracking and Veterans’ Safety Act of 2015. 

Dr. Roe. 

Dr. ROE. Thank you and the ranking member for allowing me to 

be here this morning and speak. 

And just to reiterate what the Chairman said in the Aurora, I 

didn’t think it was possible to make politicians speechless, but they 

have succeeded beyond my wildest expectations. And I look at a billion dollars at how much veterans’ healthcare you can provide, 

physical therapy, medications, cancer surgery, whatever the therapy may be that is not available in a limited budget. 

And I looked at this and, having helped run hospitals and medical practices, the interest payments alone on this if you were in 

the private world would be over $70 million a year. That is not 

paying it off. You would have to cash-flow that, your operating expenses, your salaries, your depreciation, all of those things. There 

is no way that this could possibly function. And I am one vote, but 

I am not going to vote for another penny until I go visit that place 

and I have some assurances that the veterans are going to get 

what they are paying—the taxpayers are going to get what they 

are paying for. I mean, I think we have to do that as a committee. 

And I certainly commend you all for keeping an eye on this, Mr. 

Chairman, and I thank you for that. And, Doug, you too. I know 

you are frustrated and I am too, I share your frustration. But 


VACREP0180 with DISTILLER
7 

thank you all and it is a pleasure to present H.R. 1016, the Biological Implant Tracking and Veterans’ Safety Act, before this committee for consideration. 

A frightening GAO report in January of 2014 found that the VA 

does not use a standardized process for tracking biological tissue 

from cadaver donor to living veteran recipients. In the event of a 

recall, it would be virtually impossible to track down which patient 

had received the contaminated tissue. The same GAO report detailed that the Veterans Health Administration does not always ensure they are purchasing tissue from biological implant vendors 

that have registered with the FDA and does not maintain an inventory system to keep the expired tissues from remaining in storage 

alongside unexpired tissues. 

This GAO report and our VA committee staff had discovered that 

the VA often uses a loophole in Title 38 of the U.S. Code 8123 that 

allows it to buy biological implants on the open, unregulated market, which it does in 57 percent of its biological implant purchases. 

H.R. 1016 would require the procurement of biological implants 

from vendors on the federal supply schedules which have been appropriately vetted for biological implants not on the federal supply 

schedule but requested by clinicians. My bill requires justification 

and approval of open-market purchases under the federal acquisitions regulation on a case-by-case basis, rather than simply granting a blanket waiver as provided in Title 38. 

H.R. 1016 would direct the Secretary of Veterans Affairs to adopt 

the FDA’s unique device identification system for labeling of all biological implant tissue and implement an automated inventory system to track the tissue from donor to implant recipient. This legislation would also require all biological implant tissue to be procured through vendors that are registered with the FDA, accredited 

by the American Association of Tissue Banks, and use FDA’s 

unique device identification system. 

Mr. Chairman, the six million veterans served annually by VHA 

deserve the high standard of patient care in the nation. Implementation of H.R. 1016 would help establish the VA as an industry 

leader in biological implant safety and accountability. 

I want to thank the Oversight and Investigation subcommittee 

staff for their help in developing this legislation, which truly puts 

veterans patients first. 

Thank you, Mr. Chairman, and I yield back. 

Mr. COFFMAN. Thank you, Dr. Roe. 

We will now hear from the Honorable Jackie Walorski from Indiana, who will be speaking about her directive, the Veterans Information and Security Improvement Act. 

Ms. Walorski. 

Ms. WALORSKI. Thank you very much, Mr. Chairman. Good 

morning to all my fellow colleagues. 

This H.R. 1017 comes from feedback the committee received at 

a members-only briefing in December of 2013, which the VA, the 

VA’s Office of Inspector General and the Government Accountability Office all attended. At this briefing, the committee provided 

an overview of VA’s information security vulnerabilities using VA’s 

own internal documents and previous testimony from VA’s IG. 


VACREP0180 with DISTILLER
8 

The committee has had numerous meetings, sent letters and held 

a hearing in November of 2014 to address IT security weaknesses. 

Unfortunately, VA’s lack of cooperation has been a longstanding 

issue that continues to this day. Independent information security 

experts verified HVAC’s findings about the VA’s critical network 

vulnerabilities, including the following. 

Within VA’s 420,000 computers, there are five vulnerabilities on 

95 percent of those computers. VA employs tens of thousands of 

outdated operating units. Because of VISTA’s vulnerabilities, VA 

stated that a data breach to financial, medical and personal veteran and employee information will occur with no way of tracking 

the source of the breach. VA’s network has been compromised at 

least ten times since March, 2010. 

And finally, and probably most troubling, is that the VA recently 

proclaimed they had a clean bill of health on network security. 

However, the committee found that a state actor had penetrated 

VA’s network around September of 2014. This was substantiated 

by another government entity, after which the committee briefed 

Secretary McDonald. VA was not aware of the intrusion, which by 

all accounts was then not detected by VA’s CRISP Einstein 3 or by 

any active review being conducted by a third-party contractor. 

Over the past 20 years, VA’s independent auditor, the IG and the 

GAO have all reported numerous persistent weaknesses in the VA’s 

security, placing veterans’ personal information at risk. Despite the 

GAO’s and IG’s testimony and the committee’s evidence that came 

from the VA itself, VA officials did not agree with our findings from 

the briefing. They will not acknowledge that critical security 

vulnerabilities exist. 

It is important to understand the critical nature of the security 

failures we are discussing today. These failures are not due to a 

lack of resources, they are due to a lack of priorities, leadership 

and proper federal guidance. We need stronger, more focused action 

to ensure the VA fully implements a robust security program. That 

is why we need this bill. 

I am confident this directive will provide VA with a clear IT 

roadmap and take away any guesswork in order to achieve a riskbased approach to addressing these challenges. GAO and a number 

of private sector companies also agreed and stated that if the directive is implemented it will allow VA to refocus its efforts on steps 

needed to improve the security of its systems and information. 

This bill establishes an explicit plan of action to resolve VA’s IT 

security weakness identified by the committee and others. The plan 

is taken from common federal and industry best practices. 

Specifically, the bill directs the secretary to do the following. Reclaim, secure and safeguard VA’s network; defend the work stations from critical security vulnerabilities; upgrade or phase out 

unsupported and outdated operating systems; secure Web applications from vital vulnerabilities; protect VISTA from anonymous 

user access; and comply with federal information security laws, 

OMB guidance and NIST standards. 

To improve transparency and accountability, the bill also directs 

the secretary to submit to the committee a biannual report, including a description of the actions taken by the secretary to implement 

and comply with this directive. The IG will also be required to subVerDate Aug 31 2005 15:49 May 25, 2016 Jkt 000000 PO 00000 Frm 00012 Fmt 6633 Sfmt 6633 Y:\98-628.TXT PAT

VACREP0180 with DISTILLER
9 

mit to the committee an annual report that includes a comprehensive review of VA’s execution of this directive. 

Finally, on a monthly basis the secretary will submit to the committee reports on any discovered security weaknesses. 

Thank you, Mr. Chairman. I yield back. 

Mr. COFFMAN. Thank you, Ms. Walorski. 

We will now hear from the Honorable Ann Kirkpatrick from Arizona, who will discuss her bills, H.R. 1128, the Department of Veterans Affairs Cyber Security Protection Act, and H.R. 1129, the 

Veterans Whistleblower and Patient Protection Act of 2015. 

Ms. KIRKPATRICK. Thank you, Chairman Coffman and Ranking 

Member Kuster. Members of the committee and staff, it is nice to 

see you this morning. And I really thank you for all you are doing 

for our veterans and I appreciate that you included my two bills 

in this hearing. So thank you very much. 

H.R. 1128, the Department of Veterans Affairs Cyber Security 

Protection Act, and H.R. 1129, the Veterans Whistleblower and Patient Protection Act of 2015, are two bills that will improve the 

lives of veterans. They will bring much needed accountability to the 

VA and protect VA employees and patients who report wrongdoing. 

The Cyber Security Protection Act aims to protect veterans’ personal information and improve VA information security without 

compromising the VA’s mission to provide healthcare benefits and 

services to veterans. 

After reported VA network compromises in a GAO report last 

year that found VA IT networks were vulnerable to security 

breaches, I believe legislation is necessary to ensure the VA takes 

appropriate measures to safeguard veterans’ personal information. 

This bill offers commonsense steps to do just that. 

First, it requires the VA to report quarterly to Congress on actions and plans to address known information security 

vulnerabilities and provide a timetable for addressing them. 

Second, it mandates a report on VA actions to hold employees accountable for data breaches. The report would include VA’s proposed reorganization of its information security infrastructure. 

Third, it requires the VA to develop an information security strategic plan that protects veterans’ information and anticipates future cyber security threats. It requires the VA to recruit and train 

employees with skills and expertise in information security, and to 

update VA information technology. 

This bill is not creating requirements that are so rigid that the 

VA is unable to perform vital services such as referring patients to 

other healthcare providers or granting veterans and families the 

benefits they deserve. I urge all of you to support this bill. 

As a member of the House Veterans’ Affairs Committee in the 

previous congress, I sat through hearing after hearing with many 

of you after whistleblowers at the Phoenix VA and other VA medical facilities exposed a VA-wide patient access crisis and the manipulation of patient access data. Last month I heard from two 

whistleblowers at the Phoenix VA, who reported mismanagement 

of the Phoenix VA’s suicide prevention and substance abuse treatment program. 

If not for the courage of these whistleblowers, it is unknown how 

long these practices would continue to persist. Unfortunately, many 


VACREP0180 with DISTILLER
10 

VA employees or patients who attempt to report wrongdoing face 

retaliation. 

The Veterans Whistleblower and Patient Protection Act of 2015 

would encourage those who wish to report wrongdoing to come forward without fear of retaliation. This bill would ensure that the 

whistleblower retaliation reports and patient complaints are handled at the highest level in the office of the VA secretary. This ensures that anyone reporting wrongdoing does not risk retaliation 

from local supervisors who refuse to act. 

This office of whistleblower and patient protection would equip 

the secretary with an investigatory arm to take action on allegations. The office would create one national hotline for VA employees and patients to anonymously report whistleblower retaliation 

or patient safety and treatment complaints, investigate patient 

claims, and serve as the only VA office permitted to investigate 

whistleblower retaliation complaints. It would report the results of 

its investigations and recommend actions to the VA secretary, and 

coordinate efforts between the VA Office of Inspector General and 

the Office of Special Counsel to ensure complaints are thoroughly 

investigated and to prevent duplicate investigations. 

We can continue writing letter after letter to the VA secretary 

asking for the protection of VA whistleblowers’ rights as more of 

our constituents come forward or we can pass legislation that will 

address this issue. 

Again, I urge the members of the committee to support the bill. 

I know that many of you on the committee have similar legislation 

and I just want to say I look forward to working with you, so that 

we can merge this legislation into one good bill that we can pass 

out of the House of Representatives and really make a difference 

for our veterans. So thank you very much. 

I yield back. 

Mr. COFFMAN. Thank you, Ms. Kirkpatrick. 

On our first panel, we will hear from Ms. Meghan Flanz, Director 

of the VA’s Office of Accountability Review. She is accompanied by 

Dr. Michael Icardi, the National Director of Pathology and Laboratory Medicine Services for the Veterans Health Administration; Mr. 

Stanley Lowe, Deputy Assistant Secretary for Information Security 

and VA Chief Information Security Officer; Mr. Dennis Milsten, Associate Executive Director for the Office of Operations, Office of 

Construction and Facilities Management for the Department of 

Veterans Affairs. 

Ms. Flanz, you are now recognized for five minutes to provide 

your opening remarks. 


VACREP0180 with DISTILLER
11 

STATEMENT OF MEGHAN FLANZ, DIRECTOR, OFFICE OF ACCOUNTABILITY REVIEW, DEPARTMENT OF VETERANS AFFAIRS. ACCOMPANIED BY: DR. MICHAEL ICARDI, NATIONAL 

DIRECTOR OF PATHOLOGY AND LABORATORY MEDICINE 

SERVICES, VETERANS HEALTH ADMINISTRATION; STANLEY 

LOWE, DEPUTY ASSISTANT SECRETARY AND CHIEF INFORMATION SECURITY OFFICER, DEPARTMENT OF VETERANS 

AFFAIRS; DENNIS MILSTEN, ASSOCIATE EXECUTIVE DIRECTOR, OFFICE OF OPERATIONS, OFFICE OF CONSTRUCTION 

AND FACILITIES MANAGEMENT, DEPARTMENT OF VETERANS AFFAIRS 

STATEMENT OF MEGHAN FLANZ 

Ms. FLANZ. Good morning and thank you, Mr. Chairman, Ranking Member Kuster, and other members of the subcommittee. 

We appreciate the opportunity to be here today to discuss VA’s 

views on the seven bills that do cover a wide range of topics, whistleblower protection, how VHA handles biological implants, information technology, small business contracting, and VA’s Denver 

hospital project. 

Because the committee has our detailed written statement on the 

bills in hand, I will limit my remarks to our brief observations on 

each bill, so we can then focus our time on answering your questions. 

Two of the bills today concern whistleblower rights and protections. VA has certainly had and continues to have problems ensuring that whistleblower disclosures receive prompt and effective attention, and that whistleblowers themselves are protected from retaliation. It is critical that all VA employees and supervisors share 

trust and mutual respect as they share information, especially if an 

employee is seeing something that is not working for the benefit of 

our veterans, something that is against the law, or something that 

is just not right. 

VA is absolutely committed to ensuring fair treatment for employees who bring these deficiencies to light. We are collaborating 

closely with the Office of Special Counsel, the independent office responsible for overseeing whistleblower disclosures and retaliation 

claims, to ensure that all VA supervisors understand their roles 

and responsibilities and to speed assistance to any employee who 

may be experiencing retaliation. 

Mr. Chairman, we believe strong leadership, effective training 

and close collaboration with OSC and with this committee are the 

keys to the cultural change the department requires. Our employees and the veterans we serve depend on the work you and our 

other stakeholders are doing to address our deficiencies head on. 

And of course we are eager to discuss these efforts with you and 

to get the benefit of your insights. 

VA understands the urge toward legislative action in the wake 

of reports of troubling individual VA whistleblower cases. However, 

as we have detailed in our written testimony, we are concerned 

that some aspects of H.R. 571 would be unworkable in practice and 

could lead to unintended negative consequences. We are particularly concerned that the bill adopts a one-size-fits-all rule that 

would impose the same investigative, reporting and disciplinary reVerDate Aug 31 2005 15:49 May 25, 2016 Jkt 000000 PO 00000 Frm 00015 Fmt 6633 Sfmt 6633 Y:\98-628.TXT PAT

VACREP0180 with DISTILLER
12 

quirements on all VA supervisors regardless of their grade or function. 

It is important to note that VA has more than 30,000 supervisors, fewer than 500 of whom are senior executives. Many of our 

first-level supervisors have only minimal education and are at relatively low pay grades. While of course all supervisors must respond appropriately to employees’ disclosures and all must protect 

employees from retaliation, we believe the processes by which supervisors respond to employee disclosures must be calibrated to different supervisors’ capabilities and roles. We also want to protect 

the trusting, well-balanced supervisor-subordinate relationships 

that do exist in many VA work units while correcting relationships 

that are out of balance or otherwise not working well. 

H.R. 1129 focuses on a centralized process for investigation of 

disclosures. We are concerned that this bill might unnecessarily duplicate or replace existing functions now belonging to OSC, to VA’s 

reconfigured Office of the Medical Inspector, or to the Office of the 

Inspector General. 

Also on the agenda today is H.R. 593, which would extend the 

authorization for the replacement major medical facility in Denver 

and set out requirements for an agreement with the Army Corps 

of Engineers to carry that project to conclusion. Needless to say, 

VA is determined to overcome earlier setbacks in this project to put 

it on the best track for success for Colorado veterans. We understand that the committee has questions and concerns about that 

project and Mr. Milsten is prepared to address those in detail. 

Also on the agenda are two bills regarding information technology, particularly information security. We appreciate the goals 

of H.R. 1017, but as we have stated, we are concerned that detailed 

statutory requirements for management of IT operations might 

prove too inflexible for VA to respond effectively to the constantly 

evolving cyber security landscape. 

H.R. 1128 does use a less prescriptive approach. VA appreciates 

and supports the goals of the bill and has no objection to some of 

the reporting requirements, but is concerned that some requirements might be quite onerous relative to the benefits they would 

yield. VA will be glad to work with the committee on those aspects 

of H.R. 1128 that appear problematic. 

H.R. 1016 would require VA to adopt specific systems and protocols for the procurement and tracking of biological implants, and 

would set requirements for inspections and audits. As our written 

testimony has stated, VA agrees with the general purpose of the 

bill, but has concerns about some specifics. Dr. Icardi can address 

those matters in detail. 

Finally, VA has reviewed H.R. 1015, the Protecting Business Opportunities for Veterans Act of 2015. While we support the goal of 

the bill, we would like to clarify some technical issues and ambiguities before we set out a position on it. I know VA’s small business 

program and procurement specialists will be glad to follow up with 

the committee on that bill. 

Mr. Chairman, thank you again for the opportunity to testify. We 

are now glad to answer questions the members of the committee 

may have. 


VACREP0180 with DISTILLER
13 

[THE PREPARED STATEMENT OF MEGHAN FLANZ APPEARS IN THE

APPENDIX] 

Mr. COFFMAN. Thank you, Ms. Flanz. 

Mr. Milsten, yesterday the VA issued a new cost estimate to com- plete the new VA hospital in Aurora, Colorado now at $1.73 billion. 

As the Associate Executive Director of the Office of Construction 

and Facilities Management, please explain how VA went from a 

cost not too long ago, actually last year the estimate was $604 million and now we are at $1.73 billion. How did we get here? 

Mr. MILSTEN. In my opinion, we got here by not getting those requirements right the first time that we started this project back in 

2004 when noted the project that was a joint facility with the University of Colorado and DoD. As this project continued to grow 

through its processes, it did not have the benefit of a good, rigorous 

requirements development program and a good, rigorous program 

to control requirements growth as it went through the design process. 

As we entered into the construction contract with the contractor, 

we established a ceiling and we rushed to get to a firm target price 

with the contractor as we saw the market in Denver continuing to 

escalate. The problem we had at that point was the design was not 

complete. The design continued to evolve and now we find ourselves at this crossroads. 

Mr. COFFMAN. I think that probably an easier explanation would 

be pure incompetence, pure incompetence. 

Mr. Milsten, what are the funding options VA is considering to 

finally complete the Aurora construction project for Colorado veterans? 

Mr. MILSTEN. VA has considered many different funding options, 

including transfer authority, looking at where we can take it from 

other options within the department, and we are committed to 

working with Congress to find the funding available for this 

project. 

Mr. COFFMAN. Mr. Milsten, when will VA hit the authorization 

cap on the project? 

Mr. MILSTEN. We expect to hit the authorization cap of 880, 

which is ten percent above the 800, mid-May of 2015, this year. 

Mr. COFFMAN. What is the updated completion date of the Aurora construction project now? 

Mr. MILSTEN. In a meeting yesterday with both KT and the 

Corps there was a discussion about late summer of ‘17, if we can 

continue and get to a construction contract between the Corps of 

Engineers and KT this summer. So that would be about 24 to 30 

months after that. 

Mr. COFFMAN. Will VA seek funding again in fiscal year 2016? 

Mr. MILSTEN. I know that the ‘16 President’s budget has already 

appeared and the opportunity to amend that I am not prepared to 

talk about. 

Mr. COFFMAN. Okay. After the gross mismanagement that occurred in Aurora, why shouldn’t the Army Corps of Engineers or 

someone else build all major construction projects for VA? I mean, 

I think that the personnel involved in this project, you being one 

of them, simply in my view, let me use a Marine Corps phrase of 

couldn’t lead starving troops to a chow hall. And there is no way 


VACREP0180 with DISTILLER
14 

that the American taxpayers should have any confidence in you, 

the veterans of this country should have any confidence in you. 

At this point in time, are you prepared to relinquish that authority or at least is VA taking a position that somebody else, the Army 

Corps of Engineers or some other qualified entity, ought to be taking over these major construction projects from the Department of 

Veterans Affairs? 

Mr. MILSTEN. We are committed to looking at the opportunities 

that exist with using somebody like the Corps of Engineers as the 

construction agent. We have convened and asked the Corps to come 

in and study our processes, our procedures, to see what improvements can be made, and to offer an opinion on whether it is the 

appropriate process to go forward or look at other options. We as 

a department have not ruled out the possibility of turning construction management over to the Corps of Engineers, especially where 

it is appropriate, and we are doing that in the Denver project. 

Mr. COFFMAN. Ranking Member Kuster. 

Ms. KUSTER. Thank you, Mr. Chairman. 

First let me say that I share across the aisle here the shock and 

on behalf of all of the veterans and all of the taxpayers outside of 

the great state of Colorado, not only is this a tragedy because of 

the request that you are coming forward to ask for a billion dollars 

and I join Dr. Roe in what that money could be used for. We like 

to say in the Granite State, we are frugal Yankees, we don’t throw 

taxpayer money around. But what I am most concerned about is 

that these are facilities that can’t be built elsewhere. There are lots 

and lots of veterans in need all across our country. 

And so I want to get at a more basic question, which is whether 

or not the VA is up to the task or has the capacity to take on these 

modern-day facilities and whether we shouldn’t revamp—because 

this is not the first example. I mean, this is, I have to say, the most 

shocking example, but I can remember in my first term these were 

the most troubling hearings we attended talking about facilities in 

other parts of the country. And I would like your comment, if you 

would, candidly, about whether it makes any sense at all for the 

VA to try to be building these facilities. 

I can’t imagine this kind of money in the private sector. I mean, 

Dr. Roe has more experience with hospitals, but I know what hospitals cost in New Hampshire, it is not a billion dollars and it is 

certainly not—you are going to get up to close to $2 billion here by 

the time you are done. 

So I would welcome your comments on that. 

Mr. MILSTEN. As I stated earlier, the department is committed 

to looking at whether it is appropriate for us to continue. That is 

why we have asked the Corps of Engineers to come in and conduct 

a study of our processes and procedures, and to come back and 

offer an opinion. And I know that the leadership of the department 

is committed too if it makes sense for the Corps of Engineers or 

some other federal agency to become our construction execution 

agent, we will be prepared to execute that. 

Ms. KUSTER. Well, I guess my question goes beyond that, and 

maybe this is for another day and maybe meetings with Secretary 

McDonald. I am not talking about bringing the Army Corps in on 


VACREP0180 with DISTILLER
15 

this project, I am talking about whether the VA should be in the 

business of building hospitals at all. 

But let me ask a different question, because my time is limited. 

My question goes to, you used the term, transfer authority. Has 

there been any discussion at all with either the University of Colorado or the Department of Defense taking over the construction of 

this facility, owning this facility, you selling this facility? 

I just feel like, with all due respect and it is not that people 

haven’t tried, I just feel like people are out of their league here. Is 

there somebody else in Denver—and I am not as familiar with this 

situation obviously as my chair—has there been discussion about 

simply the VA not being the party that owns this facility? 

Mr. MILSTEN. There have not currently been any discussions. 

There was discussions early on about a shared facility between 

DoD and the University of Colorado Hospital System, that was 

back in—— 

Ms. KUSTER. And is that no longer happening? That is no longer 

the—— 

Mr. MILSTEN. Back during that period, it was deemed that the 

voice from veterans that wanted veteran identity, because one of 

the things about our hospitals is that it is more than the treatment 

of our veterans, it is a place they go for their camaraderie. And the 

other issue was the issue of shared governance of a facility and 

that caused—— 

Ms. KUSTER. And I certainly do appreciate and I have heard from 

my own veterans in New Hampshire about veteran-centered care 

and all of that. 

I guess I would just close by saying, on behalf of the taxpayer, 

I feel that we can do better by our veterans without building the 

Taj Mahal, and with all due respect to Aurora, Colorado. 

So I yield back. 

Mr. COFFMAN. Thank you, Ranking Member Kuster. 

Mr. Lamborn of Colorado. 

Mr. LAMBORN. Thank you, Mr. Chairman. And I will be very 

brief, because I am just still stunned by the news that this was 

going to cost so much over what the original cost was—not just the 

time delay, but the cost increase. So I will just say I back up my 

Chairman’s position a hundred percent. I am still staggered and 

stunned by what is going on. 

And there has to be accountability, we have to change the way 

things are done in the future. Somehow we have to find the money, 

who knows where, to finish a decent facility. Maybe not everything 

that was on the drawing board, but a decent facility so that veterans can start getting their care, without sacrificing the facilities 

around the country. You know, they have legitimate needs also and 

that money is going to hurt someone else’s project. That is not 

good. We are just in an impossible situation here and it is extremely frustrating and angering. 

Mr. Chairman, I yield back. 

Mr. COFFMAN. Thank you. 

Mr. Walz. 

Mr. WALZ. Well, thank you, Mr. Chairman, and thank you all for 

being here. 


VACREP0180 with DISTILLER
16 

Again, I am not going to pile on this, but I am going to express, 

I think you get it. Today as we sit here, tens of thousands of veterans are going to be treated with the highest quality professional 

care, get what this country promised them, what they have earned 

and deserve, and that is going to be distracted by what is absolutely indefensible. 

And I am going to answer the question for them. The answer is 

no, you cannot do the construction. My concern—and I am not 

going to argue this point, I don’t think we should be in a doublewide trailer and I do believe an atrium is a gathering space. And 

my question is, that could have been incorporated into the original 

design and pay for it what we pay for it. You don’t need to overrun 

it to get the aesthetics, we have proved that time and time again. 

And my concern now starts to be is because I understand this, 

construction of medical facilities is very specific and involves the 

involvement especially of the practitioners. So my question is, if 

these things are botched, what do the operating suites look like? 

When are we done? Are the walls too close? Does the gurney not 

come out? We have seen these things happen in some of our facilities. 

And then I am back to this point—and I know this is all of you, 

you are getting the brunt of a lot of frustration that is coming on 

this, now we are caught in this conundrum much like IT. We have 

time and time and time again allocated money to IT that is absolutely necessary, absolutely critical and absolutely needs to be 

done. And when you come and testify and say there are gaps in our 

IT, I believe you. Our problem is this now, we are caught in a halffinished project that has us so frustrated and we are going to be 

asked to give more money. And I am in the same point as many 

of them, I have said this about IT, not one damn penny until you 

prove that you can use it wisely. And I am in that same boat with 

this and it is frustrating. 

So if there is anything all of you can do to convey that. I know 

there is reasons, but there is no excuse for this. And at this point 

in time, I think what you are seeing on this is you are no longer 

going to get to decide whether you build hospitals or not, that is 

where this is headed. So what we need is your help in how do we 

transition this, how do we get the best practices, how do we move 

to make sure that happens? 

I want to move to just one other subject before I go back. Mr. 

Miller’s bill. I think all of us feel very strongly about the ability of 

employees to be able to speak freely, the ability to be able if there 

is a problem to come forward, and I think whistleblower protection 

is absolutely crucial. I am concerned and I ask your opinion on 

this. I know sometimes when you do this, though, is there a chance 

we are going in creating an atmosphere of fear, of mistrust 

amongst employees? Is the best laid plan and intentions actually 

going to have another chilling effect on how this happens? 

Ms. Flanz, it is a somewhat subjective question, but if you could 

help me understand what it will do to the culture. 

Ms. FLANZ. I would certainly like to try. Thank you. 

The underlying purpose of all of the whistleblower protection 

laws and schemes is to encourage the candid disclosure of information. And there also over the years have needed to be added to that 


VACREP0180 with DISTILLER
17 

a process for penalizing those who retaliate against individuals 

who do bring something forward. Our concern is about balancing 

the punitive measures in such a way that the entire structure 

doesn’t actually act contrary to the underlying purpose. 

And our concern with this particular bill is mostly about the relationship between the front-line staff and that first-level supervisor. 

That relationship is often carried out right in the middle of patient 

care, right in the middle of providing memorial services. It is where 

our veterans are, where our mission is carried out is right there. 

Our concern is in creating a relationship through a process that 

may be necessary to ensure retaliation doesn’t take place. We don’t 

want to create a relationship where we are transferring the fear 

maybe from that front-line staffer to the first-level supervisor who 

may be so concerned about, oh, my goodness, I am now going to 

need to create this record to go back to this person who has made 

a disclosure, I have got a two-day window to do that, what if I don’t 

do that right. What if later I am in the course of supervising this 

individual, I do something that causes the individual to believe he 

or she has been retaliated against. There becomes a different culture and relationship around that supervisor-subordinate exchange 

that may not actually be as supportive of the free flow of information as we would like to see those relationships be. 

Mr. WALZ. Well, I think that is a valid point. I would be interested in seeing if there are some suggestions on this, because this 

is that touchy balance between due process and protecting that 

whistleblower’s right, and I would say encouraging them to be able 

to come forward. And it is deep, it is cultural, it is about trust, and 

we want to make sure we get those pieces right. 

Thank you, Chairman. I yield back. 

Mr. COFFMAN. Thank you, Mr. Walz. 

Dr. Phil Roe. 

Dr. ROE. Thank you, Mr. Chairman. 

Just to dovetail off what Mr. Walz was saying. In my office at 

home, we have a bulletin board full of requirements that we have 

to put up with. Wage and hour requirements, OSHA, on and on 

and on. And all of those federal regulations and rules, I can’t get 

away with the excuse of, well, I have 30,000 people who are not 

as well paid and they are not all this or not all that, I have to comply. And I don’t see why you can use that as an excuse when you 

expect the private sector to comply—not you, but we the government, we the Congress, expect the private sector to comply with 

these things. 

So I don’t think that is a valid reason. I understand it is hard, 

I do get that. As an employer for 30 years, I got that, but we have 

to do that. And we expect the VA to do the same thing that the 

private sector is doing. 

Now, just a quick comment. The VA does a lot of things extremely well, there is no question about that. I got a letter from 

a lieutenant colonel yesterday who was very appreciative. He is a 

Korean War veteran and a Vietnam veteran, he said he survived 

both. He was actually thanking the VA and the government for his 

care. And I am writing him a letter back thanking him for his service. We should be thanking him, not the other way around. Building hospitals ain’t one of them that they do well. And I said this 


VACREP0180 with DISTILLER
18 

at a hearing not long ago, I don’t think the VA ought to be allowed 

to build another hospital. I look at $930 million, my Lord, I could build a palace in Tennessee for that, I could build two palaces for that, maybe three for 

that much money. And that would be to put places—we go out 

where we live to try to find places that save the government 

money. I have got a CBOC at home that pays $1 a year in rent, 

$1. We have hunted out trying to save that. And it is not just it 

is harming veterans in Colorado and veterans who may move to 

Colorado, it is harming veterans in Tennessee and Kansas and Indiana and all around—New Hampshire and around the country. So 

I think we have got to look at that. 

I want to get to my bill just a little bit and, Dr. Icardi, if you 

would help me a little bit. Are there any issues with that bill that 

you can see from a VA standpoint that would be unreasonable to 

be able to take a piece of tissue that is implanted into a person, 

a patient, and then be able to follow that in case there is a recall, 

an infection with it? 

And one of the reasons that we brought this up was that I saw 

what a poor job the VA did in notifying the veterans based on what 

happened with colonoscopies. And this was I guess five, four or five 

years ago. And other issues where notification didn’t take place. If 

you don’t have a tracking system, that veteran, that patient may 

never know and we may never be able to find them, that individual 

that got that specific piece of tissue. 

So do you see any problem with this? Just implementing a tracking system so you can notify people, you get it from a certified tissue bank, any problems there? 

Dr. ICARDI. Yes. First, Doctor, I want to thank you for bringing 

this up again, because this is an important issue and by bringing 

this bill up you have kept it in the limelight and I want to personally thank you for that. 

One of the major issues that you have with tracking something 

is how do you identify it and, unfortunately, for tissue right now 

there is not a really uniform identifier that will follow the tissue 

from the donor to the final disposition. And there is a large number 

of steps that go through there. In the previous bill that we had, we 

were waiting to hear what the FDA was going to do with the UDI 

and now we have what the FDA wants to do with the UDI, and 

that doesn’t quite allow us to do the level of tracking that we were 

looking for. 

Dr. ROE. I guess is the problem, I mean, if you get my cornea 

or whatever it may be as I—and there probably is nothing on me 

worth using, but if there is they can use it and, if there is anything 

that is worth using, you are welcome to it. But when you transfer 

it, there is a way to do that and to transfer where that tissue came 

from, where it goes to and who it goes to. Isn’t that available now? 

Dr. ICARDI. There is, but what happens is the way it is identified 

can change on each leg of the journey. So what that means is, the 

way the UDI is set up, that is a number that gets used by the manufacturer. It may go to a distributor, that distributor may need to 

assign a different number to it. It could then go to a secondary distributor. It may then go out to a hospital, which then sends it out 

to a CBOC or that kind of thing. And the UDI is really specific for 


VACREP0180 with DISTILLER
19 

one small leg, it is not specific for the entire process. So what can 

happen is—and a great example is what happened during the first 

Gulf War with blood, where the blood supply was mobilized, you 

had units come in from all over the country each with their own 

unique identifiers, but there was no commonality between them. 

And that actually leaves that sometimes you can actually have a 

number that is the same from one collection facility as with what 

is in another collection facility, so you can’t really identify it by 

that. You are then going to have to do some sort of re-labeling or 

some sort of a reassignment of a number to track it through the 

system. 

Dr. ROE. But for patient protection, isn’t that important? I mean, 

I would think if I had an implant of some kind—well, actually I 

do have lens implants—that we should be able to—that is why I 

can see you, I had both lenses implanted—and I think if there were 

a recall on that, I would like to know what the problem is and my 

doctor or his clinic be able to identify that and to let me know. We 

should be able to do that for patients. 

Dr. ICARDI. I agree 100 percent with that. We should be able to 

do that and we shouldn’t have to go through a process where you 

have to trace things back link by link and take in some cases six 

months from when a problem is actually identified to track all 

those parts down by this system, which is inefficient. 

Dr. ROE. I am going to yield, because I am over time. But the 

fact that it is hard doesn’t mean we shouldn’t do it. 

Dr. ICARDI. And I agree as well. And that is why what we have 

been doing for the VA is looking at this, this is not just a VA problem, this is a national problem with the entire system. And for us 

to be able to fix it for the VA, we need to fix it for the nation. And 

so we have been working with Health and Human Services, FDA, 

DoD, and the other agencies, and there will be a conference on this 

in April that we will look to try and push this forward. 

Dr. ROE. Okay. 

Dr. ICARDI. But there is a solution. 

Dr. ROE. I would like to continue our conversation. My time is 

expired. 

Mr. COFFMAN. Thank you, Dr. Roe. 

Ms. Rice, you are now recognized for five minutes. 

Ms. RICE. Thank you, Mr. Chairman. 

So, Ms. Flanz, I would just like to go back to the comments that 

some people were making about the whistleblowers. I mean, it is 

clear that the VA is not protecting whistleblowers to the extent 

that they need to at this point. And while I may agree that maybe 

a two-day investigative period, given the time constraint and the 

other responsibilities that that supervisor might have might be 

something that we need to tweak, I really hope that you would be 

willing to sign off on however we revamp this bill, because if you 

can’t—I mean, clearly the VA has not been able to protect whistleblowers and you should want to be able to do that. 

And I know that it is not just putting that responsibility on supervisors, it is an appropriate training program so that people understand exactly what the parameters are. So I hope that you 

would agree to be open to some changes that would require an inVerDate Aug 31 2005 15:49 May 25, 2016 Jkt 000000 PO 00000 Frm 00023 Fmt 6633 Sfmt 6633 Y:\98-628.TXT PAT

VACREP0180 with DISTILLER
20 

ternal system to ensure the protection of a whistleblower for a real 

problem that needs to be addressed. 

Ms. FLANZ. I couldn’t agree more. I know the secretary agrees as 

well. This is a matter of great interest, it is a top priority for the 

secretary and the deputy secretary. And we have been working in 

unprecedented collaboration with the Office of Special Counsel on 

a number of things. 

Fundamentally, it is a leadership issue. Leadership must set the 

tone that disclosures need to be immediately addressed. Supervisors in a good, healthy work environment will welcome the information, because that is what leads to process improvement. That 

is how we ensure that veterans are treated safely, that our processes are efficient and are compliant with the law. Only good 

things flow from that exchange of information. When we get into 

trouble is when supervisors either don’t know the rules or react inappropriately, because they haven’t seen appropriately modeled to 

them the right behavior. 

So we absolutely are open. We have been working very closely 

with members of this committee and staff on issues with respect 

to individual whistleblowers and to the process we are using across 

the board to make the changes that really are critical. So absolutely, we are open to and need your help. 

Ms. RICE. Well, I agree that the best chance that we have is with 

Secretary McDonald, who has shown an interest in ensuring the 

protection of whistleblowers. And coming from someone who has 

run a DA’s office, you are right, the tone is set from the top. And 

if people feel that by complaining they are going to be penalized, 

no one is going to complain. And that is where the neglect or the 

abuses become more insidious. 

So I just—and this might be a repetitive question, maybe I didn’t 

understand, I just want to go back to Mr. Milsten. So you are coming and asking for a lot more money. My question is really, I think 

it is simple. Maybe it was asked before and I wasn’t here, I don’t 

know, or I didn’t hear it in your explanation before. I would like 

specifics as to why $800 million, the initial estimate, was not 

enough to finish this project—or 600—is that what it was, 600? 

Sorry. I gave you a $200 million cushion there I didn’t mean to 

give. What happened that made this project incapable of being 

completed? 

So I want specifics about people, about who didn’t do what they 

were supposed to do, about inaccurate estimates, specifics that we 

know going forward how is this not going to happen again with the 

other billion dollars that you are asking for. Because there is no 

way this government, at least I am not in the business of throwing 

good money after bad and it seems like that initial $600 million, 

as well intentioned as it may have been, is falling under that category. 

So please make the case. And I have to say that I also don’t 

think that the VA should be in the business of building hospitals, 

but that is really an issue that we as a committee will have to discuss. If you can just lay out with real specificity what happened 

and how it is not going to happen again. 

Mr. MILSTEN. Okay. I will be happy to attempt that. 


VACREP0180 with DISTILLER
21 

First of all, the VA owns this, we own this fiasco that we created. 

It is nobody else’s fault, but I am going to tell you that there are 

some other people that played a part in it. And I can tell you that 

we are looking at our role of oversight of those processes to figure 

out how and why they broke down. 

Number one, we hire a designer who is responsible for designing 

a facility to meet the requirements that we set forth. Early on, we 

develop some programmatic estimates in-house, and then we rely 

on the designer to design the project to the budget that we have 

told him that we have. So in this case we had a designer we 

charged with delivering a design that could be built for just under 

$600 million. That designer provided us with estimates of how that 

could happen. And I can tell you that our breakdown was that we 

did not do the proper amount of due diligence on that estimate, we 

did not dig in far enough detail to actually go in and figure out that 

it could or couldn’t be done. We relied on that and we moved forward. When we got advice from our construction contractor that 

the budget may not be billable, we chose unfortunately to listen to 

the designer. 

And these are changes that we are making in our process now. 

We are bringing in independent construction management firms to 

help us review estimates, to review schedules. Not just relying on 

the word of one firm representing what the requirements will cost, 

but relying on multiple firms to make sure that we get the best 

and correct answer. 

And we are also looking at how we change our culture to say 

that construction contractors are not always the enemy, if you will. 

Too often we engage in siding, if you will, with the designer and 

not listening to our sound advice from the actual builders of the facility. 

Ms. RICE. So if I can just say, that is exactly why the VA should 

understand their strengths and their weaknesses. And because you 

shouldn’t be in the business of building hospitals, that should be 

left to an expert. That may be why that oversight was not as robust as it should have been. No offense to you. 

But if I could just ask you, because what I think that we need 

is a very detailed report of exactly what went wrong, when it went 

wrong, and who you hold responsible for those mishaps and miscalculations and all of those kind of things. I mean, you are coming 

and asking for money and that I think has to be laid out, not so 

much in this forum, because we have limited time, but if you could 

by next week prepare a document that details exactly what the 

shortcomings were, so that we can understand what happened, 

that would be—— 

Mr. MILSTEN. The department has seated an administrative investigation board, that is their sole responsibility to go through 

these details and find the accountability. It looks at the mismanagement potentials and misbehavior potentials for people involved in the project. And I will turn it back over to—— 

Ms. RICE. So there is a report that exists? 

Mr. MILSTEN. No, ma’am. A panel has been set. I am going to 

turn it over to Meghan to talk about the outcome, the expected outcome and time frame for that. 


VACREP0180 with DISTILLER
22 

Ms. FLANZ. Very quickly. There are two ongoing processes and I 

will do my best to outline both very quickly. I know that the deputy 

secretary had phone calls with a number of members of this committee within the last couple of days, so I apologize if I am covering 

for you ground that has already been covered. 

But we have an administrative board of investigation, which that 

is an activity that my office owns. That group looks at individual 

accountability, who did what or failed to do what that needed to 

happen. At the leadership level, who knew and acquiesced in either 

actions or omissions by people below them. So that board looks at 

who is responsible for what error or omission that may have led 

us here. 

The second and equally important piece of VA’s process of understanding what happened is the study that the Army Corps of Engineers is leading for us that is bigger than Denver, that is, really 

gets I think at some of the fundamental issues. Does VA have the 

expertise and the capability to continue to build hospitals? What 

are some of the systemic issues that have led to cost overruns or 

delays in projects, to include Denver, but not exclusive to Denver. 

Those two processes are ongoing. We absolutely share the frustration and the sense of urgency that I hear in the members today. 

We need these answers now, we needed them before the project 

went the way that it did. 

Having said that, the process of collecting evidence about decisions made over the course of a many-year program takes time. So 

I hear the request for a written report next week. The process that 

my team is working on will take more like a month than a week, 

but we are working to get those answers just as soon as we can 

pull the evidence together. 

Ms. RICE. The problem is if the money runs out in May of 2015. 

Thank you, Mr. Chairman. 

Mr. COFFMAN. Thank you, Ms. Rice. Dr. Huelskamp, you are now 

recognized for five minutes. 

Dr. HUELSKAMP. Thank you, Mr. Chairman. I guess you used up 

my five minutes. I guess I am done, so I—just kidding. Thank you, 

Mr. Chairman, and I will note I appreciate the questions on Aurora 

and that situation. Actually, it might not seem pertinent to Kansans, but that would be the closest VA facility for a large share of 

the northwestern corner of my district. It is only 188 miles from 

Kansas. Do not forget it is 200, 300, or 400 miles the other way 

for some of mine, so I watch this very closely, because I will have 

Kansans traveling, hopefully one day, to this facility. 

I have a couple questions. First, Ms. Flanz, on my bill, I understand that you support the concept, but are you willing to work 

with my staff, Subcommittee staff, to fix a few of the technical 

issues that you have expressed? 

Ms. FLANZ. Absolutely, it is my understanding that our folks 

have already reached out to your staffers to set up a conversation 

to do exactly that. 

Dr. HUELSKAMP. Absolutely. You want to make certain that these 

set-asides obviously go to those veterans that should be qualifying 

for these particular contracts. So thank you for that commitment. 

We will continue to move forward and hopefully we will fix a few 

of those technical issues. 


VACREP0180 with DISTILLER
23 

I do have a few other questions on the other bills or some of the 

statements here. First, for Mr. Lowe, in reference to the IT—and 

I appreciate my colleague from Indiana and her work on this, and 

I was in some of these hearings—do you believe that the IT system 

at the VA is secure today? 

Mr. LOWE. Congressman, it is as secure as we can possibly make 

it. There is nobody in any position that—or anybody that sits in my 

position that can definitively state that their system is completely 

secure, because there are just too many unknowns. But based upon 

the information that I have today, I have to say that we are as secure as we can be. 

Dr. HUELSKAMP. Is there any independent assessment outside 

the VA that can—— 

Mr. LOWE. Well, you know, the IG conducted an independent assessment. GAO conducts an independent assessment. You remember hearing in—— 

Dr. HUELSKAMP. Yeah, and their assessment was not very good 

the last I saw. My question is, outside of the VA, outside of the government, have you brought in any independent—— 

Mr. LOWE. Oh, yes, we—— 

Dr. HUELSKAMP [continuing]. Contractors saying, ‘‘Yes, this system is secure at a standard for the industry that we believe is’’—— 

Mr. LOWE. We had an independent assessment come in and take 

a look at the domain controllers, which we briefed the staff on, and 

it was specific to the domain controllers. And they did not—and 

that was specific to the instance that the Committee was concerned 

about that happened in 2010, and they found that, you know, the 

remediation activities that took place in 2010 were effective. 

Dr. HUELSKAMP. All right. Well, I appreciate that and look forward to that information as we move forward ahead. 

And one other question on the issue of whistleblowers, and I 

know I speak for all the committee members that we have been 

stunned and shocked, particularly by the response from the Department at differing levels. We have had a series of secretaries 

that have promised to make certain whistleblowers were never retaliated against, and somehow that did not get down to other 

320,000 folks working in the Department. How many outstanding 

cases of alleged whistleblower retaliation are still ongoing? 

Ms. FLANZ. I do not have a number at hand. The Office of Special 

Counsel sends those cases to us in kind of two different batches, 

two levels of priority. We did work out with them last summer an 

agreement that if they prioritize a particular case because an individual employee who claims to be subject to whistleblower retaliation has a pending personnel action, something adverse is happening, those come over on an expedited basis. Our attorneys work 

with the supervisors and managers of those people to ensure that 

those—whatever adverse action is going on is stayed. 

Then there is another larger group of cases where the Office of 

Special Counsel hears from an individual who believes that he or 

she is the subject of retaliation, but there is either nothing immediate pending or the Office of Special Counsel is not as convinced 

based on the evidentiary record that they have that retaliation has, 

in fact, taken place. So those take a little bit longer. 


VACREP0180 with DISTILLER
24 

Dr. HUELSKAMP. So in order, though—I just have a few seconds 

left—in order to determine whether we have made progress or 

not—whether you have made progress or not—do you have any 

comparison baseline of what it was, maybe before you came on 

board, where it was three years ago? Can you provide those numbers to the Committee, so we can get a sense are we making 

progress? 

Ms. FLANZ. Certainly. I will be happy to provide specific numbers, and I can tell you that we had an expectation when we entered into that agreement for this expedited process that the number of complaints that would be sent through that process would 

be quite high. It has actually been lower than I think either the 

Office of Special Counsel or our staff—— 

Dr. HUELSKAMP. It is low, but you do not know what the number 

is today? 

Ms. FLANZ. It is—— 

Dr. HUELSKAMP. It is my understanding it is over 100 outstanding cases of alleged retaliation. Is that in the ballpark? 

Ms. FLANZ. That was the number that we were given at the time 

we entered into the agreement last summer. I think it is a much 

smaller number, more on the order of closer to ten that has come 

through the expedited process. But I would—I will be happy to get 

you precise numbers, so we can begin to have that kind of trend 

analysis. 

Dr. HUELSKAMP. Okay. Thank you, Mr. Chairman, I yield back. 

Mr. COFFMAN. Thank you, Dr. Huelskamp. Ms. Walorski. 

Ms. WALORSKI. Thank you, Mr. Chairman. Mr. Lowe, in your 

written statement you quote the following from the GAO that you 

were just speaking about, ‘‘In a dynamic environment, where innovations and technology and business practices supplant the status 

quo, control activities that may work today may not work in the 

future.’’ Are you aware the GAO actually supports this bill, and 

they actually worked with us in adding Section 10 to the bill on 

flexibility? 

Mr. LOWE. No, ma’am, I am not. 

Ms. WALORSKI. And in another statement you talk about—you 

point out that, ‘‘A review must be performed on any patches to ensure the operability of the particular application or system to ensure the patch does not have a harmful impact to services that VA 

provides. My legislation instructs VA to perform the risk assessments and to also test patches within two days of availability.’’ 

How long of an evaluation period would you need? 

Mr. LOWE. That is a technical question. I will have to ask the 

operational guys. I would be happy to get back to you on that. 

Ms. WALORSKI. Okay. 

Mr. LOWE. And, you know, we really—we have a unique opportunity now to actually drive what the nation is doing. I mean, legislating operations is problematic, because it does take away some of 

the flexibility. But I think we have all got the right idea, and we 

have got—we are all after the same endpoint, but there are a number of bills going through Congress right now that I think that we 

could probably squeeze all this together and come up with one legislation, so we are not having to deal with 20 or, you know, so different pieces of legislation that are coming out, not just specific to 


VACREP0180 with DISTILLER
25 

the VA, but specific to the government-wide. And I think that we 

have a really unique opportunity in time right now to be able to 

affect what the rest of the government does and what the rest of 

the nation does. 

And I would be happy to work with your folks to be able to come 

up with an awesome bill that not only this Committee could support, but the entire Congress and the Senate and the rest of the 

federal government can support. 

Ms. WALORSKI. And I appreciate that, and I would hope so as 

well. I just—if you are going to get back to me on the evaluation 

period of the assessments on the patches, could you also add to 

that? You talked about VA cannot phase out outdated or unsupported systems, because they would impact physicians at the point 

of care. My bill provides VA 90 days to come up with a migration 

transition plan to move to secure operating systems. If you could 

just add to the list how much more time would the VA need. 

Mr. LOWE. Sure. A lot of those operating systems are attached 

to medical devices, so we would actually have to, you know, a large 

number of the medical devices that are currently produced by manufacturers. And I think Dr. Roe probably knows a little bit more 

about this than I do, is the, you know, most of the medical devices 

that are in use, and most facilities today are running off of Windows XP. And so they had that FDA certification around that particular image. 

So I, you know, working with medical device manufacturers and 

replacing all that and upgrading those, whether or not the systems, 

actually themselves, that the operating can run it, that will be a 

long—I will—we will actually have to have a long conversation 

about how we do that, because we are going to have to work with 

not only the FDA, but the medical device equipment manufacturers. 

Ms. WALORSKI. That is fine. And if you could just add that to the 

list of—just sending it back at some point. 

Mr. LOWE. Absolutely. 

Ms. WALORSKI. And then I just want to, in response to your suggestion, I can tell you, I would hope so, that we can find a way to 

move this bill and to move actual verifiable accountability into the 

issue of the IT with the VA. 

And, you know, I am only starting my third year here, and from 

day one when I got here and we started talking about IT, and it 

all started back in the day when we talked about why cannot we 

get a electronic medical record and connect the DoD to the VA, and 

I sat in a subcommittee hearing even then with these same issues 

of domain controllers, of outside entities on domain controllers. 

And, you know, my concern was the breaches that have taken place 

with our veterans nationwide. And, you know, money has never 

been an issue. And when we talked about issues before with some 

of the—I do not know if they work for you, around you, I do not 

know how your whole group flows, the folks who have been in here 

testifying on it—but the reason I am pursuing it is because veterans’ information is so critical, and the bad actors that have been 

embedded and have been impacted inside of this domain controller—and we might have to just agree to disagree—but not only 

are they—not only is just their personal information available, but 


VACREP0180 with DISTILLER
26 

when these bad actors get in and disallow us from connecting to 

the DoD because of VA not having a secure website, you know, 

what happens if a bad actor gets in there and scrambles medical 

records? 

What happens if, you know, they just decide to go in and look 

at 30 million veterans and say, ‘‘How can we completely mess up 

this system?’’ And I think every veteran that served not only deserves the best of everything they were promised, but when they 

come back from fighting and they come back into our country, especially in my state, in the State of Indiana where we are over the 

top patriotic and we are over the top in sending folks to fight, 

they—I just am fighting for them to say at some point, ‘‘Let’s get 

beyond this.’’ 

And so I just wanted to make sure that we have some kind of 

level of understanding of House bill—of our bill 1017. I appreciate 

your comments in writing in the coming days. Thank you. I yield 

back my time. 

Mr. COFFMAN. Thank you. Mr. O’Rourke, you are recognized for 

five minutes. 

(No response.) 

Mr. COFFMAN. Mr. O’Rourke passes. I would like to thank the 

panel for your testimony. You are now dismissed. I now welcome 

our second and final panel to the witness table. On this panel, we 

will hear from Ms. Diane Zumatto, National Legislative Director of 

AMVETS; Mr. Frank Wilton, Chief Executive Officer of the American Association of Tissue Banks; Mr. Daimon E. Geopfert, National Leader, Security and Privacy Consulting for McGladrey, 

LLP. All of your complete written statements will be made a part 

of the hearing record. Ms. Zumatto, you are now recognized for five 

minutes. 

STATEMENT OF DIANE ZUMATTO 

Ms. ZUMATTO. Thank you, Mr. Chairman and distinguished Committee Members. I am pleased to have this opportunity to sit before 

you today to share our comments on pending veteran legislation. 

Before I get into our specific positions on these bills being considered, I would like to share a few general introductory remarks. 

AMVETS is, in general, a fiscally conservative organization 

which supports the interests of our veterans and military men and 

women. Our members want to see a balanced federal budget, and 

I have major concerns surrounding the ever-increasing federal deficit. Additionally, our membership would like to see an increase in 

federal accountability, especially within the Department of Veterans Affairs, as well as a decrease in government bureaucracy. 

AMVETS does not support the concept of indiscriminately throwing money at problems. While some of our colleagues are shocked 

by this notion, AMVETS acknowledges that there are certainly programs that would benefit from increased funding. However, we believe that before those increases are made, they should first be 

fully justified and only come after a thorough review of the organizational structure of each program or agency with an eye to identifying system efficiencies, maximizing all current resources, both 

human and financial, minimizing waste, and eliminating 

redundancies. 


VACREP0180 with DISTILLER
27 

And as far as legislation today, AMVETS supports H.R. 571, 

which would provide whistleblower protection for folks within the 

VA. If we expect employees to be willing to take actions to prevent 

fraud, illegal acts, et cetera, then those employees are going to 

have to feel confident that if they do step forward, they will be safe 

from any form of retaliation, either personal or professional, that 

the information they provide will be acted on in a confidential and 

appropriate manner, that the information will also be handled in 

a timely manner. 

AMVETS applauds Chairman Miller’s continued efforts to ensure 

that VA employees, many of whom are veterans, have an equitable 

and safe environment within which to better serve all American 

veterans. 

AMVETS supports H.R. 593. There has been a lot of discussion 

about that this morning, and there is really not much more I think 

that needs to be added. Something needs to be done. It is obvious 

that the status quo is not adequate. So we do support H.R. 593. 

We also support H.R. 1015. It is a pretty simple and straightforward solution. And there, you know again, I do not really have 

too much to say to this. I do realize that there is some monitoring 

that is going on. And I am aware also that the IG, you know, finds 

cases of abuse almost daily, so we know that there is a problem. 

And I think this is a pretty simple way to rein that in. 

We support 1016, which, you know, would require the VA to 

adopt and implement a standard identification protocol. And I have 

listened to the testimony all morning, and I understand that there 

are a lot of difficulties, but this does not seem like an insurmountable problem. It is a matter of logistics, and I would really encourage the VA to—if every provision in this bill does not work for 

whatever reason, I would hope that they would be willing to work 

towards a solution. 

We also are supportive of H.R. 1017 and 1128, both of which are 

related to information security. As a veteran, I shudder to think 

about the vulnerability of the VA system. I know they are aware 

of the problem, and I think there has been plenty of beating up on 

the VA lately. I just would really stress that this is critically important to AMVETS that this problem be taken care of. I would also 

like to applaud Representatives Walorski and Kirkpatrick for their 

efforts in this area. 

AMVETS also—I hesitate on 1129, even though it is also a whistleblower bill. And we hesitate only because of my introductory remarks. We hesitate to condone an increase in bureaucracy. My 

read of this is that there is going to be the creation of a new agency 

that would handle this problem, and we think that there is already 

probably enough between the IG and the Office of Special Counsel 

that there is probably no need to create another agency. 

That concludes my testimony at this time, and I yield back. 

[THE PREPARED STATEMENT OF DIANE ZUMATTO APPEARS IN THE

APPENDIX] 

Mr. COFFMAN. Thank you, Ms. Zumatto. Mr. Wilton, you are now 

recognized for five minutes. 


VACREP0180 with DISTILLER
28 

STATEMENT OF FRANK WILTON 

Mr. WILTON. Thank you, Subcommittee Chairman Coffman, Mr. 

O’Rourke, distinguished Members. Thank you for the opportunity 

to come before you today in support of H.R. 1016, the Biological Implant Tracking and Veterans Safety Act of 2015. 

For those who are unfamiliar with my organization, the American Association of Tissue Banks is a professional, not-for-profit scientific and educational organization. It is the only national tissue 

banking organization in the United States, and its membership totals more than 125 accredited tissue banks and approximately 850 

individual members. These banks recover tissue from more than 

30,000 donors annually and distribute in excess of two and a half 

million allografts for more than one million tissue transplants performed in this country annually. The association was founded in 

1976 by a group of doctors and scientists, who had started in 1949 

our nation’s first tissue bank, the United States Navy Tissue Bank. 

H.R. 1016 directs the Secretary of Veterans Affairs to adopt a 

standard identification system for use in the procurement of biological implants by the Department of Veterans Affairs. By building upon the success of the implementation of the unique device 

identifier, or UDI, this legislation will ensure that biological implants used within the Department can be appropriately tracked 

from human tissue donor all the way to recipient. This critical capability for track-and-trace efforts will enhance patient safety, expedite product recalls when necessary, assist with inventory management, and improve overall efficiencies. 

This legislation takes a bold step to expand the UDI to all tissue 

products. In addition to human tissue devices which are already 

covered by the UDI, the legislation adds another product category—certain biological implants, or as termed by the Food and 

Drug Administration, 361 human cells, tissues, and cellular and 

tissue-based products, or HCTIPs. While many of the biological implants do have company-specific barcoding information by requiring 

a standardized format for those barcodes as outlined in this legislation, it will be easier for the Department of Veterans Affairs’ medical facilities to utilize the universal barcoding conventions and to 

realize the full benefit of the unique identification system. 

Finally, by applying a system that has been developed for devices 

to biological implants, such a solution would also be applicable to 

other healthcare settings and other healthcare systems such as the 

Department of Defense healthcare system or the private sector. 

While I understand your skepticism in requesting the VHA attempt a VITAS-like enterprise in this legislation after failing to do 

so before, I would note that a lot has changed since 2008 when the 

VHA first envisioned VITAS. First, there is now a UDI benchmark, 

which allows those developing the necessary software for data capture to move from a design incorporating dozens of different 

barcoding technologies to only three different ones. 

In addition, the VHA is not alone in trying to develop a system 

for integrating the UDI-like information directly into the medical 

record. For instance, the Office of the National Coordinator for 

Health Information Technology is currently focused on ways in 

which UDI can be better operationalized to ensure its adoption into 

key standards. As part of those efforts, ONC is initially focused on 


VACREP0180 with DISTILLER
29 

implantables, the very focus of the legislation that we are discussing today. Therefore, the VHA will not be attempting to establish the system alone, but can partner with other governmental entities to ensure its success. 

In addition, AATB is pleased that the language, as introduced, 

ensures that our veterans receive the high quality implants by requiring that biological implants only be sourced from tissue processors accredited by the AATB or similar national accreditation organizations. With this change, the VHA will be joining the ranks 

of leading medical centers of excellence which currently require all 

tissue to be sourced from AATB-accredited banks. 

AATB is also pleased that the introduced language clarifies that 

human tissue procured by the VHA can be labeled with any of the 

three systems already identified by the Food and Drug Administration to be appropriate for biological implants. Under the UDI final 

rule, FDA has done just that by providing for multiple entities 

called issuing agencies. 

At this time, FDA has provided for three different issuing agencies, GS1, the Health Industry Business Communications Counsel, 

or HIBCC, and ICCBBA. By maintaining this appropriate flexibility, the VHA will ensure a more competitive marketplace. AATB 

strongly supports this legislation and urges you to favorably report 

it out of the Subcommittee. I welcome your questions and yield 

back the remainder of my time. 

[THE PREPARED STATEMENT OF FRANK WILTON APPEARS IN THE

APPENDIX] 

Mr. COFFMAN. Thank you, Mr. Wilton. Mr. Geopfert, you are now 

recognized for five minutes. 

STATEMENT OF DAIMON E. GEOPFERT 

Mr. GEOPFERT. Thank you. First, Chairman and Members of the 

Committee, thank you for the opportunity to discuss the Department of Veterans Affairs Information Security Programs. 

My name is Daimon Geopfert, and I was asked to speak today 

as a veteran and as a security expert with experience in both the 

government and corporate worlds. I served the United States Air 

Force Office of Special Investigations as a computer crimes investigator, the Air Intelligence Agency, three years as a DoD contractor, 

and now eight years as a security consultant within the corporate 

world. 

Also, like many of my peers, I have also received a letter from 

the VA stating that they failed to protect my personal information. 

I am here today quite simply for a call to accountability. Men and 

women in the armed services are held to account for every action 

they perform or fail to perform. And they expect that same mentality to be applied to the entities that control their sensitive personal and medical data. However, all indications are that the VA 

has failed in this duty. 

What is most frustrating to the veterans is this is not a singular 

failure but rather a long-running, repeated systemic series of failures. Passing legislation such as H.R. 1017 would provide a detailed roadmap for the VA to follow in addressing these issues. The 

VA has a widely reported history of non-compliance with a variety 


VACREP0180 with DISTILLER
30 

of regulations. We recently learned that for the 16th year in a row, 

they failed a major security audit. 

The VA’s own internal risk assessments, using their exact terms, 

state that a data breach of its primary VISTA system is practically 

unavoidable. It would result in a exposure of financial, medical, 

and personal data with no way of tracking the source of the breach. 

The VA has stated that physical loss of data and user error is their 

primary risk and accounts for 98 percent of the known incidents. 

However, extensive reporting and the consistent theme of the audits indicates that the VA mostly likely does not have the capability to know, or prove, that data was not taken by hackers. 

A specific example involved foreign infiltrators known to have extracted materials out of the VA environment, but because of the 

lack of logging and monitoring by the VA and use of encryption by 

the foreign party, it will never be known what the contents of that 

data were. Scenarios such as this allow the VA to continue to state 

that the organization is unaware of any major data loss as a result 

of hackers. But this is likely a factor of the failure and lack of capabilities of their monitoring, rather than success of any preventative 

controls. 

These widely known and extensively reported issues simply 

would not be tolerated in the corporate world, largely because of 

the existence and enforcement of explicit legislation and industry 

standards. If examinations of a private sector organization produced similar results as those identified within the VA, that entity 

would face substantial fines and penalties. There is little doubt 

that the officers and directors of such an organization would face 

serious personal consequences. The VA, for all practical purposes, 

is exempt from any of the legal penalties that force its corporate 

peers into compliance, and the results of that situation is self-evident. 

H.R. 1017 provides the VA with clear detailed technical requirements and governs mechanisms to address this issue. The FFIEC 

would not tolerate this of a bank. The SEC would not tolerate this 

of a broker/dealer. State attorneys general would not tolerate this 

under anybody within their purview without very harsh criminal 

and civil repercussions. The veteran community is reasonably curious why the VA is held to such a drastically different standard. 

It cannot be forgotten that the true risk in this scenario is the 

health and well being of the generations of veterans the VA serves. 

The most obvious risk is identity theft, which results in additional 

stress within a population already dealing with a variety of significant physical, emotional, and financial pressures. While this is the 

most obvious risk, it is not the exclusive one. 

What if beyond identity theft, some actor managed to perform a 

mass alteration or destruction of medical records out of sheer malice? Do you think this would beyond the pale for a variety of hacking groups, or hacktivists, that align themselves with rogue nations 

or terrorist groups? It could conceivably disable the entire VA infrastructure, interrupting services to millions of veterans. It would 

be a direct, highly visible strike against the veterans that fought 

them. The men and women who have served our country, as well 

as their dependents, deserve and expect to have their welfare proVerDate Aug 31 2005 15:49 May 25, 2016 Jkt 000000 PO 00000 Frm 00034 Fmt 6633 Sfmt 6633 Y:\98-628.TXT PAT

VACREP0180 with DISTILLER
31 

tected by organizations like the VA that play such a vital role in 

their lives. 

This legislation is sorely needed and would be one of the first of 

its kind to provide such detailed prescriptive guidance. The protection of the personal information of veterans should be a bipartisan 

issue. So our community hopes that this will be quickly passed and 

enforced. Targeted appropriate legislation is needed to force compliance and provide veterans and their families with the security they 

deserve. 

This legislation should explicitly require proper preventative, detective, and corrective controls along with required oversight and 

reporting. The VA, and the bodies that oversee it, have an obligation to Veterans to finally take decisive actions demonstrating the 

resolve to do the right thing. And, Mr. Chairman, that concludes 

my statements. 

[THE PREPARED STATEMENT OF DAIMON GEOPFERT APPEARS IN

THE APPENDIX] 

Mr. COFFMAN. Thank you, Mr. Geopfert. Let me do a question for 

you. There has been concern that the IT security directive is too 

detailed. It might not be applicable in the coming years due to the 

inherent changing nature of technology. What is your view regarding this potential issue? 

Mr. GEOPFERT. I think it is a very limited view. The drift in the 

corporate world has been from generalist regulation and oversight 

to very prescriptive, simply because the generalist style of guidance 

has proven to be very ineffective. The other style, the competing 

bill that is very generalist in nature, essentially puts another wrap 

around a lot of items that the VA is already supposed to be doing 

but has failed to do. What is viewed as prescriptive in this bill is 

interesting, because most of this is what they are required to be 

doing already. It is just basically done in a more regimented manner. This is already an existing legislation in the corporate world. 

So the idea that it is too prescriptive to be effective is a bit misleading. Obviously, there can be tweaks made if there are specific 

points. 

Mr. COFFMAN. Okay. Mr. Wilton, VA has indicated that it wants 

to limit the issuing agencies solely to ISBT 128. Is that a good 

idea? 

Mr. WILTON. We do not think it is, Mr. Chairman, for a couple 

of simple reasons. First and foremost, the FDA has looked at this 

fairly closely and recommended that all three systems be used. 

Secondarily, we would be concerned if the VA limited it to one 

system. There may well be tissue banks who decide to align 

themself with another system, and therefore would not be in a position to bid on business with the VA, which we think could limit 

the ability for the VA to source the best tissue for our veterans. 

So the FDA has ruled on this and, you know, in talking with our 

accredited banks, there does not seem to be a unanimity in terms 

of which system they are going to go with, so we do not think it 

is a good idea for the VA to limit that. 

Mr. COFFMAN. Ms. Zumatto, can you give us an example of something that could be a reform that could be done to the Veterans Administration to make it more efficient with respect to both the taxpayers and veterans? 


VACREP0180 with DISTILLER
32 

Ms. ZUMATTO. Wow. 

Mr. COFFMAN. What would be your top concern? 

Ms. ZUMATTO. Honestly, from both being a person who is an advocate for veterans’ issues and being in the VA system, I think the 

biggest problem is that veterans actually do not come first in the 

system. It does not feel that way when I am at the VA Medical 

Center. 

And if there was a way—and I understand the new Secretary 

says, you know, ‘‘Veterans first.’’ And that’s the motto essentially, 

‘‘We care for veterans.’’ But it does not actually feel that way to me 

personally. So if there was a way to change that so that it really 

is about veterans first, and about VA and VA employees and contractors and everybody else secondarily, I think that would go a 

long way to making some positive changes. And I do not think 

that—if those changes—they have to be modeled at the top. But if 

it does not drift down to every single layer, and there are many 

layers, then nothing is really going to change, unfortunately. 

Mr. COFFMAN. Thank you for your answer. Mr. O’Rourke, five 

minutes. 

Mr. O’ROURKE. Thank you, Mr. Chairman. I want to thank the 

witnesses for their testimony today. To have the perspective of a 

veteran service organization and then the subject matter experts 

on two issues that I do not have a lot grounding in, I think is very 

helpful, and I think helpful for the committee, as well. 

And I think you have also touched on what I think is the core 

issue that we need to resolve within the VA, which is accountability. And I think each of these pieces of legislation, to some degree, tries to correct that, and I want to thank the committee members and the staff who have worked on these bills and you all for 

your feedback on these. 

You know, Ms. Zumatto, when we talk about throwing money at 

problems, which, you know, we couldn’t agree more with you that, 

that is not the solution. We are glad that, that is your position and 

that of your organization. 

You have to conclude that if Aurora were to have taken place 

within a private hospital corporation like HCA or Tenet, that there 

would be consequences, or that that would not even happen in the 

first place, because at some point, that would have been caught 

and fixed. And to go from 600 million to 800 or 900 to 1.1 to maybe 

1.7, to me is just unconscionable and completely out of line with 

what we would expect to see in the private sector. 

And Mr. Geopfert, you mentioned that the IT protocols and the 

data and information security that we have within the VA today, 

at least by your description, does not track with what we would expect from the private sector. And you mentioned that there is legislation and industry standards that, you know, most corporations 

hue to, to ensure that they protect the data of their customers and 

clients. It is not always completely successful, but you are making 

a case for a higher standard that the VA does not adhere to. 

Mr. Wilton, from your testimony, it was not completely clear to 

me whether or not the VA in tracking biological implants and this 

issue of—the other issues that you raised—is so far out of track 

from what the national standard is, but it may be that I don’t completely understand the issue, so I just want to give you a minute 


VACREP0180 with DISTILLER
33 

or two to elaborate on that and talk about the difference between 

the VA standard and the national standard. 

Mr. WILTON. Yes. So this is an evolving issue, Congressman. But 

it is one that we see the VA actually taking a leadership role on. 

One of the very important things about all tissue is it is recovered 

and tracked from the donor through the distribution. Once it gets 

to the final location, the hospital, the doctor, then sometimes that 

chain is broken, and we want to work with the VA so that they can 

maybe take a leadership role in this and then, as I mentioned, we 

can take it out to the Department of Defense, to the private sector. 

We think this is something that can be done. We look forward 

to working with the VA on any challenges they might have. But we 

think this is just, quite frankly, the best way to do it, and I think 

our veterans deserve the best. And, you know, God forbid there is 

an incident of a recall or something like that, we should be able 

to get back to them in a timely fashion, and we think that this type 

of system will do that. 

Mr. O’ROURKE. So this is potentially a positive point coming out 

of today’s testimony and the issues that are here in terms of an opportunity for the VA not just to catch up to the rest of the country 

and other sectors, but actually potentially to lead, innovate, and set 

the standard for others? 

Mr. WILTON. Absolutely. And we commend Dr. Roe for introducing the legislation. We look forward to working with all the parties to make this happen. 

Mr. O’ROURKE. Yeah. For Mr. Geopfert, I want to make sure I 

understand that legislation that the private sector must adhere to 

and those industry standards—and I realize we cannot get into detail—but is it simply a matter of the VA matching those? Or are 

there some intrinsic differences in our systems, in our customers 

and clients, that should allow for some difference or distinction between the two systems? Or is it simply a matter of the VA just admitting that it needs to catch up to the rest of the country and follow that law? 

Mr. GEOPFERT. It does not repeat, but it rhymes. A lot of the industry standards are going to have their own names, and norms 

and references to how they do security, but they are very, very 

similar. You are probably 80 to 90 percent similar across all industries. And what is in the bill essentially captures that. Again, a lot 

of this, while they viewed it as prescriptive, is considered best practice and normal network hygiene in many other industries. 

There is going to be tweaks simply based on the size, composition, legacy systems, how they interact with others. There needs to 

be some give and take in there around risk and how they do specific things, but the vast majority of what is going on in private industry would directly translate to what they are doing. And they 

simply are just not being held to account to that right now. 

Mr. O’ROURKE. Thank you. Thank you each. I will yield back. 

Mr. COFFMAN. Thank you, Mr. O’Rourke. Ms. Walorski. 

Ms. WALORSKI. Thank you, Mr. Chairman, and thank you to all 

of you for being here today. We appreciate it. Mr. Geopfert, do you 

believe this bill allows for flexibility and that Section 10 does allow 

a risk-based approach? 


VACREP0180 with DISTILLER
34 

Mr. GEOPFERT. I believe there can be some clarification in the 

language. Based on their earlier testimony, they were specifically 

calling out two points—— 

Ms. WALORSKI. Yes. 

Mr. GEOPFERT [continuing]. Around patching and legacy systems. 

In the bill as it is right now, there is a caveat around doing risk 

assessments. I think their comment that they might take some additional time—your point that is in there now is two days—48 

hours is a very common norm for critical, high-risk patches. 

Ms. WALORSKI. Okay. 

Mr. GEOPFERT. Stuff that is rated lower might be 15, 30, 90 days, 

depending on what it is. Legacy systems, they have a valid point. 

We work in a variety of industries where it is the norm to have 

legacy unsupported systems that they have to maintain for some 

reason, similar to the VA. But they have to document why they are 

still on the network. They have to put in compensating controls to 

limit the risk. They have to isolate the system, and they have to 

begin planning on when and, if possible, they are going to remove 

them out of the environment. They do not just say we have to deal 

with them, so they are there. 

Ms. WALORSKI. Sure. Do you think it is safe for VA to be running 

on all these outdated operating systems? And then secondarily, 

how big of a risk would it be to have isolated computers on the network running on unsupported and outdated operating systems? 

Mr. GEOPFERT. The safest, obviously, would to get rid of it, but 

it might not be feasible. Their comment is very common in the industry around a lot of the legacy systems are medical devices. They 

have no direct control over those. Those come from vendors. 

But the point still states, if it is a legacy system, meaning it is 

not maintainable anymore, any exploit that comes out from here 

going forward, that system will be vulnerable to—you are basically 

embedding a permanent vulnerability on the environment. If it 

needs to be there, it needs to be isolated. It is going to be a minor 

risk. But you are treating it essentially as infected, a radioactive. 

You are isolating it as far as it can be, and still be operational. 

There are ways to go about it. I guess I will put it that way. 

Ms. WALORSKI. Okay. And then given the current information security requirements already in place, would you say that the directive duplicates existing federal guidance? 

Mr. GEOPFERT. I do not. A lot of the federal guidance out there 

is laid out as almost a recommendation style. 

Ms. WALORSKI. Okay. 

Mr. GEOPFERT. And it is very high level. And as noted earlier, 

in the private sector there is a very heavy trend towards much 

more prescriptive guidance, because they have years of incidents 

demonstrating that the statements generally go be secure, and here 

is some recommendation. It just does not work. 

And so while the VA is going to say is that is onerous for them, 

all the other industries are saying the same thing. It does not matter. They are being held to account. And it is a little bit of an oddity that the private sector is expected to comply with no question 

whatsoever, and no excuses. And for someone in a government entity to say it is onerous, so therefore I don’t want to do it. 


VACREP0180 with DISTILLER
35 

Ms. WALORSKI. Okay. I appreciate it. And thanks. And I am just 

thankful for your support and, ma’am, for yours, as well. I yield 

back my time, Mr. Chairman. Thank you. 

Mr. COFFMAN. Thank you, Ms. Walorski. I would like to thank 

the panel for your testimony. You are now excused. And I did want 

to thank everyone for their participation today. The input and feedback provided today is an important contribution as the subcommittee crafts legislation to improve the quality of service VA 

provides to our nation’s veterans. With that, I ask unanimous consent that all members have five legislative days to revise and extend their remarks and include extraneous materials. Without objection, so ordered. This hearing is now adjourned. Thank you. 

[Whereupon, at 9:51 a.m., the subcommittee was adjourned.] 


VACREP0180 with DISTILLER
36 

APPENDIX 

PREPARED STATEMENT OF CHAIRMAN MIKE COFFMAN

Good morning. This hearing will come to order. 

I want to welcome everyone to today’s legislative hearing on: H.R. 571; H.R. 593; 

H.R. 1015; H.R. 1016; H.R. 1017; H.R. 1128; and H.R. 1129. 

The latter two, H.R. 1128 and 1129, are bills suggested for this hearing by the 

Minority, so I will ask Ranking Member Kuster to address them in her opening remarks. I also welcome Full Committee Chairman Jeff Miller and ask unanimous 

consent that the Honorable Ann Kirkpatrick, the previous Ranking Member of this 

Subcommittee, be allowed to join us on the dais. While we are at it, I would also 

like to ask unanimous consent that a statement from the American Legion be entered into the hearing record. Hearing no objection, so ordered. 

Today, we will address H.R. 571—The Veterans Affairs Retaliation Prevention Act 

of 2015, which was introduced by Full Committee Chairman Jeff Miller. This bill 

will improve the treatment of whistleblower complaints by the VA by defining a set 

process for whistleblowers help correct problems at the lowest level possible, while 

creating necessary penalties for supervisors who retaliate against whistleblowers. 

Second, H.R. 593—The Aurora VA Hospital Financing and Construction Reform 

Act of 2015 is a bipartisan bill I introduced along with the rest of the Colorado delegation. H.R. 593 would increase the authorization cap to help the VA to finally finish the Aurora Medical Center, with the much-needed help of the Army Corps of 

Engineers, in order to give Colorado veterans the state-of-the-art medical facility 

they deserve. Since this bill’s introduction, the VA has announced that the Aurora 

project will cost at least $1.73 billion, a full $1.4 billion over the original cost found 

in GAO’s report. This is simply outrageous and could very well make this hospital 

the most expensive in our nation’s history. Notably, according to GAO, the New Orleans VA hospital construction project will top $1 billion as well, so mismanagement, cost overruns, and delays are the norm for VA’s construction program. For 

that reason, I question whether VA should conduct its own major construction at 

all. 

While it is my top priority to get this hospital built so that Colorado veterans get 

the service they deserve, we simply cannot authorize a nearly $1 billion authorization cap increase without VA presenting the options it has to correct its own poor 

decisions with only half of a hospital to show for it. VA has reprogrammed a portion 

of the funds needed to finish the Aurora construction, but it cannot continue to pull 

money from other projects thereby robbing other veterans around the country of a 

timely completion of their hospital. Perhaps we could use VA bonuses to provide 

funding for this grossly mismanaged project. Perhaps we could amend the Choice 

Act so that some of the $5 billion authorized for minor construction could be used 

to finish this project. 

But, what is absolutely clear is that before any money is given to the VA to bail 

them out of the mess they created in Aurora, VA construction officials responsible 

for this travesty must be held accountable. These individuals should not be simply 

taken out of the chain of command for VA construction; they should be FIRED. If 

anyone in the private sector allowed a project under their supervision to get $1 billion over budget, the decision to fire them would be simple. That should happen 

here and I look forward to our discussion today with VA on ways forward. 

Third, we will address H.R. 1015—The Protecting Business Opportunities for Veterans Act of 2015 sponsored by the Honorable Tim Huelskamp of Kansas. 

H.R. 1015 will make tremendous strides at holding accountable the bad actors 

that attempt to defraud Veteran Owned Small Businesses of crucial set asides they 

receive in business. 

Fourth, we will discuss H.R. 1016—The Biological Implant Tracking and Veteran 

Safety Act of 2015 introduced by the Honorable Phil Roe of Tennessee. This legislation requires the VA to implement a standard identification protocol for biological 

implants, consistent with the FDA’s system, which would improve VA’s ability to 

prevent implantation of contaminated tissue and also to notify veterans in cases of 

recalls. 

Fifth, we will hear about H.R. 1017, The Veteran Information Security Improvement Act, which was sponsored by the Honorable Jackie Walorski from Indiana. 

This IT Security directive is designed to assist VA in mitigating known weaknesses 

by identifying detailed actions that should be taken to address its longstanding information security challenges. 

Once again, I would like to thank all those in attendance for joining us in our 

discussion today, and I now recognize Ranking Member Kuster for five minutes to 

issue her opening statement. 


VACREP0180 with DISTILLER
37 

PREPARED STATEMENT OF CHAIRMAN JEFF MILLER OF THE FULL COMMITTEE

Thank you, Chairman Coffman. 

It is a pleasure to be here today with you to discuss my bill, H.R. 571, the Veterans Affairs Retaliation Prevention Act of 2015. During the 2014 VA scandal that 

this Committee uncovered, a culture of retaliation and bureaucratic corruption 

gripped the department. The hallmark of that culture was and remains the rampant 

retaliation against VA employees who speak up to fix problems within the VA. 

These problems were so widespread that, in 2014, the Office of Special Counsel 

became inundated with more whistleblower complaints than all other agencies in 

the federal government combined. Unfortunately, despite promises from VA leadership that whistleblower retaliation will no longer be tolerated, continued occurrences of retaliation and the lack of any meaningful accountability show that is not 

the case. Proper oversight of any federal agency simply cannot be done effectively 

without employees within that agency informing the congress and other oversight 

bodies of specific problems. 

Over the years, numerous federal statutes have been passed to provide added protections to whistleblowers, but many VA supervisors have managed to consistently 

circumvent these laws, without repercussion, to the detriment of good employees. 

My bill seeks to put an end to that. 

Specifically, H.R. 571 would provide VA employees who seek to report potential 

government waste, criminal behavior, or compromised healthcare services within 

the VA a set process to fix problems at the lowest level possible while affording 

them improved protection from retaliation. This legislation will also prohibit superiors from retaliating against employees who report or assist in reporting problems 

to the VA, the Inspector General, Congress, or the GAO. 

Employees who serve as a witness in investigations and those who refuse to perform illegal acts in the course of their employment will also be protected. To ensure 

accountability, H.R. 571 will provide meaningful penalties to VA employees who are 

found to have retaliated against another employee for filing a whistleblower complaint. 

Specifically, the retaliating employee would receive: A suspension or removal from 

federal service; a fine to repay the expense borne by the federal government in defending their retaliatory behavior; a forfeiture of bonuses received while the retaliation occurred; and a prohibition of receiving future bonuses for a one year period. 

Finally, this legislation requires improved training to be provided to all VA employees on the protections afforded to employees making complaints and the repercussions that retaliating employees will face if they seek to suppress positive 

change. America’s veterans deserve the highest quality services provided by the VA. 

Improvements to those services often come in the form of suggested fixes by its employees. 

This commonsense legislation would provide the process to safely suggest those 

fixes while giving Secretary McDonald, and all secretaries in the future, the tools 

to hold accountable employees who seek to prevent change. 

I look forward to working with Committee members, our VSO partners, the VA, 

and other stakeholders on this bill, because protecting the conscientious VA employees who report waste and wrongdoing within VA must be among our constant priorities. 

Thank you once again, Chairman Coffman, for holding this hearing and for your 

hard work and leadership of the subcommittee on oversight and investigations. I appreciate the opportunity to be with you all today. 

With that, I yield back. 


VACREP0180 with DISTILLER
38 


VACREP0180 with DISTILLERInsert offset folio 1 here 98628.001
39 


VACREP0180 with DISTILLERInsert offset folio 2 here 98628.002
40 


VACREP0180 with DISTILLERInsert offset folio 3 here 98628.003
41 


VACREP0180 with DISTILLERInsert offset folio 4 here 98628.004
42 


VACREP0180 with DISTILLERInsert offset folio 5 here 98628.005
43 


VACREP0180 with DISTILLERInsert offset folio 6 here 98628.006
44 


VACREP0180 with DISTILLERInsert offset folio 7 here 98628.007
45 


VACREP0180 with DISTILLERInsert offset folio 8 here 98628.008
46 


VACREP0180 with DISTILLERInsert offset folio 9 here 98628.009
47 


VACREP0180 with DISTILLERInsert offset folio 10 here 98628.010
48 


VACREP0180 with DISTILLERInsert offset folio 11 here 98628.011
49 


VACREP0180 with DISTILLERInsert offset folio 12 here 98628.012
50 


VACREP0180 with DISTILLERInsert offset folio 13 here 98628.013
51 


VACREP0180 with DISTILLERInsert offset folio 14 here 98628.014
52 


VACREP0180 with DISTILLERInsert offset folio 15 here 98628.015
53 


VACREP0180 with DISTILLERInsert offset folio 16 here 98628.016
54 


VACREP0180 with DISTILLERInsert offset folio 17 here 98628.017
55 


VACREP0180 with DISTILLERInsert offset folio 18 here 98628.018
56 


VACREP0180 with DISTILLERInsert offset folio 19 here 98628.019
57 


VACREP0180 with DISTILLERInsert offset folio 20 here 98628.020
58 


VACREP0180 with DISTILLERInsert offset folio 21 here 98628.021
59 


VACREP0180 with DISTILLERInsert offset folio 22 here 98628.022
60 


VACREP0180 with DISTILLERInsert offset folio 23 here 98628.023
61 


VACREP0180 with DISTILLERInsert offset folio 24 here 98628.024
62 


VACREP0180 with DISTILLERInsert offset folio 25 here 98628.025
63 


VACREP0180 with DISTILLERInsert offset folio 26 here 98628.026
64 


VACREP0180 with DISTILLERInsert offset folio 27 here 98628.027
65 


VACREP0180 with DISTILLERInsert offset folio 28 here 98628.028
66 


VACREP0180 with DISTILLERInsert offset folio 29 here 98628.029
67 


VACREP0180 with DISTILLERInsert offset folio 30 here 98628.030
68 


VACREP0180 with DISTILLERInsert offset folio 31 here 98628.031
69 


VACREP0180 with DISTILLERInsert offset folio 32 here 98628.032
70 


VACREP0180 with DISTILLERInsert offset folio 33 here 98628.033
71 


VACREP0180 with DISTILLERInsert offset folio 34 here 98628.034
72 


VACREP0180 with DISTILLERInsert offset folio 35 here 98628.035
73 


VACREP0180 with DISTILLERInsert offset folio 36 here 98628.036
74 


VACREP0180 with DISTILLERInsert offset folio 37 here 98628.037
75 

Æ 


VACREP0180 with DISTILLERInsert offset folio 38 here 98628.038