U.S. GOVERNMENT PUBLISHING OFFICE

30–246 PDF WASHINGTON : 2018

OVERSIGHT OF IT AND CYBERSECURITY AT THE 

DEPARTMENT OF VETERANS AFFAIRS 

HEARING 

BEFORE THE

SUBCOMMITTEE ON 

INFORMATION TECHNOLOGY 

OF THE

COMMITTEE ON OVERSIGHT 

AND GOVERNMENT REFORM 

HOUSE OF REPRESENTATIVES 

ONE HUNDRED FIFTEENTH CONGRESS 

FIRST SESSION 

DECEMBER 7, 2017 

Serial No. 115–59 

Printed for the use of the Committee on Oversight and Government Reform 

( 

Available via the World Wide Web: http://www.fdsys.gov 

http://oversight.house.gov 


KING-6430 with DISTILLER
(II) 

COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM

Trey Gowdy, South Carolina, Chairman 

John J. Duncan, Jr., Tennessee 

Darrell E. Issa, California 

Jim Jordan, Ohio 

Mark Sanford, South Carolina 

Justin Amash, Michigan 

Paul A. Gosar, Arizona 

Scott DesJarlais, Tennessee 

Blake Farenthold, Texas 

Virginia Foxx, North Carolina 

Thomas Massie, Kentucky 

Mark Meadows, North Carolina 

Ron DeSantis, Florida 

Dennis A. Ross, Florida 

Mark Walker, North Carolina 

Rod Blum, Iowa 

Jody B. Hice, Georgia 

Steve Russell, Oklahoma 

Glenn Grothman, Wisconsin 

Will Hurd, Texas 

Gary J. Palmer, Alabama 

James Comer, Kentucky 

Paul Mitchell, Michigan 

Greg Gianforte, Montana 

Elijah E. Cummings, Maryland, Ranking 

Minority Member 

Carolyn B. Maloney, New York 

Eleanor Holmes Norton, District of Columbia 

Wm. Lacy Clay, Missouri 

Stephen F. Lynch, Massachusetts 

Jim Cooper, Tennessee 

Gerald E. Connolly, Virginia 

Robin L. Kelly, Illinois 

Brenda L. Lawrence, Michigan 

Bonnie Watson Coleman, New Jersey 

Stacey E. Plaskett, Virgin Islands 

Val Butler Demings, Florida 

Raja Krishnamoorthi, Illinois 

Jamie Raskin, Maryland 

Peter Welch, Vermont 

Matt Cartwright, Pennsylvania 

Mark DeSaulnier, California 

Jimmy Gomez,California 

SHERIA CLARKE, Staff Director 

ROBERT BORDEN, Deputy Staff Director 

WILLIAM MCKENNA General Counsel 

SEAN BREBBIA, Senior Counsel 

KILEY BIDELMAN, Clerk 

DAVID RAPALLO, Minority Staff Director 

SUBCOMMITTEE ON INFORMATION TECHNOLOGY

Will Hurd, Texas, Chairman 

Paul Mitchell, Michigan, Vice Chair 

Darrell E. Issa, California 

Justin Amash, Michigan 

Blake Farenthold, Texas 

Steve Russell, Oklahoma 

Robin L. Kelly, Illinois, Ranking Minority 

Member 

Jamie Raskin, Maryland 

Stephen F. Lynch, Massachusetts 

Gerald E. Connolly, Virginia 

Raja Krishnamoorthi, Illinois 


KING-6430 with DISTILLER
(III) 

C O N T E N T S 

Page 

Hearing held on December 7, 2017 ........................................................................ 1 

WITNESSES 

Mr. David A. Powner, Director, IT Management Issues, U.S. Government 

Accountability Office 

Oral Statement ................................................................................................. 4 

Written Statement ............................................................................................ 6 

Mr. Scott Blackburn, Acting Chief Information Officer, Department of Veterans Affairs 

Oral Statement ................................................................................................. 39 

Written Statement ............................................................................................ 41 

Mr. Bill James, Deputy Assistant Secretary for the Enterprise Program Management Office, U.S. Department of Veterans Affairs 

Oral Statement ................................................................................................. 58 

Mr. John Windom, Program Executive for Electronic Health Records Modernization, U.S. Department of Veterans Affairs 

Oral Statement ................................................................................................. 58 

Mr. Dominic Cussatt, Chief Information Security Officer, Department of Veterans Affairs 

Oral Statement ................................................................................................. 74 

APPENDIX 

Ranking Member Kelly Opening Statement ......................................................... 78 

Mr. Connolly Opening Statement ........................................................................... 80 

GAO Chart submitted by Chairman Hurd ............................................................ 82 


KING-6430 with DISTILLER

KING-6430 with DISTILLER
(1) 

OVERSIGHT OF IT AND CYBERSECURITY AT 

THE DEPARTMENT OF VETERANS AFFAIRS 

Thursday, December 7, 2017 

HOUSE OF REPRESENTATIVES, 

SUBCOMMITTEE ON INFORMATION TECHNOLOGY, 

COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM, 

Washington, D.C. 

The subcommittee met, pursuant to call, at 2:38 p.m., in Room 

2154, Rayburn House Office Building, Hon. Will Hurd [chairman of 

the subcommittee] presiding. 

Present: Representatives Hurd, Amash, Gianforte, Kelly, Lynch, 

Connolly, and Krishnamoorthi. 

Mr. HURD. The Subcommittee on Information Technology will 

come to order. And without objection, the chair is authorized to declare a recess at any time. 

Good afternoon. Thank you for being here today. 

Seventy-six years ago to the day, Japan launched a sneak attack 

on the U.S. naval base at Pearl Harbor. By the time the sun had 

set on that infamous day, 2,335 U.S. servicemen had been killed 

and 1,143 had been wounded. The next day, the United States of 

America declared war on Japan. Three days later, the world was 

at war. Over 16 million Americans eventually served in that war, 

the so-called war to end all wars. There are only around 624,000 

World War II veterans left. Most are in their 90s. I want to take 

this opportunity today to thank all of them for their service and 

their courage. 

Sadly, that war did not end all wars. In 2016, Gulf War veterans 

became the largest group of veterans at over 7 million. The total 

number of veterans enrolled in VA’s healthcare system rose from 

7.9 million to almost 9 million for fiscal year 2006 through fiscal 

year 2016. The total veteran population currently stands at 20 million people, 20 million of our fellow citizens who are willing to put 

their lives on the line for this country and for the rest of us. And 

for that sacrifice, we should honor our promise to provide them 

with world-class health care. 

But the modernization of the VA’s legacy technology has been a 

persistent concern that is affecting millions of veterans. A veteran 

should be able to go from active duty on base to the VA to a private-sector provider seamlessly. The health records should be available and up-to-date no matter where the veteran chooses to get 

health care. A fully functional modernized healthcare information 

system is the goal, and today, we are going to talk about some of 

the specifics on how the VA will modernize and upgrade its inforVerDate Nov 24 2008 11:35 Jun 26, 2018 Jkt 000000 PO 00000 Frm 00005 Fmt 6633 Sfmt 6633 H:\30246.TXT APRIL

KING-6430 with DISTILLER
2 

mation systems and how we can learn from past mistakes so that 

this time it is going to be a success. 

But let’s be honest. There is not a track record of successes here. 

As a result of a GAO review requested by this committee back in 

May of 2016, we have learned that during fiscal years 2011 to 

2016, VA obligated about $1 billion for previous VistA modernization contracts. Seven hundred and forty million went to 15 key contractors. Without objection, I would like to enter into the record a 

chart from GAO that lists the 15 contractors and the amount they 

received to work on VistA modernization and interoperable electronic health records. So moved. 

Mr. HURD. On that list of 15 contractors is the Cerner Corporation, which was recently chosen by the VA to provide an electronic 

health record that will be interoperable with the Department of Defense and then ultimately be interoperable with the private sector. 

Also on the list are the Mitre Corporation and Booz Allen Hamilton. According to the GAO, these companies have been awarded 

program management contracts to develop planning and support 

for the electronic health record modernization effort. 

Given the amount of money spent on VistA modernization, the 

lack of return on that investment, we have concerns about this rollout. It needs to succeed. The whole country is rooting for the VA 

to succeed. Previous initiatives to modernize VistA and to develop 

and interoperable electronic health record with the Department of 

Defense have been full of missed deadlines, cost overruns, and failures to produce. According to the GAO, from 2011 to 2016, the VA 

spent about $1 billion for contractors’ activities on their health information technology systems. 

Additionally, veterans have had difficulties with scheduling appointments for far too long. The VA has been trying and failing to 

develop a scheduling system that is compatible with VistA since 

2000. That is 17 years spent working on developing a scheduling 

system. It is a whole lot of money, a whole lot of time, and very 

little to show for it. 

VA Secretary Shulkin has said that the VA, and I quote, ‘‘should 

focus on the things veterans need us to focus on and work with 

companies who know how to do this better than we do,’’ end of 

quote. The Secretary is absolutely right. The technology and tools 

to improve the VA’s technology and cybersecurity exist. What is required is strong leadership at the VA to make the tough decisions 

about pursuing that technology. Our veterans deserve a state-ofthe-art scheduling system, they deserve an interoperable and longitudinal electronic health record, and they deserve good quality information technology at the agency that exists to serve the ones 

who served. 

I am looking forward to our hearing today. I am looking forward 

to hearing from our witnesses about the future of modernization, 

improvement, and technology at the VA. 

Mr. HURD. And now, as always, it is my pleasure to recognize my 

friend Robin Kelly for her opening statement. 

Ms. KELLY. Thank you, Mr. Chairman. 

Information technology is critical to improving the service and 

performance of the Federal Government. This is especially true at 

the Department of Veterans Affairs, which is one of the largest inVerDate Nov 24 2008 11:35 Jun 26, 2018 Jkt 000000 PO 00000 Frm 00006 Fmt 6633 Sfmt 6633 H:\30246.TXT APRIL

KING-6430 with DISTILLER
3 

tegrated healthcare systems in the United States, serving millions 

of veterans and their families. The VA’s goal for modernizing its 

healthcare IT is full of interoperability, which would allow seamless sharing of health information between the VA and the Department of Defense, as well as private healthcare providers. 

The VA is now in its fourth attempt since 2001 to modernize its 

healthcare IT system. The record has not been good. The VA abandoned two earlier attempts at spending billions of dollars. This 

summer, the VA announced that it would scrap its third attempt 

in favor of acquiring the same healthcare IT system as the DOD. 

I do not know what we should make of that since the VA previously abandoned the same approach four years ago. 

Chairman Hurd and I requested that GAO examine the VA’s 

modernization efforts because of these red flags. We discovered 

that, right now, the VA is relying on 138 contractors to help it 

modernize. Some of them are the very same contractors VA had 

hired and fired after their previous attempts had failed. In fact, 34 

through 38 repeat contractors make up about $793 million of the 

$1.1 billion of the contractual obligations related to modernization 

between fiscal years 2011 through 2016. This raises serious concerns. Every change in strategy delays actually modernizing and 

makes it harder on veterans who rely on the agency for health 

care. We need to understand whether these changes are justified. 

I want to hear today what the agency is doing to hold this army 

of contractors accountable. I also want to hear about the progress 

made toward its interoperability and improving the ability to track 

patient outcomes. Getting these efforts right and improving VA operations and information security are essential to regaining the 

trust and confidence of the American public that the VA is taking 

care of our nation’s veterans. 

Thank you so much. Thank you for being here, and thank you, 

Mr. Chair. 

Mr. HURD. The gentlelady yields back. 

And I now am pleased to introduce our witnesses: Mr. Scott 

Blackburn, acting chief information officer at the VA; Mr. Dominic 

Cussatt, is that correct, sir? He is the CISO at the Department of 

Veterans Affairs, the chief information security officer; Mr. Bill 

James, the deputy assistant secretary for the Enterprise Program 

Management Office at the Department of Veterans Affairs; and Mr. 

John Windom, program executive for Electronic Health Records 

Modernization at the Department of Veterans Affairs; and the person that wins the award for most times testifying in front of OGR, 

Mr. David Powner, director of IT Management Issues at the U.S. 

Government Accountability Office. 

Welcome to you all. And pursuant to committee rules, all witnesses will be sworn in before you testify, so please rise and raise 

your right hand. 

[Witnesses sworn.] 

Mr. HURD. Thank you. Please let the record reflect that all witnesses answered in the affirmative. 

And in order to allow time for discussion, please limit your testimony to five minutes. I recognize there are only can be two statements. And your entire written statement is going to be made part 

of the record. As a reminder, the clock in front of you shows your 


KING-6430 with DISTILLER
4 

remaining time. The light will turn yellow when you have 30 seconds left, and the red when your time is up. Please also remember 

to press the button to turn your microphone on before speaking. 

We are going to actually start with Mr. Powner. Mr. Powner, it 

is always a pleasure to have you here, sir. No-shave November is 

over, just for the record. And you are now recognized for five minutes, sir. 

WITNESS STATEMENTS 

STATEMENT OF DAVID A. POWNER 

Mr. POWNER. Chairman Hurd, Ranking Member Kelly, and members of the subcommittee, thank you for inviting GAO to testify on 

VA’s FITARA progress and their efforts to modernize their aging 

electronic health records system. 

Technology can help make improvements so that ultimately our 

veterans will face shorter wait times to schedule care, receive higher-quality care, and have claims processed quicker and more accurately. The Department will spend over $4 billion on IT this year. 

That makes them the fifth-highest IT spender in the government. 

Of the $4 billion, only about $360 million goes towards developing 

or acquiring new systems. The remaining goes towards operational 

systems and payroll. Many of these operational systems are old, inefficient, and difficult to maintain. In addition to its 30-plus-yearold medical information system known as VistA, VA has an accounting system and a claims processing system that are both more 

than 50 years old. 

In 2015, GAO added two new areas to our high-risk list: managing VA health care and managing IT acquisitions and operations, 

which both highlight concerns with VA’s IT management, including 

past failures where hundreds of millions of dollars were wasted. 

Turning to VA’s FITARA progress, VA has historically done a 

good job planning for incremental development and continues to do 

so. Also to their credit they are only one of seven agencies to have 

a complete software license inventory. The area that needs the 

most work is data center optimization. VA has closed about 40 of 

its 415 centers, saved just over $20 million, and reports meeting 

one of OMB’s five optimization metrics. Their closure savings and 

optimization metrics all fall short of OMB’s goals. VA needs to consider more comprehensive data center optimization strategy that 

coincides with their new approach of reducing the 130 instances of 

VistA. 

Now turning to the EHR modernization initiative, I will briefly 

summarize the work we did for you looking at contractors involved 

in previous VA EHR efforts, current plans for the new approach, 

and suggestions for success moving forward. My written statement 

provides details on specific contractors and the amounts obligated 

to VA’s EHR efforts over the previous six years. 

Here are the highlights: VA obligated approximately $1.1 billion 

to 138 contractors between 2011 and 2016. About $740 million or 

almost 70 percent of this went to 15 contractors. Clearly, we did 

not get the return needed to modernize electronic health records 

with these previous efforts, but that’s water over the dam. What’s 

important now is how can we improve contractor oversight, perVerDate Nov 24 2008 11:35 Jun 26, 2018 Jkt 000000 PO 00000 Frm 00008 Fmt 6633 Sfmt 6633 H:\30246.TXT APRIL

KING-6430 with DISTILLER
5 

formance, and delivery with the new effort. The decision by Secretary Shulkin in June to go with the same commercial electronic 

health records system as DOD is a good one. Contract award is expected this month. Plans are to follow within 90 days, and we understand that initial deployment is expected within 18 months with 

subsequent deployments to occur over the next 10 years. 

This is a massive undertaking, and I’d like to mention five keys 

to success. One, continuity of leadership and Executive Office of the 

President involvement. This continuity includes the Secretary, CIO, 

and others. Of particular concern is VA’s CIO tenure, which is less 

than two years. They have had nine CIOs since 2004. Since leadership change is inevitable, having White House involvement could 

help mitigate setbacks associated with this. The current administration has several EOP offices whose involvement can help with 

this important acquisition. This includes the Office of Innovation 

and the American Tech Council. We also think that the Federal 

CIO’s involvement is important. 

Number two, governance in building a robust Program Management Office. We understand that both interagency governance is 

planned, as is governance run by VA’s Deputy Secretary. In addition, it is important that the PMO ensure better collaboration between the Veterans Health Administration and the CIO shop than 

has occurred historically. Also, this PMO needs to have a strong 

focus on contract management to ensure that contractors have high 

levels of productivity, quality, and delivery. 

Number three, business change management. A major issue with 

Federal agencies adopting commercial products is their unwillingness to change their business processes. This is definitely a highrisk area for VA. 

Number four, leveraging lessons from DOD. Since DOD is ahead 

of VA, learning from their experience is essential. 

And lastly, number five, building in appropriate cyber security 

measures. VA’s FISMA audit shows several cyber areas that need 

strengthening. Many of these are extremely important to the new 

EHR acquisition, including controls associated with network security and controls for monitoring systems hosted by contractors. 

Mr. Chairman, this concludes my statement. I look forward to 

your questions. 

[Prepared statement of Mr. Powner follows:] 


KING-6430 with DISTILLER
6 


KING-6430 with DISTILLERInsert offset folio 40 here 30246.001

For Release on Delivery 

Expected at 2:00 p.m ET 

Thursday, December 7, 2017 

GA0-18-267T 

United States Government Accountability Office 

Testimony 

Before the Subcommittee on Information 

Technology, Committee on Oversight 

and Government Reform, House of 

Representatives 

VETERANS AFFAIRS 

INFORMATION 

TECHNOLOGY 

Historical Perspective on 

Health System 

Modernization Contracts 

and Update on Efforts to 

Address Key FITARARelated Areas 

Statement of David A. Powner, Director 

Information Technology Management Issues 
7 


KING-6430 with DISTILLERInsert offset folio 41 here 30246.002

Why GAO .Did This Study 

GAO was asked to ~ummariz:e its 

previOus and Ongoing Work, r6gafdin9 VA's history of efforts to modernize 

VistA, including f:>'aSl use of 

contractors, ang !he d,epartfl)ent:s 

rece[lt effo~ to ~cq~ire a commercial 

electronic heal~hJecord ~ystem to 

replace VistA. GAO was also asked to 

provide an Update on VA"s progress in 

key FiTARA-rela!ed areas, including 

( 1) data center co.nsplidation and 

optimization, (2) incremental system 

developmen,t practices, and (3) 

software lic~n:se management VA 

generally agreed with the information 

upon wl)ich this.statement is based. 

What. GAO Recommends 

VETERANS AFFAIRS INFORMATION 

TECHNOLOGY 

Historical Perspective on Health System 

Modernization Contracts and Update on Efforts to 

Address Key FITARA-Reiated Areas 

What GAO Found 

For nearly two decades, the Department of Veterans Affairs (VA) has undertaken 

multiple efforts to modernize its health information system-the Veterans Health 

Information Systems and Technology Architecture (known as VistA). Two of VA's 

most recent efforts included the Integrated Electronic Health Record (iEHR) 

program, a joint program with the Department of Defense (DOD) intended to 

replace systems used by VA and DOD with a single system; and the 

VistA program, which was to modernize VistA with additional 

capabilities and a better interface for all users. VA has relied extensively on 

assistance from contractors for these efforts. VA obligated over $1.1 billion for 

contracts with 138 contractors during fiscal years 2011 through 2016 for iEHR 

and VistA Evolution. Contract data showed that the 15 key contractors that 

worked on both programs accounted for $7 41 million of the funding obligated for 

system development, project management, and operations and maintenance to 

support the two programs (see figure). VA recently announced that it intends to 

change its VistA modernization approach and acquire the same electronic health 

record system that DOD is implementing. 

Funding Obligated to Key VistA Modernization Contractors for 2011-2016 

Dollars ob!lgated {in millions) 

500 

400 

300 

200 

100 

Development Project Management Operations and Maintenance 

With respect to key FITARA-rela!ed areas, the department has reported progress 

on consolidating and optimizing its data centers, although this progress has 

fallen short of targets set by the Office of Management and Budget VA has also 

reported $23.61 million In data center-related cost savings, yet does not expect 

to realize further savings from additional closures. In addition, VA's Chief 

Information Officer (CIO) certified the use of adequate incremental development 

for 10 of the department's major IT investments; however, VA has not yet 

updated its policy and process for CIO certification as GAO recommended. 

Finally, VA has issued a software licensing policy and has generated an 

inventory of its software licenses to inform future investment decisions. 

-------------United States Government Accountability Office 
8 


KING-6430 with DISTILLERInsert offset folio 42 here 30246.003

Chairman Hurd, Ranking Member Kelly, and Members of the 

Subcommittee: 

Thank you for the opportunity to participate in today's hearing on the 

information technology (IT) efforts of the Department of Veterans Affairs 

(VA). As you know, the use of IT is crucial to helping VA effectively serve 

the nation's veterans and, each year, the department spends billions of 

dollars on its information systems and assets. 

Over many years, however, VA has experienced challenges in managing 

its IT projects and programs, which, in turn, has contributed to questions 

about the efficiency and effectiveness of the department's operations. 

These challenges have spanned a number of critical initiatives related to 

modernizing major systems within the department, including its electronic 

health information system-the Veterans Health Information Systems and 

Technology Architecture (VistA). We have previously reported on the 

challenges that the department has faced in managing this system, as 

well as other aspects of its IT. 1 

Further, given the challenges that federal agencies, including VA, have 

long encountered in managing IT acquisitions, in December 2014 

Congress enacted federal IT acquisition reform legislation (commonly 

referred to as the Federal Information Technology Acquisition Reform Act, 

1

GAO, Information Technology: Further Implementation of FITARA Related 

Recommendations Is Needed to Better Manage Acquisitions and Operations, 

GA0-18-234T (Washington, D.C .. Nov. 15, 2017): Information Technology Reform: 

Agencies Need to Improve Certification of Incremental Development, GA0-18-148 

(Washington, D.C .. Nov. 7, 2017); Information Technology: Sustained Management 

Attention to the Implementation of FITARA Is Needed to Better Manage Acquisitions and 

Operations, GA0-17-686T (Washington, D.C.: June 13, 2017); Data Center Optimization; 

Agencies Need to Address Challenges and Improve Progress to Achieve Cost Savings 

Goals, GA0~17-448 (Washington, D.C.: Aug. 15, 2017); Veterans Affairs: Improved 

Management Processes Are Necessary for IT Systems That Better Support Health Care, 

GA0-17-384 (Washington, D.C .. June 21, 2017); Data Center Optimization: Agencies 

Need to Complete Plans to Address Inconsistencies in Reported Savings, GA0-17 -388 

(Washington, D.C.: May 18, 2017); Information Technology Reform: Agencies Need to 

Increase Their Use of Incremental Development Practices, GA0-16-469 (Washington, 

D.C .. Aug. 16, 2016).; Data Center Consolidation: Agencies Making Progress, but 

Planned Savings Goals Need to Be Established [Reissued on March 4, 2016], 

GA0-16-323 (Washington, D.C.: Mar. 3, 2016); Federal Software Licenses: Beffer 

Management Needed to Achieve Significant Savings Government-Wide, GA0-14-413 

(Washington, D.C.: May 22, 2014); and Electronic Health Records: VA and DOD Need to 

Support Cost and Schedule Claims, Develop lnteroperability Plans, and Improve 

Collaboration, GA0-14-302 (Washington, D.C.: Feb. 27, 2014). 

Page 1 GA0-18-267T Veterans Affairs Information Technology 
9 


KING-6430 with DISTILLERInsert offset folio 43 here 30246.004

or FITARA)-' This law was intended to improve agencies' acquisitions 

and enable Congress to hold agencies accountable for reducing 

duplication and achieving cost savings. 

At your request, my testimony today summarizes our work that has 

examined VA's history of efforts to modernize its health information 

system, VistA, including past uses of contractors across multiple 

modernization initiatives, and the department's plan to acquire a 

commercial electronic health record system to replace VistA. In addition, 

the testimony provides an update on VA's progress in key FITARArelated areas, including (1) data center consolidation and optimization, (2) 

incremental system development practices, and (3) software license 

management. 

In developing this testimony, we relied on our previously published 

reports that discussed the history of the department's VistA modernization 

efforts, as well as the department's efforts regarding data center 

consolidation and optimization, incremental system development 

practices, and software license management. We also considered 

information provided by the department on its actions in response to our 

previous recommendations in these areas. The reports cited throughout 

this statement include detailed information on the scope and methodology 

for our prior reviews. 

Further, the statement summarizes key findings from a draft report that is 

based on our ongoing review of selected VistA modernization contracts 

and the department's recent efforts to acquire a commercial electronic 

health record system. This draft report is currently with VA for its 

comments. We anticipate issuing the final report in January 2018. 

For our ongoing review of the VistA modernization efforts, we obtained 

available data from VA on the associated contracts, related dollar 

obligations, and expected contractor activities for modernization tasks. In 

this regard, VA was able to provide the requested data for two 

2

Carl Levin and Howard P. 'Buck' McKeon National Defense Authorization Act for Fiscal 

Year 2015. Pub. L. No. 113-291, div. A, title VIII, subtitleD, 128 Stat. 3292, 3438-3450 

(Dec. 19, 2014). 

Page 2 GA0-18-267T Veterans Affairs Information Technology 
10 


KING-6430 with DISTILLERInsert offset folio 44 here 30246.005

Background 

modernization initiatives with activities that spanned the time period from 

fiscal year 2011 through fiscal year 20163 

To determine the key contractors for the two modernization initiatives, we 

first identified all of the contractors that worked on the initiatives. We then 

ranked the contractors according to the total dollars obligated for 

contracts that each contractor had been awarded. We designated the top 

15 ranked contractors, in terms of dollars obligated, as key contractors. 

We assessed the reliability of the contract data we received from VA and 

determined that the data were sufficiently reliable for the purposes of our 

review. 

To determine VA's current plans for modernizing VistA, we reviewed draft 

program schedules, organization charts, congressional testimonies of the 

VA Secretary, a White House press conference transcript, departmental 

press releases, and the department's justification for awarding a noncompetitive contract for a commercial off-the-shelf (COTS) electronic 

health record system. We also met with senior VA officials to obtain 

updated information on the efforts. 

The work upon which this statement is based is being or was conducted 

in accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audits to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives. 

VA's mission is to promote the health, welfare, and dignity of all veterans 

in recognition of their service to the nation by ensuring that they receive 

medical care, benefits, social support, and lasting memorials. In carrying 

out this mission, the department operates one of the largest health care 

delivery systems in America, providing health care to millions of veterans 

and their families at more than 1,500 facilities. 

The department's three major components-the Veterans Health 

Administration (VHA), the Veterans Benefits Administration (VBA), and 

3

VA was unable to provide data on VistA modernization contracts prior to fiscal year 2011 

because the department's records retention policy does not require it to maintain such 

data. 

Page3 GA0~18-267T Veterans Affairs Information Technology 
11 


KING-6430 with DISTILLERInsert offset folio 45 here 30246.006

VA Relies Extensively 

on IT 

the National Cemetery Administration (NCA)-are primarily responsible 

for carrying out its mission. More specifically, VHA provides health care 

services, including primary care and specialized care, and it performs 

research and development to improve veterans' needs. VBA provides a 

variety of benefits to veterans and their families, including disability 

compensation, educational opportunities, assistance with home 

ownership, and life insurance. Further, NCA provides burial and memorial 

benefits to veterans and their families. 

Collectively, the three components rely on approximately 340,000 

employees to provide services and benefits. These employees work in 

VA's Washington, D.C. headquarters, as well as 170 medical centers, 

approximately 750 community-based outpatient clinics, 300 veterans 

centers, 56 regional offices, and more than 130 cemeteries situated 

throughout the nation. 

The use of IT is critically important to VA's efforts to provide benefits and 

services to veterans. As such, the department operates and maintains an 

IT infrastructure that is intended to provide the backbone necessary to 

meet the day-to-day operational needs of its medical centers, veteranfacing systems, benefits delivery systems, memorial services, and all 

other systems supporting the department's mission. The infrastructure is 

to provide for data storage, transmission, and communications 

requirements necessary to ensure the delivery of reliable, available, and 

responsive support to all VA staff offices and administration customers, 

as well as veterans. 

According to department data as of October 2016, there were 576 active 

or in-development systems in VA's inventory of IT systems' These 

systems are intended to be used for the determination of benefits, 

benefits claims processing, and access to health records, among other 

services. VHA is the parent organization for 319 of these systems. 5 Of the 

4

According to VA Directive 6404, a system in the department inventory must (1) contain a 

combination of IT hardware, software, or information management capabilities; (2) be 

funded and operationally managed by VA·, (3) be hosted in a shared computing 

environment (e.g., data center, cloud facility, medica! center); (4) not be an infrastructure 

or software subcomponent (e.g., servers, network routers, storage) required to support a 

system; and (5) not be a medical device (e.g., cardiology equipment, medical lasers, and 

endoscope) categorized under the VA Medical Device Nomenclature System. 

5

The parent organization is the highest level functional organization within VA that is 

associated with the business sponsor for a system. 

Page4 GA0-18-267T Veterans Affairs Information Technology 
12 


KING-6430 with DISTILLERInsert offset folio 46 here 30246.007

319 systems, 244 were considered mission-related and provide 

capabilities related to veterans' health care delivery. For example, VHA's 

systems provide capabilities to establish and maintain electronic health 

records that health care providers and other clinical staff use to view 

patient information in inpatient, outpatient, and long-term care settings. 

VistA serves an essential role in helping the department to fulfill its health 

care delivery mission. Specifically, VistA is an integrated medical 

information system for all veterans' health information. It was developed 

in-house by the department's clinicians and IT personnel and has been in 

operation since the early 1980s. 6 As such, the system has long been vital 

to helping ensure the quality of health care received by the nation's 

veterans and their dependents. 

VistA is comprised of more than 200 applications that assist in the 

delivery of health care and perform other important functions within the 

department, including financial management, enrollment, and registration. 

Some of these applications have been in operation for over 30 years and, 

according to VA, have become increasingly difficult and costly to 

maintain. As such, the department has expended extensive resources to 

modernize the system and increase its ability to allow for the viewing or 

exchange of patient information with the Department of Defense (DOD) 

and private sector health providers. In addition, as we recently reported, 

VHA has unaddressed needs that indicate its current health IT systems, 

including VistA, do not fully support the organization's business 

functions. 7 Specifically, about 39 percent of all requests related to health 

IT needs have remained unaddressed after more than 5 years. 

Electronic health records are particularly crucial for optimizing the health 

care provided to veterans, many of whom may have health records 

residing at multiple medical facilities within and outside the United States. 

Taking steps toward interoperability-that is, collecting, storing, retrieving, 

and transferring veterans' health records electronically-is significant to 

improving the quality and efficiency of care. One of the goals of 

interoperability is to ensure that patients' electronic health information is 

began operation in 1983 as the Decentralized Hospital Computer Program. In 

1996, the name of the system was changed to VistA 

7 GAO, Veterans Affairs: Improved Management Processes Are Necessary for IT Systems 

That Beffer Support Health Care, GA0-17-384 (Washington, D.C.: June 21, 2017). 

Page 5 GA0-18-267T Veterans Affairs Information Technology 
13 


KING-6430 with DISTILLERInsert offset folio 47 here 30246.008

VA Manages IT Resources 

Centrally 

VA Requested Nearly $4.1 

Billion for Fiscal Year 2018 

available from provider to provider, regardless of where it originated or 

resides. 

Since 2007, VA has been operating a centralized organization, the Office 

of Information and Technology (OI&T), in which most key functions 

intended for effective management of IT are performed. This office is led 

by the Assistant Secretary for Information and Technology-VA's Chief 

Information Officer (CIO). The office is responsible for providing strategy 

and technical direction, guidance, and policy related to how IT resources 

are to be acquired and managed for the department, and for working 

closely with its business partners-such as VHA-to identify and prioritize 

business needs and requirements for IT systems. Among other things, 

OI&T has responsibility for managing the majority of VA's IT-related 

functions, including the maintenance and modernization of VistA. 8 As of 

2016, OI&Twas comprised of more than 15,000 staff, with more than half 

of these positions filled by contractors. 9 

For fiscal year 2018, the department's budget request included nearly 

$4.1 billion for IT. 10 The department requested approximately $359 million 

for new systems development or modernization efforts, approximately 

$2.5 billion for maintaining existing systems, and approximately $1.2 

billion for payroll and administration. For example, in its fiscal year 2018 

budget submission, the department requested appropriations to support 

five IT portfolios, including the development and operations and 

maintenance for programs and projects related to the: 

Medical portfolio, which provides technology solutions to deliver 

modern, high-quality medical care capabilities to veterans ($944.2 

million); 

Benefit portfolio, which addresses the technology needs managed by 

the Veterans Benefit Administration ($296.9 million); 

a joint program with O!&T and VHA 

9

Specifically, we reported in 2016 that OJ&T performed key IT~re!ated functions with the 

support of nearly 7,300 federal employees and approximately 7,800 contractor staff: GAO, 

VA IT Management: Organization Is Largely Centralized; Additional Actions Could 

Improve Human Capital Practices and Systems Development Processes, GAOw 16-403 

(Washington, D.C.: Aug. 17, 2016). 

10VA has a single, consolidated IT appropriation that is submitted and managed by OI&T. 

Page6 GA0·18·267T Veterans Affairs Information Technology 
14 


KING-6430 with DISTILLERInsert offset folio 48 here 30246.009

VA's Management of IT 

Has Contributed to HighRisk Designations 

Memorial Affairs portfolio, which provides support for the 

modernization of applications and services for National Cemeteries at 

133 locations nationwide ($24.5 million); 

Corporate portfolio, which consists of back office operations 

supporting the major business lines and department management 

($270.6 million); and 

Enterprise IT, which provides the underlying infrastructure to enable 

the other portfolios to operate and includes such things as 

cybersecurity, data centers, cloud services, telephony, enterprise 

software, and data connectivity ($1.289 billion). 

In 2015, we designated VA Health Care as a high-risk area for the federal 

government and, currently, we continue to be concerned about the 

department's ability to ensure that its resources are being used costeffectively and efficiently to improve veterans' timely access to health 

care. 11 In part, we identified limitations in the capacity ofVA's existing 

systems, including the outdated, inefficient nature of certain systems and 

a lack of system interoperability-that is, the ability to exchange and use 

electronic health information-as contributors to the department's IT 

challenges related to health care. These challenges present risks to the 

timeliness, quality, and safety of the health care. While we recently 

reported that the department has begun to demonstrate leadership 

commitment to addressing IT challenges, more work remains. 12 

Also, in February 2015, we added Improving the Management of IT 

Acquisitions and Operations to our list of high-risk areas. 13 Specifically, 

federal IT investments too frequently fail or incur cost overruns and 

schedule slippages while contributing little to mission-related outcomes. 

We have previously testified that the federal government has spent 

billions of dollars on failed IT investments, including, for example, VA's 

Scheduling Replacement Project, which was terminated in September 

11GAO maintains a high-risk program to focus attention on government operations that it 

identifies as high risk due to their greater vulnerabilities to fraud, waste, abuse, and 

mismanagement or the need for transformation to address economy, efficiency, or 

effectiveness challenges. VA's issues were highlighted in our 2015 High-Risk Report. 

GAO, High-Risk Series: An Update, GA0-15-290 (Washington, D.C .. Feb. 11, 2015) and 

2017 update, GAO, High-Risk Series_· Progress on Many High~Risk Areas, While 

Substantial Efforts Needed on Others, GA0-17-317 (Washington, D.C.: Feb. 15, 2017). 

12GA0-17-317. 

13GA0-15-290. 

Page 7 GA0-18-267T Veterans Affairs Information Technology 
15 


KING-6430 with DISTILLERInsert offset folio 49 here 30246.010

2009 after spending an estimated $127 million over 9 years; 14 and its 

Financial and Logistics Integrated Technology Enterprise program, which 

was intended to be delivered by 2014 at a total estimated cost of $609 

million, but was terminated in October 2011 due to challenges in 

managing the program. 15 

This high-risk area highlighted several critical IT initiatives in need of 

additional congressional oversight, including (1) reviews of troubled 

projects; (2) efforts to increase the use of incremental development; (3) 

efforts to provide transparency relative to the cost, schedule, and risk 

levels for major IT investments; (4) reviews of agencies' operational 

investments; (5) data center consolidation; and (6) efforts to streamline 

agencies' portfolios of investments. We noted that agencies' 

implementation of these initiatives was inconsistent and that more work 

remained to demonstrate progress in achieving IT acquisition and 

operation outcomes. 

We also recently issued an update to our high-risk report and noted that, 

while progress has been made in addressing the high-risk area of IT 

acquisitions and operations, significant work remains to be completed. 16 

For example, we noted, among other things, that additional work was 

needed to establish action plans for federal agencies to modernize or 

replace obsolete systems. Specifically, we pointed out that many federal 

systems use outdated software languages and hardware, which has 

increased spending on operations and maintenance of technology 

investments. 

VA was among a handful of departments with one or more archaic legacy 

systems. As discussed in our recent report on legacy systems used by 

federal agencies, we identified 2 of the department's systems as being 

14GAO, Information Technology: Management Improvements Are Essential to VA 's 

Second Effort to Replace Its Outpatient Scheduling System, GA0-10-579 (Washington, 

D.C.: May 27. 2010). 

15GAO, Information Technology: Actions Needed to Fully Establish Program Management 

Capability for VA 's Financial and Logistics Initiative, GA0-1 0-40 {Washington, D. C .. Oct. 

26, 2009). 

16GA0-17-317. 

PageS GA0-18-267T Veterans Affairs Information Technology 
16 


KING-6430 with DISTILLERInsert offset folio 50 here 30246.011

FITARA Is Intended to 

Help VA and Other 

Agencies Improve Their 

Acquisitions of IT 

over 50 years old, and among the 10 oldest investments and/or systems 

that were reported by 12 selected agencies. 17 

Personnel and Accounting Integrated Data (PAID}-This 53-year old 

system automates time and attendance for employees, timekeepers, 

payroll, and supervisors. It is written in Common Business Oriented 

Language (COBOL), a programming language developed in the late 

1950s and early 1960s, and runs on IBM mainframes. 

Benefits Delivery Network (BDN)-This 51-year old system tracks 

claims filed by veterans for benefits, eligibility, and dates of death. It is 

a suite of COBOL mainframe applications. 

Ongoing uses of antiquated systems, such as PAID and BDN, contribute 

to agencies spending a large, and increasing, proportion of their IT 

budgets on operations and maintenance of systems that have outlived 

their effectiveness and are consuming resources that outweigh their 

benefits. Accordingly, we have recommended that VA identify and plan to 

modernize or replace its legacy systems. The department concurred with 

our recommendation and stated that it plans to retire and replace PAID 

with the Human Resources Information System Shared Service Center in 

2017. The department also stated that it has general plans to roll the 

capabilities of BDN into another system and to retire BDN in 2018. 

Congress enacted federal IT acquisition reform legislation (commonly 

referred to as the Federal Information Technology Acquisition Reform Act, 

or FITARA) in December 2014. This legislation was intended to improve 

agencies' acquisitions of IT and enable Congress to monitor agencies' 

progress and hold them accountable for reducing duplication and 

achieving cost savings. The law applies to VA and other covered 

agencies. '

8 It includes specific requirements related to seven areas, 

17 GAO, Information Technology: Federal Agencies Need to Address Aging Legacy 

Systems, GA0-16-468 (Washington, D.C .. May 25, 2016). 

1 8

The provisions apply to the agencies covered by the Chief Financial Officers Act of 

1990, 31 U.S. C.§ 901(b). These agencies are the Departments of Agriculture, 

Commerce, Defense, Education, Energy, Health and Human Services, Homeland 

Security, Housing and Urban Development, Justice, Labor, State, the Interior, the 

Treasury, Transportation, and Veterans Affairs; the Environmental Protection Agency, 

Genera! Services Administration, National Aeronautics and Space Administration, National 

Science Foundation, Nuclear Regulatory Commission, Office of Personnel Management, 

Small Business Administration, Social Security Administration, and U.S. Agency for 

International Development However, FITARA has generally !imited application to the 

Department of Defense. 

PageS GA0-18-267T Veterans Affairs Information Technology 
17 


KING-6430 with DISTILLERInsert offset folio 51 here 30246.012

including data center consolidation and optimization, agency CIO 

authority, and government-wide software purchasing. 19 

Federal data center consolidation initiative (FDCCI). Agencies are 

required to provide the Office of Management and Budget (OMB) with 

a data center inventory, a strategy for consolidating and optimizing 

their data centers (to include planned cost savings), and quarterly 

updates on progress made. The law also requires OMB to develop a 

goal for how much is to be saved through this initiative, and provide 

annual reports on cost savings achieved20 

Agency CIO authority enhancements. CIOs at covered agencies 

are required to (1) approve the IT budget requests of their respective 

agencies, (2) certify that IT investments are adequately implementing 

incremental development, as defined in capital planning guidance 

issued by OMB, (3) review and approve contracts for IT, and (4) 

approve the appointment of other agency employees with the title of 

CIO. 

Government-wide software purchasing program. The General 

Services Administration is to develop a strategic sourcing initiative to 

enhance government-wide acquisition and management of software. 

In doing so, the law requires that, to the maximum extent practicable, 

the General Services Administration should allow for the purchase of 

a software license agreement that is available for use by all executive 

branch agencies as a single user. Expanding upon FITARA, the 

Making Electronic Government Accountable by Yielding Tangible 

Efficiencies Act of 2016, or the "MEGABYTE Act," further enhanced 

CIOs' management of software licenses by requiring agency CIOs to 

establish an agency software licensing policy and a comprehensive 

19F!TARA also includes requirements for covered agencies to enhance the transparency 

and improve risk management of IT investments, annually review IT investment portfolios, 

expand training and use of IT acquisition cadres, and compare their purchases of services 

and supplies to what is offered under the federal strategic sourcing initiative that the 

General Services Administration is to develop. The Federal Strategic Sourcing Initiative is 

a program established by the Genera! Services Administration and the Department of the 

Treasury to address government-wide opportunities to strategically source commonly 

purchased goods and services and eliminate duplication of efforts across agencies. 

201n November 2017, the FITARA Enhancement Act of 2017was enacted into law to 

extend the sunset date for the data center provisions of FITARA. The law's data center 

consolidation and optimization provisions currently expire on October 1, 2020. Pub. L. No. 

115-88 (Nov. 21, 2017). 

Page 10 GA0-18-267T Veterans Affairs Information Technology 
18 


KING-6430 with DISTILLERInsert offset folio 52 here 30246.013

VA Has Pursued Four 

VistA Modernization 

Initiatives Since 2001, 

with About a Billion 

Dollars Obligated for 

Contractors' Activities 

During Fiscal Years 

2011 through 2016 

software license inventory to track and maintain licenses, among 

other requirements. 21 

In June 2015, OMB released guidance describing how agencies are to 

implement FITARA. 22 This guidance is intended to, among other things: 

assist agencies in aligning their IT resources with statutory 

requirements; 

establish government-wide IT management controls that will meet the 

law's requirements, while providing agencies with flexibility to adapt to 

unique agency processes and requirements; 

clarify the CIO's role and strengthen the relationship between agency 

CIOs and bureau CIOs; and 

strengthen CIO accountability for IT costs, schedules, performance, 

and security. 

In our draft report that is currently with VA for comments, we discuss the 

history of VA's efforts to modernize its health information system, VistA. 

These four efforts-HealtheVet, the integrated Electronic Health Record 

(iEHR), VistA Evolution, and the Electronic Health Record Modernization 

(EHRM)-reflect varying approaches that the department has considered 

to achieve a modernized health care system over the course of nearly two 

decades. The modernization efforts are described as follows. 

HealtheVet 

In 2001, VA undertook its first VistA modernization project, the 

HealtheVet initiative, with the goals of standardizing the department's 

health care system and eliminating the approximately 130 different 

systems used by its field locations at that time. HealtheVet was scheduled 

to be fully implemented by 2018 at a total estimated development and 

deployment cost of about $11 billion. As part of the effort, the department 

had planned to develop or enhance specific areas of system functionality 

through six projects, which were to be completed between 2006 and 

2012. Specifically, these projects were to provide capabilities to support 

21 Pub. L. No. 114-210130 Stat 824 (July 29, 2016). 

220MB, Management and Oversight of Federal Information Technology, Memorandum M15-14 (Washington, D.C.: June 10, 2015). 

Page11 GA0·18~267T Veterans Affairs Information Technology 
19 


KING-6430 with DISTILLERInsert offset folio 53 here 30246.014

VA's Health Data Repository and Patient Financial Services System, as 

well as the Laboratory, Pharmacy, Imaging, and Scheduling functions. 

In June 2008, we reported that the department had made progress on the 

HealtheVet initiative, but noted issues with project planning and 

governance!' In June 2009, the Secretary of Veterans Affairs announced 

that VA would stop financing failed projects and improve the management 

of its IT development projects. Subsequently, in August 2010, the 

department reported that it had terminated the HealtheVet initiative. 

iEHR 

In February 2011, VA began its second modernization initiative, the iEHR 

program, in conjunction with DOD. The program was intended to replace 

the two separate electronic health record systems used by the two 

departments with a single, shared system. Moreover, because both 

departments would be using the same system, this approach was 

expected to largely sidestep the challenges that had been encountered in 

trying to achieve interoperability between their two separate systems. 

Initial plans called for the development of a single, joint system consisting 

of 54 clinical capabilities to be delivered in six increments between 2014 

and 2017. Among the agreed-upon capabilities to be delivered were 

those supporting laboratory, anatomic pathology, pharmacy, and 

immunizations. According to VA and DOD, the single iEHR system had 

an estimated life cycle cost of $29 billion through the end of fiscal year 

2029. 

However, in February 2013, the Secretaries of VA and DOD announced 

that they would not continue with their joint development of a single 

electronic health record system. This decision resulted from an 

assessment of the iEHR program that the secretaries had requested in 

December 2012 because of their concerns about the program facing 

challenges in meeting deadlines, costing too much, and taking too long to 

deliver capabilities. In 2013, the departments abandoned their plan to 

develop the integrated system and stated that they would again pursue 

separate modernization efforts. 

Veterans Affairs: Health Information System Modernization Far from Complete; 

Improved Project Planning and Oversight Needed, GA0-08-805 (Washington, D.C.: June 

30, 2008) 

Page 12 GA0~18-267T Veterans Affairs Information Technology 
20 


KING-6430 with DISTILLERInsert offset folio 54 here 30246.015

VistA Evolution 

In December 2013, VA initiated its VistA Evolution program as a joint 

effort of VHA and 01& T that was to be completed by the end of fiscal year 

2018. The program was to be comprised of a collection of projects and 

efforts focused on improving the efficiency and quality of veterans' health 

care by modernizing the department's health information systems, 

increasing the department's data exchange and interoperability with DOD 

and private sector health care partners, and reducing the time it takes to 

deploy new health information management capabilities. Further, the 

program was intended to result in lower costs for system upgrades, 

maintenance, and sustainment. According to the department's March 

2017 cost estimate, VistA Evolution was to have a life cycle cost of about 

$4 billion through fiscal year 2028. 

Since initiating VistA Evolution in December 2013, VA has completed a 

number of key activities that were called for in its plans. For example, the 

department delivered capabilities, such as the ability for health providers 

to have an integrated, real-time view of electronic health record data 

through the Joint Legacy Viewer, as well as the ability for health care 

providers to view sensitive DOD notes and highlight abnormal test results 

for patients. 24 VA also initiated work to standardize VistA across the 130 

VA facilities and released enhancements to its legacy scheduling, 

pharmacy, and immunization systems. In addition, the department 

released the enterprise Health Management Platform, which is a webbased user interface that assembles patient clinical data from all VistA 

instances and DOD. 

Although VistA Evolution is ongoing, VA is currently in the process of 

revising its plan for the program as a result of the department recently 

announcing its pursuit of a fourth VistA modernization program 

(discussed below). For example, the department determined that it would 

no longer pursue additional development or deployment of the enterprise 

Health Management Platform-a major VistA Evolution componentbecause the new modernization program is envisioned to provide similar 

capabilities. 

24The Joint Legacy Viewer was developed jointly by VA and DOD and is a too! that 

provides a real~time, integrated, categorized, and chronological view of electronic health 

record information contained in existing VA and DOD systems. 

Page 13 GA0~18-267T Veterans Affairs Information Technology 
21 


KING-6430 with DISTILLERInsert offset folio 55 here 30246.016

EHRM 

In June 2017, the VA Secretary announced a significant shift in the 

department's approach to modernizing VistA. Specifically, rather than 

continue to use VistA, the Secretary stated that the department plans to 

acquire the same electronic health record system that DOD is 

implementing. In this regard, DOD has contracted with the Gerner 

Corporation to provide a new integrated electronic health record system. 25 

According to the Secretary, VA has chosen to acquire this same product 

because it would allow all of VA's and DOD's patient data to reside in one 

system, thus enabling seamless care between the department and DOD 

without the manual and electronic exchange and reconciliation of data 

between two separate systems. 

The VA Secretary added that this fourth modernization initiative is 

intended to minimize customization and system differences that currently 

exist within the department's medical facilities, and ensure the 

consistency of processes and practices within VA and DOD. When fully 

operational, the system is intended to be the single source for patients to 

access their medical history and for clinicians to use that history in real 

time at any VA or DOD medical facility, which may result in improved 

health care outcomes. According to VA's Chief Technology Officer, 

Gerner is expected to provide integration, configuration, testing, 

deployment, hosting, organizational change management, training, 

sustainment, and licenses necessary to deploy the system in a manner 

that meets the department's needs. 

To expedite the acquisition, in June 2017, the Secretary signed a 

"Determination and Findings," which noted a public interest exception to 

the requirement for full and open competition, and authorized VA to issue 

a solicitation directly to the Gerner Corporation. 26 According to the 

Secretary, VA expects to award a contract to Gerner in December 2017, 

and deployment of the new system is anticipated to begin 18 months after 

the contract has been signed. 

25!n July 2015, DOD awarded a $4.3 bi!fion contract to the Gerner Corporation for a new 

integrated electronic health record system, known as MHS GENESIS. The transition to the 

new system began in February 2017 in the Pacific Northwest region of the United States 

and is expected to be completed in 2022. 

26FAR, 48 C.F.R § 6.302-7. 

Page 14 GA0~18-267T Veterans Affairs Information Technology 
22 


KING-6430 with DISTILLERInsert offset folio 56 here 30246.017

VA's Executive Director for the Electronic Health Records Modernization 

System stated that the department intends to incrementally deploy the 

new system to its medical facilities. Each facility is expected to continue 

using VistA until the new system has been deployed at that location. All 

VA medical facilities are anticipated to have the new system implemented 

within 7 to 8 years after the first deployment. 

Figure 1 shows a timeline of the four efforts that VA has pursued to 

modernize VistA since 2001. 

Figure 1: Timeline of the Department of Veterans Affairs Four Efforts to Modernize VistA Since 2001 

2007 2008 :2009 2010 2011 2012 2013 20i4 2015 2016 2017 2018 2019 

Fiscal years 

r--, t __ J Jomt effort with the Depa1in,ent of Defense 

Source. Gt\0 ar>.li)'Sls cl Departmerrt ofVetemr.s AffillfS data. ! 

Page 15 GA0-18-267T Veterans Affairs Information Technology 
23 


KING-6430 with DISTILLERInsert offset folio 57 here 30246.018

VA Obligated about $1.1 

Billion for VistA 

Modernization Contracts 

During Fiscal Years 2011 

through 2016 

For iEHR and VistA Evolution, the two modernization initiatives for which 

VA could provide contract data," the department obligated approximately 

$1.1 billion for contracts with 138 different contractors during fiscal years 

2011 through 2016. 28 Specifically, the department obligated 

approximately $224 million and $880 million, respectively, for contracts 

associated with these efforts. Of the 138 contractors, 34 of them 

performed work supporting both iEHR and VistA Evolution. The remaining 

104 contractors worked exclusively on either iEHR or VistA Evolution. 

Funding lor the 34 contractors that worked on both iEHR and VistA 

Evolution totaled about $793 million of the $1.1 billion obligated for 

contracts on the two initiatives. Obligations for contracts awarded to the 

top 15 of these 34 contractors (which we designated as key contractors) 

accounted for about $741 million (about 67 percent) of the total obligated 

for contracts on the two initiatives. The remaining 123 contractors were 

obligated about $364 million for their contracts. 

The 15 key contractors were obligated about $564 million and $177 

million for VistA Evolution and iEHR contracts, respectively. Table 1 

identifies the key contractors and their obligated dollar totals for the two 

efforts. 

not able to provide contract data related to the HealtheVet effort. The 

department indicated that it could not verify any HealtheVet vendors receiving payments 

because the time frame for the contracts falls outside the scope of record retention years 

required by applicable regulations. According to the Federal Acquisition Regulation, 

government agencies are only required to retain contract records for six years after the 

final payment (48 C.F.R § 4.805). HealtheVet was terminated in August 2010. 

28The 138 different contractors that supported lEHR and VistA Evolution in fiscal years 

2011 through 2016 were obligated funds for a total of 783 contract actions, which included 

awards of new contracts, modifications to previously awarded contracts, and issuance of 

task orders on indefinite delivery, indefinite quantity contracts. 

Page 16 GA0~18~267T Veterans Affairs Information Technology 
24 


KING-6430 with DISTILLERInsert offset folio 58 here 30246.019

Table 1: Key Contractors and the Amounts (in millions) Obligated to Each for 

Contracts on iEHR and VistA Evolution from 2011~2016 

HP Enterprise Services, LLC 24.3 576 

Harris Corporation 39.3 34.0 

T echnatomy Corporation 18.4 46.7 

Booz Allen Hamilton, Inc. 7.8 53.6 

The MITRE Corporation 6.3 35.6 

SSG Technology -Solutions 6.3 24.8 

LongView International Technology 11.9 15.8 Solutions, Inc. 

By Light Professional IT Services, LLC 4.4 23.3 

Business Information Technology 10.4 13.8 Solutions, Inc 

Systems Research and Applications 3.0 15.3 Corporation 

Gerner Corporation 6.3 7.1 

CACIInternational, Inc. 6.3 4.4 

Open Source Electronic Health Record 4.9 4.6 Agent, Inc. 

Total for 15 key contractors 177.1 563.8 

Source. GAO analysis ot agency data I GA0-18-267T 

81.9 

73.3 

65.0 

61.4 

41.8 

31.1 

27.7 

27.7 

24.2 

18.3 

13.4 

10.7 

9.5 

740.9 

Additionally, we determined that, of the $7 41 million obligated to the key 

contractors, $411 million (about 55 percent) was obligated for contracts 

supporting the development of new system capabilities, $256 million 

(about 35 percent) was obligated for contracts supporting project 

management activities, and $74 million (about 10 percent) was obligated 

for contracts supporting operations and maintenance for iEHR and VistA 

Evolution. VA obligated funds to all 15 of the key contractors for system 

development, 13 of the key contractors for project management, and 12 

of the key contractors for operations and maintenance. Figure 2 shows 

the amounts obligated for each of these areas. 

Page 17 GA0-18·267T Veterans Affairs Information Technology 
25 


KING-6430 with DISTILLERInsert offset folio 59 here 30246.020

Figure 2: Amounts of Funding Obligated to the 15 Key Contractors for iEHR and 

VistA Evolution Development, Project Management, and Operations and 

Maintenance from 2011 through 2016 

Operations and 

Maintenance 

Project 

Management 

Further, based on the key contractors' documentation, for the iEHR 

program, VA obligated $102 million for development, $65 million for 

project management, and $10 million for operations and maintenance. 

For the VistA Evolution Program, VA obligated $309 million for 

development, $191 million for project management, and $64 million for 

operations and maintenance. Figure 3 shows the amounts obligated for 

contracts on the VistA Evolution and iEHR programs for development, 

project management, and operations and maintenance. 

Page 18 GA0-18-2S7T Veterans Affairs Information Technology 
26 


KING-6430 with DISTILLERInsert offset folio 60 here 30246.021

Figure 3: Amounts of Funding Obligated to Key Contractors Supporting the VistA 

Evolution and iEHR Programs for Development, Project Management, and 

Operations and Maintenance for 2011~2016 

Dollars ob!igatecd (in millions) 

350 

300 

250 

200 

150 

100 

50 

Development Project Management Operations and Ma!ntMance 

mtegrated Electronic Health Record 

i GA0·18-2\37T 

In addition. table 2 shows the amounts that each of the 15 key contractors 

were obligated for the three types of contract activities performed on 

iEHR and VistA Evolution. 

Page 19 GA0-18-2S7T Veterans Affairs Information Technology 
27 


KING-6430 with DISTILLERInsert offset folio 61 here 30246.022

Table 2: Key Contractors and the Amounts the Department of Veterans Affairs (VA) 

Obligated to Contracts Supporting iEHR and VistA Evolution for Development, 

Project Management, and Operations and Maintenance During 2011-2016 

VistA 

Key contractor Modernization 

name effort Types of expected contractor activities 

Project Operations and 

Development management maintenance 

ASM Research iEHR $18.1 $0 $0 

VistA Evolution 142.9 0.2 1.4 

Systems Made iEHR 2.9 2.9 3.7 

Simple, Inc. 

V1stA Evolution 10.2 59.4 13.0 

HP Enterprise iEHR 14.8 7.1 2.3 

Services, LLC 

VistA Evolution 37.4 15.5 4.7 

Harris iEHR 32.4 4.5 2.4 

Corporation 

VistA Evolution 27.0 .1 6.9 

Technatomy iEHR 0 18.4 0 

Corporation 

VistA Evolution 17.2 17.1 12.4 

BoozA!!en iEHR 3.1 4.7 0 

Hamilton, Inc. 

VistA Evolution 26.3 24.5 0.8 

The MITRE iEHR 0.6 5.6 0 

Corporation 

VistA Evolution 5.4 30.2 

SSG iEHR 6.3 Technology 

Solutions 

VistA Evolution 1.1 23.7 

LongView iEHR 5.6 4.5 1.7 International 

Technology 

Solutions, Inc. 

VistA Evolution 7.2 5.3 3.3 

By Light iEHR 4.4 0 0 

Professional IT 

Services, LLC 

VistA Evolution 12.0 2.4 6.9 

Page 20 GA0-18-267T Veterans Affairs Information Technology 
28 


KING-6430 with DISTILLERInsert offset folio 62 here 30246.023

VistA 

Key contractor Modernization 

name effort Types of expected contractor activities 

Project Operations and 

Development management maintenance 

Business iEHR 2.5 7.9 

Information 

Technology 

Solutions, Inc. 

VistA Evolution 2.0 11.9 

Systems iEHR 22 0.6 0.2 

Research and 

Applications 

Corporation 

VistA Evolution 14.0 1.0 0.3 

Gerner iEHR 3.8 22 0.3 

Corporation 

VistA Evolution 7.1 

CACI iEHR 6.3 0 

International, 

Inc. 

VistA Evolution 4.0 .4 

Open Source iEHR 4.9 0 

Electronic 

Health Record 

Agent, Inc. 

VistA Evolution 0 4.6 

Totals for 410.6 255.9 74.4 

15 key 

contractors 

Source GAO analysis of VA contract data on iEHR and V!stA Evolution I GA0-1B·267T 

Page 21 GA0·18~267T Veterans Affairs Information Technology 
29 


KING-6430 with DISTILLERInsert offset folio 63 here 30246.024

VA Is in the Process of 

Developing Plans for Its 

Latest VistA Modernization 

Initiative 

Industry best practices and IT project management principles stress the 

importance of sound planning for system modernization projects. 29 These 

plans should identify key aspects of a project, such as the scope, 

responsible organizations, costs, schedules, and risks. Additionally, 

planning should begin early in the project's lifecycle and be updated as 

the project progresses. 

Since the VA Secretary announced that the department would acquire the 

same electronic health record system as DOD, VA has begun planning 

for the transition from VistA Evolution to EHRM. However, the department 

is still early in its efforts, pending the contract award. In this regard, the 

department has begun developing plans that are intended to guide the 

new EHRM program. For example, the department has developed a 

preliminary description of the organizations that are to be responsible for 

governing the EHRM program. Further, the VA Secretary announced in 

congressional testimony in November 2017, a key reporting responsibility 

for the program-stating that the Executive Director for the Electronic 

Health Records Modernization System will report directly to the 

department's Deputy Secretary. In addition, the department has 

developed a preliminary timeline for deploying its new electronic health 

record system to VA's medical facilities, and a 90-day schedule that 

depicts key program activities. The department also has begun 

documenting the EHRM program risks. 

Beyond the aforementioned planning activities undertaken thus far, the 

Executive Director stated that the department intends to complete a full 

suite of planning and acquisition management documents to guide the 

program, including a life cycle cost estimate and an integrated master 

schedule to establish key milestones over the life of the project. To this 

end, the Executive Director told us that VA has awarded two program 

management contracts to support the development of these plans to 

MITRE Corporation and Booz Allen Hamilton. 

for example, Institute of Electrical and Electronics Engineers, IEEE!EIA Guide for 

Technology, IEEE/EIA 12207.1-1997 (April1998); OMB, Management of 

Federal Information Resources, Circular No. A~130 (Washington, D.C .. Nov. 28, 2000); 

GAO, Cost Estimating and Assessment Guide: Best Practices for Developing and 

Managing Capital Program Costs, GA0-09-3SP (Washington, D.C.: March 2009); GAO, 

Schedule Assessment Guide: Best Practices tor Project Schedules-Exposure Draft, 

GA0-12-1200 (Washington, D.C.: May 2012). 

Page 22 GA0..18~267T Veterans Affairs Information Technology 
30 


KING-6430 with DISTILLERInsert offset folio 64 here 30246.025

According to the Executive Director, VA also has begun reviewing the 

VistA Evolution Roadmap, which is the key plan that the department has 

used to guide VistA Evolution since 2014. This review is expected to 

result in an updated plan that is to prioritize any remaining VistA 

enhancements needed to support the transition from VistA Evolution to 

the new system. According to the Executive Director, the department 

intends to complete the development of its plans for EHRM within 90 days 

after award of the Gerner contract, which is anticipated to occur in 

December 2017. 

Further, beyond the development of plans, VA has begun to staff an 

organizational structure for the modernization initiative, with the Under 

Secretary of Health and the Assistant Secretary for Information and 

Technology (VA's Chief Information Officer) designated as executive 

sponsors. It has also appointed a Chief Technology Officer from OI&T, 

and a Chief Medical Officer from VHA, both of whom are to report to the 

Executive Director. 

VA's efforts to develop plans for EHRM and to staff an organization to 

manage the program encompass key aspects of project planning that are 

important to ensuring effective management of the department's latest 

modernization initiative. However, the department remains early in its 

modernization planning efforts, many of which are dependent on the 

system acquisition contract award, which has not yet occurred. The 

department's continued dedication to completing and effectively executing 

the planning activities that it has identified will be essential to helping 

minimize program risks and guide this latest electronic health record 

modernization initiative to a successful outcome-one which VA, for 

almost two decades, has yet to achieve. 

Page 23 GA0-18-267T Veterans Affairs Information Technology 
31 


KING-6430 with DISTILLERInsert offset folio 65 here 30246.026

Vl\s Progress toward 

Consolidating and 

Optimizing Data 

Centers and 

Addressing Other Key 

FITARA-Related Area 

Falls Short of 

Performance Targets 

Beyond managing its system modernization efforts, such as VistA, VA 

has to ensure the effective implementation of the IT acquisition 

requirements called for in FITARA Pursuant to FITARA, in August 2016, 

the Federal CIO issued a memorandum that announced the Data Center 

Optimization Initiative (DCOI). 30 According to OMB, this new initiative 

supersedes and builds on the results of FDCCI, and is also intended to 

improve the performance of federal data centers in areas such as facility 

utilization and power usage. 

Among other things, DCOI requires 24 federal departments and agencies, 

including VA, to develop plans and report on strategies (referred to as 

DCOI strategic plans) to consolidate inefficient infrastructure, optimize 

existing facilities, improve security posture, and achieve costs savings. 31 

Further, the memorandum establishes a set of five data center 

optimization metrics and performance targets intended to measure 

agency's progress in the areas of (1) server utilization and automated 

monitoring, (2) energy metering, (3) power usage effectiveness, (4) facility 

utilization, and (5) virtualization. 32 The guidance also indicates that OMB 

is to maintain a public dashboard that will display consolidation-related 

costs savings and optimization performance information for the agencies. 

However, in a series of reports that we issued from July 2011 through 

August 2017, 33 we noted that, while data center consolidation could 

potentially save the federal government billions of dollars, weaknesses 

existed in several areas, including agencies' data center consolidation 

300MB. Data Center Optimization Initiative (DCOI), Memorandum M~16-19 (Washington, 

D.C.: Aug. 1, 2016). 

31 The 24 agencies that FITARA requires to participate in DCOI are the Departments of 

Agriculture, Commerce. Defense, Education, Energy, Health and Human Services, 

Homeland Security, Housing and Urban Development, the Interior, Justice, Labor, State, 

Transportation, the Treasury, and Veterans Affairs; the Environmental Protection Agency; 

General Services Administration; National Aeronautics and Space Administration; National 

Science Foundation: Nuclear Regulatory Commission; Office of Personnel Management; 

Small Business Administration; Social Security Administration; and U.S. Agency for 

International Development. 

320MB guidance established targets for agencies to reduce annual data center costs by at 

least 25 percent by the end of fiscal year 2018. Virtua!ization is a technology that allows 

multiple software-based machines with different operating systems, to run in isolation, 

side-by-side, on the same physical machine. 

33GA0-17-448, GA0-17-388, GA0-16-323, GA0-14-713. GA0-13-378, GA0-12-742, and 

GA0-11-565. 

Page 24 GA0~18-267T Veterans Affairs Information Technology 
32 


KING-6430 with DISTILLERInsert offset folio 66 here 30246.027

plans, data center optimization, and OMB's tracking and reporting on 

related cost savings. Further, we previously reported that VA's progress 

toward closing data centers, and realizing the associated cost savings, 

lagged behind that of other covered agencies. 34 

More recently, VA reported a total inventory of 415 data centers, of which 

39 had been closed as of August 2017. 35 While the department 

anticipates another 10 data centers will be closed by the end of fiscal year 

2018, these closures fall short of the targets set by OMB. Specifically, 

even if VA meets all of its planned targets for closure, it will only close 

about 9 percent of its tiered data centers and about 18.7 percent of its 

non-tiered data centers by the end of fiscal year 2018, which is short of 

the respective 25 and 60 percent targets set by OMB. 36 Further, while VA 

has reported $23.61 million in data center-related cost savings and 

avoidances for 2012through August2017, the department does not 

expect to realize further savings from the additional 10 data center 

closures in the next year. 

In addition, in August2017 we reported that agencies needed to address 

challenges in optimizing their data centers in order to achieve cost 

savings. 37 Specifically, we noted that, according to the 24 agencies' data 

center consolidation initiative strategic plans as of April2017, most 

agencies were not planning to meet OMB's optimization targets by the 

end offiscal year 2018. 

As of February 2017, VA reported meeting one of the five data center 

optimization metrics related to power usage effectiveness. Also, the 

department's data center optimization strategic plan indicates that the 

department plans to meet three of the five metrics by the end of fiscal 

year 2018. Further, while OMB directed agencies to replace manual 

35VA reported this data in its August 2017 inventory update to OMS. 

360MB's guidance directed agencies to categorize their data centers as either a tiered 

data center or a non-tiered data center. The guidance also directed agencies to close at 

least 25 percent of tiered data centers and at least 60 percent of non-tiered data centers 

by the end of fiscal year 2018, OMB guidance defines a tiered data center as one that 

uses each of the following: a separate physical space for IT infrastructure, an 

uninterruptible power supply, a dedicated cooling system or zone, and a backup power 

generator for a prolonged power outage. According to OMB, all other data centers shall be 

considered nonwtiered. 

37GA0-17-448. 

Page 25 GA0~18w267T Veterans Affairs Information Technology 
33 


KING-6430 with DISTILLERInsert offset folio 67 here 30246.028

Adequate Incremental 

Development for Its Major 

IT Investments for Fiscal 

Year2017, but Needs to 

Update Related Policy 

collection and reporting of metrics with automated tools no later than 

fiscal year 2018, VA had only implemented automated tools at 6 percent 

of its data centers. 

OMB has emphasized the need to deliver investments in smaller parts, or 

increments, in order to reduce risk, deliver capabilities more quickly, and 

facilitate the adoption of emerging technologies. In 2010, it called for 

agencies' major investments to deliver functionality every 12 months and, 

since 2012, every 6 months. Subsequently, FITARA codified a 

requirement that agency CIOs certify that IT investments are adequately 

implementing incremental development, as defined in the capital planning 

guidance issued by OMB. 38 Later OMB guidance on the law's 

implementation-issued in June 2015-directed agency CIOs to define 

processes and policies for their agencies which ensure that they certify 

that IT resources are adequately implementing incremental 

development. 39 

Between May 2014 and November 2017, we reported on agencies' efforts 

to utilize incremental development practices for selected major 

investments40 In November 2017, we noted that agencies reported that 

62 percent of major IT software development investments were certified 

by the agency CIO as using adequate incremental development in fiscal 

year 2017, as required by FITARA. VA's CIO certified the use of 

adequate incremental development for all 10 of its major IT investments. 

However, VA had not yet updated the department's policy and process for 

the CIO's certification of major IT investments' adequate use of 

incremental development, in accordance with OMS's guidance on the 

implementation of FITARA as we recommended. The department stated 

that it plans to address our recommendation to establish a policy and that 

the policy is targeted for completion in 2017. 

U.S.C. § 11319(b)(1)(B)(ii). 

390MB, Memorandum M~15-14. 

40GAO, Information Technology Reform: Agencies Need to Improve Cerlification of 

Incremental Development, GA0-18-148 (Washington, D.C.: Nov. 7, 2017); GA0-16-469; 

and Information Technology: Agencies Need to Establish and Implement Incremental 

Development Policies, GA0-14-361 (Washington. D.C .. May 1, 2014). 

Page 26 GA0·18-267T Veterans Affairs Information Technology 
34 


KING-6430 with DISTILLERInsert offset folio 68 here 30246.029

VA Has Made Progress in 

Developing and Using a 

Comprehensive Inventory 

of Software Licenses 

Federal agencies engage in thousands of licensing agreements annually. 

Effective management of software licenses can help organizations avoid 

purchasing too many licenses that result in unused software. In addition, 

effective management can help avoid purchasing too few licenses, which 

results in noncompliance with license terms and causes the imposition of 

additional fees. Federal agencies are responsible for managing their IT 

investment portfolios, including the risks from their major information 

system initiatives, in order to maximize the value of these investments to 

the agency. 

OMB developed a policy that requires agencies to conduct an annual, 

agency-wide IT portfolio review to, among other things, reduce 

commodity IT spending. Such areas of spending could include software 

licenses. We previously identified seven elements that a comprehensive 

software licensing policy should address: 41 

identify clear roles, responsibilities, and central oversight authority 

within the department for managing enterprise software license 

agreements and commercial software licenses; 

establish a comprehensive inventory (at least 80 percent of software 

license spending and/or enterprise licenses in the department) by 

identifying and collecting information about software license 

agreements using automated discovery and inventory tools; 

regularly track and maintain software licenses to assist the agency in 

implementing decisions throughout the software license management 

life cycle; 

analyze software usage and other data to make cost-effective 

decisions; 

provide training relevant to software license management; 

establish goals and objectives of the software license management 

program; and 

consider the software license management life-cycle phases (i.e., 

requisition, reception, deployment and maintenance, retirement, and 

disposal phases) to implement effective decision making and 

incorporate existing standards, processes, and metrics. 

41 GAO, Federal Software Licenses: Better Management Needed to Achieve Stgnificant 

Savings Government-Wide, GA0-14-413 (Washington, D.C. May 22, 2014). 

Page 27 GA0~18~267T Veterans Affairs Information Technology 
35 


KING-6430 with DISTILLERInsert offset folio 69 here 30246.030

We previously made recommendations to VA to (1) develop an agencywide comprehensive policy for the management of software licenses that 

includes guidance for using analysis to better inform investment decision 

making, (2) employ a centralized software license management approach 

that is coordinated and integrated with key personnel, (3) establish a 

comprehensive inventory of software licenses using automated tools, (4) 

track and maintain a comprehensive inventory of software licenses using 

automated tools and metrics, (5) analyze agency-wide software license 

data to identify opportunities to reduce costs and better inform investment 

decision making, and (6) provide software license management training to 

appropriate personnel. 42 

Consistent with our recommendation, in July 2015, VA issued a 

comprehensive software licensing policy that addressed weaknesses we 

previously identified. The department also issued a directive that 

documents VA's software license management policy and responsibilities 

for central management of agency-wide software licenses, consistent with 

our recommendations. By implementing our recommendations, VA should 

be better positioned to consistently and cost-effectively manage software 

throughout the agency. 

In August 2017, the department also provided documentation showing 

that it had generated a comprehensive inventory of software licenses 

using automated tools for the majority of agency software license 

spending or enterprise-wide licenses. This inventory can serve to reduce 

redundant applications and help identify other cost saving opportunities. 

Further, the department implemented a solution to analyze agency-wide 

software license data, including usage and costs. This solution should 

allow VA to identify cost saving opportunities and inform future investment 

decisions. In addition, the department has provided information indicating 

that appropriate personnel receive software license management training. 

In conclusion, VA has made extensive use of numerous contractors and 

has obligated more than $1 billion for contracts that supported two of four 

VistA modernization programs that the department has initiated. VA has 

recently begun the fourth modernization program in which it plans to 

replace VistA with the same commercially available electronic health 

42GA0-14-413. 

Page 28 GA0..18·267T Veterans Affairs Information Technology 
36 


KING-6430 with DISTILLERInsert offset folio 70 here 30246.031

GAO Contact and 

Staff 

Acknowledgments 

(102334) 

record system that is used by DOD. However, the department's latest 

modernization effort is in the early stages of planning and is dependent 

on the system acquisition contract award in December 2017. VA's 

completion and effective execution of plans will be essential to guiding 

this latest electronic health record modernization initiative to a successful 

outcome. 

Beyond VistA, the department continues to make progress on key 

FITARA-related initiatives. Although the department has made progress 

in the area of software licensing, additional actions in the areas of data 

center consolidation and optimization, as well as incremental system 

development can better position VA to effectively manage its IT. We plan 

to continue to monitor the department's progress on these important 

activities. 

Chairman Hurd, Ranking Member Kelly, and Members of the 

Subcommittee, this completes my prepared statement. I would be 

pleased to respond to any questions that you may have. 

If you or your staffs have any questions about this testimony, please 

contact David A. Pawner at (202) 512-9286 or pownerd@gao.gov. 

Contact points for our Offices of Congressional Relations and Public 

Affairs may be found on the last page of this testimony statement. GAO 

staff who made key contributions to this statement are Mark Bird 

(Assistant Director), Jacqueline Mai (Analyst in Charge), Justin Booth, 

Chris Businsky, Rebecca Eyler, Paris Hawkins, Valerie Hopkins, Brandon 

S. Pettis, Jennifer Stavros-Turner, Eric Trout, Christy Tyson, Eric Winter, 

and Charles Youman. 

Page 29 GA0*18~267T Veterans Affairs Information Technology 
37 


KING-6430 with DISTILLERInsert offset folio 71 here 30246.032

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this materia! separately. 
38 


KING-6430 with DISTILLERInsert offset folio 72 here 30246.033

GAO's Mission 

Obtaining Copies of 

GAO Reports and 

Testimony 

Order by Phone 

Connect with GAO 

To Report Fraud, 

Waste, and Abuse in 

Federal Programs 

Congressional 

Relations 

Public Affairs 

Strategic Planning and 

External Liaison 

The Government Accountability Office, the audit, evaluation, and investigative 

arm of Congress, exists to support Congress in meeting its constitutional 

responsibilities and to help improve the performance and accountability of the 

federal government for the American people. GAO examines the use of public 

funds; evaluates federal programs and policies; and provides analyses, 

recommendations, and other assistance to help Congress make informed 

oversight, policy, and funding decisions. GAO's commitment to good government 

is reflected in its core values of accountability, integrity, and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no cost is 

through GAO's website (http://www.gao.gov). Each weekday afternoon, GAO 

posts on its website newly released reports, testimony, and correspondence. To 

have GAO e-mail you a list of newly posted products, go to http://www.gao.gov 

and select "E-mail Updates." 

The price of each GAO publication reflects GAO's actual cost of production and 

distribution and depends on the number of pages in the publication and whether 

the publication is printed in color or black and white. Pricing and ordering 

information is posted on GAO's website, http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card, MasterCard, 

Visa, check, or money order. Call for additional information. 

Connect with GAO on Facebook, Flickr, Linkedln, Twitter, and YouTube. 

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts. 

Visit GAO on the web at www gao.gov and read The Watchblog. 

Contact: 

Website: http://www.gao.gov/fraudnetlfraudnet.htm 

E-mail: fraudnet@gao.gov 

Automated answering system: (800) 424-5454 or (202) 512-7470 

Orice Williams Brown, Managing Director, WilliamsO@gao.gov, (202) 512-4400, 

U.S. Government Accountability Office, 441 G Street NW, Room 7125, 

Washington, DC 20548 

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800 

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548 

James-Christian Blackwood, Managing Director, spel@gao.gov, (202) 512-4707 

U.S. Government Accountability Office, 441 G Street NW, Room 7814, 

Washington, DC 20548 

•!: Please Print on Recycled Paper, 
39 

Mr. HURD. Thank you, sir. 

Mr. Blackburn, I have been advised you are going to speak for 

the entire VA team. You are now recognized for five minutes. Welcome. 

STATEMENT OF SCOTT BLACKBURN 

Mr. BLACKBURN. Will do. Chairman Hurd, Ranking Member 

Kelly, members of the subcommittee, thank you very much for the 

opportunity to discuss OIT transformation with an emphasis on IT 

modernization, cybersecurity, FISMA and FITARA compliance, and 

the electronic health record management initiative. 

I’m accompanied by Mr. James, Mr. Cussatt, and Mr. Windom, 

and then also available to answer questions behind me as Mr. John 

Short, executive director of Information Technology Systems Modernization. 

Also, thank you all for the opportunity to meet with you one-onone. The feedback we received was very positive, very constructive, 

and we really appreciate that. We especially appreciate your interest to help ensure we get the electronic health record modernization effort off on the right foot, along with other pressing VA matters. 

VA is in the midst of a turnaround. Trust was broken in 2014, 

and helping re-earn that trust is why I left the private sector to 

join the VA in November of 2014. This is personal to me as a disabled veteran and as one of five siblings who are all either veterans 

or still serving today in uniform. 

Our first quarterly survey to measure veteran trust two years 

ago revealed that only 47 percent of veterans said that they trusted 

the VA to fulfill our country’s commitment to veterans. Today, that 

number is 69 percent with an uptick in each of the last seven quarters. OIT has played a major role in that improvement. And while 

69 percent is great compared to where we started, that still means 

that 31 percent of veterans do not trust VA, which means we still 

have a long way to go, and OIT will play an even more important 

role closing that gap. 

We have a comprehensive IT modernization plan, which is the 

foundation for reducing reliance on the VA legacy systems. We will 

leverage modern technology such as telehealth, cloud, robotics, machine learning, mobile, digital services, and blockchain. We will 

stop or migrate 240 of our 299 current projects and leverage a buyfirst strategy, getting us out of the software development business 

and ensuring we are positioned to manage the influx of new technologies and innovations. 

I’d like to highlight four areas which align with the Secretary’s 

priorities. Number one, the selection of the new electronic health 

record is a major step for VA. A veteran will have one single longitudinal lifetime medical record. That means a single common system from the time of enlistment or commission throughout their 

service and the remainder of their life as a veteran. We realize implementing Cerner Millennium across the country’s largest integrated healthcare system will not be easy, but we strongly believe 

it is the right thing to do. Our new electronic health records system 

will enable VA to keep pace with the improvements in health IT 

and cybersecurity, which the current system VistA is unable to do. 


KING-6430 with DISTILLER
40 

Continuing to maintain VistA is costly. Transition solutions for 

nearly all VistA modules have been identified with the majority to 

be replaced by the Cerner solution. 

Number two, modernizing our scheduling systems is something 

I am extremely passionate about as a veteran who’s received treatment at the Washington, D.C., VA Medical Center. This is an area 

where we have made improvements, but much more must be done. 

Number three, another OIT commitment is modernizing the legacy COBOL-based financial management system to standardize 

and improve accounting and acquisition services. 

And number four involves our benefits delivery network, BDN, 

and modernizing BDN will ensure that VBA-wide—that’s our benefits administration—wide monthly payment and processing of 4 

million checks remains feasible and that veterans receive benefits 

quickly. 

Additionally, VA cybersecurity program enables data protection 

in the face of threats and is committed to safeguarding veteran information. We have recently achieved various program capability 

and policy milestones to advance cybersecurity to include just a few 

hours ago receiving from the Federal CIO this memo closing 11 

open cyber stat activities with OMB. 

VA received a B-plus grade from your FITARA scorecard, and 

while we are proud of that score, we acknowledge that our data 

center consolidation, as Mr. Powner noted, is nowhere near where 

it needs to be, and we are working to fix it. The establishment of 

an OIT-based strategic sourcing division will ensure FITARA compliance for all IT acquisitions. 

Thank you again, Chairman and Ranking Member, for the opportunity to discuss OIT’s transformation efforts. As a note, if there 

are any questions that are acquisitions-sensitive to our EHR efforts, we will not be able to discuss those in a public session, but 

we can provide those—that information to you in a closed session 

at a later date. 

Ensuring a safe and secure environment for veteran information 

and improving their experiences our goal. I look forward to your 

questions. 

[Prepared statement of Mr. Blackburn follows:] 


KING-6430 with DISTILLER
41 


KING-6430 with DISTILLERInsert offset folio 73 here 30246.034

AMENDED PASSBACK 

STATEMENT OF 

MR. SCOTT BLACKBURN 

EXECUTIVE IN CHARGE FOR INFORMATION AND TECHNOLOGY 

OFFICE OF INFORMATION AND TECHNOLOGY 

DEPARTMENT OF VETERANS AFFAIRS (VA) 

BEFORE THE 

SUBCOMMITTEE ON INFORMATION TECHNOLOGY 

COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM 

U.S. HOUSE OF REPRESENTATIVES 

December 7, 2017 

Good morning, Chairman Hurd, Ranking Member Kelly, and Distinguished 

Members of the Subcommittee. Thank you for providing me with this opportunity to 

discuss the progress that the Department of Veterans Affairs (VA) Office of Information 

and Technology (OIT) is making towards its transformation efforts with an emphasis on 

Information Technology (IT) modernization; Enterprise Cybersecurity Strategy; Federal 

Information Security Modernization Act (FISMA), and Federal Information Technology 

Acquisition Reform Act (FITARA) compliance; and the Electronic Health Record 

Modernization (EHRM) initiative. I am pleased to be accompanied today by Mr. Bill 

James, Deputy Assistant Secretary for the Enterprise Program Management Office 

(EPMO), Mr. Dominic Cussatt, Chief Information Security Officer, Mr. John Short, 

Executive Director for Information Technology Systems Modernization, and Mr. John 

Windom, Program Executive for Electronic Health Record Modernization. 

The health, safety, and welfare of our Veterans are among our highest national 

priorities. As one of five siblings who are Veterans or still serving in uniform and who 

are all at least fourth generation U.S. military Veterans, I take personal pride every day 

in fulfilling VA's sacred mission, which was passed down to us by President Abraham 

Lincoln more than 150 years ago, to care for those who "have borne the battle" and for 

their families and survivors. VA, and OIT, is in the middle of a turnaround. Trust was 

broken in 2014; helping re-earn that trust is why I left the private sector to join VA in 

November 2014. When we started a quarterly survey to measure Veteran trust of VA 2 

years ago, only 47 percent of Veterans said they trust VA to fulfill our Nation's 
42 


KING-6430 with DISTILLERInsert offset folio 74 here 30246.035

commitment to Veterans. Today, that number is 69 percent, and we have seen an 

uptick in each of the last seven quarters. OIT has played a major role in that 

improvement and will only play an even more important role as we continue to 

modernize and regain the trust of all Veterans. We are proud of our progress, but we 

clearly still have a lot of work to do. 

This is not the first time OIT leadership has appeared before the Subcommittee. 

On March 16, 2016, my predecessor, Ms. LaVerne Council, discussed the progress OIT 

was making to better serve our business partners, our Veterans, and examined VA's 

implementation of FISMA and FIT ARA, as well as specific information technology (IT) 

investments. My testimony will build on this, covering a number of the subject areas 

raised previously and will provide you with a glimpse into the significant progress we 

have made since that time. 

IT MODERNIZATION 

Our comprehensive IT Plan is the foundation for reducing our reliance on legacy 

systems and creating new capabilities for a modern VA by leveraging cloud, digital 

platforms, while incorporating other modern and innovative technologies like expanded 

telehealth, robotics, artificial Intelligence, mobile devices, machine learning, Blockchain, 

and digital services to increase access, engagement, and interoperability. Through this 

plan, we will stop or migrate 240 of our 299 projects and leverage a buy-first strategygetting us out of the software development business and ensuring we are positioned to 

manage the influx of new technologies. In OIT, we are committed to the following 

efforts, which align with the Secretary's initiatives to provide greater choice and 

transparency for Veterans, modernize systems, focus resources more effective and 

efficiently, improve timeliness of services, and prevent Veteran suicides. 

First and foremost is our Electronic Health Record (EHR) Modernization effort, 

which is a major White House initiative, and has received a fair amount of media and 

Congressional interest. In arriving at his decision on our Next-Generation EHR for VA, 

the Secretary reviewed numerous studies, reports, and commissions on this topic, 

2 
43 


KING-6430 with DISTILLERInsert offset folio 75 here 30246.036

including the recent Commission on Care report. He also spent considerable time 

talking to clinicians and consulting with Chief Executive Officers from leading health 

systems to solicit their own thoughts. 

This led the Secretary to announce that VA will begin to work toward a single 

common solution by adopting a new EHR system, using the same state-of-the-art 

solution currently being deployed by the Department of Defense (DoD). The selection 

of a new EHR strategy is a major step forward for VA and is a critical component of our 

strategic commitments. We hope to very soon finalize and sign a contract with Gerner 

Corporation to begin this work with our first pilot sites located in Washington State, 

leveraging the work and lessons learned from DoD and Gerner. With regard to the 

standardization of VistA over the past 18 months, the clinically validated data extraction 

work was conducted by the BISL COW team, and the data migration planning started in 

August 2016. These efforts will help make the Gerner rollout in 18 months more 

successful. 

As we proceed in a thoughtful and deliberate manner, our teams will incorporate 

critical lessons and experiences learned from the visionaries and users of our legacy 

VistA system and DoD's lessons learned from deploying the same Gerner solution to 

contribute to building the most advanced, integrated EHR in the Nation. This path 

forward will make a big difference for Veterans everywhere and will provide VA 

clinicians modern tools to deliver the seamless care Veterans deserve. Having an EHR 

that can follow our Veterans during their health and treatment is one of the most 

important things we can do to ensure their safety, health, and general well-being. The 

adoption of the same system between VA and DoD will allow for all patient data to 

reside in a common system, so there will be a seamless link between the Departments 

without the manual or electronic exchange of information. A Veteran will now be able to 

have a single common system from the time of enlistment or commission throughout 

their life, with one single lifetime record. There will never be a need to go back and forth 

between Departments and say, "records are not there for me", or "my doctor is not able 

to have input into what the DoD is doing." This is because VA and DoD's interoperable 

3 
44 


KING-6430 with DISTILLERInsert offset folio 76 here 30246.037

EHR system is based on a single instance and database, so all DoD records will be 

available to VA as soon as they are available to DoD. 

Today, VA and DoD share more medical information than any two health care 

organizations in the country. We have developed and deployed, in close collaboration 

with DoD, the Joint Legacy Viewer (JLV) to enable this data sharing capability. TheJLV 

is available to all clinicians in every VA facility and is a web-based user interface that 

provides clinicians with an intuitive display of DoD and VA health care data on a single 

screen. As of November 1, 2017, the latest data identified 89,623 DoD and 332,586 VA 

users. Between May 2013 and October 2017, almost 8 million medical records have 

been viewed through JLV. The outcomes of VA and DoD joint development on JLV is a 

clear demonstration of the business outcomes the two agencies can deliver through 

deep collaboration and integration. While JLV is very valuable, the proposed new EHR 

will add and improve the capabilities we have today in JLV. This will allow VA and DoD 

to build on the success of JLV by having a single instance of a Veterans record. 

A second commitment involves modernizing the Benefits Delivery Network 

(BDN). A 50-plus year old COBOL-based legacy system, BDN is the primary database 

and payment system for VA's education benefit programs and is something that 

supports Veterans every day. Modernizing the BDN will ensure that Veterans Benefits 

Administration (VBA)-wide financial payment and processing of 4 million checks each 

month remains feasible and those Veterans continue to receive the benefits they have 

earned in a timely manner. BDN has generally had a successful payment history for 

over 40 years. 

A third commitment is our continuing effort to Improve Enterprise Cybersecurity. 

VA's Enterprise Cybersecurity Strategy will ensure that Veteran data is secure, 

available, and safe from cyber threats. Safeguarding Veteran information and VA data 

is essential to providing quality health care, benefits, and services to our Nation's 

Veterans. More specific details associated with our Enterprise Cybersecurity Strategy 

can be found later in this testimony. 

4 
45 


KING-6430 with DISTILLERInsert offset folio 77 here 30246.038

Our fourth commitment extends to modernizing the Department's scheduling 

systems- which as a patient who receives treatment at the Washington DC VA Medical 

Center, Orange Clinic - is something I am very passionate about. This is an area where 

we have made improvements but still have a long way to go. We now have VistA 

Scheduling Enhancement (VSE) upgrades fully implemented in 130 of 158 sites, 

improving the interface for the schedulers so they easily view appointment times and 

reduce scheduling errors. Just in the past month, we have seen online scheduling 

increase 5 times due to recent improvements (4,541 appointments scheduled online 

between 11/09/17-11/30/17);this capability is currently in place at more than 100 sites. 

Medical Appointment Scheduling System (MASS) in being piloted in Columbus, Ohio; 

and the Faster Care for Veterans Act test installs have been successfully completed in 

Minneapolis, Minnesota; Salt Lake City, Utah; and Bedford, Massachusetts. As Gerner 

deploys to each site, it will be converted to Gerner's resource based Scheduling 

System. Earlier this year, the Secretary launched a new access and quality tool known 

as "Access to Care." This web-based site was developed for Veterans and their 

families to see in real-time the wait times at local VA facilities and VA hospital ratings in 

comparison with private hospitals in their area. This information empowers Veterans to 

choose the time and place they receive their care. Not only will this web-site take in and 

process complex data, but it will make these data transparent to Veterans. We will 

continue improving transparency via the Access to Care site as we receive feedback 

from Veterans, employees, Veterans Service Organizations, and Congress. 

In addition to scheduling software, we are making strides with our technology and 

business partners. We completed a proof of concept for the Digital Health Platform, 

now called the Digital Veteran Platform, or DVP, marking an entirely new approach to 

health care. DVP is a revolutionary concept in health care information technology 

management that enables interoperability among systems much more efficiently than 

traditional system integration efforts. DVP will allow commercial application developers 

to create solutions that connect internal and external care providers to support 

comprehensive seamless Veteran care across organizational boundaries and clinical 

5 
46 


KING-6430 with DISTILLERInsert offset folio 78 here 30246.039

systems. Further, DVP will create an open, accessible platform that can be used not 

only for Veterans' care, but also for advanced knowledge sharing, clinical decision 

support, technical expertise and process interoperability with organizations through the 

US care delivery system by simplifying access to the largest data set of clinical data 

anywhere. This will accelerate the discovery and development of new clinical pathways 

for the benefit of the Veterans and community at large. 

Another significant OIT commitment is modernizing the legacy Financial 

Management System to standardize and improve accounting and acquisition activities 

across the VA enterprise. VA has a clear and urgent need to address multiple legacy 

platforms used today in our finance and accounting mission critical functions. We are 

working to adopt and implement a commercial, cloud-hosted, integrated financial and 

acquisitions system. This transformation effort will increase the transparency, accuracy, 

timeliness, and reliability of financial information. The result will be improved fiscal 

accountability to American taxpayers and improved care and services to our Veterans. 

ENTERPRISE CYBERSECURITY STRATEGY (ECSS) 

VA, our core constituents, and our external partners are subject to a wide variety 

of cyber threats. Given the high degree of connectivity, interdependence, and reliance 

on integrated open platform technology, meeting cybersecurity challenges requires 

strategic attention and collaboration across the VA ecosystem. The purpose of the 

Enterprise Cyber Security Strategy, also known as ECSS, is to guide agency-wide 

cybersecurity planning and risk-based decision making. ECSS directs VA leadership to 

act as cybersecurity resource stewards to identify and articulate requirements, 

standards, and opportunities for transformative cybersecurity improvements. 

Within OIT, we are committed to protecting Veteran information, VA data, and 

limiting access to only those with the proper authority. This commitment requires us to 

think agency-wide about security holistically. ECSS promotes collaboration, enables 

data protection, and provides resiliency in the face of a broad spectrum of threats 

through the realization of the following five strategic cybersecurity goals: 

6 
47 


KING-6430 with DISTILLERInsert offset folio 79 here 30246.040

• Veteran Information and VA Data are Protected: Data protection is an 

essential VA function that involves people, processes, and technology. VA must 

identify its high-value assets (HVA); understand its business processes and 

system interactions so that security and privacy protections can be applied 

commensurate with risk and enhance awareness of safe information handling 

practices so that the VA workforce, Veterans, and partners are equipped to help 

protect VA data and Veteran information. 

• VA's Cyberspace Ecosystem is Resilient to Threats: VA needs to maintain 

critical functions in the face of inevitable breaches. While defense in depth 

remains essential, we as an organization must also be resilient. Implementing 

the appropriate policies, procedures, and technologies provides VA with the 

ability to maintain continuity of operations both during and after a cyber event, as 

well as evolving VA's resiliency to better adapt to advanced cyber threats. 

• VA Information Systems and Infrastructure are Protected: VA identifies and 

strengthens its mission critical systems and infrastructure, modernizes IT, and 

employs an integrated, resilient architecture. VA is also committed to leveraging 

cloud and Federal shared services. VA not only integrates cybersecurity 

protections into VA information systems and networks but also verifies that 

business associates are appropriately implementing protections within their 

systems. 

• A Secure Operational Environment Supports Effective Operations: For VA 

to operate effectively in the cybersecurity domain, a secure operational 

environment is necessary. Such an environment is realized through efficient, 

agile acquisitions that help VA keep pace with evolving cyber threats and 

technological innovations, operates transparently and, to the extent possible, 

seamlessly and is enabled by integration of information security capabilities and 

outcomes across enterprise governance, business operations, and technology 

architecture frameworks. 

• VA Recruits, Develops, and Retains a Talented Cybersecurity and Privacy 

Workforce: Strong cybersecurity capabilities require a cybersecurity workforce 

7 
48 


KING-6430 with DISTILLERInsert offset folio 80 here 30246.041

that is agile, multifunctional, dynamic, and flexible to adapt to an ever-changing 

threat environment. VA's workforce planning capability and framework provide 

VA the data it needs to make fact-based decisions on cyber and privacy 

workforce recruitment, development. and retention. 

To achieve this end, our Office of Information Security (OIS) manages 

cybersecurity risk through VA's Enterprise Cybersecurity Strategy Program, or ECSP, to 

enable VA to securely fulfill our mission and protect VA information systems. 

As part of the ECSP, VA's Enterprise Cybersecurity Strategy is being refreshed 

to include the reinforcement of VA's strategic goals and objectives that inform 

cybersecurity behaviors at VA. Our principles include, but are not limited to, patient 

safety, holistic risk management, adaptive defense and cyber resiliency, security, and 

privacy integration, shared services, and IT modernization. 

With the establishment of the ECSP, we are embarking on a change in mindset 

of how to manage cyber risk. Through the ECSP, we will make prioritized, defensible 

decisions related to the implementation of cybersecurity projects (that may be technical 

or procedure-based), align programmatic activities with the National Institute of 

Standards and Technology (NIST) Cybersecurity Framework (CSF), and create an 

integrated and transparent program across each level of the program, which includes 

Government-wide statutory requirements, VA policy and implementation guidance, 

organizational cybersecurity capabilities, mission/business processes, and the 

information system level. 

As part of our Enterprise Cybersecurity Strategy Team (ECST), we have recently 

focused on the following: 

• Plans of Action created in response to the fiscal year (FY) 2015 Office of 

Inspector General (OIG) FISMA audit. 

8 
49 


KING-6430 with DISTILLERInsert offset folio 81 here 30246.042

• Eight Strategic Domains created as a result of VA's 2015 Enterprise 

Cybersecurity Strategy following the release of the Office of Management and 

Budget (OMB) Cybersecurity Implementation Plan on October 30, 2015. 

VA's ECSP is another step forward in VA's commitment to safeguarding Veteran 

information and VA data within a complex environment. Our strategy establishes an 

ambitious yet carefully-crafted approach to cybersecurity and privacy protections that 

helps VA to execute its mission of providing quality health care, benefits, and services 

to Veterans, while delivering on our promise to keep Veteran information and VA data 

safe and secure. 

Recent 0/S Accomplishments 

Through ECST, we have been able to achieve various program, capability, and 

policy milestones on the path to further advancing the VA cybersecurity program: 

From a programmatic perspective: 

a. We have established a plan to transition from the ECST to ECSP to 

enable proactive cyber risk management through the prioritization of 

cybersecurity projects and alignment to the NIST CSF. 

b. We formally established an Information Security Continuous Monitoring 

(ISCM) Strategy, as well as an Integrated Project Team (IPT) Charter for 

management oversight, implementation, and operation of the program. 

With regard to capability milestones: 

a. We continue to develop a risk-scoring model, which is designed to 

advance VA's implementation of the NIST Risk Management Framework 

(RMF) and assist with prioritizing risk across security and privacy control 

families in support of proactive cybersecurity risk management. 

b. Since the middle of 2015, we have reduced the number of elevated 

privileged user accounts for employees and contractors by 96 percent. 

9 
50 


KING-6430 with DISTILLERInsert offset folio 82 here 30246.043

c. We have developed a new end-user driven site map and updated design 

to support adoption of the VA Knowledge Service as the single 

authoritative source of VA control policy and implementation guidance. 

d. Within the Knowledge Service, we have also developed an interactive 

Security Controls Explorer to provide OIT stakeholders (e.g., System 

Owners, Information Security Officers) with implementation guidance for 

applying the NIST RMF to VA information systems. 

e. We created a process for VA to consistently analyze planned software 

implementations against the One-VA Technical Reference Model, used as 

a technology road map and tool for supporting OIT, prior to project 

initiation. 

f. We implemented a process to annually test contingency plans and failover 

capabilities for applications and general support systems based on 

system/site categorization levels. 

g. We updated the Assessment and Authorization process by focusing on 

increasing system owner accountability for systems nearing Authority to 

Operate (ATO) expiration. 

h. We also created an organizational library of security incidents with root 

cause analyses and corrective actions for educational/response 

references for future incidents. 

With respect to revising policies and guidelines: 

a. We have developed a cloud security framework that aligns with the NIST 

CSF. 

b. We have also instituted a new firewall policy to cover new technologies in 

coordination with the Office of Cybersecurity Policy and Compliance. 

c. We have published Directive and Handbook 6513, Secure External 

Connections, which governs the process for managing and continuously 

monitoring VA connections. 

10 
51 


KING-6430 with DISTILLERInsert offset folio 83 here 30246.044

FISMA AND FITARA COMPLIANCE 

FISMA Update 

Through OIS, we currently manage a Cybersecurity Policy and Reporting 

Requirements Matrix which tracks FISMA submissions by VA. Through this matrix, we 

are able to organize and track cybersecurity policies, public laws, and NIST Special 

Publications guidance, Federal Information Processing Standards, Internal/Interagency 

Reports. The matrix also tracks VA's recurring reporting requirements that are 

submitted to Government-wide authorities such as Congress, the Department of 

Homeland Security (DHS), and OMB, and is updated when new rules, regulations, and 

recommendations are published. 

VA is able to leverage the Cybersecurity Policy and Reporting Requirements 

Matrix to follow FISMA guidelines and laws in accordance with the following: 

• OMB Memorandum M-17-05, Fiscal Year 2016-2017 Guidance on Federal 

Information Security and Privacy Management Requirements; 

• OMB Memorandum M-17-25, Reporting Guidance on the Executive Order of 

Strengthening the Cybersecurity of Federal Networks and Critical 

Infrastructure; 

• The recent Executive Order on Strengthening the Cybersecurity of Federal 

Networks and Critical Infrastructure; 

• The Federal Information Security Modernization Act, or FISMA, of 2014; 

• The E-Government Act of 2002; 

• The FY 2017 FISMA Chief Information Officer (CIO) Metrics (October 2016); 

and 

• The FY 2017 FISMA OIG Metrics (April2017). 

11 
52 


KING-6430 with DISTILLERInsert offset folio 84 here 30246.045

As of October 31, 2017, we have reported our FISMA Maturity Model responses 

to DHS, including Information Security Continuous Monitoring (!SCM), Risk 

Management, Configuration Management, Contingency Planning, Identity and Access 

Management, Incident Response, and Security Training. 

In response to the 2017 OIG FISMA Audit, OIT is currently conducting an 

analysis of the FY 2017 audit findings in order to determine the appropriate remediation 

measure to take. In addition, OIS has mapped our recent FY 2017 OIG findings to 

NIST security and privacy controls in order to identify the controls which were commonly 

aligned to findings within the audit. By this mapping exercise, OIS will be able to 

discern the controls that require more attention and prioritize future projects based on 

this information. In preparation for future audit cycles, OIS is planning to develop 

detailed control implementation guidance for high-risk controls, providing the field with 

the knowledge base they will need to successful execute controls on a day-to-day basis. 

As the control implementation guidance is developed, it will be incorporated into the VA 

RMF Knowledge Service (KS); the KS will serve as the single authoritative source of VA 

control policy and implementation guidance. 

FITARA Progress 

For the third consecutive rating period, VA received a B+ grade from the House 

Committee on Oversight and Government Reform FITARA scorecard. While we are 

pleased by our score, we are not satisfied and are seeking ways to improve upon that 

grade. Our goal is to raise the score to an "A," and we are taking steps to achieve this 

milestone. One of those steps is the establishment of an OIT -based Strategic Sourcing 

division to ensure FIT ARA compliance for all IT acquisitions. Strategic Sourcing 

practices will improve speed to market, compliance and quality for IT solutions, provide 

VA with access to industry innovation, and empower employees who have the deepest 

understanding of the work to deliver the best solution, at the best value, to the Veteran. 

The IT Operations and Services (ITOPS) division within OIT supported 

acquisition and asset management improvements that directly tie to the A grade that VA 

12 
53 


KING-6430 with DISTILLERInsert offset folio 85 here 30246.046

received in Software Inventory, a subcategory in the scorecard. In addition, !TOPS 

continues its Data Center Consolidation effort to merge and close data centers at VA 

facilities throughout the country in accordance with OMB's Data Center Optimization 

Initiative memorandum, which mandated a freeze on the development of new data 

centers and a consolidation of the rest. This year, the team closed 23 data centers. 

The team plans to close another 91 by the end of FY 2018. The benefits of the Data 

Center Consolidation effort include increased system security, reliability, and efficiency; 

enhanced cybersecurity; and the opportunity to introduce innovative and cost-saving 

technological advances to VA systems. These improvements will allow VA employees 

to spend less time managing the infrastructure and more time on customer-focused 

activities that better serve Veterans. 

As OIT continues to build the Strategic Sourcing division and its capabilities, and 

continues to make progress in data center consolidation, VA will remain a Government 

leader in compliance with this legislation and VA's FITARA score will continue to 

improve. 

ELECTRONIC HEALTH RECORD MODERNIZATION INITIATIVE 

On June 5, 2017, Secretary Shulkin announced his decision to adopt the same 

EHR system as DoD, which at its core is about improving VA services and significantly 

enhancing the coordination of care for Veterans who receive medical care not only from 

VA, but DoD and our community partners. Having a Veteran's complete and accurate 

health record in a single common EHR system is critical to that care and to patient 

safety. This new EHR system will enable VA to keep pace with the improvements in 

health information technology and cyber security which the current system, VistA, is 

unable to do. In addition, the new EHR will support the critical need for VA to effectively 

and efficiently share patient data with DoD and community partners. 

With Congress' urging, VA and DoD have been working together for over 17 

years on EHR issues. While we have established some interoperabifity between VA 

13 
54 


KING-6430 with DISTILLERInsert offset folio 86 here 30246.047

and DoD for key aspects of the health record, seamless care is fundamentally 

constrained by ever-changing information on sharing standards, separate chains of 

command, complex governance, and a host of related complexities requiring constant 

lifecycle maintenance resulting from separate implementation schedules, program 

offices, and funding appropriation. 

Despite previous efforts, we still do not have the ability to trade information to 

seamlessly execute a shared plan of care for our Veteran patients. Without improved 

and consistently implemented national interoperability standards, VA and DoD will 

continue to face significant challenges in providing the highest quality of care for our 

Veterans. 

For these reasons, the Secretary decided that VA would adopt the same EHR 

system as DoD, which at its core consists of Gerner's Millennium EHR. Adopting 

Gerner's EHR system, which the Secretary believes is in the Veterans' and the public's 

interest, will ultimately result in all patient data residing in one common system. It will 

enable seamless care between the Departments without the current manual and 

electronic exchange and reconciliation of data between two separate systems. It will 

also result in better service to our Veterans because transitioning Service members will 

have their medical records at VA on day one. 

Replacing VistA is a Must 

Continuing to maintain VistA is more costly in the long-run and will not meet full 

interoperability. To bring VistA up to where it needs to be is our most expensive option. 

VA would have to spend roughly $19 billion over 10 years to upgrade and maintain 

VistA to industry standards, and this still would not provide all the needed 

enhancements and upgrades and interoperability with DoD. In addition, VA currently 

has fewer programmers than it did when VistA was designed and will be much more 

expensive to maintain on an ongoing basis as compared to a more modern Commercial 

14 
55 


KING-6430 with DISTILLERInsert offset folio 87 here 30246.048

Off-the-Shelf (COTS) solution. VistA is in many ways like the car that we love and don't 

want to trade in, though it is now costing us way too much money to maintain. 

The current VistA system is made up of 130 instances of the VistA EHR. Even if 

VA were to make the required upgrades to VistA, it still would not be able to deliver all 

the capabilities that the new Gerner EHR system will include, specifically a single 

common system to provide seamless care with DoD, and improved integrated 

interoperability with community providers via health information exchanges. 

VA Will Leverage DoD's Efforts 

Throughout our negotiations with Gerner, VA has been able to leverage lessons 

learned from DoD. VA is approximately three times the size of DoD's health care 

system. VA has 2.5 times more facilities (1 ,675 vs. 665); 3.7 times more interfaces (102 

vs. 27); and triple the licensed users. In addition, VA's patient population will 

necessitate the purchase of a greater number of services and capability requirements, 

including greater health care interoperability and information exchange nationally, which 

will improve interoperability with community providers. 

Efficiencies as a Result of EHR Modernization 

VA will find considerable savings/efficiencies across our existing systems. 

Transition solutions for nearly all (138 of 143) VistA modules have been identified; the 

majority of which will be replaced directly by Gerner as part of our EHR modernization 

effort. The Gerner solution and VistA EHR will be operating simultaneously for an 

extended period of time with the appropriate decommissioning plan of VistA to ensure 

no disruption of services to our Veterans during the transition of capabilities from VistA 

to our modernized EHR. 

The VA EHRM Team is working hand-in-hand with their DoD counterparts to 

ensure that seamless care and information exchange objectives are fully realized. 

15 
56 


KING-6430 with DISTILLERInsert offset folio 88 here 30246.049

Efforts include the exchange of lessons learned, alignment of EHRM deployment 

schedules to support early interoperability successes and the establishment of an 

interagency governance board to promote configuration management control and longterm adherence to interoperability objectives. 

Adoption of Cybersecurity Enhancements 

Within the breadth ofVA's migration to a new EHR system, we are actively 

assessing the need for VA to adopt significant cybersecurity enhancements, and we 

intend to leverage the architecture, tools, and processes that have already been put in 

place to protect DoD data, to include both physical and virtual separation from 

commercial clients. We are coordinating with DoD on near-term activities regarding 

agency reciprocity for the EHR system ATO, EHR data, and a VA-DoD reciprocity task 

force. VA has undertaken activities that will further align VA RMF and Assessment and 

Authorization processes to current DoD practices. These activities include but are not 

limited to the following: 

RMF collaboration, to include the sharing and analysis of: security and 

privacy controls, ATO documentation, and security artifacts; 

• Drafting an ATO reciprocity memo to include the EHR system and other 

ancillary partnership efforts between VA and DoD; 

• Collaboration with DoD on the EHR architecture and risk tolerance levels; 

• Acquisition of the eMASS Governance, Risk Management, and Compliance 

tool, of which DoD currently uses; and 

• Establishment of the VA RMF Knowledge Service (KS) similar to DoD. The 

KS will contain security policies and guidance, as well as new NIST security 

control implementation and assessment procedures. 

16 
57 


KING-6430 with DISTILLERInsert offset folio 89 here 30246.050

Oversight and Transparency 

VA will provide full transparency in this project, including an Initial Operating 

Capability milestone and other decision points prior to full deployment. We would also 

like to request establishment of a separate new appropriation account for EHRM costs. 

A separate account would allow all EHRM costs to be captured in one place, provide full 

transparency of and accountability for resources, and enhance EHRM implementation. 

Finally, this is being managed differently than past efforts. First, this is a SecretaryLevel initiative, with the Deputy Secretary overseeing the new governance structure, 

which includes OIT and VHA. Additionally, we are using a buy vs. build strategy to 

implement proven technology from an industry leader. Finally, we are leveraging 

lessons-learned from DoD as well as private sector expertise in a way that has not been 

done before. 

CONCLUSION 

Mr. Chairman and Madam Ranking Member, this concludes my testimony. 

Thank you again for the opportunity to discuss with you today the progress that the VA 

OIT is making towards its transformation efforts. Throughout this transformation, our 

number one priority has and will be always the Veteran. Ensuring a safe and secure 

environment for their information and improving their experience is our goal. I look 

forward to answering your questions. 

17 
58 

Mr. HURD. Thank you, Mr. Blackburn. 

And before we turn to Mr. Gianforte for the first round of questions, Mr. Cussatt, we know what a CISO does. Mr. James and Mr. 

Windom, can I get you all to explain to the committee what your 

exact role is, who you report to directly? Just take 30 seconds. 

Mr. JAMES. Yes, Chairman, thank you. The Enterprise Program 

Management Office inside the CIO’s organization at the VA, we’re 

the control tower for all of the projects, the ongoing projects with 

the exception of the EHR project, which has its own BEO. So we 

track all the project’s costs, schedule performance that are ongoing 

today in the IT organization. 

Mr. HURD. And who is your direct supervisor? 

Mr. JAMES. Scott Blackburn, sir. 

Mr. HURD. Got you. Mr. Windom? 

Mr. WINDOM. Sir, recently retired, Captain John Windom, 33 

years United States Navy. I was a program manager that oversaw 

the DOD successful acquisition of the Cerner Millennium product. 

I was brought over in uniform about six months ago at the request 

of Secretary Shulkin from Secretary Mattis to kick off if you will 

the DNF activities and negotiations with Cerner. I’ve been leading 

that and now in a retired capacity as a—as the executive overseeing the entire electronic health record modernization, direct report to the Deputy Secretary, and so he is who I consider my boss. 

Mr. HURD. Well, welcome. It is good to have you here. 

Mr. WINDOM. Thank you. 

Mr. HURD. It is a mess, and we are glad we have you on board 

to work on this project. 

Mr. WINDOM. Great to be here, sir. 

Mr. HURD. The distinguished gentleman from Montana is now 

recognized for five minutes. 

Mr. GIANFORTE. Okay. Thank you, Mr. Chairman. I want to 

thank each of you for being here. This is a critically important topic 

for us to be discussing. In Montana, we are the second-largest per 

capita of citizens that have served in the military. And as I travel 

the State, the number-one issue I hear is health care from the VA 

in every single meeting, so I appreciate you being here. 

And in a rural State like Montana, it can take hours to drive to 

a VA hospital or clinic, so scheduling becomes extremely important, 

particularly advanced notice. It could take three days to go to an 

appointment and come back again. So, as we have heard, clearly 

we can do better, and I appreciate your efforts in that regard. 

I come from a software background. I have done literally thousands of enterprise-class deployments. One particular one was for 

the Air Force Personnel Center. It was their entire records systems 

for processing all the stuff, so have some experience. And that handled all active-duty and all retired Air Force personnel, so it was 

of some scale. 

You have shared that this new Cerner system, Mr. Blackburn, 

will be $10 billion and 10 years to complete. Is that correct? 

Mr. BLACKBURN. That’s correct, sir. 

Mr. GIANFORTE. Okay. I haven’t been through a lot of sales cycles 

on the software side. If I had walked into a boardroom and asked 

for $10 billion and 10 years before we could get a system deployed, 

honestly, I would have gotten laughed out of the boardroom. It is 


KING-6430 with DISTILLER
59 

difficult to fathom it could take that long. And comparing my own 

experience with the Air Force system that we deployed, granted, 

the entire VA is larger, but what you are proposing is not 10 times 

more expensive, it is not 100 times more expensive, it is 1,000 

times more expensive, three orders of magnitude, which provides 

some level of sticker shock. 

Where I want to focus my questioning, Mr. Blackburn, is just on 

what steps you are taking to minimize the cost and get 

functionality in the field so that we can retire this VistA system 

and move on. So the first area I want to speak about is just 

customization of applications. When large enterprise-class applications are customized, they tend to become brittle. Integrations don’t 

work as well. What percentage—and one measure of that is how 

much of the total fee is going into customization versus licenses 

versus operation and maintenance. Can you share with me a little 

bit of how that $10 billion breaks out between license and 

customization? 

Mr. BLACKBURN. Well, first of all, thank you for the one-on-one 

time. That was very productive, and I really appreciate it. 

This is going to be the largest implementation of a healthcare 

system, EHR, ever, and it’s going to be a really big undertaking. 

The key difference between previous efforts is we’re going to be 

buying the commercial off-the-shelf solution and absolutely minimizing the customization. 

I’ll ask Mr. Windom to kind of get into some of the specifics 

there. 

Mr. WINDOM. Sir, I appreciate your question, appreciate the opportunity. 

The—I need to make sure there are some facts brought to the 

table. Number one is the VA is three times larger than DOD. We 

awarded the contract for DOD at $4.33 billion, and so the complexity is deemed about four times larger in that we have well over 

100 interfaces. DOD had approximately 25 to 27 interfaces. The $10 billion is not what’s needed at contract award. The $10 

billion is for the duration of the contract. And I’m really not at liberty to talk about specifics of the price negotiation. We’ll gladly 

come brief you in whatever detail you’d like personally and give 

you a complete breakdown of the pricing structure. 

Mr. GIANFORTE. So just in the initial acquisition, what percentage is professional services versus license? 

Mr. WINDOM. The—sir, that would be crossing me over to Procurement Integrity Act because I would be giving you contract values. Again, sir, prepared to give you that granularity in a private 

session outside —— 

Mr. GIANFORTE. Okay. 

Mr. WINDOM.—the public forum, so I apologize. I guess —— 

Mr. GIANFORTE. I think with a number that large we are just 

asking to understand. 

Mr. WINDOM. Well —— 

Mr. GIANFORTE. And, Mr. Blackburn then, if we—one of the recommendations from the GAO here was item 3 to redesign business 

process to conform with commercial off-the-shelf software as a way 

to bring costs down and reliability. What business process redesign 

efforts are you undertaking inside VA to conform with best pracVerDate Nov 24 2008 11:35 Jun 26, 2018 Jkt 000000 PO 00000 Frm 00063 Fmt 6633 Sfmt 6633 H:\30246.TXT APRIL

KING-6430 with DISTILLER
60 

tices and maybe leave behind some of those 30-year-old processes 

and pick up new ones that are available to us? 

Mr. BLACKBURN. Well, one of the big issues that we have is we 

have different processes at each one of our 168 medical centers, 

and so we’re not standardized right now across our own medical 

system. What this will force us to do is standardize across our medical system and then also in line with the workflows of DOD in 

order to implement this off-the-shelf solution. 

Mr. GIANFORTE. And, Mr. James, is that a primary focus of the 

PMO in doing business process redesign to bring conformity across 

the —— 

Mr. JAMES. Congressman, that would be better addressed by the 

PEO Mr. Windom. 

Mr. WINDOM. Sir, my primary responsibility is program management oversight, as you alluded to. You get what you inspect, not 

expect. I have led to a number of multibillion-dollar programs and 

understanding that though we have selected a phenomenal partner 

in Cerner or will award a contract, we’ve got to have the mechanisms in place to oversee their efforts to protect the taxpayers’ interest and obviously the interest of our veterans. So our Program 

Management Office is going to consist of what I believe is you need 

physics, physicists to grade physics homework. So we’re going to 

have the full breadth of clinical capabilities and technological capabilities at our disposal to oversee the implementation, sir. 

Mr. GIANFORTE. Okay. Well, I would encourage you that as much 

standardization would be —— 

Mr. WINDOM. Yes, sir. 

Mr. GIANFORTE.—helpful in keeping the cost down. 

The last point I just want to ask Mr. Blackburn is we have heard 

before this committee a number of other agencies testify about the 

cost savings increase in reliability and speed to deployment when 

solutions are in the cloud. What percentage of the Cerner system 

will be native in-the-cloud technology? 

Mr. BLACKBURN. The—Mr. Windom will probably have the best 

information for that, but it’s the majority. 

Mr. WINDOM. Sir, so we’re involving with technology. As you 

know, there are a number of inhibitors associated with the movement of PII data into the cloud. I can assure you we’re working 

—— Mr. GIANFORTE. So is there a percentage? 

Mr. WINDOM. Sir, I don’t have a percentage, but we’re going to 

be on premise and in the cloud simultaneously in delivering that 

support. What the —— 

Mr. GIANFORTE. We have had other agencies testify that there 

are 100 percent in the cloud now. 

Mr. WINDOM. That’s not the case, sir. 

Mr. GIANFORTE. Okay. Well —— 

Mr. WINDOM. That would not be the case for us. 

Mr. GIANFORTE.—I just want to—I will just finish up. I have run 

past my time. Thank you, Mr. Chairman. It is just the work you 

are doing is critically important for our veterans. They are not— 

we all know they are not being served well today. Let’s work together to make this happen. 

Mr. BLACKBURN. Absolutely. Absolutely, sir. 


KING-6430 with DISTILLER
61 

Mr. GIANFORTE. I yield back. 

Mr. HURD. The gentleman yields back. Now, I recognize the 

ranking member for her first five minutes of questions. 

Ms. KELLY. Thank you, Mr. Chair. 

The number-one mission of the VA is to care for our veterans, 

and a central part of that mission in delivering quality healthcare 

generally is tracking outcomes. The ability to track outcomes help 

both prevention and treatment. Mr. Blackburn, the VA cannot 

properly care for our veterans and track outcomes without the ability to communicate with DOD and share information. Can DOD 

and the VA currently exchange patient health data between one 

another? 

Mr. BLACKBURN. Thank you, Ranking Member Kelly, and thank 

you also for our one-on-one session. 

The—yes. The answer is yes, that we currently can. My doctor 

in the Orange Clinic of the Washington VAMC, we have something 

called Joint Legacy Viewer in—which allows clinicians within DOD 

and VA to be able to see each other’s medical records. It’s not perfect. It’s read-only. It’s as good as it could possibly get it. I think 

we have roughly almost 8 million or so medical records that have 

been viewed on Joint Legacy Viewer. 

Ms. KELLY. Thank you. Do all users have access to interoperable 

electronic health records, the system? 

Mr. BLACKBURN. The—I think most. John Short, is that all? All. 

Ms. KELLY. All? Okay, great. 

Mr. BLACKBURN. Yes. 

Ms. KELLY. VistA evolution showed progress in achieving the 

ability to share data between DOD and VA. In June of this year, 

however, the Secretary announced that the VA would now acquire 

the same health system as the DOD. This is a rather remarkable 

shift since it was previously planned that DOD and VA would have 

the same healthcare system and that efforts were abandoned. Why 

is the VA going back to this plan that it previously abandoned, and 

why does it believe this is the best course of action at this time? 

Mr. BLACKBURN. The—maintaining our current VistA system is 

not an option. It will be incredibly costly. Matter of fact, we had 

a third-party estimate that took a look at it and estimated it would 

be roughly up to $19 billion to maintain and to upgrade our current 

VistA system. And that would not get us the seamless interoperability of—that we’re looking for with veterans. With—by moving 

to the same exact product, the same exact instance that DOD has, 

it will all be one record. It will be DOD doctors and VA doctors 

going into the exact same record, which will make that seamless. 

Currently, as a veteran, most of my records as a soldier were on 

paper. Those were lost when my parents’ basement was flooded, so 

my VA doctor does not have that information. That will not be the 

case for my kids when they go to serve. 

Ms. KELLY. Okay. And, Mr. Blackburn, will the transition away 

from the health management platform that was the key part of the 

VistA evolution affect the interoperability with the Department of 

Defense? 

Mr. BLACKBURN. Please repeat the question. 

Ms. KELLY. Will the transition away from the health management platform that was a key part of VistA —— 


KING-6430 with DISTILLER
62 

Mr. BLACKBURN. Yes. 

Ms. KELLY.—evolution, will that affect the interoperability with 

the Department of Defense? 

Mr. BLACKBURN. We will maintain that ability on Cerner to be 

able to view those records within the Joint Legacy Viewer, so we 

will not lose that data. That will be a key part of our implementation. 

Ms. KELLY. And what is your timeline? 

Mr. BLACKBURN. The timeline overall for implementation of 

Cerner is roughly 10 years —— 

Ms. KELLY. And —— 

Mr. BLACKBURN.—for the entire thing. 

Ms. KELLY. And what are you doing to achieve interoperability 

with healthcare providers outside of the VA and DOD? 

Mr. BLACKBURN. That’s a great question, and that’s actually 

something that we’re working with the Office of American Innovation and the White House on. The Cerner solution, that will give 

us interoperability within the VA, first of all. Second, it will give 

us interoperability with the DOD because it’s the same record. And 

then thirdly, the—Cerner has a CommonWell solution in which 

they have their network of private hospitals that that will—but it 

won’t give us 100 percent. No solution right now will give us 100 

percent with the private sector. That solution does not exist right 

now, but I think that would be a longer-term goal for our country 

so that it would be completely seamless. And that’s actually a problem that we’re working with the White House on. 

Ms. KELLY. Okay. Thank you. In previous testimony before this 

committee GAO has stated that agencies need, and I quote, ‘‘To define what they aim to accomplish through these efforts and identify 

meaningful outcome-oriented goals and metrics.’’ DOD and VA, do 

you agree with GAO’s assessment that outcome-oriented goals 

would help measure progress toward interoperability and hold your 

departments accountable for their progress? 

Mr. BLACKBURN. Absolutely. Absolutely agree. 

Ms. KELLY. And what do—well, what does your respective agency 

aim to achieve regarding improved health outcomes and delivery 

from your interoperability efforts? 

Mr. BLACKBURN. Ask Mr. Windom for specifics there. 

Mr. WINDOM. The metrics—the right metrics, ma’am, I would 

offer are our primary concerns, so KPPs, SLRs, SLAs, things that 

we can use to clearly identify that we are achieving our quality 

goals on behalf of our beneficiaries. 

We’ve got what’s called a quality assurance surveillance plan as 

part of the contract. Those contracting officer representatives, quality assurance representatives will be overseeing the delivery of 

those metrics as the product is being rolled out to ensure that we’re 

in fact getting what we paid for. So there’s a myriad of metrics that 

add value that are not only aligned with the commercial standards 

that kind of reduce that customized problem that we often have 

when implemented business systems but also to leverage what’s 

important within the VA with regards to value metrics. So a combination of the two, ma’am, and we use the quality assurance surveillance plan as that tool to oversee those metrics. 

Ms. KELLY. Can I just ask one more question? 


KING-6430 with DISTILLER
63 

When I asked about how you are working with outside —— 

Mr. BLACKBURN. Yes. 

Ms. KELLY.—entities, now in the State of Illinois I believe they 

passed legislation where a veteran could go to another hospital or 

at least they were working on it. 

Mr. BLACKBURN. Yes. 

Ms. KELLY. How many States is it, do you know, that —— 

Mr. BLACKBURN. The whole —— 

Ms. KELLY.—can do that? The whole —— 

Mr. BLACKBURN. The whole country. That’s the Veterans Choice 

Program, which has not been perfect. I know in Montana it has not 

been good. It’s been terrible. But that’s something that we’re working on, and actually, there’s draft proposals of bills in place to improve that program right now. 

Ms. KELLY. Okay. Is this—like where I live in the suburbs or the 

south suburbs of Chicago and where the VA hospitals are —— 

Mr. BLACKBURN. Yes. 

Ms. KELLY.—downtown and west, so it is an effort to get there, 

not like Montana but —— 

Mr. BLACKBURN. Yes. So, ma’am, I’m actually a good example. I 

get my primary care at the Washington VAMC, but I get physical 

therapy through the Veterans Choice Program in Bethesda closer 

to where I live. The—and it makes a big difference. 

Ms. KELLY. Okay. Thank you. 

Mr. BLACKBURN. Yes. 

Mr. HURD. All right. I recognize myself —— 

Mr. CONNOLLY. I am sorry, Mr. Chairman. Did I just hear Maryland, not Virginia? 

Mr. BLACKBURN. That is correct, Mr. Connolly. 

Mr. CONNOLLY. Oh, my Lord. All right. 

Mr. HURD. Bad move, Mr. Blackburn. 

I recognize myself for five minutes, and I yield to the gentleman 

from Montana. 

Mr. GIANFORTE. Okay. Thank you, Mr. Chairman. 

I just want to continue the conversation a little bit. And, Mr. 

Blackburn, you testified again this Cerner implementation, $10 billion, 10 years, and I understand the VistA system then has to stay 

in place for that entire period of time. And as I understand the cost 

to—annual cost currently for the system is between 800 and $900 

million a year. Is that correct? 

Mr. BLACKBURN. Roughly. Roughly. It’s multiple hundreds of millions of dollars, way too expensive. 

Mr. GIANFORTE. And aspects of that system are pretty long in the 

tooth, is that correct? It has been around a long time? 

Mr. BLACKBURN. Oh, it’s been around for about 40 years. 

Mr. GIANFORTE. And it is not working that well? 

Mr. BLACKBURN. It has worked for 40 years, but it’s not sustainable. It can’t go forward into the future. 

Mr. GIANFORTE. It has lost its luster at a minimum —— 

Mr. BLACKBURN. It has. 

Mr. GIANFORTE.—the 40 years. So here is my—one strategy I 

have seen used in the private sector when you have these massive 

boil-the-ocean kind of projects like the one we are undertaking that 

is 10 years and $10 billion is to use on an interim basis best-ofVerDate Nov 24 2008 11:35 Jun 26, 2018 Jkt 000000 PO 00000 Frm 00067 Fmt 6633 Sfmt 6633 H:\30246.TXT APRIL

KING-6430 with DISTILLER
64 

breed technologies to pick off high-value components that may be 

excessively costly or of high value in terms of functionality. You 

mentioned scheduling. 

Mr. BLACKBURN. Yes. 

Mr. GIANFORTE. It happens that I had served on a board of directors of a medical scheduling company. I am not here to advocate 

for them, but we did scheduling for tens of thousands of doctors 

across the United States completely in the cloud. If you were able 

to spend a small amount of money to do something and then throw 

it away when utopia arrives in 10 years, have you considered strategies like this to use best-of-breed technology on an interim basis 

to deliver more value to our vets in the short term and save operation and maintenance costs out of this $8–900 million a year you 

are spending on VistA? 

Mr. BLACKBURN. We have. And scheduling’s been a massive issue 

for us. As a matter of fact, we have a board, a visual that shows 

what our previous scheduling system looked like, right? This is 

what doctors had to go and use. What we’re currently doing right 

now in 151 out of our 158 facilities is we’ve moved under Mr. 

James, who has lead this program, to what we’re calling VSE, 

VistA—it’s an upgraded VistA GUI system on top of that. That is 

a shorter-term bridge as one of the efforts we’ve done on there. 

There are also a couple of other efforts that we have. One is an online scheduling application, again, a homegrown system, so —— 

Mr. GIANFORTE. Okay. 

Mr. BLACKBURN.—the VSE system is homegrown. 

Mr. GIANFORTE. To what extent have you looked at commercial 

off-the-shelf —— 

Mr. BLACKBURN. Yes. 

Mr. GIANFORTE.—best-of-breed applications to pick off either 

high-cost or high-value components of VistA just on an interim— 

I mean, because 10 years is a long time. I am not sure any of us 

are going to be sitting here in 10 years, but we are going to have 

veterans looking for services. To what extent have you implemented that sort of strategy? 

Mr. BLACKBURN. Yes. Mr. James, do you want to talk a little bit 

about that? 

Mr. JAMES. Sure. We’ve looked at that over and over again, and 

we can apply, for example, with the VSE, VistA scheduling enhancement outlook like GUIDANCE, that type of best-of-breed at 

the top layer, but the problem comes when you have to interface 

it to the 130 different versions of VistA across the country, each 

one of which has 140 to 150 old —— 

Mr. GIANFORTE. Does that —— 

Mr. JAMES.—applications. 

Mr. GIANFORTE. That VistA GUI, does that work on mobile devices? 

Mr. BLACKBURN. Yes. Yes, sir. 

Mr. GIANFORTE. And it works on a web browser? 

Mr. JAMES. Yes, sir. 

Mr. GIANFORTE. So a veteran can access it from anywhere? 

Mr. JAMES. Yes, sir. 

Mr. GIANFORTE. And is that deployed in Montana? 

Mr. JAMES. I believe it is. I’d have to confirm —— 


KING-6430 with DISTILLER
65 

Mr. BLACKBURN. It’s currently deployed in 110 of our sites. We’ll 

have to check and make sure Fort Harris —— 

Mr. GIANFORTE. I am more interested—I ask more from the perspective of a rural State —— 

Mr. BLACKBURN. Yes. 

Mr. GIANFORTE.—that has a lot of veterans. So I would just encourage you to do that. And just in our conversation, to summarize, 

I think—and you have mentioned these things. I would just encourage you, minimize customization. 

Mr. BLACKBURN. Yes. 

Mr. GIANFORTE. Change business practices to standardize them 

so you are not doing the customization. Get to the cloud. That is 

where the puck is going to be. 

Mr. BLACKBURN. Yes. 

Mr. GIANFORTE. We need to skate there. And then I would highly 

encourage you to look at best-of-breed commercial off-the-shelf apps 

as gap-fillers between now and utopia that is going to show up in 

10 years from now. 

Mr. BLACKBURN. Absolutely. I appreciate that feedback. 

Mr. GIANFORTE. And, Mr. Chairman, I yield back. 

Mr. HURD. Reclaiming my time. Mr. Powner, there is a lot of conversations going on, a lot of topics hit. Do you have any opinion on 

the comments so far? 

Mr. POWNER. Yes. I think clearly the word minimize is—that’s a 

scary word, okay, because we’ve heard minimize customization 

with a lot of commercial products in the Federal Government, and 

that’s—minimize means a range of activities. I think you want to 

really try to almost eliminate customization. You’re going to change 

your business processes anyway significantly, so go full bore and 

eliminate. 

Mr. HURD. Thank you, Mr. Powner. 

Now, it is a pleasure to recognize my friend from the Commonwealth of Virginia, Mr. Connolly, for your round of questions. 

Mr. CONNOLLY. I thank my friend from Texas, Mr. Chairman. 

Thank you. 

And welcome. And Mr. Blackburn was also—you made the 

rounds, and good for you. 

Mr. BLACKBURN. Thank you. 

Mr. CONNOLLY. Mr. Powner, let’s begin by—can you summarize 

what kind of performance did we see in the FITARA scorecard for 

VA this time? 

Mr. POWNER. Well, on the FITARA scorecard overall B-plus. 

They’ve consistently scored well on incremental development to 

their credit. Software licensing, they were one of seven agencies to 

have that inventory and do something with it, so those areas are 

very strong. The one area that everyone acknowledges that they 

have a lot of work to do is on data center optimization. They fall 

far short of OMB’s goals on closures, savings, and also with the optimization metrics. 

Mr. CONNOLLY. And, by the way, just putting that in context, if 

I am correct, GAO reported that, as of August 2017, we have identified a total of 12,062 data centers. That is 2,000 more than a year 

ago. 


KING-6430 with DISTILLER
66 

Mr. POWNER. Yes, we’ve been back and forth on the total number 

here. A lot of that’s attributed to Treasury where you’ve —— 

Mr. CONNOLLY. Those people —— 

Mr. POWNER. They had a number in the inventory, off the inventory. They’re back in the inventory, so now we are up to about 

12,000. The good news government-wide is we’ve closed almost half 

of those, close to 6,000, so that’s the good news. 

Mr. CONNOLLY. Right. Okay. And let me see. And, Mr. 

Blackburn, if I understand your inventory, you have got 415 data 

centers, correct? 

Mr. BLACKBURN. Roughly. I think we started with 386, but it’s 

an awful lot, way too many. 

Mr. CONNOLLY. And you have closed only 39 as of August? 

Mr. BLACKBURN. I had 24 but the—roughly correct. 

Mr. CONNOLLY. Mr. Powner, do you want to comment on that? 

Mr. POWNER. My numbers are close to about 40 of the 415 —— 

Mr. CONNOLLY. Right. 

Mr. POWNER.—as of August. 

Mr. CONNOLLY. I mean, I am kind of following his numbers, but 

—— 

Mr. POWNER. Sure. 

Mr. CONNOLLY.—if your performance is even less stellar —— 

Mr. POWNER. I have even less closures. 

Mr. CONNOLLY. All right. Now, in our conversation you set a metric for yourself, and do you want to share that with us? So let’s call 

the number somewhere around 400 data centers. 

Mr. BLACKBURN. Yes. 

Mr. CONNOLLY. What do you want to get it down to and in what 

time frame? 

Mr. BLACKBURN. We would like to get down to 14 core data centers by the end of 2020. In addition to that, we would have 42 special-purpose data centers. These are things like for our mail-order 

pharmacy and things of that nature, but even that to me feels it 

might be a little high, so I would like to go and kind of scrub those 

with my team. But that would be our goal by the end of 2020. 

Mr. CONNOLLY. That is a pretty strong stretch goal to go from 

400-plus to 20. Mr. Powner, realistic goal? 

Mr. POWNER. I believe—here’s what’s—that makes it realistic. 

When you look at the 130 instances of VistA and a lot of the data 

centers are co-located at these facilities, I think the data center 

consolidation really needs to go hand-in-hand with this migration 

to the commercial Cerner product. That’s where there’s a real opportunity to save a lot of money in the data center area. We’re 

spending a lot of money, but we can get a huge return from a data 

center point of view. 

Mr. CONNOLLY. What is the estimated savings if Mr. Blackburn 

achieves this goal in three years for the data center consolidation? 

Any estimate? 

Mr. POWNER. I don’t have a good estimate on that. 

Mr. CONNOLLY. Are you operating on any kind of assumption it 

will save us X? 

Mr. BLACKBURN. I haven’t been able to get an estimate yet. I 

think that’s one of the reasons why we have such a low grade on 

FITARA. 


KING-6430 with DISTILLER
67 

Mr. CONNOLLY. Yes, I think that is really important both for —— 

Mr. BLACKBURN. Yes. 

Mr. CONNOLLY.—incentivization and maybe more important now 

that MGT, the bill we have been working on collectively here, hopefully will be law soon. 

Mr. BLACKBURN. By Tuesday. 

Mr. CONNOLLY. By Tuesday. And that obviously allows you to be 

reinvesting in yourself with the savings effectuated pursuant to 

FITARA. So we—among other things, but I mean I would hope that 

is an incentive for people. 

Mr. BLACKBURN. Absolutely. We’re very excited about that, and 

I think the more positive incentives like MGT that can put in place 

where we can reinvest those savings, we’re extremely excited, and 

that will really help us. 

Mr. CONNOLLY. Mr. James, I see you affirming that. You are welcome to comment. 

Mr. JAMES. Yes, Congressman. I’m from your district so I can dig 

Scott out of —— 

Mr. CONNOLLY. Excuse me. 

Mr. JAMES.—his Maryland hole. 

Mr. CONNOLLY. This man is only deputy assistant. He needs a 

promotion. 

Mr. JAMES. Congressman, the reason I share the excitement in 

that act is that our Secretary has challenged us to go find—ask industry for some innovative ideas, share-in-savings types of ideas 

where we put in some seed money, they find savings, and then we 

share the benefits. We win, they win. And the seed money could 

come from that particular act, and so we’re—we have a runway in 

front of us that, with that act, I think we can make some headway. 

Mr. CONNOLLY. And you have raised the Secretary, and that is 

good to hear, too. Can you talk a little bit, both you and Mr. 

Blackburn, anyone else who wants to as well, but one of the things 

Mr. Hurd, Ms. Kelly, and Mr. Meadows and I are concerned about 

frankly is the organization chart. Who reports to whom? How high 

up in the hierarchy is the CIO? Because we feel that if you don’t 

have the ear of the boss, it is all fascinating but no guarantee anyone is going to pay the kind of qualitative attention we demand, 

we want. We think that the CIO has just got to be an empowered 

person and everyone needs to know it. So comment a little bit 

about what is the relationship with the Secretary? 

Mr. BLACKBURN. Yes. 

Mr. CONNOLLY. Let’s stipulate the Secretary is wonderful and 

walks on water. We will stipulate that, but what is the working relationship and what does it look like on the organization chart so 

the somebody like us, it would leap out right away or it wouldn’t? 

Mr. BLACKBURN. So on the organizational chart the CIO reports 

directly to the Deputy Secretary at the VA. The —— 

Mr. CONNOLLY. Which is Mr. James? 

Mr. BLACKBURN. Which is Mr. Tom Bowman is the Deputy Secretary. 

Mr. CONNOLLY. Okay. 

Mr. BLACKBURN. The —— 

Mr. CONNOLLY. Oh, I’m sorry, you said Deputy Secretary. 

Mr. BLACKBURN. Yes. 


KING-6430 with DISTILLER
68 

Mr. CONNOLLY. Right. 

Mr. BLACKBURN. Yes. Yes. So CIO reports to—I report to Tom 

Bowman. The—Secretary Shulkin is incredibly hands-on involved. 

He and I have a great relationship. I was the interim deputy secretary until Mr. Bowman came on board. He has been very, very 

hands-on and active. He is the one that personally made the decision to go to the commercial off-the-shelf solution with Cerner. He 

is very comfortable with technology and a big proponent of what 

we’re doing. 

Mr. CONNOLLY. Sure. And you concur, Mr. James? 

Mr. JAMES. Yes. Yes, Congressman. 

Mr. CONNOLLY. All right. Anyone else want to comment? 

So, Mr. Powner, we are going to be back here in a year or so 

hopefully with a different grade that is an improved grade because 

of data center consolidation. Do you agree? 

Mr. POWNER. Let’s hope so. 

Mr. CONNOLLY. All righty. Thank you all so much for being here. 

I do hope—I want to underscore Mr. Hurd, my presence here, and 

Ms. Kelly and Mr. Meadows—who couldn’t join us today—I don’t 

mean to leave you out. I am just talking about the ranking member 

and the chair. We are committed on a bipartisan basis to make this 

happen, so we have got your back, but we will also—we are more 

than willing to create pressure and stress where it is needed to improve performance because we are very serious about FITARA and 

the other related bills. So thank you for being here and thanks for 

your commitment, which I think is robust, and I like that in government, so thank you. 

Mr. BLACKBURN. Thank you, sir. 

Mr. HURD. I now recognize myself again for five minutes of questions. And to follow up on what my friend from Virginia was talking about, about the question on coordinating data centers with the 

Cerner rollout, and everybody was shaking their head as if this is 

a good idea. And my question is are we coordinating the closure of 

data centers with the Cerner rollout? Mr. Blackburn, maybe that 

goes to you. 

Mr. BLACKBURN. We are, and I’ll yield to Mr. Windom to talk 

about the Cerner rollout. 

Mr. WINDOM. Yes, sir. Mr. Chairman, the Cerner solution has a 

platform called Healthy Intent. That’s its primary data management hosting element that we intend to move our data into obviously in a controlled and properly risk-mitigated fashion such that 

we don’t compromise that care being delivered. We are going to 

make sure that we—that data is where we want it to be and usable 

before we shut anything down. That’s why I believe that our data 

consolidation plan is feasible because we are moving that data very 

similar to the DOD solution into the Healthy Intent platform that 

gives us again that seamless movement of data across DOD and 

VA environments. 

Mr. HURD. So how long will VistA and the new electronic health 

records system coexist? 

Mr. WINDOM. Sir, let me—so you have a relative—the DOD— 

when we awarded the DOD contract, it’s a seven-year rollout for 

about a third of the size of the VA population, 1,600 facilities on 

VA side, about 600-plus including ships and expeditionary platVerDate Nov 24 2008 11:35 Jun 26, 2018 Jkt 000000 PO 00000 Frm 00072 Fmt 6633 Sfmt 6633 H:\30246.TXT APRIL

KING-6430 with DISTILLER
69 

forms on the DOD side. In addition, we have 318,000 users relative 

to about 112,000 users on the DOD side. So the answer to your 

question is is that the plan is going to be to roll this out, VistA has 

to run simultaneously with the new solution. That’s part of the acquisition curve and that we have to keep that solution delivering 

today. 

Mr. HURD. Mr. Windom —— 

Mr. WINDOM. Yes, sir. 

Mr. HURD.—I understand, and your job is hard. 

Mr. WINDOM. Yes, sir. 

Mr. HURD. Nobody questions that. Nobody questions that. But 

the difficulty you are going to have is what I would call the incompetence of previous activity, right? And so you are the new man, 

and you have the right credentials to do this, but this is the frustration when you see this has been going on for a long time because we are solving the problem. So the first—if the veteran 

leaves DOD in, let’s say, 2019 and they transition to the VA, he 

or she will be moving to the VistA system, is that correct? 

Mr. WINDOM. Potentially. And I say that because one of the reasons for our deployment schedule is we’re—we intended to align as 

much as possible to the deployment schedule of DOD —— 

Mr. HURD. Yes. 

Mr. WINDOM.—because we want to demonstrate interoperability 

to you immediately. 

Mr. HURD. So —— 

Mr. WINDOM. So it depends would be the answer. 

Mr. HURD. And let’s get to interoperability. We are going to be 

here for a while. The JLV is not interoperability. Has anybody at 

this panel set with doctors in a facility and had them walk you 

through the JLV? Mr. Windom? 

Mr. WINDOM. Yes, sir. I was DOD when we only were moving 50 

records. 

Mr. HURD. Yes. 

Mr. WINDOM. Now, we’re moving tens of thousands if not hundreds of thousands —— 

Mr. HURD. So —— 

Mr. WINDOM.—so yes, sir, the answer is yes, sir. 

Mr. HURD. So you understand the problem. And so we talk about 

JLV like we have already achieved interoperability. We haven’t. It 

is the equivalent of using microfiche, and so the fact that, yes, it 

is the right decision to go to one system, but that one—so the people that are going to benefit are potentially—we are seven years 

away from that. And yes, Healthy Intent is the data platform that 

you’re going to be using on Cerner, but what VA and DOD have 

not proven they can do is to integrate that data in one view. 

And so my concern is this is still a problem of data interoperability because we have to take all the data that has been gathered 

from VistA and make sure it is viewable through Cerner. And there 

is nothing to date that makes me feel comfortable that we know 

we can do that. And we are sitting here saying, yes, it is a big— 

the largest software sale ever in the history of the planet, right? 

Like I get how big of a deal it is, but, number one, why the hell 

are there 130 versions of VistA? Now, Mr. Windom, I know that is 

not your problem. That is not your problem. But, Mr. Blackburn, 


KING-6430 with DISTILLER
70 

can you give me some—like how has that been allowed to continue? 

I don’t even know what that means. How would you have 130 

versions of the same program operating in one organization? 

Mr. BLACKBURN. So my understanding of that—and VistA started around the time I was born, so this decision dates back to me 

being a toddler—was—the idea at the time was local innovation. 

VistA was built by doctors, for doctors. Still to this day it actually 

rates as a—doctors rate it as the most user-friendly electronic 

health record. 

Mr. HURD. It was groundbreaking —— 

Mr. BLACKBURN. Yes. 

Mr. HURD.—when it started. 

Mr. BLACKBURN. Yes. 

Mr. HURD. Yes. I would agree with that. 

Mr. BLACKBURN. And they —— 

Mr. HURD. But 130 versions later is pretty crummy. 

Mr. BLACKBURN. You’re exactly correct, and that means, you 

know, if I go—if I’m getting seen in—right now in Washington, 

they can’t—it’s difficult if I go to another instance for that data to 

flow seamlessly. 

Mr. HURD. So what processes were in place or not in place that 

allowed that behavior to continue? Because if we don’t first identify 

why that behavior was allowed to happen, we are not going to be 

able to prevent it in the future. 

Mr. BLACKBURN. The philosophy at the time was we’re going to 

push the power of how to run the hospital to the electronic health 

record and their workflow to the local hospitals. 

Mr. HURD. Sure. 

Mr. BLACKBURN. So there’s the joke if you’ve seen one VA, you’ve 

seen one VA. They run completely differently, and then they map 

their health record to how they were run. What we are—what we 

are going to do is standardize workflows and not allow that to happen. And matter of fact, DOD and VA will have the exact same 

workflows. 

Mr. HURD. Now, it is pretty clear from the limited time we have 

in with Mr. Windom that he is high speed, low drag, and my question, Mr. Windom, when will we be able to demonstrate for one 

record that we can get the data from a VistA EHR and view it 

through a Cerner application? When will we be able to demonstrate 

the ability to do that for one? 

Mr. WINDOM. Sir, the timeline for what we call initial operating 

capability, which we anticipate for Pacific Northwest is less than 

18 months. So we expect to be able to demonstrate interoperability. 

Obviously, we will be doing it in a laboratory environment where 

will be able to demonstrate a record, but we want to show you in 

a real-time environment. And so prior to full deployment, we will 

have achieved IOC at these various sites, sir. 

Mr. HURD. The last time we had this conversation with your 

predecessors, my question was, at its core, this is not a hard challenge. You map one data element to another data element. L name 

maps to last name, full name maps to F name. Have we done that 

mapping? 

Mr. WINDOM. Sir, that alignment—we’ve got a comprehensive 

data management strategy. You know, your points are right on 


KING-6430 with DISTILLER
71 

point if you will in that we are not going to put JLV data into the 

Healthy Intent platform. That data is being reconciled such that 

we have transactional capability to move data —— 

Mr. HURD. Sure. 

Mr. WINDOM.—to process data between DOD and VA, so it’s not 

just—we know—JLV was a—was an interim fix. JLV access will 

exist as we transition because we don’t want to destroy that existing continuity of data. But the Healthy Intent, it’s just not going 

to be load JLV into Healthy Intent. It’s going to have manipulatable data, transactional data that supports the movement of information across the DOD and the VA enterprise, sir. 

Mr. HURD. So is the data architecture of VistA version 1 different 

from VistA version 130? So are you working with 130 different data 

sets? 

Mr. WINDOM. Yes, sir. That would be accurate. 

Mr. HURD. That is crazy. 

I would like to now recognize Mr. Connolly. 

Mr. CONNOLLY. Thank you, Mr. Chairman. Just to humanize 

what you are talking about, Mr. Chairman, Mr. Blackburn, I think 

you shared with me your own personal experience in terms of 

health records. Could you remind me, so you come from Massachusetts, God’s country, right —— 

Mr. BLACKBURN. Right. 

Mr. CONNOLLY.—except for Virginia. 

Mr. BLACKBURN. Yes. 

Mr. CONNOLLY. And your files were in —— 

Mr. BLACKBURN. Partners Health Care, so Mass General Hospital —— 

Mr. CONNOLLY. Right. Okay. 

Mr. BLACKBURN.—Beth Israel. 

Mr. CONNOLLY. And you need to have someone here look at 

them, right? 

Mr. BLACKBURN. Yes, so I—and I lived in Cleveland for 10 years, 

so I have medical information in the Cleveland Clinic. Obviously, 

I was a soldier in the Army. I get my care at the VA. I get some 

of my care at NovaCare. The—last summer, I broke my arm and 

got rushed to the hospital at a Johns Hopkins Hospital, so all my 

data, my healthcare data is spread out over all these different 

healthcare systems that do not necessarily talk to each other. 

Mr. CONNOLLY. So how did that affect in any material way the 

quality of care you were given? 

Mr. BLACKBURN. Oh, it affects it drastically. The—you know, 

when I came here and enrolled in the Washington VAMC, I actually brought a large paper file from the Cleveland Clinic that I 

printed out to my doctor, and he was very appreciative of that. 

The—it’s very difficult for them to tell me—to be able to see things 

like x-rays from when I broke my arm, what shots I’ve had. You 

have to fill out paperwork over and over again. 

Mr. CONNOLLY. Which an electronic record-keeping system ought 

to obviate? 

Mr. BLACKBURN. As long as they talk to each other. 

Mr. CONNOLLY. But they have got to be compatible, which it goes 

to interoperability, right, Mr. Windom? 

Mr. WINDOM. Yes, sir. 


KING-6430 with DISTILLER
72 

Mr. CONNOLLY. Well, as we heard, it is not just a nice thing to 

do, and it is not even just that it saves money. It also affects quality of care of the veterans we serve —— 

Mr. BLACKBURN. Yes. 

Mr. CONNOLLY.—so there is a real imperative here. I thank you. 

Thank you, Mr. Chairman. 

Mr. HURD. The distinguished gentleman from Montana is recognized. 

Mr. GIANFORTE. Thank you, Mr. Chairman. 

Mr. Blackburn, you had said that scheduling is a particular area 

of focus —— 

Mr. BLACKBURN. Yes. 

Mr. GIANFORTE.—for you, so a very simple question. Does the VA 

currently have a commercial off-the-shelf scheduling pilot in production? 

Mr. BLACKBURN. We have two. So we have one as mandated by 

the Faster Care for Veterans Act. We actually—it’s in test mode 

right now. I believe it just went live just a few days ago in three 

VA hospitals: Minneapolis; Salt Lake City; and Bedford, Massachusetts. We also have a pilot going on in Columbus, Ohio, with a solution called MASS, which is an Epic-based, resource-based scheduling system. 

Mr. GIANFORTE. Okay. So Epic is really a competitor with 

Cerner? 

Mr. BLACKBURN. They are. 

Mr. GIANFORTE. Yes, so you are deploying Epic as well as 

Cerner? 

Mr. BLACKBURN. The Epic is in pilot mode in Columbus. We— 

that was actually—that was put in place before the Secretary made 

the Cerner decision. 

Mr. GIANFORTE. Okay. So that will be phased out and converted 

to Cerner? 

Mr. BLACKBURN. Depending on how the pilot—we haven’t made 

that final decision yet, but we will be making that in the spring. 

Mr. GIANFORTE. Okay. So we have VistA that is 30 years old. We are rolling out a $10 billion Cerner project. We are also rolling out 

a competitor in the Epic system. I thought I was going to ask about 

scheduling, but this gives me more concern. Why wouldn’t you just 

shut that project down now that you have made the decision to go 

with Cerner? 

Mr. BLACKBURN. That was one of the options. 

Mr. GIANFORTE. Is this —— 

Mr. BLACKBURN. We just haven’t made the final decision. 

Mr. GIANFORTE. Is this taxpayer dollars being well spent on a 

project that is going to get—I, honestly—frankly, I just don’t understand that decision. 

On the scheduling, you say you have just been live a short period 

of time. Do you have any initial analysis of the functionality of this 

OPSS system that is piloted versus the lipstick that was put on the 

pig on VistA? 

Mr. BLACKBURN. Mr. James? 

Mr. JAMES. Yes, Congressman. The Faster Care for Veterans Act 

specifies seven capabilities that must be provided by the OPSS system, and today, our PM tells me that the OPSS system meets those 


KING-6430 with DISTILLER
73 

seven requirements. The other part of the Faster Care for Veterans 

Act requires a Mitre in the IVNV mode to assess other similar 

types of scheduling, homebrewed systems if you will into VA, and 

that one is far. And that also has those seven capabilities. 

Mr. GIANFORTE. Okay. So you’re just getting started with that 

pilot. What is your first review period of the pilot? Is it in 90 days 

or so? 

Mr. JAMES. Sir, the Secretary must certify according to the law 

that it provides those seven capabilities by December 31 at those 

three sites, and we believe that it is operating today, but that’s just 

today. We have some time. Then, subsequent to that certification, 

we have to have an independent validation verification of those 

seven capabilities. That’s also in the law by an FFRDC. In this 

case, that’s Mitre. So that’ll happen after the Secretary certifies 

on—by December 31. 

Mr. GIANFORTE. Okay. Well, Mr. Chairman, I would just suggest 

that maybe we ask for some feedback on this pilot. We have been 

advocating—earlier, I advocated for commercial off-the-shelf scheduling applications. This OPSS didn’t come up in that earlier discussion. It sounds like we are live in a number of cities. We ought to 

know in 90 days if it is working or not and is it better than the 

lipstick we are putting on VistA that is costing us so much money. 

So I thank you for sharing that additional information. I yield 

back. 

Mr. HURD. I recognize myself for five minutes. 

Mr. James, MGT, what do you need to do in order to ensure that 

you have a working capital fund, an MGT working capital fund to 

take advantage of the savings that Mr. Blackburn and Mr. Windom 

are going to realize through their efforts? 

Mr. JAMES. Thank you. Thank you, Mr. Chairman. I’m not the 

finance guy in OINT. I believe we do have today some working capital fund mechanisms in place that we already use. My expectation 

is that MGT would either complement those or augment those or 

be part of those. I can come back with additional information. 

Mr. HURD. Who would be the person that would set that up so 

Mr. Blackburn has his MGT working capital fund? 

Mr. JAMES. Chairman, they’re—inside our CIO organization we 

have a finance organization that’s dedicated to managing our appropriation every year, so that is our—internally, we call that 

ITRM. That’s our CFO if you will for our CIO organization. He 

would have that responsibility. 

Mr. HURD. Well, will you please deliver a message to him that 

this committee is interested in ensuring that Mr. Blackburn has 

a—or Mr. Blackburn’s replacement has a working capital fund from 

MGT because there is going to be a whole lot of modernization 

going on in the VA. There is going to be savings that are being realized, and because it is such a massive enterprise, that will be 

able to help Mr. Windom hopefully beat that 10-year clock —— 

Mr. JAMES. Sure. 

Mr. HURD.—of getting this implemented. 

Mr. Cussatt, we haven’t even gotten to you because there are so 

many questions about the actual deployment. How are you ensuring when this deployment is being done, that all the appropriate 


KING-6430 with DISTILLER
74 

cybersecurity tools and functions are activated and live to ultimately protect the health data of our veterans? 

Mr. CUSSATT. Thank you, Chairman. So it’s—I see it as my job 

as the CISO for the VA to ensure that cybersecurity is not a barrier 

to interoperability and information-sharing but instead it’s an enabler of it. 

So I came from DOD. I was there for 12 years in the CIO’s office, 

and we rewrote all the DOD policy to better employ the NIST 

standards. And in the year-and-a-half I’ve been at VA, we’ve done 

the same at VA. So we are —— 

Mr. HURD. So, Mr. Cussatt, are we going to have a written policy 

on application security for the Cerner implementation? 

Mr. CUSSATT. I believe the Cerner application will benefit from 

the policy we have writ large for VA that applies to all the systems. 

We’re trying not to build a one—a single instant solution for it. We 

want to build something that’s going to benefit us across the Department and be interoperable with DOD. 

Mr. HURD. So, gentlemen, there are so many questions here. Mr. 

Powner, before I close, do you have any further insights on the rest 

of the conversations that have been going on today? 

Mr. POWNER. Just a comment about the scheduling situation. I 

mean, you have VSE, we have pilots going on, we clearly have a 

module with Cerner. What needs to occur in the scheduling area 

is direction forward. What’s the plan? There needs to be a clear 

plan because right now, it’s duplicative. There’s no other way—it’s 

duplicative. And it’s okay to pilot and do things and test all this, 

but we ultimately need a plan going forward that’s a solid plan 

with the right solution. 

Mr. HURD. Good copy, Mr. Powner. One of the things that I feel 

good about is that I love that many of the folks intimately involved 

in this are veterans. You understand the type of sacrifices your 

compatriots have made. You understand the interest that this service is to many of our veterans. 

But I would say you all are actually doing something that can be life-altering for a lot of folks. A $10 billion project to integrate 

130 different data sets and achieving true interoperability, this will 

be the model. If we are able to integrate DOD in VA, the two largest healthcare providers in the world, then we are going to be able 

to integrate to every other system. 

And so the VA is going to be back in setting the curve and being 

on the cutting edge because you all have achieved the ability to do 

a true longitudinal record so everybody is going to be able to have 

better health outcomes because every doctor they go to, they are 

going to be able to see every other time they went to the doctor. 

We are going to be able to do virtualized research cohorts based on 

this information because it is in the cloud and we are going to be 

able to access it. Mr. Cussatt is going to make sure it is protected 

and anonymized, and then we are going to be able to bring drugs, 

lifesaving drugs to market faster. And so this is the opportunity 

that we have here, and if we can’t do it in 10 years with $10 billion, then it is never going to get done. 

And so I think you all recognize and understand this issue. This 

committee is going to continue to provide oversight and continue to 

get into the weeds. It is great having the talent of folks like my 


KING-6430 with DISTILLER
75 

friend from Montana and the gentleman from the Commonwealth 

of Virginia. We are not going to stop. 

So thank you all for being here. Mr. Powner, it is always great 

having you here. This is an important issue, and I know many of 

my friends around the country are hoping you all succeed. And we 

are going to continue to make sure we are doing our part to make 

sure you have the tools to be successful. So I thank you all for appearing before us today. 

The hearing record will remain open for two weeks for any member to submit a written opening statement or questions for the 

record. And if there is no further business, without objection, the 

subcommittee stands adjourned. 

[Whereupon, at 3:50 p.m., the subcommittee was adjourned.] 


KING-6430 with DISTILLER

KING-6430 with DISTILLER
(77) 

APPENDIX 

MATERIAL SUBMITTED FOR THE HEARING RECORD


KING-6430 with DISTILLER
78 


KING-6430 with DISTILLERInsert offset folio 90 here 30246.051

\Connrcss of tbr ~lnltrb $tatrs 

1!)ou!>r of :l.~rprrsrnt,lti\Jcs 

COMMIITEE ON OVERSIGHT AND GOVERIIMHJT REFORM 

2157 RAYBURI·J H•)U:>f 0"F!,.:;E 8•_;t: Dlrll-'i 

WASHtnGroN. DC 20515-6143 

Opening Statement 

Ranking Member Robin Kelly 

Hearing on "Oversight of IT and Cybersecurity at the Department of Veterans Affairs" 

December 7, 2017 

Thank you, Mr. Chairman. 

Information technology is critical to improving the service and performance of the federal 

government. This is especially true at the Department ofVeterans Affairs, which is one of the 

largest integrated healthcare systems in the United States, serving millions of veterans and their 

families. 

The V A's goal for modernizing its healthcare IT is full interoperability, which would 

allow seamless sharing of health information between the VA and the Department of Defense, as 

well as private healthcare providers. 

The VA is now on its fourth attempt since 200 I to modernize its health care IT system. 

The record has not been good. The VA abandoned two earlier attempts after spending 

billions of dollars. This summer the VA announced that it would scrap its third attempt in favor 

of acquiring the same healthcare IT system as the DOD. 

I do not know what we should make of that, since the VA previously abandoned this 

same approach four years ago. 

Chairman Hurd and I requested that GAO examine the VA's modernization efforts 

because of these red flags. 

We discovered that right now the VA is relying on 138 contractors to help it modernize. 

Some of them are the very same contractors VA had hired and fired, after their previous attempts 

had failed. 

In fact, 34 of the 38 repeat contractors make up about $793 million of the $1.1 billion of 

the contractual obligations related to modernization between fiscal years 2011 through 2016. 
79 


KING-6430 with DISTILLERInsert offset folio 91 here 30246.052

This raises serious concerns. This change in strategy delays actually modernizing and 

makes it harder on veterans who rely on the agency for healthcare. We need to understand 

whether these changes are justified. 

I want to hear today what the agency is doing to hold this army of contractors 

accountable. I also want to hear about the progress made towards interoperability and improving 

the ability to track patient outcomes. 

Getting these efforts right and improving VA operations and infonnation security are 

essential to regaining the trust and confidence of the American public that the VA is taking care 

of our Nation's veterans. 

Thank you, Mr. Chainnan. 

Contact: Jennifer Werner, Communications Director, (202) 226-5181. 

2 
80 


KING-6430 with DISTILLERInsert offset folio 92 here 30246.053

Oversight of IT and Cybersecurity at the Department of Veterans Affairs 

House Committee on Oversight and Government Reform 

Subcommittee on Information Technology 

2:00PM, Thursday December 7, 2017 

2154RHOB 

Rep. Gerald E. Connolly (D-VA) 

Mr. Chainnan, thank you for hold today's important oversight hearing on the infonnation 

technology (IT) systems at the Department of Veterans' Affairs (VA), including the agency's 

grade on the most recent Federal Infonnation Technology Acquisition Refonn Act (FIT ARA) 

scorecard, the agency's modernization efforts, and the development of an interoperable 

electronic health records system. 

On the most recent FITARA Scorecard, the VA received a grade ofB+, scoring A's in 

the categories of"agency CIO authority enhancements" and "software licensing." However, the 

VA received a failing grade on the data center optimization initiative. According to the 

Government Accountability Office (GAO), the V A's progress toward closing data centers and 

realizing the associated cost savings lagged behind that of other covered agencies." The VA has 

415 data centers and as of August 2017, only 39 of those centers have closed. In its testimony, 

GAO also noted that the VA anticipates another 10 data centers will be closed by the end of 

fiscal year 2018. These numbers fall well short of the target set by OMB, which calls for a total 

of 130 data center closures at the agency. The VA must do more to consolidate and optimize its 

data centers and use the cost savings to reinvest in the enterprise and upgrade its legacy IT 

systems. 

Despite a B+ grade on the FITARA Scorecard, for the 181

h straight year, the Department 

of Veterans' Affairs Office of Inspector General (OIG) designated the VA's cybersecurity a 

material weakness this past June. In response to the OIG's findings the VA Office oflnfonnation 

and Technology noted that it has made significant progress across all33 of the IG's 

recommendations. As the VA continues its seemingly endless Electronic Health Record (EHR) 

Modernization effort, it must significantly improve its cybersecurity posture and work quickly to 

ensure that patches and vulnerabilities are closed in a timely manner. I look forward to hearing 

more about the agency's progress towards closing the IG's recommendations and whether the 

VA expects cybersecurity to remain a material weakness after the Federal Infonnation Security 

Modernization Act (FISMA) Audit for Fiscal Year 2017. 

The cybersecurity and infonnation technology modernization challenges faced by the VA 

are not helped by the leadership changes at the Office oflnfonnation and Technology. Today's 

witness, Mr. Scott Blackburn, has the title of Acting CIO but has only been in that position for 

the past two months. The previous Acting CIO retired in October after only ten months in the 
81 


KING-6430 with DISTILLERInsert offset folio 93 here 30246.054

position. When I met with Mr. Blackburn earlier this week, he understood the importance and 

benefits of data center consolidation and IT modernization, specifically the Electronic Health 

Record Modernization Initiative. However, Mr. Blackburn is only filling in until the President 

nominates and the Senate confirms a permanent CIO. While I hope Mr. Blackburn can ably lead 

the Office of Information and Technology until a permanent CIO is in place, there is no 

replacement for permanent and sustained leadership, especially during this critical time. 

Finally, I would like to raise my concerns with documented problems at the DC VA 

Medical Center. Earlier this year, the VA OIG found serious and troubling deficiencies at the 

Medical Center that placed patients at unnecessary risk. Among several concerning problems, the 

OIG found that there was no effective digital inventory system for managing the availability of 

medical equipment and supplies used for patient care, that there was no effective system to 

ensure that supplies and equipment that were subject to patient safety recalls were not used on 

patients, and that 18 of the 25 sterile satellite storage areas for supplies were dirty. These 

problems are completely unacceptable. While the Office oflnformation and Technology is not 

responsible for these problems, it can be an asset in implementing an effective digital inventory 

management system. It is important that the Office oflnformation and Technology is involved in 

all of the agency's IT related decisions in order to ensure that any new system is compatible with 

existing systems and that they can talk to each other. If the new inventory system at DC VA is 

not compatible with existing VA systems, then the VA will not be able to resolve issues raised 

by the OIG. 

2 
82 


KING-6430 with DISTILLERInsert offset folio 94 here 30246.055

Table 1: Key Contractors and the Amounts (in millions) Obligated to Each for Contracts on iEHR 

and VistA Evolution from 2011-2016 

24.3 57.6 81.9 

Harris Corporation 39.3 34.0 73.3 

Technatomy Corporation 18.4 46.7 65.0 

Booz Allen Hamilton, Inc. 7.8 53.6 61.4 

The MITRE Corporation 6.3 35.6 41.8 

SBG Technology Solutions 6.3 24.8 31.1 

LongView International Technology Solutions, Inc. 11.9 15.8 27.7 

By Light Professional IT Services, LLC 4.4 23.3 27.7 

Business Information Technology Solutions, Inc. 10.4 13.8 24.2 

Systems Research and Applications Corporation 3.0 15.3 18.3 

CACI International, Inc. 6.3 4.4 10.7 

Open Source Electronic Health Record Agent, Inc. 4.9 4.6 9.5 

Total for 15 key contractors 177.1 563.8 740.9 

Source GAO analysis of VA contract data on 1EHR and V1stA Evo!ut1on 1 GA0-18~208 
83 


KING-6430 with DISTILLERInsert offset folio 95 here 30246.056

Table 2: Key Contractors and the Amounts the Department of Veterans Affairs (VA) Obligated to 

Contracts Supporting iEHR and VistA Evolution for Development, Project Management, and 

Operations and Maintenance During 2011-2016 

VistA 

Modernization 

Key contractor name effort Types of expected contractor activities 

Project Operations and 

Development management maintenance 

VistA Evolution 142.9 0.2 1.4 

Systems Made Simple, Inc. iEHR 2.9 2.9 3.7 

VistA Evolution 10.2 59.4 13.0 

LLC iEHR 14.8 7.1 2.3 

VistA Evolution 37.4 15.5 4.7 

Harris Corporation iEHR 32.4 4.5 2.4 

VistA Evolution 27.0 .1 6.9 

Technatomy Corporation iEHR 0 18.4 0 

VistA Evolution 17.2 17.1 12.4 

Booz Allen Hamilton, Inc. iEHR 3.1 4.7 

VistA Evolution 28.3 24.5 0.8 

The MITRE Corporation iEHR 0.6 5.6 0 

VistA Evolution 5.4 30.2 0 

SSG Technology Solutions iEHR 0 6.3 0 

VistA Evolution 1.1 23.7 0 

Technology Solutions, Inc. iEHR 5.8 45 1.7 

Services, LLC iEHR 4.4 0 0 
84 


KING-6430 with DISTILLERInsert offset folio 96 here 30246.057

Business Information 

Technology Solutions, Inc. iEHR 2.5 7.9 0 

VistA Evolution 2.0 11.9 0 

Research and 

Applications Corporation iEHR 2.2 0.6 0.2 

14.0 1.0 0.3 

Gerner Corporation iEHR 3.8 2.2 0.3 

VistA Evolution 0 0 7.1 

CACI International, Inc. iEHR 6.3 0 0 

VistA Evolution 4.0 0 .4 

Open Source Electronic 

Health Record Agent, Inc. iEHR 4.9 0 0 

VistA Evolution 0 0 4.6 

Totals for 15 key 

contractors 410.6 255.9 74.4 

Source: GAO analys1s of VA contract data on iEHR and VistA Evolution. 1 GA0~16-208 
85 

Æ 


KING-6430 with DISTILLERInsert offset folio 97 here 30246.058