Year 2000 Computing Crisis: Action Needed to Ensure Continued Delivery of Veterans Benefits and Health Care Services
Published: 1999-04-15T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Pursuant to a congressional request, GAO discussed the Department of Veterans Affairs (VA) year 2000 readiness, focusing on: (1) VA's ability to deliver benefits and health care services through the turn of the century; and (2) the readiness of automated systems that support such delivery, the compliance status of biomedical equipment used in patient care, and the year 2000 readiness of the pharmaceutical and medical-surgical manufacturers upon which VA relies.
section_title: What GAO Found
paragraphs: GAO noted that: (1) VA continues to make progress in its year 2000 readiness; (2) however, key actions remain to be performed; (3) for example, the Veterans Benefits Administration and Veterans Health Administration (VHA) have not yet completed testing of their mission-critical systems to ensure that these systems can reliably accept future dates--such as January 1, 2000; (4) also, VHA has not completed assessments for its facility systems, which can be essential to ensuring continuing health care; (5) in addition, neither VA nor the Food and Drug Administration have implemented GAO's prior recommendation to review the test results for biomedical equipment used in critical care/life support environments; (6) further, VHA's pharmaceutical operations are at risk because the automated systems supporting its consolidated mail outpatient pharmacies are not year 2000 compliant; (7) VHA does not know if its medical facilities will have a sufficient supply of pharmaceutical and medical-surgical supplies on hand, because it does not have complete information on the year 2000 readiness of these manufacturers; and (8) it is critical that these concerns be addressed if VA is to continue to reliably deliver benefits and health care.

section_title: Letter
paragraphs: We appreciate the opportunity to participate in today’s hearing on the  readiness of the Department of Veterans Affairs (VA) to deliver benefits and  health care services through the turn of the century.  We will focus on the  Year 2000 (Y2K) readiness of automated systems that support such  delivery, the compliance status of biomedical equipment used in patient  care, and the Y2K readiness of the pharmaceutical and medical-surgical  manufacturers upon which VA relies.  In discussing biomedical equipment  and pharmaceutical products, we will also share with you information on  the Food and Drug Administration’s (FDA) Y2K efforts.
In brief, VA continues to make progress in its Y2K readiness.  However, key  actions remain to be performed.  For example, the Veterans Benefits  Administration (VBA) and Veterans Health Administration (VHA) have not  yet completed testing of their mission-critical systems to ensure that these  systems can reliably accept future dates--such as January 1, 2000.  Also,  VHA has not  completed assessments for its facility systems, which can be  essential to ensuring continuing health care.  In addition, neither VA nor  FDA have implemented our prior recommendation to review the test  results for biomedical equipment used in critical care/life support  environments.  Further, VHA’s pharmaceutical operations are at risk  because the automated systems supporting its consolidated mail outpatient  pharmacies are not Y2K compliant.  Finally, VHA does not know if its  medical facilities will have a sufficient supply of pharmaceutical and  medical-surgical supplies on hand because it does not have complete  information on the Y2K readiness of these manufacturers.  It is critical that  these concerns be addressed if VA is to continue reliably delivering benefits  and health care.
subsections: section_title: Key Actions Remain to Ensure That VA Can Deliver Benefits and Health Care Into the Next Century
paragraphs: Like many organizations, VA faces the possibility of computer system  failures at the turn of the century due to incorrect information processing  relating to dates.  The reason for this is that in many systems, the year 2000  is indistinguishable from 1900, since the year is represented only by “00.”   This could make veterans who are eligible for benefits and medical care  appear ineligible.  If this happens, the issuance of benefits and the  provision of medical care that veterans rely on could be delayed or  interrupted.
As we reported last August, VBA had made progress in addressing the  recommendations in our May 1997 report and making its information  systems Y2K compliant.  It reported it had renovated 75 percent of its  mission-critical applications as of June 1998.  At the same time, VHA  reported it had assessed all and renovated the vast majority of its mission- critical information systems.
Despite this progress, VBA was making limited progress in renovating two  key mission-critical applications--the compensation and pension online  application and the Beneficiary Identification and Record Locator Sub- System.  And, except for its Insurance Service, VBA had not developed  business continuity and contingency plans for its program services-- Compensation and Pension (the largest), Education, Loan Guaranty, and  Vocational Rehabilitation and Counseling--to ensure that they would  continue to operate if Y2K failures occurred.
VHA’s Y2K program likewise had areas of concern.  For example, although  VHA’s medical facilities had hospital contingency plans, as required by the  Joint Commission on Accreditation of Healthcare Organizations, they had  not yet completed Y2K business continuity and contingency plans.  To  address these areas and to reduce the likelihood of delayed or interrupted  benefits and health care services, we recommended that VA reassess its Y2K mission-critical efforts for the compensation and  pension online application and the Beneficiary Identification and  Record Locator Sub-System, as well as other information technology  initiatives, such as special projects, to ensure that the Y2K efforts have  adequate resources, including contract support, to achieve compliance  in time; establish critical deadlines for the preparation of business continuity  and contingency plans for each core business process or program  service so that mission-critical functions affecting benefits delivery can  be carried out even if software applications and commercial-off-the- shelf (COTS) products fail, including a description of resources, staff  roles, procedures, and timetables needed for implementation; and ensure rapid development of business continuity and contingency plans  for each medical facility so that mission-critical functions affecting  patient care can be carried out if software applications, COTS products,  and/or facility-related systems and equipment do not function properly,  including a description of resources, staff roles, procedures, and  timetables needed for implementation.
subsections: section_title: VA Continues to Make Progress
paragraphs: VA has been responsive to our recommendations.  For example, VBA  reassessed its mission-critical efforts for the compensation and pension  online application and the Beneficiary Identification and Record Locator  Sub-System, as well as other information technology initiatives.  It also  reallocated resources to ensure that the Y2K efforts had adequate  resources, including contract support, to achieve compliance.
In addition, VBA completed a draft business continuity and contingency  plan in January 1999 for its core business processes, as well as a related  planning template for its regional offices.  The plan provides a high-level  overview of the resources, staff roles, procedures, and timetables for its  implementation.  It addresses risks, including mitigation actions to reduce  the impact of Y2K-induced business failures, and analyzes the effect on  each business line of a number of potential Y2K disasters--such as loss of  electrical power, loss of communications, loss of data processing  capabilities, and failure of internal infrastructure.  According to VBA, the  plan, which it expects to test this August, is an evolving document, to be  revised and updated periodically until January 1, 2000.
VBA’s plan makes no reference to contingencies for the failure of three of  VBA’s benefit payment systems--Compensation and Pension, Education,  and Vocational Rehabilitation and Counseling.  However, it is currently  developing a payment contingency plan for these systems and expects this  to be completed in May 1999.  A VBA official told us that the payment  contingency plan should have been referenced in VBA’s business continuity  and contingency plan and will be in future versions.  The current plan also  does not contain the designation of an information technology security  coordinator and a physical security coordinator--individuals that VBA  acknowledges are essential to the agency’s Y2K efforts--with responsibility  for ensuring overall security for VBA's network and web site and backing  up data storage before, during, and following January 1, 2000.  This type of  information will be necessary if security-related failures occur.  According  to VBA, it expects to designate these individuals by August 1999.
VHA has also made progress in developing business continuity and  contingency plans for its medical facilities.  Last month, VHA issued its  Patient-Focused Year 2000 Contingency Planning Guidebook to its medical  facilities describing actions they can take to minimize Y2K-related  disruptions to patient care.  The guidebook discusses how the facilities  should develop contingency plans for each major hospital function--such as  radiology, pharmacy, and laboratory--as well as each major support  function--such as telecommunications, facility systems, medical devices,  and automated information systems.  The guidebook also contains  examples of plans, policies, and solutions for problems that a medical  facility may face and provides Y2K templates describing the areas a facility  should address by specific hospital function.  VA provided this guidebook  to the medical facilities early last month and expects the facilities to use it  to prepare their individual business continuity and contingency plans, set  to be completed by April 30.  The guidebook stresses that these plans  should be tested and suggests that the medical facilities begin testing in  June.
The guidebook addresses external emergency preparedness as well as  internal operations.  Specifically, it discusses three functions that medical  facilities should perform in order to ensure that potential external hazards  are considered and planned for.  These are (1) performing an assessment of  hazard vulnerabilities--that is, the types and kinds of Y2K problems that are  anticipated within the community, (2) conducting an inventory of  community resources--people, money, clinical space, supplies, and  equipment--available to address these hazards, and (3) closing the gap  between vulnerabilities and capabilities by putting into place measures that  will mitigate potential disruptions in critical services by developing new  working relationships with various government agencies, non-VA health  care organizations, and vendors of critical supplies.
In addition to implementing our recommendations, VA continues to make  progress renovating, validating, and implementing its systems.  On March 31, 1999, VA reported to the Office of Management and Budget  (OMB) that the department has renovated and implemented all of the  mission-critical applications supporting its 11 systems areas.  As shown in  table 1, VBA has six of these areas, and VHA has two.
section_title: Testing of Mission-Critical Systems Not Yet Complete
paragraphs: Complete and thorough Y2K testing is essential to providing reasonable  assurance that new or modified systems will process dates correctly and  will not jeopardize an organization’s ability to perform core business  operations.  Because the Y2K problem is so pervasive, potentially affecting  an organization’s systems software, applications software, databases,  hardware, firmware, embedded processors, telecommunications, and  interfaces, the requisite testing can be extensive and expensive.   Experience is showing that Y2K testing is consuming between 50 and 70  percent of a Y2K project’s time and resources.
According to our Y2K guide, to be done effectively, testing should be  planned and conducted in a structured and disciplined fashion.  Our guide  describes a step-by-step framework for managing Y2K testing, which  includes the following key processes:
Software unit testing to verify that the smallest defined module of  software (individual subprograms or procedures) continues to work as  intended.
Software integration testing to verify that units of software, when  combined, continue to work together as intended.  Typically, integration  testing focuses on ensuring that the interfaces work correctly and that  the integrated software meets requirements.
System acceptance testing to verify that the complete system--that is,  the full complement of application software running on the target  hardware and systems software infrastructure--satisfies specific  requirements and is acceptable to users.  This testing can be run  separately or in some combination in an operational environment  (actual or simulated) and collectively verifies that the entire system  performs as expected.
According to VBA and VHA officials, their testing criteria were based on  their software development life cycle guidance documents.  They said that  upon completion of software unit and integration testing, a system is  considered Y2K compliant.  They said this type of testing had been  completed for all of their mission-critical systems.
As of March 31, 1999, neither VBA nor VHA had completed systems  acceptance testing--which requires that each system be tested, including  full forward-date testing, on a compliant platform--for all their mission- critical systems.  Specifically, according to VBA officials, the agency had  completed systems acceptance testing for half of its mission-critical  systems--Insurance, Loan Guaranty, and Vocational Rehabilitation and  Counseling.  According to VBA’s March 1999 draft test plan, systems  acceptance testing of the Compensation and Pension and most of the  Education systems was to start in mid-April 1999.  According to a VBA  official, one of the reasons for the late systems testing was that the IBM  platform at its Hines, Illinois, data center was not made Year 2000 compliant until the compiler was upgraded in February 1999.  According  to VBA, the Compensation and Pension and most of the Education systems  will be future-date tested throughout April.
VHA also plans to begin system acceptance testing of its mission-critical  systems this month and complete it this June.  According to VHA officials,  they could not perform this type of testing before March of this year  because VHA did not have a separate Y2K-compliant test environment to  isolate the testing from the hospital systems in use.
In addition to testing of individual systems, end-to-end testing of multiple  systems is also critical.  End-to-end testing, as defined in our test guide,  verifies that a defined set of interrelated systems, which collectively  support an organizational core business area or function, continues to  work as intended in an operational environment, either actual or simulated.   For example, in order to successfully process a compensation benefit  payment to a veteran, VBA’s Compensation and Pension System must work  correctly with its Beneficiary Identification and Records Locator Sub- System, Treasury’s Financial Management System, the Federal Reserve  System, and financial institution systems.
VBA and VHA plan to conduct end-to-end testing between now and this  July.  VBA is defining end-to-end testing as verification that core mission- critical business functions, including benefit payments and vendor and  payroll payments, process correctly.  The interfaces between VBA’s benefits  system and Treasury’s Financial Management System are to be tested in  May.  VBA also plans to test transactions that interface with VHA systems,  such as information related to veteran eligibility.  VHA is defining end-to- end testing as verification that core mission-critical business functions,  including patient-care transactions and vendor and payroll payments,  process correctly.  Once these tests are completed, VBA and VHA plan to  conduct a “business process simulation” during the July 4, 1999, weekend.   This simulation of day-to-day work at VA is to include users at the VBA  regional offices and VHA test laboratories, who will simulate various  transactions and process them through a set of interrelated systems  necessary to complete a core business function. VBA expects to pretest the  business process simulation during May.
section_title: Assessment of VHA’s Facility Systems Not Yet Complete
paragraphs: VA’s facility systems are essential to the continued delivery of health care  services.  For example, heating, ventilating, and air conditioning equipment  is used by hospitals to ensure that contaminated air is confined to a  specified area such as an isolation room or patient ward.  If computer  systems used to maintain these systems were to fail, any resulting climate  fluctuations could affect patient safety.
Despite their importance, VHA has not yet completed its assessment of  facility systems.  As of February 28, 1999, VHA medical facilities reported  that they had assessed 55 percent of their facility systems.  According to  VHA’s Director of Safety and Technical Programs, the remaining 45 percent  have not been fully assessed primarily because (1) facility systems tend to  be a combination of unique elements that have to be separately assessed  for compliance--a time-consuming process--and (2) VHA is still awaiting  compliance status information from facility system manufacturers.  VHA  has not established milestones for completing its assessment and  implementation of compliant facility systems. To help ensure that sufficient  time remains to complete these activities, we recommend that VHA  consider setting such deadlines.
In the event that facility-related systems and equipment do not function  properly due to Y2K problems, VHA medical facilities will need to ensure  that they have business continuity and contingency plans addressing how  mission-critical functions affecting patient care will be carried out.   According to VHA’s Director of Safety and Technical Programs, most of its  facility systems have some kind of manual override or reset that will allow  them to continue functioning after a Y2K problem.  He agreed, however,  with the importance of developing contingency plans that fully document  continued delivery of essential services in the event of a facility system  failure.  VHA medical facilities expect to have individual business  continuity and contingency plans completed by April 30.
On April 14, 1999, VA informed us that its February 28, 1999, report  contained an error.  The corrected numbers for facility systems at the end  of February were 91 percent assessed and 9 percent not assessed.
section_title: Biomedical Equipment: Additional Status Information Available, But Test Results Not Reviewed
paragraphs: The question of whether medical devices such as magnetic resonance  imaging (MRI) systems, x-ray machines, pacemakers, and cardiac  monitoring equipment can be counted on to work reliably on and after  January 1, 2000, is also critical to VHA.  To the extent that biomedical  equipment uses embedded computer chips, it is vulnerable to the Y2K  problem.  Such vulnerability carries with it possible safety risks.  This could  range from the more benign--such as incorrect formatting of a printout--to  the most serious--such as incorrect operation of equipment with the  potential to adversely affect the patient.  The degree of risk depends in  large part on the role the equipment plays in a patient’s care.
subsections: section_title: Additional Biomedical Equipment Status Information Available
paragraphs: Last September we testified before this Subcommittee that VHA was  making progress in assessing its biomedical equipment, but that it did not  know the full extent of the Y2K problem with this equipment because it had  not received compliance information from 398 manufacturers (26.7  percent). According to VHA, as of March 16, 1999, the number of  nonresponsive manufacturers had been reduced to 126 (8.5 percent).  As  shown in table 2, about 19 percent of the manufacturers in VHA’s database  of suppliers had at least one biomedical equipment item that was either  noncompliant or conditionally compliant.
To identify specific biomedical equipment in the inventories of VHA’s  medical facilities that still require Y2K compliance status information from  manufacturers, VHA’s Chief Network Officer sent a letter to the directors of  VHA's 22 Veterans Integrated Service Networks (VISN).  This letter  requested that they (1) review VHA’s list of manufacturers that have yet to  respond and compare it with a list of manufacturers from whom their  medical facilities still require compliance information and (2) indicate the  equipment item that the facility owns for each manufacturer.  According to  VHA’s Y2K project director, as of mid-March--with 135 of 147 medical  reporting sites--47 biomedical equipment items involving 35 manufacturers  were identified as still requiring compliance status information.  The  project director told us that VHA medical facilities have been instructed to  replace or eliminate equipment in their inventories for which they do not  know the compliance status by June 30.  According to VHA's February 1999  status report on medical devices, medical facilities estimated that the total  cost of renovations will be about $41 million.
We have previously reported that most manufacturers citing noncompliant  products listed incorrect display of date and/or time as the Y2K problem.   According to VA, these cases do not present a risk to patient safety because  health care providers, such as physicians and nurses, can work around the  problem.  Of more serious concern are situations in which devices depend  on date calculations--the results of which can be incorrect.  One  manufacturer cited the example of a product used for planning delivery of  radiation treatment using a radioactive isotope as the source.  An error in  calculating the strength of the radiation source on the day of treatment  could result in a dose that is too high or too low, which could have an  adverse effect on the patient.  Other examples of equipment presenting a  risk to patient safety identified by manufacturers to FDA include  hemodialysis delivery systems; therapeutic apheresis systems; alpha- fetoprotein kits for neural tube defects; various types of medical imaging  equipment; and systems that store, track, and recall images in  chronological order.
To track the compliance status of its biomedical equipment, VHA uses a  monthly status report on medical devices based on information provided  by the VISNs.  According to the February 1999 report, approximately  426,000 of 531,000 medical devices in VHA medical facilities are compliant.   Of the remaining devices, 86,452 were identified as conditional-compliant  or were not assessed for Y2K compliance because the manufacturers  certified that the equipment contained no software or embedded chips, and  19,073 were reported as being noncompliant.  Of the noncompliant devices  identified, 15,621 are to be repaired, 1,582 are to be replaced, 757 are to be  used as is, 255 are to be retired, and 858 are still awaiting a decision on the  remedy.  According to VHA’s Chief Biomedical Engineer, most of the  noncompliant devices identified incorrectly displayed date/time.
As we reported last September, FDA was also trying to determine the Y2K  compliance status of biomedical equipment.  Its goal is to provide a  comprehensive, centralized source of information on the Y2K compliance  status of biomedical equipment used in the United States and make this  information publicly available on a web site.  At the time, however, FDA  had a disappointing response rate from manufacturers to its letter  requesting compliance information.   And, while FDA made this  information available to the public, it was not detailed enough to be useful.   Specifically, FDA’s list of compliant equipment lacked information on  particular make and model.
To provide more detailed information on the compliance status of  biomedical equipment, as well as to integrate more detailed compliance  information gathered by VHA, we recommended that VA and the  Department of Health and Human Services (HHS) jointly develop a single  data clearinghouse that provides such information to all users.  We said  development of the clearinghouse should involve representatives from the  health care industry, such as the Department of Defense and the Health  Industry Manufacturers Association.  We recommended that the  clearinghouse contain such information as (1) the compliance status of all  biomedical equipment by make and model and (2) the identity of  manufacturers that are no longer in business.  We also recommended that  VHA and FDA determine what actions should be taken regarding  biomedical equipment manufacturers that have not provided compliance  information.
In response to our recommendation, FDA--in conjunction with VHA--has  established the Federal Year 2000 Biomedical Equipment Clearinghouse.   With the assistance of VHA, the Department of Defense, and the Health  Industry Manufacturers Association, FDA has made progress in obtaining  compliance-status information from manufacturers.  For example,  according to FDA, as of April 5, 1999, 4,251 biomedical equipment  manufacturers had submitted data to the clearinghouse.  As shown in  figure 1, about 54 percent of the manufacturers reported having products  that do not employ a date, while about 16 percent reported having date- related problems such as incorrect display of date/time.  FDA is still  awaiting responses from 399 manufacturers.
FDA has also expanded the information in the clearinghouse.  For example,  users can now find information on manufacturers that have merged with or  have been bought out by other firms.  In collaboration with the National  Patient Safety Partnership, FDA is in the process of obtaining more  detailed information from manufacturers on noncompliant products, such  as make and model and descriptions of the impact of the Y2K problem on  products left uncorrected.
section_title: Review of Biomedical Equipment Test Results Lacking
paragraphs: We reported last September that VHA and FDA relied on manufacturers to  validate, test, and certify that equipment is Y2K compliant.  We also  reported that there was no assurance that the manufacturers adequately  addressed the Y2K problem for noncompliant equipment because FDA did  not require medical device manufacturers to submit test results to it  certifying compliance.  Accordingly, we recommended that VA and HHS  take prudent steps to jointly review manufacturers’ compliance test results  for critical care/life support biomedical equipment.  We were especially  concerned that VA and FDA review test results for equipment previously  determined to be noncompliant but now deemed by manufacturers to be  compliant, or equipment for which concerns about compliance remain.  We  also recommended that VA and HHS determine what legislative, regulatory,  or other changes were necessary to obtain assurances that the  manufacturers’ equipment was compliant, including performing  independent verification and validation of the manufacturers’  certifications.
At the time, VA stated that it had no legislative or regulatory authority to  implement the recommendation to review test results from manufacturers.   In its response, HHS stated that it did not concur with our recommendation  to review test results supporting medical device equipment manufacturers’  certifications that their equipment is compliant.  It believed that the  submission of appropriate certifications of compliance was sufficient to  ensure that the certifying manufacturers are in compliance.  HHS also  stated that it did not have the resources to undertake such a review, yet we  are not aware of HHS’ requesting resources from the Congress for this  purpose.
More recently, VHA’s Chief Biomedical Engineer told us that VHA medical  facilities are not requesting test results for critical care/life support  biomedical equipment; they also are not currently reviewing the test results  available on manufacturers’ web sites.  He said that VHA’s priority is  determining the compliance status of its biomedical equipment inventory  and replacing noncompliant equipment.  The director of FDA’s Division of  Electronics and Computer Science likewise said FDA sees no need to  question manufacturers’ certifications.
In contrast to VHA’s and FDA’s positions, some hospitals in the private  sector believe that testing biomedical equipment is necessary to prove that  they have exercised due diligence in the protection of patient health and  safety.  Officials at three hospitals told us that their biomedical engineers  established their own test programs for biomedical equipment, and in many  cases contacted the manufacturers for their test protocols.  Several of  these engineers informed us that their testing identified some  noncompliant equipment that the manufacturers had certified as  compliant.  According to these engineers, to date, the equipment found to  be noncompliant all had display problems and was not critical care/life  support equipment.  We were told that equipment found to be incorrectly  certified as compliant included a cardiac catheterization unit, a pulse  oxymeter, medical imaging equipment, and ultrasound equipment.
VHA, FDA, and the Emergency Care Research Institute continue to  believe that manufacturers are best qualified to analyze embedded systems  or software to determine Y2K compliance.  They further believe that  manufacturers are the ones with full access to all design and operating  parameters contained in the internal software or embedded chips in the  equipment.  VHA believes that such testing can potentially cause  irreparable damage to expensive health care equipment, causing it to lock  up or otherwise cease functioning.  Further, a number of manufacturers  also have recommended that users not conduct verification and validation  testing.
We continue to believe that rather than relying solely on manufacturers'  certifications, organizations such as VHA or FDA can provide users of  medical devices with a greater level of confidence that the devices are Y2K  compliant through independent reviews of manufacturers’ compliance test  results.  The question of whether to independently verify and validate  biomedical equipment that manufacturers have certified as compliant is  one that must be addressed jointly by medical facilities’ clinical staff,  biomedical engineers, and corporate management.  The overriding  criterion should be ensuring patient health and safety.
section_title: VHA Pharmaceutical Operations Also Face Y2K Risks
paragraphs: Another critical component to VA’s ability to deliver health care at the turn  of the century is ensuring that the automated systems supporting VHA’s  medical facility pharmacies and its consolidated mail outpatient  pharmacies (CMOP) are Y2K compliant.  VHA reported that in 1998, it filled  about 72 million prescriptions for 3.4 million veterans, at an estimated cost  of about $2 billion.  About half of the prescriptions were filled by the over  200 pharmacies located in VA’s medical centers, clinics, and nursing homes.   These pharmacies rely on the pharmaceutical applications in the Veterans  Health Information Systems Architecture (VISTA) for (1) drug distribution  and inventory management, (2) dispensing of drugs to inpatients and  outpatients, (3) patient medication information, and (4) an electronic  connection between the pharmacies and the CMOPs.  Y2K failures in these  applications could impair the pharmacies’ ability to fill prescriptions.
The remaining 50 percent of VHA’s prescriptions are filled by seven CMOPs,  geographically located throughout the United States.  These facilities are  supported by automated systems provided by one of two contractors-- SI/Baker, Inc. and Siemens ElectroCom.  For example, the CMOP  electronically receives a prescription for a veteran through the medical  center.  The prescription is downloaded to highly automated dispensing  equipment to be filled.  The filled prescription is then validated by a  pharmacist who compares the medication against a computerized image of  the prescribed medication.  Afterward, the prescription is packaged and an  automatically generated mailing label is applied for delivery to the veteran.   Finally, the medical center is electronically notified that the prescription  has been filled.  Because of the reliance on automation, the CMOPs’ ability  to fill prescriptions could be delayed or interrupted if a Y2K failure  occurred.
VHA has determined that the automated systems supporting its CMOPs are  not Y2K compliant. Specifically, neither of the systems provided by their  contractors are Y2K compliant.  According to the Y2K coordinator for the  SI/Baker facilities, failure to make the SI/Baker systems Y2K compliant  may delay the filling of outpatient prescriptions.  The SI/Baker systems are  used by three of VHA’s CMOPs--Hines, Illinois; Charleston, South Carolina;  and Murfreesboro, Tennessee; they handle about 58 percent of all  prescriptions filled by CMOPs.  In contrast to the SI/Baker systems,  according to a contractor hired by the CMOPs that use these systems,  failure to make the Siemens ElectroCom systems Y2K compliant may result  in delays in processing management reports for prescriptions filled, but not  the actual filling of prescriptions.
Although the CMOPs plan to replace their noncompliant systems with  compliant ones, these systems are not scheduled to be implemented until  mid- to late-1999.  As shown in table 3, the earliest estimated completion  date for implementing a compliant system is June 30, 1999, while the latest  is December 1, 1999.  This leaves little time to address any unexpected  implementation problems.
Given the late schedule for implementing compliant systems, it is crucial  that the CMOPs develop business continuity and contingency plans to  ensure that veterans will continue to receive their medications if these  systems are not implemented in time or fail to operate properly.  As of  March 31, VA had not completed a business continuity and contingency  plan for the CMOPs.  The Y2K coordinator for the Siemens ElectroCom  system has been tasked with developing this plan, which is to be completed  by the end of this month.
Further, VA did not include the CMOP systems in its quarterly reports of  mission-critical systems to OMB.  According to VHA’s Y2K project director,  VHA considered the CMOP systems to be COTS products and, therefore,  did not report them as mission-critical systems.  Given the criticality of  these systems to VHA’s ability to fill prescriptions at the turn of the century,  we believe VA should reassess this decision, reporting CMOPs as mission- critical to VA top management and OMB to help ensure that necessary  attention is paid to and action is taken on them.
subsections: section_title: VA Taking Action to Determine Y2K Readiness of Pharmaceutical and Medical-Surgical Manufacturers
paragraphs: VA, like other users of pharmaceutical and medical-surgical products,  needs to know whether it will have a sufficient supply of these items for its  customers.  Therefore, it has taken a leadership role in the federal  government in determining whether manufacturers supplying these  products to VHA are Y2K-ready.  This information is essential to VHA’s  medical facilities and CMOPs because of their “just-in-time” inventory  policy.  Accordingly, they must know whether their manufacturers’  processes, which are highly automated, are at risk, as well as whether the  rest of the supply chain will function properly.
To determine the Y2K readiness of their suppliers, on January 8, 1999, VA’s  National Acquisition Center (NAC) sent a survey to 384 pharmaceutical  firms and 459 medical-surgical firms with which it does business.  The  survey contained questions on the firms’ overall Y2K status and inquired  about actions taken to assess, inventory, and plan for any perceived impact  that the century turnover would have on their ability to operate at normal  levels.  In addition, the firms were asked to provide status information on  progress made to become Y2K compliant and a reliable estimated date  when compliance will be achieved for business processes such as (1) ordering and receipt of raw materials, (2) mixing and processing  product, (3) completing final product processing, (4) packaging and  labeling product, and (5) distributing finished product to distributors/ wholesalers and end customers.
According to NAC officials, of the 455 firms that responded to the survey as  of March 31, 1999, about 55 percent completed all or part of the survey.   The remainder provided general information on their Y2K readiness status  or literature on their efforts.  As shown in table 4, more than half of the  pharmaceutical firms surveyed responded (52 percent), with just less than  one-third (32 percent) of those respondents reporting that they are  compliant.  Among the pharmaceutical firms that had not responded as of  March 31, however, were two of VA’s five largest suppliers.  The three  large pharmaceutical suppliers that did respond provided general  information on their Y2K readiness status, rather than answering the  survey, and estimated that they will be compliant by June 30, 1999.
Table 4 also shows that 54 percent of the medical-surgical firms surveyed  responded, with about two-thirds of them (166) reporting that they are Y2K  compliant.  All five of VA’s largest medical-surgical suppliers have  responded.  Specifically, two reported being compliant, two reported they  would be compliant by June 30, 1999, and the remaining supplier did not  report an expected compliance date.
On March 17, 1999, NAC sent a second letter to its pharmaceutical and  medical-surgical firms, informing them of VA’s plans to make Y2K readiness  information previously provided to VA available to the public through a  web site (www.va.gov/oa&mm/nac/y2k).  VA made the survey results  available on its web site on April 13, 1999.  The letter also requested that  manufacturers that had not previously responded provide information on  their readiness.  NAC’s Executive Director said that he would personally  contact any major VA supplier that does not respond.  On a broader level,  VHA has taken a leadership role in obtaining and sharing information on  the Y2K readiness of the pharmaceutical industry.  Specifically, VHA chairs  the Year 2000 Pharmaceuticals Acquisitions and Distributions  Subcommittee, which reports to the Chair of the President’s Council on  Year 2000 Conversion.  The purpose of this subcommittee is to bring  together federal and pharmaceutical representatives to address issues  concerning supply and distribution as they relate to the year 2000.  The  subcommittee consists of FDA, federal health care providers, and industry  trade associations such as the Pharmaceutical Research and Manufacturers  of America (PhRMA), the National Association of Chain Drug Stores, and  the National Wholesale Druggists’ Association.  Several of these trade  associations have surveyed their members on their Y2K readiness and  made the results available to the public.  However, the information is not  manufacturer-specific or as detailed as VHA's survey results.
section_title: FDA’s Y2K Efforts for Pharmaceutical and Biological Products Industries Were Initially Focused on Awareness
paragraphs: FDA’s oversight and regulatory responsibility for pharmaceutical and  biological products is to ensure that they are safe and effective for public  use.  Because of its concern about the Y2K impact on manufacturers of  these products, FDA has taken several actions to raise the Y2K awareness  of the pharmaceutical and biological products industries.  In addition, it is  thinking about conducting a survey to determine the industry’s Y2K  readiness.
One of FDA’s actions to raise industry awareness was the January 1998  issuance of industry guidance by the Center for Biologics Evaluation and  Research (CBER) on the Y2K impact of computer systems and software  applications used in the manufacture of blood products.  In addition, as  shown in table 5, FDA has issued several letters to pharmaceutical and  biological trade associations and sole-source drug manufacturers.
Further, on February 11, 1999, FDA’s director of emergency and  investigation operations sent a memorandum on FDA’s interim inspection  policy for the Y2K problem to the directors of FDA’s investigations branch.  The policy emphasizes FDA’s Y2K awareness efforts for manufacturers.  It  states that FDA inspectors are to (1) inform the firm of FDA’s Y2K web page  (URL http://www.fda.gov/cdrh/yr2000/year2000.html), (2) provide the firm  with copies of the appropriate FDA Y2K awareness letter, (3) explain that  Y2K problems could potentially affect aspects of the firm’s operations,  including some areas not regulated by FDA, and that FDA anticipates that  firms will take prudent steps to ensure that they are not adversely affected  by Y2K, and (4) provide firms with a copy of FDA’s compliance policy guide  “Year 2000 (Y2K) Computer Problems.”
In addition, FDA and PhRMA jointly held a government/industry forum on  the Y2K preparedness of the pharmaceutical and biotech industries on  February 22, 1999.  The objectives of this forum were to (1) share  information on Y2K programs conducted by health care providers,  pharmaceutical companies, FDA, and other federal agencies, (2) provide a  vehicle for networking, and (3) raise awareness.
On March 29, 1999, FDA revised its February 11, 1999, interim inspection  policy.  The revision states that field inspectors are now to inquire about  manufacturers’ efforts to ensure that their computer-controlled or date- sensitive manufacturing processes and distribution systems are Y2K  compliant.  Inspectors are to include this information in their reports, along  with a determination of activities that firms have completed or started to  ensure that they will be Y2K compliant.
Further, FDA inspectors may review documentation in cases in which firms  have made changes to their computerized production or manufacturing  control systems to address Y2K problems.  The purpose of this review is to  ensure that the changes were made in accordance with the firms’  procedures and applicable regulations.  If inspectors determine that a firm  has not taken steps to ensure Y2K compliance, they are to notify their  district managers and the responsible FDA center.
FDA’s interim policy describes steps inspectors are to take in reviewing  manufacturers’Y2K compliance.  However, FDA stated that the primary  focus of its inspections for the remainder of 1999 will be to ensure that  products sold in the United States are safe and effective for public use and  comply with federal statutes and regulations, including “good  manufacturing practice” (GMP).  FDA officials explained that the agency  does not have sufficient resources to perform both regulatory oversight of  the manufacturers and in-depth evaluations of firms’ Y2K compliance  activities.
Nevertheless, according to the March 29, 1999, memorandum, field  inspectors are to note any concerns they may have with a firm’s Y2K  readiness in the administrative remarks section of their inspection reports.   These reports are to be reviewed by FDA district managers.  If the Y2K  concern appears to present a serious problem to a firm’s ability to produce  safe, effective medication, the district manager can discuss this issue with  FDA’s Office of Regulatory Affairs and determine a course of action.   However, FDA officials have stressed that the agency cannot take any  regulatory action toward the firm until a Y2K-related problem affects a  pharmaceutical or biological product.
Like VHA, FDA is interested in the impact of Y2K readiness of  pharmaceutical and biological products on the availability of products for  health care facilities and individual patients.  FDA’s Acting Deputy  Commissioner for Policy informed us on March 24, 1999, that the agency is  thinking about surveying pharmaceutical and biological products  manufacturers, distributors, product repackagers, and others in the drug  dispensing chain, on their Y2K readiness and contingency planning.  In  anticipation of a possible survey, the agency has published a notice in the  March 22, 1999, Federal Register regarding this matter.  The Acting Deputy  Commissioner said that potential survey questions on contingency  planning would include steps the manufacturers are taking to ensure an  adequate supply of bulk manufacturing materials from overseas suppliers.  This is a key issue because, as we reported in March 1998, according to  FDA, as much as 80 percent of the bulk pharmaceutical chemicals used by  U.S. manufacturers to produce prescription drugs is imported.
In summary, VBA and VHA continue to make progress in preparing their  mission-critical systems for the year 2000.  However, key actions remain to  be taken in the areas of mission-critical systems testing, VHA facility  systems compliance, and CMOP systems compliance.  We also reiterate the  need for VHA and FDA to take prudent steps to ensure that the test results  of critical care/life support biomedical equipment are obtained and  reviewed.  Finally, VHA needs information on the Y2K readiness of specific  pharmaceutical and medical-surgical manufacturers.  Until this information  is obtained and publicized, VHA medical facilities and veterans will remain  in doubt as to whether an adequate supply of pharmaceutical and biological  products will be available.  FDA and the pharmaceutical and biological  trade associations can play key roles in helping VHA obtain this  information and publicize the results in a single data clearinghouse.
In carrying out this assignment, we reviewed and analyzed VA's Y2K  documents and plans, comparing them against our guidance on Y2K  activities.  We also reviewed and analyzed FDA documentation relating to  its Y2K efforts on biomedical devices and pharmaceutical manufacturers.   In addition, we visited selected VHA medical centers, VA data centers, and  VHA consolidated mail outpatient pharmacies to discuss their Y2K  activities, and interviewed VA and FDA officials on those activities.  We  also interviewed officials of the Emergency Care Research Institute  regarding their statements on biomedical equipment testing.  Finally, we  interviewed selected private hospital officials about their Y2K actions and  pharmaceutical trade associations on their Y2K readiness surveys of  pharmaceutical manufacturers.
Mr. Chairman, this concludes my statement.  I would be pleased to respond  to any questions that you or other members of the Subcommittee may have  at this time.
The first copy of each GAO report and testimony is free. Additional copies are $2 each.  Orders should be sent to the  following address, accompanied by a check or money order made  out to the Superintendent of Documents, when necessary, VISA and  MasterCard credit cards are accepted, also.
Orders for 100 or more copies to be mailed to a single address are  discounted 25 percent.
U.S. General Accounting Office P.O. Box 37050 Washington, DC  20013 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537.
Each day, GAO issues a list of newly available reports and  testimony.  To receive facsimile copies of the daily list or any list  from the past 30 days, please call (202) 512-6000 using a touchtone  phone.  A recorded menu will provide information on how to obtain  these lists.