Computer-Based Patient Records: Better Planning and Oversight By VA, DOD, and IHS Would Enhance Health Data Sharing
Published: 2001-04-30T00:00:00

Fast Facts:

Highlights:
section_title: What GAO Found
paragraphs: In November 1997, the President called for the Department of Veterans Affairs (VA) and the Department of Defense (DOD) to create an interface that would allow the two agencies to share patient health information. By allowing health care providers to electronically share comprehensive patient information, computer-based patient record's (GCPR) should help VA, DOD, and the Indian Health Service (IHS) to improve the quality of care for their beneficiaries. But without a lead entity, a clear mission, and detailed planning to achieve that mission, it is difficult to monitor progress, identify project risks, and develop appropriate contingency plans to keep the project moving forward and on track. Critical project decisions were not made, and the agencies were not bound by those that were made. The VA and DOD Chief Information Officers' (CIO) action to focus on short-term deliverables and to capitalize on existing technologies is warranted and a step in the right direction. However, until problems with the two agencies' existing systems and issues regarding planning, management, and accountability are resolved, project costs will likely continue to increase and implementation of the larger GCPR effort--and its expected benefits--will continue to be delayed.

section_title: Letter
paragraphs: The Department of Veterans Affairs (VA) and the Department of Defense (DOD) combined provide health care services to approximately 12 million veterans, military personnel, and dependents at an annual cost of $34 billion. The Veterans Health Administration (VHA) and the Military Health System (MHS) collect and maintain patient health information in separate systems. The Gulf War exposed many deficiencies in these systems and highlighted the need for VA and DOD to be able to readily access and transfer accurate health data on their respective populations. In December 1992, the Congress asked us to report on how VA and DOD, along with the Indian Health Service (IHS), could share information technology (IT) and patient medical information to provide greater continuity of care, accelerate VA eligibility determinations, and save software development costs. In November 1997, the President called for VA and DOD to create an interface that would allow the two agencies to share patient health information.
In 1998, the Government Computer-Based Patient Record (GCPR) project was initiated by VA, DOD, and IHS, which was included in the effort because of its population-based research expertise and its long-standing relationship with VA. Early project documents stated that, when completed, GCPR would allow health care professionals to “share clinical information via a comprehensive, lifelong medical record.” Given the inherent complexity of such an undertaking and the value of achieving this capability, the Congress directed us to report on the status of the GCPR effort. Specifically, we were asked to (1) describe GCPR’s time frames, costs, and expected benefits; (2) determine whether barriers to the progress of the project exist; and (3) if barriers exist, describe agency actions to address them.
Our review of the GCPR project was based on site visits to VA, DOD, and IHS facilities and on interviews with officials at these facilities and at the agencies’ headquarters, GCPR management and contractors, and medical IT experts from the health care industry. We also reviewed relevant GCPR project documents as well as documents on the three agencies’ health information systems. In addition, we conducted site visits to several private sector health care organizations that are also undertaking efforts to link disparate health information systems, and we interviewed representatives of these organizations about their experiences. We conducted this review from March 2000 through February 2001 in accordance with generally accepted government auditing standards. For more on our scope and methodology, see appendix I.
subsections: section_title: Background
paragraphs: The GCPR effort developed out of VA and DOD discussions about ways to share data in their health information systems and from efforts to create electronic records for active duty personnel and veterans. The patients served by VA’s and DOD’s systems tend to be highly mobile. Consequently, their health records may be at multiple federal and nonfederal medical facilities both in and outside the United States. In December 1996, the Presidential Advisory Committee on Gulf War Veterans’ Illnesses reported on many deficiencies in VA’s and DOD’s data capabilities for handling service members’ health information. In November 1997, the President called for the two agencies to start developing a “comprehensive, life-long medical record for each service member.” In August 1998, 8 months after the GCPR project was officially established, the President issued a directive requiring VA and DOD to develop a “computer-based patient record system that will accurately and efficiently exchange information.” The directive further stated that VA and DOD should “define, acquire, and implement a fully integrated computer-based patient record available across the entire spectrum of health care delivery over the lifetime of the patient” and recognized VA and DOD’s effort to “create additional interface mechanisms that will act as bridges between existing systems.”IHS became involved because of its expertise in population-based research and its long-standing relationship with VA in caring for the Indian veteran population as well as IHS’ desire to improve the exchange of information among its facilities.
Each of the three agencies’ health facilities is linked to their agency’s regional database or an IT center: VA has about 750 facilities in 22 regions, DOD has about 600 MTFs in 14 domestic and overseas medical regions, and IHS has 550 facilities in 12 regions. Currently, these facilities cannot electronically share patient health information across agency lines, and only VA facilities have the capability of sharing certain information across regions.
GCPR is not intended to be a separate computerized health information system, nor is it meant to replace VA’s, DOD’s, and IHS’ existing systems.
GCPR is intended to allow physicians and other authorized users at the agencies’ health facilities to access data from any of the agencies’ other health facilities by serving as an interface among their health information systems (see fig. 1). As envisioned, the interface would compile requested patient information in a temporary or virtual record while appearing on the computer screen in the format of the user’s system. GCPR would divide health data into 24 categories, or “partitions,” including pharmacy, laboratory results, adverse reactions, vital signs, patient demographics, and doctors’ notes.
With this ability to exchange information, GCPR is expected to achieve several benefits, including improving quality of care; providing data for population-based research and public health surveillance; advancing industrywide medical information standards; and generating administrative and clinical efficiencies, such as cost savings.
Several management entities share responsibility for GCPR:   Military and Veterans Health Coordinating Board: This entity was created to ensure coordination among VA, DOD, and the Department of Health and Human Services (HHS) on military and veteran health matters, particularly as they relate to deployed settings, such as the Persian Gulf. The board also oversees implementation of the President’s August 1998 directive. The board consists of the Secretaries of VA, DOD, and HHS.
DOD and VA Executive Council: The council was created to identify and implement interagency initiatives that are national in scope. One initiative is to ensure a smooth transfer of information between DOD’s and VA’s health care systems through efforts such as GCPR. The council comprises VA’s Under Secretary for Health, DOD’s Assistant Secretary for Health Affairs, their key deputies, and the Surgeon General of each military branch.
GCPR Board of Directors: The board was established to set GCPR programmatic and strategic priorities and secure funding from VA, DOD, and IHS. The board consists of the VA Under Secretary for Health and CIOs for MHS and IHS.
GCPR Executive Committee: The Executive Committee sets tactical priorities, oversees project management activities, and ensures that adequate resources are available. The committee membership consists of senior managers from VA, DOD, and IHS.
GCPR is managed on a day-to-day basis by a program office staffed by personnel from VA, DOD, IHS, and the project’s prime contractor, Litton/PRC of McLean, Virginia. Litton/PRC is responsible for building, shipping, installing, configuring, and operating the interface and administering site training. Battelle Memorial Institute of Columbus, Ohio, holds contracts for developing medical “reference models,” which allow for the exchange of data among different systems without requiring standardization. Assisting in the project are government-led work groups, which consist of VA, DOD, and IHS employees and Litton/PRC staff. The work groups’ key tasks include acquisition, finance, legal work, marketing, telecommunications, and documenting clinical practices.
section_title: Time Frames and Cost Estimates Have Expanded, and Expected Benefits Have Been Delayed
paragraphs: Throughout the course of the GCPR project, time frames and cost estimates have expanded, and GCPR’s ability to deliver its expected benefits has become less certain. In 1999, initial plans called for GCPR to begin worldwide deployment October 1, 2000, but target dates for intermediate phases, such as testing, were not met, pushing project deployment out to an undefined date. For example, completion of testing was originally scheduled for September 2000 but was delayed until August 2002 (see fig. 2).
GCPR cost estimates also increased. GCPR was estimated in September 1999 to cost about $270 million over its 10-year life cycle; by August 2000, projections for GCPR stood at $360 million (see table 1). However, GCPR project officials told us that the cost estimates were unreliable and probably understated, in part because some costs—such as computer hardware needed by the project’s contractors—were not included. Other cost estimates, such as those for deployment, could not be verified. In the case of deployment, final decisions affecting costs were not made.
By the end of 2000, it became apparent that the benefits described in GCPR project documents and brochures and on its website—including access to comprehensive, life-long patient information—would not be realized in the near future. According to Litton/PRC, preliminary testing of data transfer among selected VA facilities is demonstrating that the GCPR technology works. However, significant issues in sharing comprehensive patient data have not been adequately addressed. For example, while GCPR managers planned to field test 6 of the 24 data partitions, they had no plans for when other partitions would be tested. Moreover, access was to be limited to patient information in VA’s, DOD’s, and IHS’ health information systems; information in other major data sources, such as TRICARE—DOD’s managed care program—and other third-party providers would not be accessible. Access to patient information would be further limited because full deployment of CHCS II—DOD’s new, more comprehensive health information system, currently under development— has been delayed until 2004 as the result of complications such as limited system capacity and slow response time. With CHCS II, GCPR would provide access to information on immunizations; allergies; and outpatient encounters, such as diagnostic and treatment codes; as well as to information in CHCS I, DOD’s current system, which primarily includes information on patient hospital admission and discharge, patient medications, laboratory results, and radiology. Providing other anticipated benefits—such as improved quality of patient health records—will also be difficult because GCPR plans do not include steps for correcting long- standing data problems, such as inaccurate data entries.
section_title: Inadequate Accountability and Planning Compromised GCPR’s Progress
paragraphs: The lack of accountability and sound IT project planning—critical to any project, particularly an interagency effort of this magnitude and complexity—put GCPR at risk of failing. The relationships among GCPR’s management entities were not clearly established, and no one entity had the authority to make final project decisions binding on the other entities. As a result, plans for the development of GCPR have not included a clear vision for the project and have not given sufficient attention to technological and privacy and security issues as the effort has moved forward.
subsections: section_title: Lack of Accountability Undermined Agencies’ Commitment to the Project
paragraphs: From the outset, decision-making and oversight were blurred across several management entities, compromising GCPR’s progress. The roles and responsibilities of these entities and the relationships among them are not spelled out in the VA-DOD-IHS memorandum of agreement (MOA), and no one entity exercised final authority over the project. The Board of Directors and the Executive Committee did not follow sound IT business practices—such as ensuring agency commitment, securing stable funding, and monitoring the project’s progress—as dictated by federal requirements. For example, GCPR documents show that VA, DOD, and IHS should provide consistent project funding of 40 percent, 40 percent, and 20 percent, respectively, but DOD has never provided this level of funding and, at times, temporarily withheld funding it had promised. Moreover, the Board of Directors and the Executive Committee did not exercise sufficient oversight, including monitoring, to ensure that the project would be adequately funded.
Without agency commitment and sufficient oversight, the project team has been limited in its ability to manage GCPR effectively or efficiently. Unstable funding forced GCPR project managers to develop and issue multiple short-term contracts for work that could have been covered by a single longer-term contract. At one point during our review, project managers told us that the project would end after field-testing because of a lack of adequate funding and a lack of a clear mandate to proceed with full deployment, even though plans called for the project to continue through deployment.
section_title: Inadequate Planning Hindered Progress
paragraphs: The three partner agencies never reached consensus on GCPR’s mission and how it would relate to the individual agencies’ missions. In addition, key project documents, such as the MOA establishing GCPR, have not adequately spelled out the project’s goals and objectives. For example, some DOD officials thought GCPR’s mission paralleled the goals and objectives of Presidential Review Directive 5; however, GCPR project managers did not share this understanding and the directive was never adopted as GCPR’s mission. Without an agreed upon mission with clear goals and objectives, it remained unclear what problem GCPR was trying to solve. This lack of consensus on the project’s mission, goals, and objectives affected the agencies’ dedication of resources. Expecting GCPR to enhance its ability to carry out its mission to provide health care to veterans, VA was providing the most funding to the project. In contrast, DOD elected to place priority on funding CHCS II, which is estimated to cost several billion dollars because officials believe it will more specifically address the Department’s health mission.
GCPR plans have also not sufficiently addressed other critical issues that need to be resolved, such as decisions about key data elements. For example, DOD and IHS use different identifiers to match health records to patients—DOD facilities use Social Security numbers, while IHS facilities use facility-specific health record numbers. Differences such as these complicate the electronic exchange of health information. Further, in the absence of common medical terminology, project personnel, assisted by Battelle, are developing reference models they believe will interpret VA, DOD, and IHS data and present the data in a format understandable to the user—without requiring cross-agency standards. However, GCPR plans have not specified the key tasks for developing these models, their relation to one another, and who should carry them out. As a result, work progressed slowly and rework has been necessary. For example, coordination between the Battelle team and Litton/PRC was, initially, not adequate to ensure that the reference models developed by Battelle would meet Litton/PRC’s technical requirements for developing the interface. Therefore, the models had to be revised.
In addition, the MOA and other key project documents did not lay out the specific roles and responsibilities of VA, DOD, and IHS in developing, testing, and deploying the interface. GCPR plans also did not describe how the project would use the agencies’ existing technologies for sharing patient health information and to avoid duplication of effort. For example, GCPR plans do not discuss VA’s “remote view” capability—which will allow users of VA’s Computer Patient Record System (CPRS) to simultaneously view health data across multiple facilities—or three of DOD’s health information systems: Theater Medical Information Program (TMIP), Pacific Medical Network (PACMEDNET), and Pharmacy Data Transaction System (PDTS).
Finally, a comprehensive strategy to guarantee the privacy and security of electronic information shared through GCPR was not developed. GCPR’s draft privacy and security plan delegates primary responsibility for ensuring privacy and security to more than 1,000 VA, DOD, and IHS local facilities, with few additional resources and little guidance. However, there have been long-standing privacy and security problems within VA’s, and DOD’s information systems. For example, weak access controls put sensitive information—including health information—at risk of deliberate or inadvertent misuse, improper disclosure, or destruction. By providing broader access to more users, GCPR may exacerbate these risks. DOD is required by the Floyd D. Spence National Defense Authorization Act for 2001 (P.L. 106-398) to submit to the Congress a comprehensive plan consistent with HHS medical privacy regulations to improve privacy. The act also requires DOD to promulgate interim regulations that allow for use of medical records as necessary for certain purposes, including patient treatment and public health reporting, thus providing DOD the flexibility to share patient health information through a mechanism such as GCPR. The HHS privacy regulations went into effect on April 14, 2001, and contain provisions that require consent to disclose health information before engaging in treatment, payment, or health care operations (45 C.F.R. parts 160-164).
section_title: CIOs Change Immediate Focus, but Serious Concerns Remain
paragraphs: Over the past several months, we have provided briefings on our findings to agency and project officials, including the CIOs of VHA and MHS whom we initially briefed in September 2000. Concerned about the lack of progress and the significant weaknesses that we found, the CIOs have begun to exert much needed oversight. They told us that they are now focusing on “early deliverables” for VA and DOD. To ensure more immediate applicability of GCPR to their missions, VA and DOD’s current priority is to allow VA health care providers to view DOD health data by the end of September 2001. Once this interim effort is completed, the CIOs told us that they plan to resume the broader GCPR project—establishing a link among all three partner agencies’ health information systems.
Under the interim effort, as described by the CIOs, certain trigger events, such as a new veteran enrolling for VA medical treatment, will prompt VISTA to contact a central server, which would search the hundreds of CHCS I sites and collect any data on that patient. To help ensure efficient development of the interim effort, VA and DOD now plan to evaluate their existing IT products—such as VA’s remote view capability, which could have the potential to facilitate the retrieval of DOD health data—as well as commercial products to determine if these technologies can be used to electronically transmit data among the agencies’ systems. While we did not conduct an in-depth review of these initiatives, we agree that such an evaluation may allow VA and DOD to reduce or eliminate redundancies because these products have a common aim of sharing patient data. However, it is unclear to what extent the interim effort will be using the GCPR technology—which, according to Litton/PRC, has demonstrated that data can be moved among VA facilities.
However, our concerns regarding the usefulness of the information—and the implications for GCPR’s expected benefits—still remain. For example, under the interim effort, the requested information is expected to take as long as 48 hours to be received. In addition, only authorized VHA personnel will have the ability to see CHCS I data from MTFs; health care providers at MTFs will not be able to view health information from VHA— or information from other MTFs. It is also unclear whether all or only selected VA and DOD facilities will have the interim capability now being proposed. IHS will not be included in the interim effort. Moreover, the interim effort will rely on DOD’s aging system, CHCS I, which historically has not been adequate to meet physicians’ needs. CHCS I is primarily limited to administrative information and some patient medical information, such as pharmacy and laboratory results. CHCS I does not include patient information on the health status of personnel when they enter military service, on reservists who receive medical care while not on active duty status, or on military personnel who receive care from TRICARE providers. CHCS I also does not include physician notes made during examinations. In addition, information captured by CHCS I can vary from MTF to MTF. Some facilities, such as Tripler Army Medical Center in Hawaii, have significantly enhanced their CHCS software to respond to the needs of physicians and other system users and to collect patient health information not collected by other facilities.
Further, the interim effort will need to address many of the same problems that confronted the broader GCPR effort:   Transmitted information will be viewable only as sent; therefore, it will not be computable—that is, it will not be possible to organize or manipulate data for quick review or research.
Electronic connectivity among MTFs is limited, and the interim effort does not propose to establish facility-to-facility links. Currently, only MTFs within the same region and using the same DOD IT hardware can access one another’s data using CHCS I.
The requested data will not be meaningful to the VA user unless CHCS’ language is translated into VISTA’s. For example, without interpretation, a VA physician’s VISTA query for a patient’s sodium level would not recognize “NA” (used by DOD) as equivalent to “sodium” (used by VA). Until terms and their context are standardized or the variations are identified, or “mapped,” across all VA and DOD facilities, much of the information could be meaningless to VA physicians.
According to VHA’s and MHS’ CIOs, detailed plans and time frames are being prepared for the short-term, interim effort to allow VA to receive available electronic health information in CHCS I. However, as of the end of February 2001, no agreement on the goals, time frames, costs, and oversight for the interim approach has been reached, and no formal plans for the interim project exist. Moreover, revised plans for the broader, long- term GCPR project—including how and when IHS will resume its role in the project—have not been developed.
While a draft of this report was being reviewed by the agencies, they developed a new near-term effort which they outlined in their comments. This effort, which revises their interim effort, is intended to address our concerns. However, many of our concerns remain and are addressed in our response to comments from the agencies.
section_title: Conclusions
paragraphs: GCPR’s aim to allow health care providers to electronically share comprehensive patient information should provide VA, DOD, and IHS a valuable opportunity to improve the quality of care for their beneficiaries. But without a lead entity, a clear mission, and detailed planning to achieve that mission, it is difficult to monitor progress, identify project risks, and develop appropriate contingency plans to keep the project moving forward and on track. Critical project decisions were not made, and the agencies were not bound by those that were made. The VA and DOD CIOs’ action to focus on short-term deliverables and to capitalize on existing technologies is warranted and a step in the right direction. However, until problems with the two agencies’ existing systems and issues regarding planning, management, and accountability are resolved, projected costs are likely to continue to increase, and implementation of the larger GCPR effort— along with its expected benefits—will continue to be delayed.
section_title: Recommendations for Executive Action
paragraphs: To help strengthen management and oversight of GCPR, we recommend that the Secretaries of VA and DOD and the Director of IHS reassess decisions about the broader, long-term GCPR project, based on the results of the interim effort. If the Secretaries of VA and DOD and the Director of IHS decide to continue with the broader effort, they should direct their health CIOs to apply the principles of sound project management delineated in our following recommendations for the interim effort.
For the interim effort, we recommend that the Secretaries of VA and DOD and the Director of IHS direct their health CIOs to take the following actions:   Designate a lead entity with final decision-making authority and establish a clear line of authority.
Create comprehensive and coordinated plans to ensure that the agencies’ can share comprehensive, meaningful, accurate, and secure patient health data. These plans include an agreed-upon mission and clear goals, objectives, and performance measures, and they should capitalize on existing medical IT capabilities.
section_title: Agency Comments
paragraphs: VA, DOD, and IHS reviewed and separately commented on a draft of this report. Each concurred with the findings and recommendations. The agencies also provided comments that outline a new near-term effort for GCPR and that aim to clarify GCPR’s purpose. Additionally, VA, DOD, and IHS provided written technical comments, which we have incorporated where appropriate. The full texts of their comments are reprinted as appendixes II, III, and IV.
Regarding our recommendation to establish a clear line of authority, the Secretary of VA committed to meeting with the Secretary of Defense and the Director of IHS to designate a lead entity that will have decision- making authority for the three organizations. He said that once established, that entity will have a clear line of authority over all GCPR development activities. With regard to our recommendation to create comprehensive and coordinated plans for sharing patient health data, the Secretary of VA said he would direct the VHA CIO, in collaboration with VA’s departmentwide CIO to prepare such plans under the oversight of the lead entity. In response to our recommendation that longer-term GCPR decisions be reassessed based on the results of the interim effort, the Secretary of VA responded that GCPR will be reassessed based on the results of their near-term effort. Additionally, he said that the longer-term strategy will depend to some extent on advances in medical informatics, standards development, and the ability to bring in additional partners.
DOD provided similar comments on our recommendation concerning longer-term GCPR decisions and also mentioned that it plans to include the Military Health System Information Management Committee in GCPR oversight. While IHS provided no information on the steps it plans to take to implement our recommendations, it commented, along with VA and DOD, that collaboration is essential to the future of GCPR. Overall, the agencies’ statements, in our view, represent a commitment to oversight and management of GCPR. However, it is much too soon to know whether their commitment will result in a successful project.
VA, DOD, and IHS also provided information that, according to the organizations, is intended to serve as a foundation for assessing GCPR and its progress. The agencies emphasized that GCPR is not intended to carry the whole weight for the service members’ health records and the related health information systems, but instead consists of the agencies’ core health information systems with GCPR handling the transfer and mediation of data. Our report does not suggest that GCPR is a replacement for the agencies’ information systems or that it should carry the weight of the agencies’ patient health information. Rather, our report states that GCPR is intended to create an electronic link that will enable the agencies to share patient data from their separate health information systems.
The agencies also provided a clarification of GCPR’s purpose, stating that it will provide a longitudinal record covering service members from the start of their service through their care with VA. VA acknowledges that the realities of the challenges the project has presented have led to a scaling back of the initial version of GCPR as described in early project documents, such as budget submissions, contractors’ statements of work, and project plans. These documents indicated that in addition to including IHS, GCPR would permit health care professionals to share clinical information via a comprehensive lifelong, medical record—one that would include information from all sources of care. GCPR was similarly described on GCPR’s home page and during briefings to the Congress and others, such as the National Committee on Vital and Health Statistics. Some documents, such as VA’s Fiscal Year 2001 Performance Plan, have described GCPR as including dependents of service members. To the extent that the agencies agree on the scaled-back description of GCPR, project documents and communications need to reflect this new understanding. This is, in part, why we recommended that the agencies develop and document a clear, agreed upon project mission, along with specific goals, objectives, and performance measures.
The agencies’ also provided information on a new near-term effort for GCPR, which they developed while reviewing our draft report. According to the agencies, this revised near-term effort that they have developed uses the GCPR framework and will provide VA clinicians with DOD data on all active duty members, retirees, and separated personnel. VA and DOD recognize that this one-way flow of information is not perfect but should be a substantial improvement for physicians making medical decisions and enhance the continuity of care for veterans. According to the agencies, the near-term effort is funded through year 2001 and they expect to have initial operating capability by fall 2001. We agree that, if successful, this effort should provide useful information to VA clinicians. In our view, their outline of the new near-term approach indicates that it is only in the concept stage and detailed planning and actual work are just beginning. For example, the agencies note that current data will be sent in “near real- time transmission,” and historical data will be “extracted and transmitted on a predetermined schedule.” But they do not define “near real-time” and “predetermined schedule.”
Additionally, the agencies assert that the new near-term effort addresses many of the concerns we raised in the report. However, several of these issues remain and, as we recommended, need to be reassessed at the conclusion of the near-term effort because of their implications for the long-term effort:   GCPR—both the near-term and larger efforts—will not provide a longitudinal record because plans call for GCPR to use DOD’s CHCS I for the foreseeable future. CHCS I, as DOD acknowledges in its comments, was not designed to include patient information on the health status of personnel when they enter military service, on reservists who receive medical care while not on active duty status, or on military personnel who receive care outside MTFs.
The meaningfulness of the transmitted data remains in question because the agencies do not plan to standardize or map the differing terminology in their health information systems. As we note in the report, without standardized terminology or mapping, the meaning of certain terms used in medical records may not be apparent to the VA provider requesting the information. For example, unless the context is clear, the meaning of the term “cold” in a medical record may be interpreted as meaning a rhinovirus, a feeling of being cold, or having chronic obstructed lung disease.
The agencies also need to more fully address data-specific matters, such as GCPR’s reference modeling, before developing additional hardware and software. Once they reach consensus on these issues, their agreement must be clearly stated in a formalized document—one that is binding on all three partners. Finally, for the project to be successfully deployed, detailed plans on GCPR’s system components and tasks with clear project parameters need to be developed. Until such plans are developed, the agencies’ GCPR efforts cannot be fully assessed.
Privacy and security issues are also continuing concerns. DOD states in its comments that it does not intend to delegate responsibility for complying with DOD and federal privacy and security requirements to its local facilities. However, DOD does not describe how it plans to ensure compliance, raising concerns such as how unintended or unauthorized disclosure or access of information would be prevented when the near- term effort provides selected “data feeds from CHCS I  a database to be accessed by VA.” Similarly, VA generally describes how authorized VA staff will access DOD medical records. However, we have concerns about how the two Departments will ensure the privacy and security of patient information given the security weaknesses in their computer systems, which we have repeatedly reported on. In March 2001, we reported that DOD continues to face significant personnel, technical, and operational challenges in implementing a departmentwide information security program, and DOD management has not carried out sufficient program oversight. We included VA’s computer security in our January 2001 High- Risk Series and, in an accompanying report, pointed out persistent computer security weaknesses that placed critical VA operations, including health care delivery, at risk of misuse, fraud, improper disclosure, or destruction. For example, we found that VA has not adequately limited access granted to authorized users, managed user identification and passwords, or monitored access activity—weaknesses that VA’s Inspector General recently testified on.
Funding is also a concern. VA states that GCPR’s “success and rate of progression will depend to some extent on the ability to add partners and available funding.” Similarly, DOD states that GCPR program requirements will be funded in accordance with overarching DOD mission priorities. IHS also noted that it faces competing demands for scarce resources. We recognize that each agency has multiple priorities. However, securing adequate and stable funding and determining whether additional partners are needed depends on reliable cost estimates—which can only be determined with well-defined goals and detailed plans for achieving those goals. As DOD points out in its comments, the 10-year cost estimates for GCPR will continue to be considered unreliable until clear mid- and long- term goals and objectives have been established and agreed to by the three agencies.
Each of the three agencies also stated that GCPR may have been judged by the criteria used to assess a standard information system development effort and that doing so understates the complexity of their undertaking. While we believe that the technology exists to support GCPR—particularly the new near-term effort—we agree that GCPR presents unique and difficult administrative challenges. Yet it is this very complexity that calls for thorough planning, interagency coordination, and diligent oversight as well as consistent and regular communication of the project’s status and progress to all stakeholders.
Finally, VA noted that it would like to discuss with us certain details in our report with which it did not fully agree but yet did not disclose in its comments. Throughout the course of the project—and particularly over the past 6 months—we met frequently with the agencies to provide observations on our work and discuss any concerns that were brought to our attention. We are committed to continuing to meet with VA, DOD, and IHS to help in this important endeavor.
We are sending this report to the Honorable Anthony Principi, Secretary of Veterans Affairs; the Honorable Donald Rumsfeld, Secretary of Defense; the Honorable Tommy Thompson, Secretary of Health and Human Services; appropriate congressional committees; and other interested parties. We will also make copies available to others upon request. Should you have any questions on matters discussed in this report, please contact me at (202) 512-7101. Other contacts and key contributors to this report are listed in appendix V.
section_title: Appendix I: Scope and Methodology
paragraphs: To determine the status of the GCPR project, we conducted site visits to VA, DOD, and IHS facilities; interviewed personnel at these locations, representatives of nonfederal health care organizations, and others knowledgeable about computerized linking of disparate health information systems; and reviewed documents relevant to the project. We also consulted with project officials at various times during our audit about the status of our review.
We went to a total of nine VA, DOD, and IHS health care facilities in California, Hawaii, Indiana, and Washington, D.C. These sites were judgmentally selected based on a variety of factors, including diversity of system capabilities and size and type of facility, such as major medical centers and small community-based clinics. Therefore, they are not necessarily representative of the agencies’ facilities. During these site visits, we spoke with a variety of facility staff—ranging from a DOD regional medical commander and IHS facility managers to VA administrative personnel—about their experiences using the agencies’ existing health information systems. We also asked them about what additional information and system features they consider to be important in treating patients and conducting population-based research. Further, we talked with facility IT technicians and administrators about their systems’ capabilities and the technical requirements for developing the GCPR interface, and we discussed the potential effect the interface might have on current operations and systems.
We interviewed VA, DOD, and IHS officials, primarily from the agencies’ headquarters, involved directly in the GCPR project to obtain specific information about the project’s day-to-day operations and management, including timelines, costs, and technical matters. We also interviewed personnel from the two primary GCPR contractors—Litton/PRC in McLean, Virginia, and Battelle Memorial Institute of Columbus, Ohio—on the status of the interface development, particularly regarding the reference modeling. We also talked with agency representatives on the GCPR Board of Directors and Executive Committee about the oversight of the project.
To obtain additional perspectives about the development of computerized patient record systems, we talked with recognized leaders in the field and visited selected private sector facilities, including Kaiser Permanente, Aurora HealthCare of Wisconsin, and the Regenstrief Institute of the University of Indiana in Indianapolis. We also talked with officials from the National Committee on Vital and Health Statistics regarding privacy and security issues and the status of the development of HIPAA regulations.
Finally, we reviewed many GCPR project documents. These included technical plans, such as the project’s draft privacy and security plan, deployment plans, and other planning documents; cost analyses; and Board of Directors and Executive Committee meeting minutes; and other relevant project documents. We conducted our review between March 2000 and April 2001 in accordance with generally accepted government auditing standards.
section_title: Appendix II: Comments From the Department of Veterans Affairs
section_title: Appendix III: Comments From the Department of Defense
section_title: Appendix IV: Comments From the Indian Health Service
section_title: Appendix V: GAO Contacts and Staff Acknowledgments
subsections: section_title: GAO Contacts
section_title: Staff Acknowledgments
paragraphs: In addition to those named above, the following staff made key contributions to this report: Tonia Johnson, Helen Lew, William Lew, Valerie Melvin, Karen Sloan, and Thomas Yatsco.