Veterans Affairs Information Technology: Historical Perspective on Health System Modernization Contracts and Update on Efforts to Address Key FITARA-Related Areas
Released: 2017-12-07T00:00:00

Letter

Background

VA’s mission is to promote the health, welfare, and dignity of all veterans in recognition of their service to the nation by ensuring that they receive medical care, benefits, social support, and lasting memorials. In carrying out this mission, the department operates one of the largest health care delivery systems in America, providing health care to millions of veterans and their families at more than 1,500 facilities.

The department’s three major components—the Veterans Health Administration (VHA), the Veterans Benefits Administration (VBA), and the National Cemetery Administration (NCA)—are primarily responsible for carrying out its mission. More specifically, VHA provides health care services, including primary care and specialized care, and it performs research and development to improve veterans’ needs. VBA provides a variety of benefits to veterans and their families, including disability compensation, educational opportunities, assistance with home ownership, and life insurance. Further, NCA provides burial and memorial benefits to veterans and their families.

Collectively, the three components rely on approximately 340,000 employees to provide services and benefits. These employees work in VA’s Washington, D.C. headquarters, as well as 170 medical centers, approximately 750 community-based outpatient clinics, 300 veterans centers, 56 regional offices, and more than 130 cemeteries situated throughout the nation.

VA Relies Extensively on IT

The use of IT is critically important to VA’s efforts to provide benefits and services to veterans. As such, the department operates and maintains an IT infrastructure that is intended to provide the backbone necessary to meet the day-to-day operational needs of its medical centers, veteran- facing systems, benefits delivery systems, memorial services, and all other systems supporting the department’s mission. The infrastructure is to provide for data storage, transmission, and communications requirements necessary to ensure the delivery of reliable, available, and responsive support to all VA staff offices and administration customers, as well as veterans.

According to department data as of October 2016, there were 576 active or in-development systems in VA’s inventory of IT systems. These systems are intended to be used for the determination of benefits, benefits claims processing, and access to health records, among other services. VHA is the parent organization for 319 of these systems. Of the 319 systems, 244 were considered mission-related and provide capabilities related to veterans’ health care delivery. For example, VHA’s systems provide capabilities to establish and maintain electronic health records that health care providers and other clinical staff use to view patient information in inpatient, outpatient, and long-term care settings.

VistA serves an essential role in helping the department to fulfill its health care delivery mission. Specifically, VistA is an integrated medical information system for all veterans’ health information. It was developed in-house by the department’s clinicians and IT personnel and has been in operation since the early 1980s. As such, the system has long been vital to helping ensure the quality of health care received by the nation’s veterans and their dependents.

VistA is comprised of more than 200 applications that assist in the delivery of health care and perform other important functions within the department, including financial management, enrollment, and registration. Some of these applications have been in operation for over 30 years and, according to VA, have become increasingly difficult and costly to maintain. As such, the department has expended extensive resources to modernize the system and increase its ability to allow for the viewing or exchange of patient information with the Department of Defense (DOD) and private sector health providers. In addition, as we recently reported, VHA has unaddressed needs that indicate its current health IT systems, including VistA, do not fully support the organization’s business functions. Specifically, about 39 percent of all requests related to health IT needs have remained unaddressed after more than 5 years.

Electronic health records are particularly crucial for optimizing the health care provided to veterans, many of whom may have health records residing at multiple medical facilities within and outside the United States. Taking steps toward interoperability—that is, collecting, storing, retrieving, and transferring veterans’ health records electronically—is significant to improving the quality and efficiency of care. One of the goals of interoperability is to ensure that patients’ electronic health information is available from provider to provider, regardless of where it originated or resides.

VA Manages IT Resources Centrally

Since 2007, VA has been operating a centralized organization, the Office of Information and Technology (OI&T), in which most key functions intended for effective management of IT are performed. This office is led by the Assistant Secretary for Information and Technology—VA’s Chief Information Officer (CIO). The office is responsible for providing strategy and technical direction, guidance, and policy related to how IT resources are to be acquired and managed for the department, and for working closely with its business partners—such as VHA—to identify and prioritize business needs and requirements for IT systems. Among other things, OI&T has responsibility for managing the majority of VA’s IT-related functions, including the maintenance and modernization of VistA. As of 2016, OI&T was comprised of more than 15,000 staff, with more than half of these positions filled by contractors.

VA Requested Nearly $4.1 Billion for Fiscal Year 2018

For fiscal year 2018, the department’s budget request included nearly $4.1 billion for IT. The department requested approximately $359 million for new systems development or modernization efforts, approximately $2.5 billion for maintaining existing systems, and approximately $1.2 billion for payroll and administration. For example, in its fiscal year 2018 budget submission, the department requested appropriations to support five IT portfolios, including the development and operations and maintenance for programs and projects related to the:

Medical portfolio, which provides technology solutions to deliver modern, high-quality medical care capabilities to veterans ($944.2 million);

Benefit portfolio, which addresses the technology needs managed by the Veterans Benefit Administration ($296.9 million);

Memorial Affairs portfolio, which provides support for the modernization of applications and services for National Cemeteries at 133 locations nationwide ($24.5 million);

Corporate portfolio, which consists of back office operations supporting the major business lines and department management ($270.6 million); and

Enterprise IT, which provides the underlying infrastructure to enable the other portfolios to operate and includes such things as cybersecurity, data centers, cloud services, telephony, enterprise software, and data connectivity ($1.289 billion).

VA’s Management of IT Has Contributed to High- Risk Designations

In 2015, we designated VA Health Care as a high-risk area for the federal government and, currently, we continue to be concerned about the department’s ability to ensure that its resources are being used cost- effectively and efficiently to improve veterans’ timely access to health care. In part, we identified limitations in the capacity of VA’s existing systems, including the outdated, inefficient nature of certain systems and a lack of system interoperability—that is, the ability to exchange and use electronic health information—as contributors to the department’s IT challenges related to health care. These challenges present risks to the timeliness, quality, and safety of the health care. While we recently reported that the department has begun to demonstrate leadership commitment to addressing IT challenges, more work remains.

Also, in February 2015, we added Improving the Management of IT Acquisitions and Operations to our list of high-risk areas. Specifically, federal IT investments too frequently fail or incur cost overruns and schedule slippages while contributing little to mission-related outcomes. We have previously testified that the federal government has spent billions of dollars on failed IT investments, including, for example, VA’s Scheduling Replacement Project, which was terminated in September 2009 after spending an estimated $127 million over 9 years; and its Financial and Logistics Integrated Technology Enterprise program, which was intended to be delivered by 2014 at a total estimated cost of $609 million, but was terminated in October 2011 due to challenges in managing the program.

This high-risk area highlighted several critical IT initiatives in need of additional congressional oversight, including (1) reviews of troubled projects; (2) efforts to increase the use of incremental development; (3) efforts to provide transparency relative to the cost, schedule, and risk levels for major IT investments; (4) reviews of agencies’ operational investments; (5) data center consolidation; and (6) efforts to streamline agencies’ portfolios of investments. We noted that agencies’ implementation of these initiatives was inconsistent and that more work remained to demonstrate progress in achieving IT acquisition and operation outcomes.

We also recently issued an update to our high-risk report and noted that, while progress has been made in addressing the high-risk area of IT acquisitions and operations, significant work remains to be completed. For example, we noted, among other things, that additional work was needed to establish action plans for federal agencies to modernize or replace obsolete systems. Specifically, we pointed out that many federal systems use outdated software languages and hardware, which has increased spending on operations and maintenance of technology investments.

VA was among a handful of departments with one or more archaic legacy systems. As discussed in our recent report on legacy systems used by federal agencies, we identified 2 of the department’s systems as being over 50 years old, and among the 10 oldest investments and/or systems that were reported by 12 selected agencies.

Personnel and Accounting Integrated Data (PAID)—This 53-year old system automates time and attendance for employees, timekeepers, payroll, and supervisors. It is written in Common Business Oriented Language (COBOL), a programming language developed in the late 1950s and early 1960s, and runs on IBM mainframes.

Benefits Delivery Network (BDN)—This 51-year old system tracks claims filed by veterans for benefits, eligibility, and dates of death. It is a suite of COBOL mainframe applications.

Ongoing uses of antiquated systems, such as PAID and BDN, contribute to agencies spending a large, and increasing, proportion of their IT budgets on operations and maintenance of systems that have outlived their effectiveness and are consuming resources that outweigh their benefits. Accordingly, we have recommended that VA identify and plan to modernize or replace its legacy systems. The department concurred with our recommendation and stated that it plans to retire and replace PAID with the Human Resources Information System Shared Service Center in 2017. The department also stated that it has general plans to roll the capabilities of BDN into another system and to retire BDN in 2018.

FITARA Is Intended to Help VA and Other Agencies Improve Their Acquisitions of IT

Congress enacted federal IT acquisition reform legislation (commonly referred to as the Federal Information Technology Acquisition Reform Act, or FITARA) in December 2014. This legislation was intended to improve agencies’ acquisitions of IT and enable Congress to monitor agencies’ progress and hold them accountable for reducing duplication and achieving cost savings. The law applies to VA and other covered agencies. It includes specific requirements related to seven areas, including data center consolidation and optimization, agency CIO authority, and government-wide software purchasing.

Federal data center consolidation initiative (FDCCI). Agencies are required to provide the Office of Management and Budget (OMB) with a data center inventory, a strategy for consolidating and optimizing their data centers (to include planned cost savings), and quarterly updates on progress made. The law also requires OMB to develop a goal for how much is to be saved through this initiative, and provide annual reports on cost savings achieved.

Agency CIO authority enhancements. CIOs at covered agencies are required to (1) approve the IT budget requests of their respective agencies, (2) certify that IT investments are adequately implementing incremental development, as defined in capital planning guidance issued by OMB, (3) review and approve contracts for IT, and (4) approve the appointment of other agency employees with the title of CIO.

Government-wide software purchasing program. The General Services Administration is to develop a strategic sourcing initiative to enhance government-wide acquisition and management of software. In doing so, the law requires that, to the maximum extent practicable, the General Services Administration should allow for the purchase of a software license agreement that is available for use by all executive branch agencies as a single user. Expanding upon FITARA, the Making Electronic Government Accountable by Yielding Tangible Efficiencies Act of 2016, or the “MEGABYTE Act,” further enhanced CIOs’ management of software licenses by requiring agency CIOs to establish an agency software licensing policy and a comprehensive software license inventory to track and maintain licenses, among other requirements.

In June 2015, OMB released guidance describing how agencies are to implement FITARA. This guidance is intended to, among other things: assist agencies in aligning their IT resources with statutory establish government-wide IT management controls that will meet the law’s requirements, while providing agencies with flexibility to adapt to unique agency processes and requirements; clarify the CIO’s role and strengthen the relationship between agency CIOs and bureau CIOs; and strengthen CIO accountability for IT costs, schedules, performance, and security.

VA Has Pursued Four VistA Modernization Initiatives Since 2001, with About a Billion Dollars Obligated for Contractors’ Activities During Fiscal Years 2011 through 2016

In our draft report that is currently with VA for comments, we discuss the history of VA’s efforts to modernize its health information system, VistA. These four efforts—HealtheVet, the integrated Electronic Health Record (iEHR), VistA Evolution, and the Electronic Health Record Modernization (EHRM)—reflect varying approaches that the department has considered to achieve a modernized health care system over the course of nearly two decades. The modernization efforts are described as follows.

In 2001, VA undertook its first VistA modernization project, the HealtheVet initiative, with the goals of standardizing the department’s health care system and eliminating the approximately 130 different systems used by its field locations at that time. HealtheVet was scheduled to be fully implemented by 2018 at a total estimated development and deployment cost of about $11 billion. As part of the effort, the department had planned to develop or enhance specific areas of system functionality through six projects, which were to be completed between 2006 and 2012. Specifically, these projects were to provide capabilities to support VA’s Health Data Repository and Patient Financial Services System, as well as the Laboratory, Pharmacy, Imaging, and Scheduling functions.

In June 2008, we reported that the department had made progress on the HealtheVet initiative, but noted issues with project planning and governance. In June 2009, the Secretary of Veterans Affairs announced that VA would stop financing failed projects and improve the management of its IT development projects. Subsequently, in August 2010, the department reported that it had terminated the HealtheVet initiative.

In February 2011, VA began its second modernization initiative, the iEHR program, in conjunction with DOD. The program was intended to replace the two separate electronic health record systems used by the two departments with a single, shared system. Moreover, because both departments would be using the same system, this approach was expected to largely sidestep the challenges that had been encountered in trying to achieve interoperability between their two separate systems.

Initial plans called for the development of a single, joint system consisting of 54 clinical capabilities to be delivered in six increments between 2014 and 2017. Among the agreed-upon capabilities to be delivered were those supporting laboratory, anatomic pathology, pharmacy, and immunizations. According to VA and DOD, the single iEHR system had an estimated life cycle cost of $29 billion through the end of fiscal year 2029.

However, in February 2013, the Secretaries of VA and DOD announced that they would not continue with their joint development of a single electronic health record system. This decision resulted from an assessment of the iEHR program that the secretaries had requested in December 2012 because of their concerns about the program facing challenges in meeting deadlines, costing too much, and taking too long to deliver capabilities. In 2013, the departments abandoned their plan to develop the integrated system and stated that they would again pursue separate modernization efforts.

In December 2013, VA initiated its VistA Evolution program as a joint effort of VHA and OI&T that was to be completed by the end of fiscal year 2018. The program was to be comprised of a collection of projects and efforts focused on improving the efficiency and quality of veterans’ health care by modernizing the department’s health information systems, increasing the department’s data exchange and interoperability with DOD and private sector health care partners, and reducing the time it takes to deploy new health information management capabilities. Further, the program was intended to result in lower costs for system upgrades, maintenance, and sustainment. According to the department’s March 2017 cost estimate, VistA Evolution was to have a life cycle cost of about $4 billion through fiscal year 2028.

Since initiating VistA Evolution in December 2013, VA has completed a number of key activities that were called for in its plans. For example, the department delivered capabilities, such as the ability for health providers to have an integrated, real-time view of electronic health record data through the Joint Legacy Viewer, as well as the ability for health care providers to view sensitive DOD notes and highlight abnormal test results for patients. VA also initiated work to standardize VistA across the 130 VA facilities and released enhancements to its legacy scheduling, pharmacy, and immunization systems. In addition, the department released the enterprise Health Management Platform, which is a web- based user interface that assembles patient clinical data from all VistA instances and DOD.

Although VistA Evolution is ongoing, VA is currently in the process of revising its plan for the program as a result of the department recently announcing its pursuit of a fourth VistA modernization program (discussed below). For example, the department determined that it would no longer pursue additional development or deployment of the enterprise Health Management Platform—a major VistA Evolution component— because the new modernization program is envisioned to provide similar capabilities.

In June 2017, the VA Secretary announced a significant shift in the department’s approach to modernizing VistA. Specifically, rather than continue to use VistA, the Secretary stated that the department plans to acquire the same electronic health record system that DOD is implementing. In this regard, DOD has contracted with the Cerner Corporation to provide a new integrated electronic health record system. According to the Secretary, VA has chosen to acquire this same product because it would allow all of VA’s and DOD’s patient data to reside in one system, thus enabling seamless care between the department and DOD without the manual and electronic exchange and reconciliation of data between two separate systems.

The VA Secretary added that this fourth modernization initiative is intended to minimize customization and system differences that currently exist within the department’s medical facilities, and ensure the consistency of processes and practices within VA and DOD. When fully operational, the system is intended to be the single source for patients to access their medical history and for clinicians to use that history in real time at any VA or DOD medical facility, which may result in improved health care outcomes. According to VA’s Chief Technology Officer, Cerner is expected to provide integration, configuration, testing, deployment, hosting, organizational change management, training, sustainment, and licenses necessary to deploy the system in a manner that meets the department’s needs.

To expedite the acquisition, in June 2017, the Secretary signed a “Determination and Findings,” which noted a public interest exception to the requirement for full and open competition, and authorized VA to issue a solicitation directly to the Cerner Corporation. According to the Secretary, VA expects to award a contract to Cerner in December 2017, and deployment of the new system is anticipated to begin 18 months after the contract has been signed.

VA’s Executive Director for the Electronic Health Records Modernization System stated that the department intends to incrementally deploy the new system to its medical facilities. Each facility is expected to continue using VistA until the new system has been deployed at that location. All VA medical facilities are anticipated to have the new system implemented within 7 to 8 years after the first deployment.

Figure 1 shows a timeline of the four efforts that VA has pursued to modernize VistA since 2001.

VA Obligated about $1.1 Billion for VistA Modernization Contracts During Fiscal Years 2011 through 2016

For iEHR and VistA Evolution, the two modernization initiatives for which VA could provide contract data, the department obligated approximately $1.1 billion for contracts with 138 different contractors during fiscal years 2011 through 2016. Specifically, the department obligated approximately $224 million and $880 million, respectively, for contracts associated with these efforts. Of the 138 contractors, 34 of them performed work supporting both iEHR and VistA Evolution. The remaining 104 contractors worked exclusively on either iEHR or VistA Evolution.

Funding for the 34 contractors that worked on both iEHR and VistA Evolution totaled about $793 million of the $1.1 billion obligated for contracts on the two initiatives. Obligations for contracts awarded to the top 15 of these 34 contractors (which we designated as key contractors) accounted for about $741 million (about 67 percent) of the total obligated for contracts on the two initiatives. The remaining 123 contractors were obligated about $364 million for their contracts.

The 15 key contractors were obligated about $564 million and $177 million for VistA Evolution and iEHR contracts, respectively. Table 1 identifies the key contractors and their obligated dollar totals for the two efforts.

Additionally, we determined that, of the $741 million obligated to the key contractors, $411 million (about 55 percent) was obligated for contracts supporting the development of new system capabilities, $256 million (about 35 percent) was obligated for contracts supporting project management activities, and $74 million (about 10 percent) was obligated for contracts supporting operations and maintenance for iEHR and VistA Evolution. VA obligated funds to all 15 of the key contractors for system development, 13 of the key contractors for project management, and 12 of the key contractors for operations and maintenance. Figure 2 shows the amounts obligated for each of these areas.

Further, based on the key contractors’ documentation, for the iEHR program, VA obligated $102 million for development, $65 million for project management, and $10 million for operations and maintenance. For the VistA Evolution Program, VA obligated $309 million for development, $191 million for project management, and $64 million for operations and maintenance. Figure 3 shows the amounts obligated for contracts on the VistA Evolution and iEHR programs for development, project management, and operations and maintenance.

In addition, table 2 shows the amounts that each of the 15 key contractors were obligated for the three types of contract activities performed on iEHR and VistA Evolution.

VA Is in the Process of Developing Plans for Its Latest VistA Modernization Initiative

Industry best practices and IT project management principles stress the importance of sound planning for system modernization projects. These plans should identify key aspects of a project, such as the scope, responsible organizations, costs, schedules, and risks. Additionally, planning should begin early in the project’s lifecycle and be updated as the project progresses.

Since the VA Secretary announced that the department would acquire the same electronic health record system as DOD, VA has begun planning for the transition from VistA Evolution to EHRM. However, the department is still early in its efforts, pending the contract award. In this regard, the department has begun developing plans that are intended to guide the new EHRM program. For example, the department has developed a preliminary description of the organizations that are to be responsible for governing the EHRM program. Further, the VA Secretary announced in congressional testimony in November 2017, a key reporting responsibility for the program—stating that the Executive Director for the Electronic Health Records Modernization System will report directly to the department’s Deputy Secretary. In addition, the department has developed a preliminary timeline for deploying its new electronic health record system to VA’s medical facilities, and a 90-day schedule that depicts key program activities. The department also has begun documenting the EHRM program risks.

Beyond the aforementioned planning activities undertaken thus far, the Executive Director stated that the department intends to complete a full suite of planning and acquisition management documents to guide the program, including a life cycle cost estimate and an integrated master schedule to establish key milestones over the life of the project. To this end, the Executive Director told us that VA has awarded two program management contracts to support the development of these plans to MITRE Corporation and Booz Allen Hamilton.

According to the Executive Director, VA also has begun reviewing the VistA Evolution Roadmap, which is the key plan that the department has used to guide VistA Evolution since 2014. This review is expected to result in an updated plan that is to prioritize any remaining VistA enhancements needed to support the transition from VistA Evolution to the new system. According to the Executive Director, the department intends to complete the development of its plans for EHRM within 90 days after award of the Cerner contract, which is anticipated to occur in December 2017.

Further, beyond the development of plans, VA has begun to staff an organizational structure for the modernization initiative, with the Under Secretary of Health and the Assistant Secretary for Information and Technology (VA’s Chief Information Officer) designated as executive sponsors. It has also appointed a Chief Technology Officer from OI&T, and a Chief Medical Officer from VHA, both of whom are to report to the Executive Director.

VA’s efforts to develop plans for EHRM and to staff an organization to manage the program encompass key aspects of project planning that are important to ensuring effective management of the department’s latest modernization initiative. However, the department remains early in its modernization planning efforts, many of which are dependent on the system acquisition contract award, which has not yet occurred. The department’s continued dedication to completing and effectively executing the planning activities that it has identified will be essential to helping minimize program risks and guide this latest electronic health record modernization initiative to a successful outcome—one which VA, for almost two decades, has yet to achieve.

VA’s Progress toward Consolidating and Optimizing Data Centers and Addressing Other Key FITARA-Related Area Falls Short of Performance Targets

Beyond managing its system modernization efforts, such as VistA, VA has to ensure the effective implementation of the IT acquisition requirements called for in FITARA. Pursuant to FITARA, in August 2016, the Federal CIO issued a memorandum that announced the Data Center Optimization Initiative (DCOI). According to OMB, this new initiative supersedes and builds on the results of FDCCI, and is also intended to improve the performance of federal data centers in areas such as facility utilization and power usage.

Among other things, DCOI requires 24 federal departments and agencies, including VA, to develop plans and report on strategies (referred to as DCOI strategic plans) to consolidate inefficient infrastructure, optimize existing facilities, improve security posture, and achieve costs savings. Further, the memorandum establishes a set of five data center optimization metrics and performance targets intended to measure agency’s progress in the areas of (1) server utilization and automated monitoring, (2) energy metering, (3) power usage effectiveness, (4) facility utilization, and (5) virtualization. The guidance also indicates that OMB is to maintain a public dashboard that will display consolidation-related costs savings and optimization performance information for the agencies.

However, in a series of reports that we issued from July 2011 through August 2017, we noted that, while data center consolidation could potentially save the federal government billions of dollars, weaknesses existed in several areas, including agencies’ data center consolidation plans, data center optimization, and OMB’s tracking and reporting on related cost savings. Further, we previously reported that VA’s progress toward closing data centers, and realizing the associated cost savings, lagged behind that of other covered agencies.

More recently, VA reported a total inventory of 415 data centers, of which 39 had been closed as of August 2017. While the department anticipates another 10 data centers will be closed by the end of fiscal year 2018, these closures fall short of the targets set by OMB. Specifically, even if VA meets all of its planned targets for closure, it will only close about 9 percent of its tiered data centers and about 18.7 percent of its non-tiered data centers by the end of fiscal year 2018, which is short of the respective 25 and 60 percent targets set by OMB. Further, while VA has reported $23.61 million in data center-related cost savings and avoidances for 2012 through August 2017, the department does not expect to realize further savings from the additional 10 data center closures in the next year.

In addition, in August 2017 we reported that agencies needed to address challenges in optimizing their data centers in order to achieve cost savings. Specifically, we noted that, according to the 24 agencies’ data center consolidation initiative strategic plans as of April 2017, most agencies were not planning to meet OMB’s optimization targets by the end of fiscal year 2018.

As of February 2017, VA reported meeting one of the five data center optimization metrics related to power usage effectiveness. Also, the department’s data center optimization strategic plan indicates that the department plans to meet three of the five metrics by the end of fiscal year 2018. Further, while OMB directed agencies to replace manual collection and reporting of metrics with automated tools no later than fiscal year 2018, VA had only implemented automated tools at 6 percent of its data centers.

VA’s CIO Has Certified Adequate Incremental Development for Its Major IT Investments for Fiscal Year 2017, but Needs to Update Related Policy

OMB has emphasized the need to deliver investments in smaller parts, or increments, in order to reduce risk, deliver capabilities more quickly, and facilitate the adoption of emerging technologies. In 2010, it called for agencies’ major investments to deliver functionality every 12 months and, since 2012, every 6 months. Subsequently, FITARA codified a requirement that agency CIOs certify that IT investments are adequately implementing incremental development, as defined in the capital planning guidance issued by OMB. Later OMB guidance on the law’s implementation—issued in June 2015—directed agency CIOs to define processes and policies for their agencies which ensure that they certify that IT resources are adequately implementing incremental development.

Between May 2014 and November 2017, we reported on agencies’ efforts to utilize incremental development practices for selected major investments. In November 2017, we noted that agencies reported that 62 percent of major IT software development investments were certified by the agency CIO as using adequate incremental development in fiscal year 2017, as required by FITARA. VA’s CIO certified the use of adequate incremental development for all 10 of its major IT investments. However, VA had not yet updated the department’s policy and process for the CIO’s certification of major IT investments’ adequate use of incremental development, in accordance with OMB’s guidance on the implementation of FITARA as we recommended. The department stated that it plans to address our recommendation to establish a policy and that the policy is targeted for completion in 2017.

VA Has Made Progress in Developing and Using a Comprehensive Inventory of Software Licenses

Federal agencies engage in thousands of licensing agreements annually. Effective management of software licenses can help organizations avoid purchasing too many licenses that result in unused software. In addition, effective management can help avoid purchasing too few licenses, which results in noncompliance with license terms and causes the imposition of additional fees. Federal agencies are responsible for managing their IT investment portfolios, including the risks from their major information system initiatives, in order to maximize the value of these investments to the agency.

OMB developed a policy that requires agencies to conduct an annual, agency-wide IT portfolio review to, among other things, reduce commodity IT spending. Such areas of spending could include software licenses. We previously identified seven elements that a comprehensive software licensing policy should address: identify clear roles, responsibilities, and central oversight authority within the department for managing enterprise software license agreements and commercial software licenses; establish a comprehensive inventory (at least 80 percent of software license spending and/or enterprise licenses in the department) by identifying and collecting information about software license agreements using automated discovery and inventory tools; regularly track and maintain software licenses to assist the agency in implementing decisions throughout the software license management life cycle; analyze software usage and other data to make cost-effective provide training relevant to software license management; establish goals and objectives of the software license management consider the software license management life-cycle phases (i.e., requisition, reception, deployment and maintenance, retirement, and disposal phases) to implement effective decision making and incorporate existing standards, processes, and metrics.

We previously made recommendations to VA to (1) develop an agency- wide comprehensive policy for the management of software licenses that includes guidance for using analysis to better inform investment decision making, (2) employ a centralized software license management approach that is coordinated and integrated with key personnel, (3) establish a comprehensive inventory of software licenses using automated tools, (4) track and maintain a comprehensive inventory of software licenses using automated tools and metrics, (5) analyze agency-wide software license data to identify opportunities to reduce costs and better inform investment decision making, and (6) provide software license management training to appropriate personnel.

Consistent with our recommendation, in July 2015, VA issued a comprehensive software licensing policy that addressed weaknesses we previously identified. The department also issued a directive that documents VA’s software license management policy and responsibilities for central management of agency-wide software licenses, consistent with our recommendations. By implementing our recommendations, VA should be better positioned to consistently and cost-effectively manage software throughout the agency.

In August 2017, the department also provided documentation showing that it had generated a comprehensive inventory of software licenses using automated tools for the majority of agency software license spending or enterprise-wide licenses. This inventory can serve to reduce redundant applications and help identify other cost saving opportunities.

Further, the department implemented a solution to analyze agency-wide software license data, including usage and costs. This solution should allow VA to identify cost saving opportunities and inform future investment decisions. In addition, the department has provided information indicating that appropriate personnel receive software license management training.

In conclusion, VA has made extensive use of numerous contractors and has obligated more than $1 billion for contracts that supported two of four VistA modernization programs that the department has initiated. VA has recently begun the fourth modernization program in which it plans to replace VistA with the same commercially available electronic health record system that is used by DOD. However, the department’s latest modernization effort is in the early stages of planning and is dependent on the system acquisition contract award in December 2017. VA’s completion and effective execution of plans will be essential to guiding this latest electronic health record modernization initiative to a successful outcome.

Beyond VistA, the department continues to make progress on key FITARA-related initiatives. Although the department has made progress in the area of software licensing, additional actions in the areas of data center consolidation and optimization, as well as incremental system development can better position VA to effectively manage its IT. We plan to continue to monitor the department’s progress on these important activities.

Chairman Hurd, Ranking Member Kelly, and Members of the Subcommittee, this completes my prepared statement. I would be pleased to respond to any questions that you may have.

GAO Contact and Staff Acknowledgments

If you or your staffs have any questions about this testimony, please contact David A. Powner at (202) 512-9286 or pownerd@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this testimony statement. GAO staff who made key contributions to this statement are Mark Bird (Assistant Director), Jacqueline Mai (Analyst in Charge), Justin Booth, Chris Businsky, Rebecca Eyler, Paris Hawkins, Valerie Hopkins, Brandon S. Pettis, Jennifer Stavros-Turner, Eric Trout, Christy Tyson, Eric Winter, and Charles Youman.

This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.