Inadequate Oversight of Contractors’ Personal Identity Verification Cards Puts Veterans’ Sensitive Information and Facility Security at Risk

The VA Office of Inspector General (OIG) conducted this review to determine whether Veterans Health Administration (VHA) contracting officers complied with mandates to ensure contractors account for and return their personnel’s personal identity verification (PIV) cards as required, such as at the end of a contract or employment. PIV cards are federally issued credentials used by authorized individuals to gain access to federal facilities and information systems. The Federal Acquisition Regulation (FAR) establishes that it is the contracting officer’s responsibility to ensure that contractor employees return all PIV cards they are issued. Unreturned cards increase risks for unauthorized access to VA facilities and information systems. The review team examined a random sample of 46 professional service and healthcare resource contracts. None of the reviewed contracts had adequate evidence to demonstrate FAR requirements were met. VHA contracting officers’ noncompliance with PIV card requirements occurred because they were unaware of their responsibilities and the requirements. In addition, VHA did not have policies or procedures detailing supervisory oversight of contracting officers’ duties regarding PIV cards, the internal audit office did not review compliance, and there was no automated tool for continuous tracking and monitoring of PIV cards issued to contractors’ personnel. The OIG made 10 recommendations to the under secretary for health to address deficiencies related to compliance with requirements for PIV cards issued to contractors’ personnel. Recommendations include ensuring all PIV cards are returned prior to contract closeout, outlining specific supervisory responsibilities for contracting officer oversight, and periodically reviewing contract compliance. The OIG also recommended VHA assess whether the existing and planned information systems could have the functionality to allow effective and routine monitoring of contractors’ PIV cards or a new system is needed.