The VA Office of Inspector General (OIG) conducted this audit to determine whether VA and its contractor had sufficient controls to prevent, respond to, and mitigate the impact of major performance incidents affecting the electronic health record (EHR) system.In May 2018, VA awarded a 10-year contract to Cerner (now Oracle Health) to implement the system. Since then, it has experienced hundreds of major performance incidents affecting the five VA medical centers where the system was initially deployed.The OIG found VA and Oracle Health did not have adequate controls to prevent system changes from causing major incidents, to respond to those incidents uniformly and thoroughly, or to mitigate their impact by providing standard procedures and interoperable downtime equipment. Further, although major performance incidents can delay care to veterans, VA had no formal process to link reports of these delays to specific major performance incidents. Ultimately, the inadequate controls for handling major incidents stemmed from the May 2018 contract. In May 2023, VA modified the contract to strengthen some requirements for addressing major incidents but could do more.The EHR system’s estimated cost has grown. It was originally $16 billion. If VA does not improve controls, major performance incidents will continue, leading to further costly delays in system implementation and posing an ongoing risk to patient safety.The OIG made nine recommendations, including real-time data sharing to give VA greater awareness of potential problems in system operations, prioritizing major performance incident response in a clear and consistent manner, developing and enforcing response and other performance metrics to hold the contractor accountable, requiring sufficient detail in post-resolution reports, raising staff awareness of procedures and acquiring appropriate backup systems for downtime, and better identifying and addressing major performance incidents linked to negative patient outcomes.
Open Recommendations
| Recommendation Number | Significant Recommendation | Recommended Questioned Costs | Recommended Funds for Better Use | Additional Details | |
|---|---|---|---|---|---|
| 01 | No | $0 | $0 | ||
| Assess electronic health record major performance incident data needs and contractually commit to real-time data sharing that will provide greater awareness of system operations. | |||||
| 02 | No | $0 | $0 | ||
| Develop a formal procedure for verifying performance metrics and associated credits to ensure the department receives the remedies it is due under the contract. | |||||
| 03 | No | $0 | $0 | ||
| Update the process for prioritizing major performance incidents to ensure that notification and resolution occur in a consistent manner. | |||||
| 04 | No | $0 | $0 | ||
| Develop effective notification and resolution metrics that consistently capture results for all major performance incidents, regardless of the owner, and enforce them. | |||||
| 05 | No | $0 | $0 | ||
| Identify the information needed in post-resolution reports, such as corrective and preventative actions, and require the contractor to consistently collect, verify, and report that information as a contract deliverable. | |||||
| 06 | No | $0 | $0 | ||
| Develop a plan to ensure all clinicians are familiar with the national downtime procedures. | |||||
| 07 | No | $0 | $0 | ||
| Identify the appropriate backup system and develop a training strategy to ensure clinicians can use the system during downtime. | |||||
| 08 | No | $0 | $0 | ||
| Assess facilities patient safety reports identified during this audit to determine if additional actions need to be taken and, if so, provide an action plan. | |||||
| 09 | No | $0 | $0 | ||
| Develop a mechanism to better identify major performance incidents and negative patient outcomes and provide a plan to prioritize and address their causes. | |||||
