Federal Reports

We determined that DHS' information security program for Top Secret/Sensitive Compartmented Information intelligence systems is effective this year as the Department achieved “Level 4 – Managed and Measurable” in three of five cybersecurity functions, based on current reporting instructions for intelligence systems. However, we identified deficiencies in DHS’ overall patch management process and the Cybersecurity and Infrastructure Security Agency’s weakness remediation and security awareness training activities. We made one recommendation to the Office of Intelligence and Analysis and two recommendations to the Cybersecurity and Infrastructure Security Agency to address the deficiencies identified. DHS concurred with all three recommendations.

Reports dealing with grant management issues for grants administered for ARC by State agencies

The Veterans Health Administration (VHA) is the nation’s largest care provider for chronic hepatitis C virus infection, with rates about three times the national average. Direct-acting antivirals (DAA) can cure chronic hepatitis C, and Congress appropriated over $3 billion between fiscal years 2015–2017 to provide such treatment for infected veterans. The VA Office of Inspector General (OIG) conducted this review to assess VHA facilities’ care of patients with chronic hepatitis C. In one study population, the OIG found that 8,813 (55 percent) of 15,940 patients who tested positive for chronic hepatitis C did not receive DAA treatment. VHA providers documented acceptable reasons for nontreatment for 85.5 percent of these patients. Acceptable reasons included when the patient received treatment outside VHA, deferred or declined treatment, or did not respond to contact attempts by VHA. Other patients did not receive treatment for reasons that were unidentifiable (11.6 percent) or indeterminate (2.9 percent) to the OIG, hindering its ability to evaluate providers’ plans to offer these patients treatment or specialty care referrals. The OIG also found that 9.6 percent of patients who completed DAA treatment did not receive posttreatment testing to confirm they were cured, although the OIG was unable to determine the reasons why testing was not done. In a second study population of 5,467 patients, the OIG assessed whether those who tested positive for hepatitis C antibodies received further confirmatory testing for chronic hepatitis C infection as required. An estimated 99.1 percent of these patients had confirmatory testing completed. The OIG made two recommendations to the VHA Executive in Charge to ensure patients with chronic hepatitis C have provider treatment considerations documented and that providers obtain and document posttreatment follow-up testing in the patients’ medical record in alignment with VA National Viral Hepatitis Program Guidelines.