Federal Reports

Due to the importance of security measures required to protect the Tennessee Valley Authority’s (TVA) information and operations from cybersecurity threats, the OIG performed a penetration test of TVA’s network, systems, and applications.  Our objective was to determine if vulnerabilities and other cybersecurity weaknesses in TVA’s network, systems, and applications were present and exploitable. Specifics are being withheld from public release due to their sensitive nature in relation to TVA’s cybersecurity. We made five recommendations to TVA management.

We audited the Puerto Rico Public Housing Administration’s management of lead‐based paint in its public housing program based on our assessment of the risks of lead‐based paint in public housing.  The risk factors assessed included the age of buildings, the number of units, and reported cases of childhood lead poisoning.  The Puerto Rico Public Housing Administration (Authority) is the second largest public housing agency (PHA) in the country with about 53,700 public housing units, the majority of which were constructed before 1978, the oldest having been constructed in 1941.

We found that Puerto Rico Public Housing Administration has not adequately managed lead-based paint in its public housing.  It did not (1) conduct lead-based paint inspections or risk assessments, (2) maintain adequate records, (3) integrate interim controls, including ongoing maintenance and visual assessments, in its normal operations, or (4) properly disclose the presence of lead-based paint to its public housing residents.  These deficiencies are the result of weak governance and inadequate oversight by the Authority.  Leadership failed to allocate the necessary resources, implement effective risk management practices, and maintain up-to-date policies consistent with Federal regulations.  Poor information management and communication further contributed to gaps in tracking lead-based paint hazards and informing affected families.  Additionally, the lack of monitoring prevented the timely identification and correction of deficiencies, ultimately compromising the safety of public housing residents, particularly young children.  As a result, individuals and families living in the Authority’s public housing units, including those with children under 6 years of age, are at an increased risk of exposure to lead-based paint hazards shown to result in adverse health effects, a risk compounded by the absence of complete and reliable information necessary for the Authority and HUD to implement adequate mitigation measures.  While the Authority implemented procedures in HUD’s LSHR to manage elevated blood lead levels (EBLL) cases for children under 6 years of age, improvements are needed.  Specifically, the Authority (1) did not notify families of the results of its environmental investigations, (2) did not notify HUD in a timely manner of the results of environmental investigations, and (3) did not perform hazard reduction in one case.  The Authority’s policies for managing EBLL cases were outdated and contained operational and communication deficiencies, indicating the need for continued efforts to strengthen monitoring and ensure the protection of residents, particularly young children.  While the Authority took steps to complete environmental investigations for EBLL cases, individuals and families, especially those with children under 6 years old, were not adequately informed of lead-based paint hazards, increasing the risk of prolonged exposure and delayed medical intervention.

We recommend that the Director of the Caribbean Office of Public Housing require the Authority to (1) conduct risk assessments in public housing without adequate lead-based paint inspection documentation to ascertain the existence of lead-based paint hazards, (2) conduct lead-based paint inspections at public housing where removal methods had been applied but  an abatement report is unavailable, (3) abate or implement interim control measures to reduce the risk of exposure to lead-based paint hazards identified through risk assessments, (4) implement an ongoing maintenance program for lead-based paint to ensure units remain hazard free, (5) develop and implement adequate policies and procedures regarding the management of lead-based paint in public housing, including adequate record-keeping practices, completing interim controls, and conducting ongoing maintenance for lead-based paint and (6) ensuring   appropriate and accurate disclosures to prospective and current tenants.  We also recommend that the Director of the Caribbean Office of Public Housing require the Authority to (1) revise and update the Authority’s policies to ensure that environmental investigations are completed for all EBLL cases, and ensure that HUD and residents are notified of the results of environmental investigations in a timely manner, (2) coordinate with HUD to train the Authority’s staff on managing EBLL cases, and to provide technical assistance such as developing written procedures, improving internal controls, or contracting with subject matter experts on procedures and controls to address the issues cited in this report, and (3) provide evidence that it abated lead-based paint hazards in one EBLL case where the Authority did not abate the hazards identified in an environmental investigation.

The VA Office of Inspector General (OIG) conducted a healthcare inspection at the Syracuse VA Medical Center (facility) to assess allegations of reduced clinical services, poor leadership communication, and staff resignations. The OIG also identified concerns about patient transfer delays and oversight of infrastructure requirements.

The OIG substantiated that clinical services were reduced. The former Facility Director closed the neurosurgery program without submitting a required clinical restructuring request, bypassing national oversight. Facility leaders allowed contracts for infectious disease and endocrinology services to lapse and did not implement contingency plans upon the lapses. The OIG also substantiated eight physicians resigned due to clinical service reductions and deficient communication. Further, coverage requirements of the facility’s complexity designation were not met, which reduced the availability of clinical services. Although the OIG did not identify any adverse patient outcomes, the OIG is concerned about the potential risk.

Facility leaders did not have a process to monitor patient transfer timeliness; therefore, the OIG was unable to determine if delays occurred. Veterans Integrated Service Network and facility leaders also did not provide compulsory oversight of facility infrastructure requirements, increasing risks to patient care. 

In response to the OIG’s recommendations, the Acting Under Secretary for Health outlined plans for communicating expectations for infrastructure deficiency waivers. The Interim Veterans Integrated Service Network Director committed to evaluating circumstances that led to facility leaders not following clinical restructuring requirements as well as ensuring accurate infrastructure reviews. The Interim Facility Director also reported plans to verify accurate infrastructure reviews, enhance communication strategies, and examine contracting and patient transfer processes.

USDA OIG'S objective was to determine whether Food and Nutrition Service has taken actions to secure IT hardware to effectively prevent Supplemental and Nutrition Assistance Program (SNAP) benefit theft through card skimming, card and terminal cloning, and other similar fraudulent methods.
 

The VA Office of Inspector General (OIG) identified a potential patient safety risk related to the Veterans Health Administration’s (VHA’s) use of generative artificial intelligence (AI) chat tools for clinical care and documentation. Generative AI creates new, original content by learning patterns from existing data.  During a national review initiated on October 16, 2025, the OIG found that VHA lacks a formal process to report, track, and respond to safety issues associated with generative AI use. Not having a process precludes a feedback loop and a means to detect patterns that could improve AI tools used in clinical settings.

VHA authorizes two general-purpose AI chat tools, VA GPT and Microsoft 365 Copilot Chat, for use with patient health information. These tools rely on clinical prompts. The output from an AI chat tool can be used to support medical decision-making and copied into the electronic health record. However, generative AI can produce inaccurate outputs, which may affect diagnosis and treatment decisions.

VHA Directive 1050.01(1) requires the Office of Quality Management and the National Center for Patient Safety (NCPS) to provide oversight of VHA quality programs and VHA patient safety programs. Interviews with leaders from VHA’s NCPS and National AI Institute and the Office of Information Technology’s Chief AI Officer team revealed that generative AI chat tools deployment occurred without coordination with NCPS. The OIG is concerned about VHA’s ability to promote and safeguard patient safety.

The OIG continues to monitor this issue and will include further analysis in its final report.