Inspection of Information Security at the VA Spokane Healthcare System in Washington

The VA Office of Inspector General’s (OIG) information security inspection program assesses whether VA facilities are meeting federal security requirements related to three high-risk control areas: configuration management, security management, and access. For this inspection, the OIG selected the VA Spokane Healthcare System in Washington and found deficiencies in all three areas.

Configuration management controls, which identify and manage security features for all hardware and software components of an information system, were deficient in vulnerability remediation and system baseline configurations.

Security management controls had one deficiency. The OIG identified volunteers and scheduling clerks who were granted unnecessary access to an electronic health record screen that contained unredacted personally identifiable information.

Access controls had four deficiencies. The OIG found that the Mann-Grandstaff VA Medical Center was deficient in inventory management of physical keys, unsecured network equipment, electrical grounding, and fuel storage. As a result, the facility risks unauthorized access, disruption, and destruction of critical information technology resources.

To address deficiencies, the OIG made seven recommendations to VA, all of which VA concurred with.