Open Recommendations

USDA OIG has determined that this recommendation contains sensitive information and will not be publicly released due to privacy concerns.

USDA OIG has determined that this recommendation contains sensitive information and will not be publicly released due to privacy concerns.

USDA OIG has determined that this recommendation contains sensitive information and will not be publicly released due to privacy concerns.

We recommend Departmental Administration Information Technology Office management enforce multi-factor authentication, or the equivalent thereof, to the application.

We recommend (REDACTED) management implement a system of quality control to ensure the timely completion of quarterly privileged user access reviews in accordance with USDA Departmental Regulation 3505-003.

We recommend Departmental Administration Information Technology Office management configure the system to generate user listings with the required data elements (e.g., first name, last name, account creation date, and roles or privileges) to support its system of internal controls and operational needs.

We recommend (REDACTED) management enable the collection of privileged and non-privileged audit logging events and design and implement a process for monitoring and analyzing significant events for unauthorized or unusual activities.

We recommend Cybersecurity and Privacy Operations Center management update existing policies and procedures to include repercussions when an individual does not complete their required role-based security training in the designed 45-day time frame.

We recommend Cybersecurity and Privacy Operations Center management develop a mechanism to track the completion of role-based security training and verify remedial action has occurred in the event an individual has not taken the training on a timely basis.

We recommend the Chief Information Officer perform a cybersecurity resource assessment to identify any technology, people, or tool gaps.

The Phoenix VA Health Care System Director ensures Phoenix VA Health Care System rapid response policy is in alignment with Veterans Health Administration Directive 1177, Cardiopulmonary Resuscitation.

The Phoenix VA Health Care System Director ensures Phoenix VA Health Care System policies and procedures related to responding to medical emergencies do not conflict.

The Phoenix VA Health Care System Director ensures Phoenix VA Health Care System policy is in alignment with Veterans Health Administration Directive 1101.14, Emergency Medicine.

The Phoenix VA Health Care System Director determines the need for, and implements placement of, public access automated external defibrillators in accordance with Veterans Health Administration Directive 1177, Cardiopulmonary Resuscitation.

The Phoenix VA Health Care System Director assesses outpatient clinic compliance with vital sign completion and documentation, identifies deficiencies, and takes action as warranted.

The Phoenix VA Health Care System Director reviews and assesses the need for non-clinical staff training on the use of the Joint Patient Safety Reporting system, and takes action as warranted.

The Phoenix VA Health Care System Director reviews organizational communication channels and ensures consistency with Veterans Health Administration high reliability organization principles and I CARE values.

The Phoenix VA Health Care System Director makes certain that investigation and closure of events placed into the Joint Patient Safety Reporting system are completed per the Veterans Health Administrations established time frame, and monitors compliance.

Ensure that a process is in place to validate that all audit trail data elements, including investigative elements provided by TIGTA Office of Investigations, are being captured and can be provided by Login.gov prior to using its identity proofing services for IRS IAL2 applications.

Appropriate IRS management works in conjunction with Login.gov management to assess the extent and impact that the critical vulnerability had on the users who authenticated via Login.gov to access IRS applications and may have had their Personally Identifiable Information sent to unauthorized locations outside of the United States.

The Hampton VA Medical Center Director conducts focused clinical care reviews in accordance with Veterans Health Administration requirements, and monitors for compliance.

The Hampton VA Medical Center Director ensures that summary suspensions are conducted in accordance with Veterans Health Administration policy, and monitors for compliance.

The Hampton VA Medical Center Director confirms that proposed reduction or revocation of privileges complies with Veterans Health Administration policies and procedures, and monitors for compliance.

The Hampton VA Medical Center Director complies with Veterans Health Administration requirements when reporting licensed independent practitioners to state licensing boards.

The Hampton VA Medical Center Director completes a review of Medical Executive Committee meeting minutes and ensures recommendations made for focused professional practice evaluations for cause for licensed independent practitioners have been completed according to Veterans Health Administration requirements.