Veterans Affairs Information Technology: Historical Perspective on Health System Modernization Contracts and Update on Efforts to Address Key FITARA-Related Areas

The use of IT is crucial to helping VA effectively serve the nation's veterans and, each year, the department spends billions of dollars on its information systems and assets. However, VA has faced challenges spanning a number of critical initiatives related to modernizing its major systems. To improve all major federal agencies' acquisitions and hold them accountable for reducing duplication and achieving cost savings, in December 2014 Congress enacted federal IT acquisition reform legislation (commonly referred to as the Federal Information Technology Acquisition Reform Act , or FITARA).

GAO was asked to summarize its previous and ongoing work regarding VA's history of efforts to modernize VistA, including past use of contractors, and the department's recent effort to acquire a commercial electronic health record system to replace VistA. GAO was also asked to provide an update on VA's progress in key FITARA-related areas, including (1) data center consolidation and optimization, (2) incremental system development practices, and (3) software license management. VA generally agreed with the information upon which this statement is based.

For nearly two decades, the Department of Veterans Affairs (VA) has undertaken multiple efforts to modernize its health information system—the Veterans Health Information Systems and Technology Architecture (known as VistA). Two of VA's most recent efforts included the Integrated Electronic Health Record (iEHR) program, a joint program with the Department of Defense (DOD) intended to replace separate systems used by VA and DOD with a single system; and the VistA Evolution program, which was to modernize VistA with additional capabilities and a better interface for all users. VA has relied extensively on assistance from contractors for these efforts. VA obligated over $1.1 billion for contracts with 138 contractors during fiscal years 2011 through 2016 for iEHR and VistA Evolution. Contract data showed that the 15 key contractors that worked on both programs accounted for $741 million of the funding obligated for system development, project management, and operations and maintenance to support the two programs (see figure). VA recently announced that it intends to change its VistA modernization approach and acquire the same electronic health record system that DOD is implementing.

With respect to key FITARA-related areas, the department has reported progress on consolidating and optimizing its data centers, although this progress has fallen short of targets set by the Office of Management and Budget. VA has also reported $23.61 million in data center-related cost savings, yet does not expect to realize further savings from additional closures. In addition, VA's Chief Information Officer (CIO) certified the use of adequate incremental development for 10 of the department's major IT investments; however, VA has not yet updated its policy and process for CIO certification as GAO recommended. Finally, VA has issued a software licensing policy and has generated an inventory of its software licenses to inform future investment decisions.

GAO has made multiple recommendations to VA aimed at improving the department's IT management. VA has generally agreed with the recommendations and begun taking responsive actions.

Thank you for the opportunity to participate in today’s hearing on the  information technology (IT) efforts of the Department of Veterans Affairs  (VA). As you know, the use of IT is crucial to helping VA effectively serve  the nation’s veterans and, each year, the department spends billions of  dollars on its information systems and assets.

Over many years, however, VA has experienced challenges in managing  its IT projects and programs, which, in turn, has contributed to questions  about the efficiency and effectiveness of the department’s operations.  These challenges have spanned a number of critical initiatives related to  modernizing major systems within the department, including its electronic  health information system—the Veterans Health Information Systems and  Technology Architecture (VistA). We have previously reported on the  challenges that the department has faced in managing this system, as  well as other aspects of its IT.

Further, given the challenges that federal agencies, including VA, have  long encountered in managing IT acquisitions, in December 2014  Congress enacted federal IT acquisition reform legislation (commonly  referred to as the Federal Information Technology Acquisition Reform Act,  or FITARA). This law was intended to improve agencies’ acquisitions  and enable Congress to hold agencies accountable for reducing  duplication and achieving cost savings.

At your request, my testimony today summarizes our work that has  examined VA’s history of efforts to modernize its health information  system, VistA, including past uses of contractors across multiple  modernization initiatives, and the department’s plan to acquire a  commercial electronic health record system to replace VistA. In addition,  the testimony provides an update on VA’s progress in key FITARA- related areas, including (1) data center consolidation and optimization, (2)  incremental system development practices, and (3) software license  management.

In developing this testimony, we relied on our previously published  reports that discussed the history of the department’s VistA modernization  efforts, as well as the department’s efforts regarding data center  consolidation and optimization, incremental system development  practices, and software license management. We also considered  information provided by the department on its actions in response to our  previous recommendations in these areas. The reports cited throughout  this statement include detailed information on the scope and methodology  for our prior reviews.

Further, the statement summarizes key findings from a draft report that is  based on our ongoing review of selected VistA modernization contracts  and the department’s recent efforts to acquire a commercial electronic  health record system. This draft report is currently with VA for its  comments. We anticipate issuing the final report in January 2018.

For our ongoing review of the VistA modernization efforts, we obtained  available data from VA on the associated contracts, related dollar  obligations, and expected contractor activities for modernization tasks. In  this regard, VA was able to provide the requested data for two  modernization initiatives with activities that spanned the time period from  fiscal year 2011 through fiscal year 2016.

To determine the key contractors for the two modernization initiatives, we  first identified all of the contractors that worked on the initiatives. We then  ranked the contractors according to the total dollars obligated for  contracts that each contractor had been awarded. We designated the top  15 ranked contractors, in terms of dollars obligated, as key contractors.  We assessed the reliability of the contract data we received from VA and  determined that the data were sufficiently reliable for the purposes of our  review.

To determine VA’s current plans for modernizing VistA, we reviewed draft  program schedules, organization charts, congressional testimonies of the  VA Secretary, a White House press conference transcript, departmental  press releases, and the department’s justification for awarding a non- competitive contract for a commercial off-the-shelf (COTS) electronic  health record system. We also met with senior VA officials to obtain  updated information on the efforts.

The work upon which this statement is based is being or was conducted  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audits to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

VA’s mission is to promote the health, welfare, and dignity of all veterans  in recognition of their service to the nation by ensuring that they receive  medical care, benefits, social support, and lasting memorials. In carrying  out this mission, the department operates one of the largest health care  delivery systems in America, providing health care to millions of veterans  and their families at more than 1,500 facilities.

The department’s three major components—the Veterans Health  Administration (VHA), the Veterans Benefits Administration (VBA), and the National Cemetery Administration (NCA)—are primarily responsible  for carrying out its mission. More specifically, VHA provides health care  services, including primary care and specialized care, and it performs  research and development to improve veterans’ needs. VBA provides a  variety of benefits to veterans and their families, including disability  compensation, educational opportunities, assistance with home  ownership, and life insurance. Further, NCA provides burial and memorial  benefits to veterans and their families.

Collectively, the three components rely on approximately 340,000  employees to provide services and benefits. These employees work in  VA’s Washington, D.C. headquarters, as well as 170 medical centers,  approximately 750 community-based outpatient clinics, 300 veterans  centers, 56 regional offices, and more than 130 cemeteries situated  throughout the nation.

The use of IT is critically important to VA’s efforts to provide benefits and  services to veterans. As such, the department operates and maintains an  IT infrastructure that is intended to provide the backbone necessary to  meet the day-to-day operational needs of its medical centers, veteran- facing systems, benefits delivery systems, memorial services, and all  other systems supporting the department’s mission. The infrastructure is  to provide for data storage, transmission, and communications  requirements necessary to ensure the delivery of reliable, available, and  responsive support to all VA staff offices and administration customers,  as well as veterans.

According to department data as of October 2016, there were 576 active  or in-development systems in VA’s inventory of IT systems. These  systems are intended to be used for the determination of benefits,  benefits claims processing, and access to health records, among other  services. VHA is the parent organization for 319 of these systems. Of the 319 systems, 244 were considered mission-related and provide  capabilities related to veterans’ health care delivery. For example, VHA’s  systems provide capabilities to establish and maintain electronic health  records that health care providers and other clinical staff use to view  patient information in inpatient, outpatient, and long-term care settings.

VistA serves an essential role in helping the department to fulfill its health  care delivery mission. Specifically, VistA is an integrated medical  information system for all veterans’ health information. It was developed  in-house by the department’s clinicians and IT personnel and has been in  operation since the early 1980s. As such, the system has long been vital  to helping ensure the quality of health care received by the nation’s  veterans and their dependents.

VistA is comprised of more than 200 applications that assist in the  delivery of health care and perform other important functions within the  department, including financial management, enrollment, and registration.  Some of these applications have been in operation for over 30 years and,  according to VA, have become increasingly difficult and costly to  maintain. As such, the department has expended extensive resources to  modernize the system and increase its ability to allow for the viewing or  exchange of patient information with the Department of Defense (DOD)  and private sector health providers. In addition, as we recently reported,  VHA has unaddressed needs that indicate its current health IT systems,  including VistA, do not fully support the organization’s business  functions. Specifically, about 39 percent of all requests related to health  IT needs have remained unaddressed after more than 5 years.

Electronic health records are particularly crucial for optimizing the health  care provided to veterans, many of whom may have health records  residing at multiple medical facilities within and outside the United States.  Taking steps toward interoperability—that is, collecting, storing, retrieving,  and transferring veterans’ health records electronically—is significant to  improving the quality and efficiency of care. One of the goals of  interoperability is to ensure that patients’ electronic health information is  available from provider to provider, regardless of where it originated or  resides.

Since 2007, VA has been operating a centralized organization, the Office  of Information and Technology (OI&T), in which most key functions  intended for effective management of IT are performed. This office is led  by the Assistant Secretary for Information and Technology—VA’s Chief  Information Officer (CIO). The office is responsible for providing strategy  and technical direction, guidance, and policy related to how IT resources  are to be acquired and managed for the department, and for working  closely with its business partners—such as VHA—to identify and prioritize  business needs and requirements for IT systems. Among other things,  OI&T has responsibility for managing the majority of VA’s IT-related  functions, including the maintenance and modernization of VistA. As of  2016, OI&T was comprised of more than 15,000 staff, with more than half  of these positions filled by contractors.

VA Requested Nearly $4.1 Billion for Fiscal Year 2018

For fiscal year 2018, the department’s budget request included nearly  $4.1 billion for IT. The department requested approximately $359 million  for new systems development or modernization efforts, approximately  $2.5 billion for maintaining existing systems, and approximately $1.2  billion for payroll and administration. For example, in its fiscal year 2018  budget submission, the department requested appropriations to support  five IT portfolios, including the development and operations and  maintenance for programs and projects related to the:

Medical portfolio, which provides technology solutions to deliver  modern, high-quality medical care capabilities to veterans ($944.2  million);

Benefit portfolio, which addresses the technology needs managed by  the Veterans Benefit Administration ($296.9 million);

Memorial Affairs portfolio, which provides support for the  modernization of applications and services for National Cemeteries at  133 locations nationwide ($24.5 million);

Corporate portfolio, which consists of back office operations  supporting the major business lines and department management  ($270.6 million); and

Enterprise IT, which provides the underlying infrastructure to enable  the other portfolios to operate and includes such things as  cybersecurity, data centers, cloud services, telephony, enterprise  software, and data connectivity ($1.289 billion).

VA’s Management of IT Has Contributed to High- Risk Designations

In 2015, we designated VA Health Care as a high-risk area for the federal  government and, currently, we continue to be concerned about the  department’s ability to ensure that its resources are being used cost- effectively and efficiently to improve veterans’ timely access to health  care. In part, we identified limitations in the capacity of VA’s existing  systems, including the outdated, inefficient nature of certain systems and  a lack of system interoperability—that is, the ability to exchange and use  electronic health information—as contributors to the department’s IT  challenges related to health care. These challenges present risks to the  timeliness, quality, and safety of the health care. While we recently  reported that the department has begun to demonstrate leadership  commitment to addressing IT challenges, more work remains.

Also, in February 2015, we added Improving the Management of IT  Acquisitions and Operations to our list of high-risk areas. Specifically,  federal IT investments too frequently fail or incur cost overruns and  schedule slippages while contributing little to mission-related outcomes.  We have previously testified that the federal government has spent  billions of dollars on failed IT investments, including, for example, VA’s  Scheduling Replacement Project, which was terminated in September 2009 after spending an estimated $127 million over 9 years; and its  Financial and Logistics Integrated Technology Enterprise program, which  was intended to be delivered by 2014 at a total estimated cost of $609  million, but was terminated in October 2011 due to challenges in  managing the program.

This high-risk area highlighted several critical IT initiatives in need of  additional congressional oversight, including (1) reviews of troubled  projects; (2) efforts to increase the use of incremental development; (3)  efforts to provide transparency relative to the cost, schedule, and risk  levels for major IT investments; (4) reviews of agencies’ operational  investments; (5) data center consolidation; and (6) efforts to streamline  agencies’ portfolios of investments. We noted that agencies’  implementation of these initiatives was inconsistent and that more work  remained to demonstrate progress in achieving IT acquisition and  operation outcomes.

We also recently issued an update to our high-risk report and noted that,  while progress has been made in addressing the high-risk area of IT  acquisitions and operations, significant work remains to be completed.  For example, we noted, among other things, that additional work was  needed to establish action plans for federal agencies to modernize or  replace obsolete systems. Specifically, we pointed out that many federal  systems use outdated software languages and hardware, which has  increased spending on operations and maintenance of technology  investments.

VA was among a handful of departments with one or more archaic legacy  systems. As discussed in our recent report on legacy systems used by  federal agencies, we identified 2 of the department’s systems as being  over 50 years old, and among the 10 oldest investments and/or systems  that were reported by 12 selected agencies.

Personnel and Accounting Integrated Data (PAID)—This 53-year old  system automates time and attendance for employees, timekeepers,  payroll, and supervisors. It is written in Common Business Oriented  Language (COBOL), a programming language developed in the late  1950s and early 1960s, and runs on IBM mainframes.

Benefits Delivery Network (BDN)—This 51-year old system tracks  claims filed by veterans for benefits, eligibility, and dates of death. It is  a suite of COBOL mainframe applications.

Ongoing uses of antiquated systems, such as PAID and BDN, contribute  to agencies spending a large, and increasing, proportion of their IT  budgets on operations and maintenance of systems that have outlived  their effectiveness and are consuming resources that outweigh their  benefits. Accordingly, we have recommended that VA identify and plan to  modernize or replace its legacy systems. The department concurred with  our recommendation and stated that it plans to retire and replace PAID  with the Human Resources Information System Shared Service Center in  2017. The department also stated that it has general plans to roll the  capabilities of BDN into another system and to retire BDN in 2018.

FITARA Is Intended to Help VA and Other Agencies Improve Their Acquisitions of IT

Congress enacted federal IT acquisition reform legislation (commonly  referred to as the Federal Information Technology Acquisition Reform Act,  or FITARA) in December 2014. This legislation was intended to improve  agencies’ acquisitions of IT and enable Congress to monitor agencies’  progress and hold them accountable for reducing duplication and  achieving cost savings. The law applies to VA and other covered  agencies. It includes specific requirements related to seven areas, including data center consolidation and optimization, agency CIO  authority, and government-wide software purchasing.

Federal data center consolidation initiative (FDCCI). Agencies are  required to provide the Office of Management and Budget (OMB) with  a data center inventory, a strategy for consolidating and optimizing  their data centers (to include planned cost savings), and quarterly  updates on progress made. The law also requires OMB to develop a  goal for how much is to be saved through this initiative, and provide  annual reports on cost savings achieved.

Agency CIO authority enhancements. CIOs at covered agencies  are required to (1) approve the IT budget requests of their respective  agencies, (2) certify that IT investments are adequately implementing  incremental development, as defined in capital planning guidance  issued by OMB, (3) review and approve contracts for IT, and (4)  approve the appointment of other agency employees with the title of  CIO.

Government-wide software purchasing program. The General  Services Administration is to develop a strategic sourcing initiative to  enhance government-wide acquisition and management of software.  In doing so, the law requires that, to the maximum extent practicable,  the General Services Administration should allow for the purchase of  a software license agreement that is available for use by all executive  branch agencies as a single user. Expanding upon FITARA, the  Making Electronic Government Accountable by Yielding Tangible  Efficiencies Act of 2016, or the “MEGABYTE Act,” further enhanced  CIOs’ management of software licenses by requiring agency CIOs to  establish an agency software licensing policy and a comprehensive  software license inventory to track and maintain licenses, among  other requirements.

In June 2015, OMB released guidance describing how agencies are to  implement FITARA. This guidance is intended to, among other things: assist agencies in aligning their IT resources with statutory establish government-wide IT management controls that will meet the  law’s requirements, while providing agencies with flexibility to adapt to  unique agency processes and requirements;  clarify the CIO’s role and strengthen the relationship between agency  CIOs and bureau CIOs; and  strengthen CIO accountability for IT costs, schedules, performance,  and security.

VA Has Pursued Four VistA Modernization Initiatives Since 2001, with About a Billion Dollars Obligated for Contractors’ Activities During Fiscal Years 2011 through 2016

In our draft report that is currently with VA for comments, we discuss the  history of VA’s efforts to modernize its health information system, VistA.  These four efforts—HealtheVet, the integrated Electronic Health Record  (iEHR), VistA Evolution, and the Electronic Health Record Modernization  (EHRM)—reflect varying approaches that the department has considered  to achieve a modernized health care system over the course of nearly two  decades. The modernization efforts are described as follows.

In 2001, VA undertook its first VistA modernization project, the  HealtheVet initiative, with the goals of standardizing the department’s  health care system and eliminating the approximately 130 different  systems used by its field locations at that time. HealtheVet was scheduled  to be fully implemented by 2018 at a total estimated development and  deployment cost of about $11 billion. As part of the effort, the department  had planned to develop or enhance specific areas of system functionality  through six projects, which were to be completed between 2006 and  2012. Specifically, these projects were to provide capabilities to support  VA’s Health Data Repository and Patient Financial Services System, as  well as the Laboratory, Pharmacy, Imaging, and Scheduling functions.

In June 2008, we reported that the department had made progress on the  HealtheVet initiative, but noted issues with project planning and  governance. In June 2009, the Secretary of Veterans Affairs announced  that VA would stop financing failed projects and improve the management  of its IT development projects. Subsequently, in August 2010, the  department reported that it had terminated the HealtheVet initiative.

In February 2011, VA began its second modernization initiative, the iEHR  program, in conjunction with DOD. The program was intended to replace  the two separate electronic health record systems used by the two  departments with a single, shared system. Moreover, because both  departments would be using the same system, this approach was  expected to largely sidestep the challenges that had been encountered in  trying to achieve interoperability between their two separate systems.

Initial plans called for the development of a single, joint system consisting  of 54 clinical capabilities to be delivered in six increments between 2014  and 2017. Among the agreed-upon capabilities to be delivered were  those supporting laboratory, anatomic pathology, pharmacy, and  immunizations. According to VA and DOD, the single iEHR system had  an estimated life cycle cost of $29 billion through the end of fiscal year  2029.

However, in February 2013, the Secretaries of VA and DOD announced  that they would not continue with their joint development of a single  electronic health record system. This decision resulted from an  assessment of the iEHR program that the secretaries had requested in  December 2012 because of their concerns about the program facing  challenges in meeting deadlines, costing too much, and taking too long to  deliver capabilities. In 2013, the departments abandoned their plan to  develop the integrated system and stated that they would again pursue  separate modernization efforts.

In December 2013, VA initiated its VistA Evolution program as a joint  effort of VHA and OI&T that was to be completed by the end of fiscal year  2018. The program was to be comprised of a collection of projects and  efforts focused on improving the efficiency and quality of veterans’ health  care by modernizing the department’s health information systems,  increasing the department’s data exchange and interoperability with DOD  and private sector health care partners, and reducing the time it takes to  deploy new health information management capabilities. Further, the  program was intended to result in lower costs for system upgrades,  maintenance, and sustainment. According to the department’s March  2017 cost estimate, VistA Evolution was to have a life cycle cost of about  $4 billion through fiscal year 2028.

Since initiating VistA Evolution in December 2013, VA has completed a  number of key activities that were called for in its plans. For example, the  department delivered capabilities, such as the ability for health providers  to have an integrated, real-time view of electronic health record data  through the Joint Legacy Viewer, as well as the ability for health care  providers to view sensitive DOD notes and highlight abnormal test results  for patients. VA also initiated work to standardize VistA across the 130  VA facilities and released enhancements to its legacy scheduling,  pharmacy, and immunization systems. In addition, the department  released the enterprise Health Management Platform, which is a web- based user interface that assembles patient clinical data from all VistA  instances and DOD.

Although VistA Evolution is ongoing, VA is currently in the process of  revising its plan for the program as a result of the department recently  announcing its pursuit of a fourth VistA modernization program  (discussed below). For example, the department determined that it would  no longer pursue additional development or deployment of the enterprise  Health Management Platform—a major VistA Evolution component— because the new modernization program is envisioned to provide similar  capabilities.

In June 2017, the VA Secretary announced a significant shift in the  department’s approach to modernizing VistA. Specifically, rather than  continue to use VistA, the Secretary stated that the department plans to  acquire the same electronic health record system that DOD is  implementing. In this regard, DOD has contracted with the Cerner  Corporation to provide a new integrated electronic health record system.  According to the Secretary, VA has chosen to acquire this same product  because it would allow all of VA’s and DOD’s patient data to reside in one  system, thus enabling seamless care between the department and DOD  without the manual and electronic exchange and reconciliation of data  between two separate systems.

The VA Secretary added that this fourth modernization initiative is  intended to minimize customization and system differences that currently  exist within the department’s medical facilities, and ensure the  consistency of processes and practices within VA and DOD. When fully  operational, the system is intended to be the single source for patients to  access their medical history and for clinicians to use that history in real  time at any VA or DOD medical facility, which may result in improved  health care outcomes. According to VA’s Chief Technology Officer,  Cerner is expected to provide integration, configuration, testing,  deployment, hosting, organizational change management, training,  sustainment, and licenses necessary to deploy the system in a manner  that meets the department’s needs.

To expedite the acquisition, in June 2017, the Secretary signed a  “Determination and Findings,” which noted a public interest exception to  the requirement for full and open competition, and authorized VA to issue  a solicitation directly to the Cerner Corporation. According to the  Secretary, VA expects to award a contract to Cerner in December 2017,  and deployment of the new system is anticipated to begin 18 months after  the contract has been signed.

VA’s Executive Director for the Electronic Health Records Modernization  System stated that the department intends to incrementally deploy the  new system to its medical facilities. Each facility is expected to continue  using VistA until the new system has been deployed at that location. All  VA medical facilities are anticipated to have the new system implemented  within 7 to 8 years after the first deployment.

Figure 1 shows a timeline of the four efforts that VA has pursued to  modernize VistA since 2001.

VA Obligated about $1.1 Billion for VistA Modernization Contracts During Fiscal Years 2011 through 2016

For iEHR and VistA Evolution, the two modernization initiatives for which  VA could provide contract data, the department obligated approximately  $1.1 billion for contracts with 138 different contractors during fiscal years  2011 through 2016. Specifically, the department obligated  approximately $224 million and $880 million, respectively, for contracts  associated with these efforts. Of the 138 contractors, 34 of them  performed work supporting both iEHR and VistA Evolution. The remaining  104 contractors worked exclusively on either iEHR or VistA Evolution.

Funding for the 34 contractors that worked on both iEHR and VistA  Evolution totaled about $793 million of the $1.1 billion obligated for  contracts on the two initiatives. Obligations for contracts awarded to the  top 15 of these 34 contractors (which we designated as key contractors)  accounted for about $741 million (about 67 percent) of the total obligated  for contracts on the two initiatives. The remaining 123 contractors were  obligated about $364 million for their contracts.

The 15 key contractors were obligated about $564 million and $177  million for VistA Evolution and iEHR contracts, respectively. Table 1  identifies the key contractors and their obligated dollar totals for the two  efforts.

Additionally, we determined that, of the $741 million obligated to the key  contractors, $411 million (about 55 percent) was obligated for contracts  supporting the development of new system capabilities, $256 million  (about 35 percent) was obligated for contracts supporting project  management activities, and $74 million (about 10 percent) was obligated  for contracts supporting operations and maintenance for iEHR and VistA  Evolution. VA obligated funds to all 15 of the key contractors for system  development, 13 of the key contractors for project management, and 12  of the key contractors for operations and maintenance. Figure 2 shows  the amounts obligated for each of these areas.

Further, based on the key contractors’ documentation, for the iEHR  program, VA obligated $102 million for development, $65 million for  project management, and $10 million for operations and maintenance.  For the VistA Evolution Program, VA obligated $309 million for  development, $191 million for project management, and $64 million for  operations and maintenance. Figure 3 shows the amounts obligated for  contracts on the VistA Evolution and iEHR programs for development,  project management, and operations and maintenance.

In addition, table 2 shows the amounts that each of the 15 key contractors  were obligated for the three types of contract activities performed on  iEHR and VistA Evolution.

VA Is in the Process of Developing Plans for Its Latest VistA Modernization Initiative

Industry best practices and IT project management principles stress the  importance of sound planning for system modernization projects. These  plans should identify key aspects of a project, such as the scope,  responsible organizations, costs, schedules, and risks. Additionally,  planning should begin early in the project’s lifecycle and be updated as  the project progresses.

Since the VA Secretary announced that the department would acquire the  same electronic health record system as DOD, VA has begun planning  for the transition from VistA Evolution to EHRM. However, the department  is still early in its efforts, pending the contract award. In this regard, the  department has begun developing plans that are intended to guide the  new EHRM program. For example, the department has developed a  preliminary description of the organizations that are to be responsible for  governing the EHRM program. Further, the VA Secretary announced in  congressional testimony in November 2017, a key reporting responsibility  for the program—stating that the Executive Director for the Electronic  Health Records Modernization System will report directly to the  department’s Deputy Secretary. In addition, the department has  developed a preliminary timeline for deploying its new electronic health  record system to VA’s medical facilities, and a 90-day schedule that  depicts key program activities. The department also has begun  documenting the EHRM program risks.

Beyond the aforementioned planning activities undertaken thus far, the  Executive Director stated that the department intends to complete a full  suite of planning and acquisition management documents to guide the  program, including a life cycle cost estimate and an integrated master  schedule to establish key milestones over the life of the project. To this  end, the Executive Director told us that VA has awarded two program  management contracts to support the development of these plans to  MITRE Corporation and Booz Allen Hamilton.

According to the Executive Director, VA also has begun reviewing the  VistA Evolution Roadmap, which is the key plan that the department has  used to guide VistA Evolution since 2014. This review is expected to  result in an updated plan that is to prioritize any remaining VistA  enhancements needed to support the transition from VistA Evolution to  the new system. According to the Executive Director, the department  intends to complete the development of its plans for EHRM within 90 days  after award of the Cerner contract, which is anticipated to occur in  December 2017.

Further, beyond the development of plans, VA has begun to staff an  organizational structure for the modernization initiative, with the Under  Secretary of Health and the Assistant Secretary for Information and  Technology (VA’s Chief Information Officer) designated as executive  sponsors. It has also appointed a Chief Technology Officer from OI&T,  and a Chief Medical Officer from VHA, both of whom are to report to the  Executive Director.

VA’s efforts to develop plans for EHRM and to staff an organization to  manage the program encompass key aspects of project planning that are  important to ensuring effective management of the department’s latest  modernization initiative. However, the department remains early in its  modernization planning efforts, many of which are dependent on the  system acquisition contract award, which has not yet occurred. The  department’s continued dedication to completing and effectively executing  the planning activities that it has identified will be essential to helping  minimize program risks and guide this latest electronic health record  modernization initiative to a successful outcome—one which VA, for  almost two decades, has yet to achieve.

VA’s Progress toward Consolidating and Optimizing Data Centers and Addressing Other Key FITARA-Related Area Falls Short of Performance Targets

Beyond managing its system modernization efforts, such as VistA, VA  has to ensure the effective implementation of the IT acquisition  requirements called for in FITARA. Pursuant to FITARA, in August 2016,  the Federal CIO issued a memorandum that announced the Data Center  Optimization Initiative (DCOI). According to OMB, this new initiative  supersedes and builds on the results of FDCCI, and is also intended to  improve the performance of federal data centers in areas such as facility  utilization and power usage.

Among other things, DCOI requires 24 federal departments and agencies,  including VA, to develop plans and report on strategies (referred to as  DCOI strategic plans) to consolidate inefficient infrastructure, optimize  existing facilities, improve security posture, and achieve costs savings.  Further, the memorandum establishes a set of five data center  optimization metrics and performance targets intended to measure  agency’s progress in the areas of (1) server utilization and automated  monitoring, (2) energy metering, (3) power usage effectiveness, (4) facility  utilization, and (5) virtualization. The guidance also indicates that OMB  is to maintain a public dashboard that will display consolidation-related  costs savings and optimization performance information for the agencies.

However, in a series of reports that we issued from July 2011 through  August 2017, we noted that, while data center consolidation could  potentially save the federal government billions of dollars, weaknesses  existed in several areas, including agencies’ data center consolidation  plans, data center optimization, and OMB’s tracking and reporting on  related cost savings. Further, we previously reported that VA’s progress  toward closing data centers, and realizing the associated cost savings,  lagged behind that of other covered agencies.

More recently, VA reported a total inventory of 415 data centers, of which  39 had been closed as of August 2017. While the department  anticipates another 10 data centers will be closed by the end of fiscal year  2018, these closures fall short of the targets set by OMB. Specifically,  even if VA meets all of its planned targets for closure, it will only close  about 9 percent of its tiered data centers and about 18.7 percent of its  non-tiered data centers by the end of fiscal year 2018, which is short of  the respective 25 and 60 percent targets set by OMB. Further, while VA  has reported $23.61 million in data center-related cost savings and  avoidances for 2012 through August 2017, the department does not  expect to realize further savings from the additional 10 data center  closures in the next year.

In addition, in August 2017 we reported that agencies needed to address  challenges in optimizing their data centers in order to achieve cost  savings. Specifically, we noted that, according to the 24 agencies’ data  center consolidation initiative strategic plans as of April 2017, most  agencies were not planning to meet OMB’s optimization targets by the  end of fiscal year 2018.

As of February 2017, VA reported meeting one of the five data center  optimization metrics related to power usage effectiveness. Also, the  department’s data center optimization strategic plan indicates that the  department plans to meet three of the five metrics by the end of fiscal  year 2018. Further, while OMB directed agencies to replace manual collection and reporting of metrics with automated tools no later than  fiscal year 2018, VA had only implemented automated tools at 6 percent  of its data centers.

VA’s CIO Has Certified Adequate Incremental Development for Its Major IT Investments for Fiscal Year 2017, but Needs to Update Related Policy

OMB has emphasized the need to deliver investments in smaller parts, or  increments, in order to reduce risk, deliver capabilities more quickly, and  facilitate the adoption of emerging technologies. In 2010, it called for  agencies’ major investments to deliver functionality every 12 months and,  since 2012, every 6 months. Subsequently, FITARA codified a  requirement that agency CIOs certify that IT investments are adequately  implementing incremental development, as defined in the capital planning  guidance issued by OMB. Later OMB guidance on the law’s  implementation—issued in June 2015—directed agency CIOs to define  processes and policies for their agencies which ensure that they certify  that IT resources are adequately implementing incremental  development.

Between May 2014 and November 2017, we reported on agencies’ efforts  to utilize incremental development practices for selected major  investments. In November 2017, we noted that agencies reported that  62 percent of major IT software development investments were certified  by the agency CIO as using adequate incremental development in fiscal  year 2017, as required by FITARA. VA’s CIO certified the use of  adequate incremental development for all 10 of its major IT investments.  However, VA had not yet updated the department’s policy and process for  the CIO’s certification of major IT investments’ adequate use of  incremental development, in accordance with OMB’s guidance on the  implementation of FITARA as we recommended. The department stated  that it plans to address our recommendation to establish a policy and that  the policy is targeted for completion in 2017.

VA Has Made Progress in Developing and Using a Comprehensive Inventory of Software Licenses

Federal agencies engage in thousands of licensing agreements annually.  Effective management of software licenses can help organizations avoid  purchasing too many licenses that result in unused software. In addition,  effective management can help avoid purchasing too few licenses, which  results in noncompliance with license terms and causes the imposition of  additional fees. Federal agencies are responsible for managing their IT  investment portfolios, including the risks from their major information  system initiatives, in order to maximize the value of these investments to  the agency.

OMB developed a policy that requires agencies to conduct an annual,  agency-wide IT portfolio review to, among other things, reduce  commodity IT spending. Such areas of spending could include software  licenses. We previously identified seven elements that a comprehensive  software licensing policy should address:  identify clear roles, responsibilities, and central oversight authority  within the department for managing enterprise software license  agreements and commercial software licenses; establish a comprehensive inventory (at least 80 percent of software  license spending and/or enterprise licenses in the department) by  identifying and collecting information about software license  agreements using automated discovery and inventory tools;  regularly track and maintain software licenses to assist the agency in  implementing decisions throughout the software license management  life cycle; analyze software usage and other data to make cost-effective provide training relevant to software license management; establish goals and objectives of the software license management  consider the software license management life-cycle phases (i.e.,  requisition, reception, deployment and maintenance, retirement, and  disposal phases) to implement effective decision making and  incorporate existing standards, processes, and metrics.

We previously made recommendations to VA to (1) develop an agency- wide comprehensive policy for the management of software licenses that  includes guidance for using analysis to better inform investment decision  making, (2) employ a centralized software license management approach  that is coordinated and integrated with key personnel, (3) establish a  comprehensive inventory of software licenses using automated tools, (4)  track and maintain a comprehensive inventory of software licenses using  automated tools and metrics, (5) analyze agency-wide software license  data to identify opportunities to reduce costs and better inform investment  decision making, and (6) provide software license management training to  appropriate personnel.

Consistent with our recommendation, in July 2015, VA issued a  comprehensive software licensing policy that addressed weaknesses we  previously identified. The department also issued a directive that  documents VA’s software license management policy and responsibilities  for central management of agency-wide software licenses, consistent with  our recommendations. By implementing our recommendations, VA should  be better positioned to consistently and cost-effectively manage software  throughout the agency.

In August 2017, the department also provided documentation showing  that it had generated a comprehensive inventory of software licenses  using automated tools for the majority of agency software license  spending or enterprise-wide licenses. This inventory can serve to reduce  redundant applications and help identify other cost saving opportunities.

Further, the department implemented a solution to analyze agency-wide  software license data, including usage and costs. This solution should  allow VA to identify cost saving opportunities and inform future investment  decisions. In addition, the department has provided information indicating  that appropriate personnel receive software license management training.

In conclusion, VA has made extensive use of numerous contractors and  has obligated more than $1 billion for contracts that supported two of four  VistA modernization programs that the department has initiated. VA has  recently begun the fourth modernization program in which it plans to  replace VistA with the same commercially available electronic health  record system that is used by DOD. However, the department’s latest  modernization effort is in the early stages of planning and is dependent  on the system acquisition contract award in December 2017. VA’s  completion and effective execution of plans will be essential to guiding  this latest electronic health record modernization initiative to a successful  outcome.

Beyond VistA, the department continues to make progress on key  FITARA-related initiatives. Although the department has made progress  in the area of software licensing, additional actions in the areas of data  center consolidation and optimization, as well as incremental system  development can better position VA to effectively manage its IT. We plan  to continue to monitor the department’s progress on these important  activities.

Chairman Hurd, Ranking Member Kelly, and Members of the  Subcommittee, this completes my prepared statement. I would be  pleased to respond to any questions that you may have.

If you or your staffs have any questions about this testimony, please  contact David A. Powner at (202) 512-9286 or pownerd@gao.gov.  Contact points for our Offices of Congressional Relations and Public  Affairs may be found on the last page of this testimony statement. GAO  staff who made key contributions to this statement are Mark Bird  (Assistant Director), Jacqueline Mai (Analyst in Charge), Justin Booth,  Chris Businsky, Rebecca Eyler, Paris Hawkins, Valerie Hopkins, Brandon  S. Pettis, Jennifer Stavros-Turner, Eric Trout, Christy Tyson, Eric Winter,  and Charles Youman.

This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.