OIG Makes 9 Recommendations to Strengthen VA’s EHR System Controls

An Office of Inspector General (OIG) report found that the VA and Oracle Health did not have adequate controls to prevent system changes in the EHR project from causing major incidents, to respond to those incidents uniformly and thoroughly, or to mitigate their impact by providing standard procedures and interoperable downtime equipment. 

The EHR system experienced hundreds of major performance incidents affecting the five VA medical centers where the system was initially deployed. 

A performance incident is defined as major when it causes severe system degradation, leads to an outage of services required for VA’s key operations, or affects patient care and requires a response beyond routine incident management.

In response to these issues, VA halted all planned EHR deployments in July 2022, with the exception of the deployment at the Captain James A. Lovell Federal Health Care Center in North Chicago, Illinois, on March 9, 2024. Since then, however, major performance incidents have continued, as recently as March 2024, the report said. 

The report also said that although major performance incidents can delay care to veterans, VA had no formal process to link reports of these delays to specific major performance incidents.

Ultimately, OIG says, the inadequate controls for handling major incidents stemmed from the May 2018 10-year contract with Cerner (now Oracle Health). In May 2023, VA modified the contract to strengthen some requirements for addressing major incidents, but could do more.
The EHR system’s estimated cost has grown. It was originally $16 billion. If VA does not improve controls, major performance incidents will continue, leading to further costly delays in system implementation and posing an ongoing risk to patient safety, the report noted. 

The OIG made nine recommendations, including real-time data sharing to give VA greater awareness of potential problems in system operations, prioritizing major performance incident response in a clear and consistent manner, developing and enforcing response and other performance metrics to hold the contractor accountable, requiring sufficient detail in post-resolution reports, raising staff awareness of procedures and acquiring appropriate backup systems for downtime, and better identifying and addressing major performance incidents linked to negative patient outcomes.