VA OIG Teams Tackle Security Posture Problems at VA Medical Facilities Nationwide

Fred Baker
Welcome back to another podcast episode of Veteran Oversight Now, an official podcast of the VA Office of Inspector General. I’m your host, Fred Baker.
Each month on this podcast, we’ll bring you highlights of the OIG’s recent oversight activities and interview key stakeholders in the office’s critical work for veterans.
Joining me today is Shawn Steele. Shawn is the director of the Office of Audits and Evaluations, Health Care Infrastructure Division. In this role, he’s charged with conducting independent oversight of the programmatic foundation, the Veterans Health Administration. He’s published reports on topics such as human capital management, health care enrollment, patient advocacy, and security and preparedness.
Welcome, Shawn.
Shawn Steele
Thanks, Fred. I’m happy to be here.
Fred Baker
So, Shawn, before we get into the report, do me a favor and tell the listeners how long you’ve been at the VA Office of Inspector General and kind of a little bit about how you got here.
Shawn Steele
Sure. So, I have been with the VA Office of Inspector General about 18 years now. I started right out of grad school about a month from getting my degree. I was attracted to the OIG due in large part to a strong veteran presence in my family, especially my grandfather who served in World War II. I just was really called to the mission and haven’t had much of a reason to leave.
Fred Baker
Eighteen years says a lot.
Shawn Steele
It does.
Fred Baker
Awesome. Also, before we get into the details of the report, I want to kind of set the stage a little bit, if you don’t mind. This was not your typical VA OIG review. Can you tell us a little bit about the unique nature of it and how it was approached?
Shawn Steele
Certainly, yeah, it definitely was not a standard review. In a normal project, we do all our upfront pre-planning. We formally engage with the department, and we have entrance conferences and briefings to kind of explain why we’re doing what we’re doing and get some initial feedback.
We did not take those steps for this project. We had kind of read the signs and the risk factors that were out there. And while we did take the time to plan a very diligent approach, we did not go about announcing this project in advance. We provided simultaneous notice to all key stakeholders about an hour before our teams hit ground, and then they executed a carefully designed review that went about checking various factors at these different facilities.
On day 1, within an hour, we had deployed teams at 33 sites. By day 3, we had completed 65 sites, and overall, we had visited 70 sites and with 37 teams conducting the work. We’d also distribute a survey via QR code on business cards and posters to get direct feedback from the VA police officers at those sites. They could use their own personal phone access to survey via the QR code and give us true anonymous feedback without a filter. So, a lot of steps that we generally wouldn’t take that allowed us to get out there faster and get a real time view of things, but definitely not traditional.
Fred Baker
So, tell me again, why was time of the essence?
Shawn Steele
So, when—what we were trying to get to was what does security look like at a VA medical facility? Are they prepared in the event that somebody attempts to do something, tries to access something they shouldn’t? So, getting out there and not necessarily giving them time to put extra layers of controls in place was very important.
I think a good analogy would be like a pop quiz in an academic field. If a teacher comes in Monday morning and says, get out your pencils, we’re having a quiz, that gives you a real time understanding of what their knowledge is. That same teacher comes in Monday and says, we’re having a quiz on Thursday on this subject; we’re sure the scores are going to be a lot better. And that’s kind of what we were going for. Not that we could truly measure the difference between the unannounced and if they had a little bit of time, but we thought it was imperative to know what is it at this particular juncture.
Fred Baker
And tell me how many total staff participated?
Shawn Steele
We had 80 auditors that were part of these teams and 70 criminal investigators. So, 150 total.
Fred Baker
So 150... 3 days. And how many facilities?
Shawn Steele
Seventy-two.
Fred Baker
Seventy-two. Wow, big project.
Shawn Steele
Yes, very.
Fred Baker
So, in the report, you cite 36 incidents that presented significant concerns of VA facilities. Can you give us an idea of what those incidents were?
Shawn Steele
Sure. So, for first, a point of clarification is that we obtained this information from a relatively new system in VA that is now set up to kind of collect events at VA facilities and categorize them in a way that people here in Washington at the central office can really make some decisions on controls. It’s a relatively new system, not used to trend yet, but we had gotten access to the information and found these serious incident reports.
Now we do talk about a couple of examples in the report. On page one, we mentioned a bomb threat at the Wichita VA Medical Center. It’s a perfect example of what we’re talking about. These serious incident reports capture things like shootings involving VA police, terroristic threats towards people or the facility itself. Arrests of VA employees or major thefts of property or major losses.
A couple of other incidents that we did not necessarily include in the published work was one of the facilities in West Virginia had a veteran who had intentionally drove their vehicle into the entrance of the main building. It’s kind of a flavor of some of the reports. But most common were VA arrests for either theft or the sale and use of drugs and alcohol.
Fred Baker
And this, just again, so these serious incidents came out of a reporting system, out of VA’s own reporting system, and they’re real events.
Shawn Steele
Yeah. That’s correct. They’re not nothing that we identified. They are from VA.
Fred Baker
So, these facilities you looked at, you know, they’re open campuses by design. What are some of the security challenges you saw as you were doing this report?
Shawn Steele
Yeah, the open nature of the campuses is a really important factor. And I’m glad you mentioned it because VA medical facilities are meant to be welcoming. They’re meant to be easy to access and as a result, have many entrances. And on top of that, there is 171 geographically diverse medical facilities in the VA network, and each of them comes with their own unique challenges. And I wanted to kind of focus in on that because it’s important to understand that there is not one template that can be applied. There’s 171 templates that need to be applied. And so that was something that we really considered, and we designed our approach.
As a result, we focused on items that a person with a reasonable understanding of security could test. Things like, can you actively see police officers? Do you see police cruisers? How is the physical security at these sites? Are the officers trained and are emergency preparedness plans in place? When it’s all said and done and we were analyzing the results, we really synthesized what we found into three umbrellas: a lack of sufficient VA police staffing, the need for more resources to support the staff that were already onboard, and additional physical security measures for target hardening.
Fred Baker
So, VA staffing shortages are not a new report topic for the VA OIG.
Shawn Steele
Not at all.
Fred Baker
We’ve reported many times that shortages are seen across occupations, across facilities, VA police staffing shortages included. Tell us how this impacts the facility’s ability to provide adequate security.
Shawn Steele
Yeah, that’s right. I mean, the issues of VA police staffing has been ongoing since 2018. So, this is not a new issue at all. We’ve had numerous reports on this area.
Police officers have a wide range of responsibility. They’re expected to patrol, maintain presence at certain vulnerable areas in a facility, respond to active threats or disturbances on the facility, and then watch security camera footage. There’s a lot that goes into that. And if you don’t have enough people to carry it all out, then that contributes to potential risks and vulnerabilities.
I did want to mention to VA’s credits, since we have been reporting on this for about five years, they have taken some recent steps to attempt to close the gap with police vacancies. They issued a national strategic recruitment plan that installed a career ladder, hiring incentives and special salary rates, as well as they established minimum police coverage standards for VA medical facilities. All that said, despite these steps, we still saw that VA police staffing shortages were a major issue every place we visited.
Fred Baker
And what is the contributing factor to the shortages?
Shawn Steele
Most of it is pay. And if you even take just a VA police officer’s pay to a local precinct down the road, there’s a big disparity there. And VA has been trying to close that gap. They’re just not there yet.
Fred Baker
It’s much the same with our nursing occupation shortages.
Shawn Steele
Yes, yes. That’s a good comparison. And I think, you know, what we report is that overall, the facilities had a 33 percent vacancy rate. So that’s for all 70. But the vacancy rate was as high as 60 percent in some places. And to kind of put that in context, one of the larger facilities we went to, that 60 percent vacancy rate amounted to 57 VA police officers. So, we’re talking about gaps in security and vulnerabilities. if you’re missing 57 people that, have you’ve already decided you need those to do what you need to do,
you’re clearly not going to be able to accomplish your mission.
Fred Baker
Right. So, with respect to resources, we’ve reported or this report said that they were generally compliant with completed training, later required training, but you identified gaps in resources that could improve their capabilities. Can you speak to those?
Shawn Steele
Certainly. Training was a good news story, but there were certainly other areas that the gaps needed to be closed. The biggest gap was security cameras. Cameras are an essential part, a central tool to aid VA police officers to help them mobilize to other areas of this campus if they’re not patrolling. Some of these campuses are huge, just taking, let’s say, the Bay Pines, Florida, campus is 350 acres. That’s a lot for police officers to cover. And so, the camera systems are meant to aid that.
What we found was that about 19 percent of all cameras were not functional. Some facilities had more than 20 percent of their cameras just not working. And while they generally monitored the footage, there was a wide range of capability of what they were monitoring. Some facilities had very sophisticated systems where they could focus in on license plates and individuals and identify them across the campus. And others were kind of what you see in like an old school TV series where they’re just kind of watching that CRT monitor. So, the range there means that there is inconsistencies in what they can monitor and what they can do with that footage.
Some of the other gaps that we talked about in the report were on police operations rooms. While most facilities had these, these rooms are set up for not only just operations as the title entails, but for police officers to maintain their equipment, to conduct interrogations or interviews and like weapons storage.
While they had them, we found that they didn’t always necessarily meet the requirements of VA policy. And perhaps more importantly, close to 30 percent of our survey respondents felt that the working environment within those police operations rooms was not acceptable. There’s just a lack of sufficient space, or there are poorly located for where they need to do their jobs.
Fred Baker
Can we talk about that survey just real quick?
Shawn Steele
Sure.
Fred Baker
So, these are VA police officers responding to your survey. This is an observation you made. So, this is them talking about their resources. Correct?
Shawn Steele
Yes. That is their perception of the resources. And there was 635 total respondents to our survey.
Fred Baker
So that was a respectable amount.
Shawn Steele
Yeah. Yes, it was.
Fred Baker
They were ready and willing to talk.
Shawn Steele
Yeah. Yeah. It was a positive result, for sure.
Fred Baker
Awesome. Finally, you talk about target hardening. That’s kind of a scary term, but what does that mean?
Shawn Steele
Yeah, that’s a good observation. And it probably should be to those who are trying to get into your VA facility. Target hardening is a commonly used term in the police and security field that can simply be defined as securing property to reduce crime. So, these can be things like hard barriers, fences, intrusion resistant windows, or things that perhaps are simply a sign in requirements, wearing badges, security presence, and cameras like we just talked about, measures taken to try to deter threats before they even occur.
For this particular review, we focused on two very simple components of target hardening. Were security personnel visible and were doors that should be locked, in fact, secure? And we did find that there were some deficiencies in each of those areas. In terms of security presence, we did find that there wasn’t always a VA police officer or contracted security guard, which is acceptable according to VA policy, at public access doors. VA policies suggest that security should be at high traffic locations as a deterrent for those who would come through those particular areas.
We found that 87 percent of the high traffic public entrance areas did not have a visible security presence, which was actually one of the more alarming things that we found. In terms of doors, as part of our approach each of the teams that went out walked the entire perimeter of the main hospital, the main building where veterans would go for their treatments. And as part of that walk around, they would try to open any door that they saw, including those that were clearly marked as should have been locked. We found that 17 percent of those doors were not locked, and our teams could walk right in.
One of the examples that we do cite in the report, our teams accessed one of these nonpublic doors that should have been locked and pretty much walked right into the intensive care unit. So clearly entering an area that an auditor should not be.
And I think we had other similar circumstances like that where we even tested high risk areas within the facility. So, after you are outside the perimeter walk, inside the facility, such as like restricted access areas for the pharmacies or emergency rooms or things like that. And we did find that at 25 locations there were certain areas we could still access, even though we shouldn’t. So that’s those kind of some of the things that fall under that target hardening that VA could do a better job with.
Fred Baker
Wow. Wow. So, you made six recommendations. Can you kind of summarize those and talk us through them?
Shawn Steele
Yeah. So, we made six recommendations to three different officials. First, we made two recommendations to the secretary of Veterans Affairs. And they involve delegating responsibility to monitor VA police vacancies and establishing sufficient staffing for VA police forces to be inspected under their, what has been established as an inspection program in the Office of Security and Law Enforcement. We elevated these recommendations to the secretary because these are issues that have been persistent since 2018. And so, we wanted to put those at a level that carefully spurred some action.
The second set of recommendations were made to the undersecretary for health. And they focused on ensuring that directors assessed VA police staffing vacancies at their locations and leveraged available mechanisms to fill those vacancies; that they took steps to commit resources to fix some of the security measures that we highlighted in our report; and that they direct VISN police chiefs, in conjunction with local facilities staff, to present a plan to identify overall security weaknesses at their location. The sixth and final recommendation was made to the assistant secretary for human resources, administration, operations, security and preparedness to establish policy to standardize the review of retention requirements for facility security cameras to really kind of better leverage that resource.
Fred Baker
So how did VA respond? What did they say?
Shawn Steele
They agree with our findings and concur with our recommendations. They established positive corrective action plans for each of the six recommendations. We had some good feedback from the VA secretary, the chief of staff, and the undersecretary for health, which was much welcomed. And we will continue to monitor those corrective actions through a follow-up process.
Fred Baker
So positive outcomes and worthwhile work.
Shawn Steele
Yes.
Fred Baker
Well, thanks, Shawn. Thanks for being here today. We appreciate you. Appreciate the work of your team. Is there anything else you’d like to add?
Shawn Steele
I’d just like to thank you for the opportunity to highlight this important work. While it was a quick and focused project, we do believe it’s going to have a lasting impact because what we did was brought to the forefront, the importance of security at VA open campuses and provided a much needed reality check for VA leaders so they can understand what the actual on -the-ground security status is for their facilities. And we’re hopeful that we’ll continue to affect change at VA.
Fred Baker
And keep everyone safe.
Shawn Steele
Very much so.
Fred Baker
Thanks, Shawn.
Shawn Steele
Thanks, Fred.
Fred Baker
And now I’ll turn the podcast over to Mary Estacion, who will give us this month’s highlights.
Mary Estacion:
Thanks, Fred. Now some highlights of the work the VA OIG completed in January 2023.
I’ll start with updates to several recent investigations.
A former Miami VA Medical Center employee was sentenced in the Eastern District of Pennsylvania to three years’ probation and ordered to pay restitution of approximately $134,000 after previously pleading guilty to conspiracy to bribe a public official. The defendant was employed by VA as the assistant chief of logistics and was responsible for supervising the ordering of goods and services at the medical center. According to the investigation, which was based on a hotline complaint, the defendant and other VA employees placed orders for supplies in exchange for cash bribes and kickbacks from corrupt vendors. The prices of supplies were often grossly inflated, and some orders were only partially filled or not filled at all. After leaving VA, the defendant immediately began working for one of the vendors and paid kickbacks and bribes to VA employees at multiple VA medical centers in exchange for the placement of orders. The vendors charged in this case were responsible for approximately $38 million in purchase card orders and contracts.
Another VA OIG investigation revealed that a veteran defrauded VA by making false representations that he suffered from posttraumatic stress disorder due to his active-duty service. Based upon these false statements, VA increased the defendant’s disability rating and provided additional monthly disability benefit payments to him. The loss to VA is almost $119,000. The defendant also sent a text message to a VA OIG agent in which he threatened physical violence against the agent and any other agent involved in investigating him. The defendant pleaded guilty in the District of New Jersey to theft of government funds and interstate transmission of a threat to injure.
The last investigative update I’d like to mention involves a former nurse at the VA Medical Center in Chillicothe, Ohio, who was charged in connection with a workers’ compensation fraud scheme. A VA OIG and Department of Labor OIG investigation alleges that from 2015 through 2021, the former nurse submitted fraudulent reimbursement claim forms to the Department of Labor’s Office of Workers’ Compensation Program for medication she allegedly used due to an injury that resulted from her VA employment. In support of these false claims, the defendant attached fraudulent homemade receipts pertaining to medication that she had not paid for or received. After reimbursing the defendant for the fraudulent medication claims, the Department of Labor then charged back these amounts to VA. The loss to VA is approximately $932,000. The defendant was charged in the Southern District of Ohio with healthcare fraud.
Now on to published reports.
The VA OIG published 14 reports in January, including inspections of information technology security at facilities in Alabama and Oregon as well as a Comprehensive Healthcare Inspection Program, or CHIP, report on the El Paso VA Health Care System in Texas.
I’ll highlight a few reports now.
Our Office of Healthcare Inspections published the report “Improvements Recommended in Visit Frequency and Contingency Planning for Emergencies in Intensive Community Mental Health Recovery Programs.” The VA OIG conducted a national review to assess elements of VHA’s Intensive Community Mental Health Recovery programs, also known as ICMHR, which provide high-intensity, community-based care to veterans with serious mental illness. The OIG examined visit frequency for ICMHR-enrolled veterans, as well as VHA healthcare systems’ contingency planning for veterans’ medication access during emergencies, including access to long-acting injectable antipsychotic medications. The OIG found ICMHR did not meet VHA’s visit frequency requirement of two to three visits weekly, on average, for high-intensity services. Additionally, the OIG found the majority of VHA healthcare systems did not have ICMHR-specific contingency plans for veteran medication access. The OIG made three recommendations to the under secretary for health related to ICMHR visit frequency and the intensity of care provided, the ongoing role of virtual care in the delivery of ICMHR, and ICMHR-specific contingency planning for veterans’ medication access during emergencies.
We recently spoke with Dr. Wanda Hunt, a health systems specialist who was on the team that produced this report, on a recent episode of Inside Oversight, a VA OIG official podcast. To learn more about what Wanda’s team found and how they completed this national review, listen to this podcast episode on all major podcast providers like Apple and Spotify or find the episode on the VA OIG website, under the media tab.
We also published two Vet Center Inspection Program, or VCIP reports. VCIP reports provide a focused evaluation of the quality of care delivered at vet centers. Vet centers are community-based clinics that provide a wide range of psychosocial services to clients, including eligible veterans, active-duty service members, National Guard members, reservists, and their families, to support a successful transition from military to civilian life. The two VCIP reports published in January evaluated Midwest District 3, Zones 3 and 1, which includes vet centers in Columbia, Missouri; Fargo, North Dakota; Omaha, Nebraska; Sioux Falls, South Dakota; South Bend, Indiana; and Cleveland, Columbus, and Toledo in Ohio.
For more information about these and the other reports the VA OIG published in January, go to our website at va.gov/oig and click on reports under the Publications tab.
Finally, I want to highlight a VA OIG hotline case. The VA OIG’s hotline staff accepts complaints from VA employees, the veteran community, and the public concerning criminal activity, waste, abuse, and mismanagement of VA programs and operations. The following case was opened by the Hotline Division.
In this case, a complainant reported a patient of VA’s Puget Sound Healthcare System had been waiting over a year for the Office of Community Care to approve a consult for a follow-up positron emission tomography scan, also known as a PET scan. The allegation was referred to VA’s Puget Sound Healthcare System for review and substantiated. A review of the patient’s treatment record revealed their provider failed to document the patient’s eligibility for care in the community and failed to enter the standard episode of care using the consult toolbox three times before correctly entering the consult for a PET scan in the community. Consult Toolbox is a software that enables staff to track and manage consults. In accordance with the Office of Community Care field guidebook, a patient’s eligibility for care in the community, along with a standard episode of care, is required before a consult is approved. The Puget Sound Healthcare System provided additional training to the community care provider liaison and community care clinical reviewers on proper utilization of the consult toolbox to ensure community care eligibility is documented and the appropriate standard episode of care is selected to minimize delays in care. In addition, the Office of Community Care is now running a report to ensure providers are entering consults correctly and implementing on-the-spot training when necessary.

That’s it for this episode of Veteran Oversight Now. I encourage you to check out other episodes wherever you listen to podcasts. Stay tuned for more highlights next month. Thanks for turning in!
This has been an official podcast of the VA Office of Inspector General. Veteran Oversight Now is produced by the Office of Communications and Public Affairs and is available at va.gov/oig. Tune in monthly to hear how the VA OIG serves veterans, their families, and caregivers, through meaningful independent oversight. Check out the website for more on the VA OIG oversight mission, read current reports, and keep up to date on the latest criminal investigations. Report potential crimes related to VA; waste or mismanagement; potential violations of laws, rules, or regulations; or risks to patients, employees, or property to the OIG online or call the hotline at 1-800- 488-8244. If you are a veteran in crisis or concerned about one, call the Veterans Crisis Line at 1-800- 273-8255, press 1, and speak with a qualified responder now.

VA OIG Teams Tackle Security Posture Problems at VA Medical Facilities Nationwide
Broadcast by