Inspector General Finds Security Vulnerabilities and Risks at VA Medical Facilities

In 2022, the US Department of Veterans Affairs (VA) Office of Inspector General (OIG) received 36 separate serious incident reports involving 32 medical facilities—including a bomb threat. In response to those reports, OIG teams of auditors and criminal investigators visited 70 VA medical facilities in September 2022 to assess security and to issue a formal report.

Noting that VA policy includes an “extensive list of security safeguards” for medical facilities to implement, the OIG focused its review on those that “a person with a reasonable level of security knowledge could assess.” According to their report, released in February, they identified a variety of security vulnerabilities and deficiencies, ranging from shortages of police officers to radios with poor signal strength.

For one, the OIG says, the facilities were designed to provide a welcoming environment, which means the public can enter the grounds freely at many different points. But the open-campus design makes it more difficult to balance security with easy and prompt access for patients. Consequently, the OIG says, “threats may originate from many locations within the medical facility campus itself or in the nearby community.”

Walking around the perimeters of the facility buildings, the OIG teams assessed the security level of 2960 public and nonpublic access doors. They found that 87% of public doors did not have an active security presence, and of those, 23% also did not have a security camera. Moreover, 17% of nonpublic doors were unlocked; 97% of those did not have a security presence, and 43% did not have a security camera. Even more concerning: Some of those doors led to sensitive or restricted facility areas. For example, at one midwestern facility, an unlocked nonpublic access door led to the surgical intensive care unit.

The OIG teams also assessed training records for 170 police officers across the 70 facilities and found that nearly all officers were compliant with training requirements. Most respondents also reported they received adequate training to perform their job duties and provided numerous positive indicators. Well trained or not, though, a notable problem in maintaining security, the OIG teams found, was there simply weren’t enough officers.

The OIG has repeatedly issued reports on significant police officer staffing shortages since at least 2018. VA police officers are not only empowered to make arrests, carry firearms while on duty, and investigate criminal activity within VA’s jurisdiction, but also assist individuals on medical campuses “in myriad ways,” the OIG notes. Staffing shortages are likely to compromise overall facility security, morale, and staff retention and underscore the need for maintaining communication with local law enforcement agencies for assistance, the OIG report points out.

In the OIG surveys, security personnel often noted they were understaffed. Although VA guidance calls for at least 2 VA police officers on duty at all times, 21% of respondents said they were aware of a duty shift during which minimum police staffing requirements were not met. About 37% of respondents expressed concerns about the physical security at their facilities. Some pointed out that the lack of VA police on duty could make it difficult to respond to threats like an active shooter.

In May 2022, the VA issued a directive that established minimum police coverage at medical facilities, as well as a police officer staffing decision tool to help determine appropriate officer levels. It required facilities to have an active security presence in their emergency departments around-the-clock by May 2023. As of September 2022, 58% of the facilities’ emergency departments did not yet have a visible security presence.

The teams also found issues with security devices: 19% of all cameras were not functional; at 24 facilities, more than 20% of the cameras were not working. A few facilities had “highly functional” systems that allowed personnel to monitor the campus thoroughly and even search for specific individuals—but they weren’t always operable.

At one western facility, it came down to a problem that would be frustrating at any time, but alarming for security management: Security personnel could not access the monitoring system because the required security certificates had expired, and no one knew the administrative password. If the system went offline, the OIG team was told, no one could fix the problem without password access. Neither VA’s Office of Information and Technology nor the contractor for the facility’s cameras could override the administrative password.

On the bright side, the OIG teams found that camera video feeds were being actively surveilled by security personnel at 60 of 70 facilities. All but 1 site kept camera footage for an average of 2 weeks or more.

VA policy states that, in addition to at least 2 intermediate weapons (such as batons and pepper spray) uniformed officers must always be issued radios for use while on duty. Survey respondents generally indicated they received their equipment and that it was adequate, but 15% said theirs lacked functionality, such as battery life and signal strength.

Based on the teams’ findings, the OIG made 6 recommendations: (1) delegating a responsible official to monitor and report monthly on facilities’ security-related vacancies; (2) authorizing sufficient staff to inspect VA police forces per the OIG’s 2018 unimplemented recommendation; (3) ensuring medical facility directors appropriately assess VA police staffing needs, authorize associated positions, and leverage available mechanisms to fill vacancies; (4) committing sufficient resources to ensure that facility security measures are adequate, current, and operational; (5) directing Veterans Integrated Services Network police chiefs, in coordination with medical facility directors, facility police chiefs, and facility emergency management leaders, to present a plan to remedy identified security weaknesses; and (6) establishing policy that standardizes the review and retention requirements for facility security camera footage.

The VA concurred with all recommendations and submitted corrective action plans.

In 2022, the US Department of Veterans Affairs (VA) Office of Inspector General (OIG) received 36 separate serious incident reports involving 32 medical facilities—including a bomb threat. In response to those reports, OIG teams of auditors and criminal investigators visited 70 VA medical facilities in September 2022 to assess security and to issue a formal report.

Noting that VA policy includes an “extensive list of security safeguards” for medical facilities to implement, the OIG focused its review on those that “a person with a reasonable level of security knowledge could assess.” According to their report, released in February, they identified a variety of security vulnerabilities and deficiencies, ranging from shortages of police officers to radios with poor signal strength.

For one, the OIG says, the facilities were designed to provide a welcoming environment, which means the public can enter the grounds freely at many different points. But the open-campus design makes it more difficult to balance security with easy and prompt access for patients. Consequently, the OIG says, “threats may originate from many locations within the medical facility campus itself or in the nearby community.”

Walking around the perimeters of the facility buildings, the OIG teams assessed the security level of 2960 public and nonpublic access doors. They found that 87% of public doors did not have an active security presence, and of those, 23% also did not have a security camera. Moreover, 17% of nonpublic doors were unlocked; 97% of those did not have a security presence, and 43% did not have a security camera. Even more concerning: Some of those doors led to sensitive or restricted facility areas. For example, at one midwestern facility, an unlocked nonpublic access door led to the surgical intensive care unit.

The OIG teams also assessed training records for 170 police officers across the 70 facilities and found that nearly all officers were compliant with training requirements. Most respondents also reported they received adequate training to perform their job duties and provided numerous positive indicators. Well trained or not, though, a notable problem in maintaining security, the OIG teams found, was there simply weren’t enough officers.

The OIG has repeatedly issued reports on significant police officer staffing shortages since at least 2018. VA police officers are not only empowered to make arrests, carry firearms while on duty, and investigate criminal activity within VA’s jurisdiction, but also assist individuals on medical campuses “in myriad ways,” the OIG notes. Staffing shortages are likely to compromise overall facility security, morale, and staff retention and underscore the need for maintaining communication with local law enforcement agencies for assistance, the OIG report points out.

In the OIG surveys, security personnel often noted they were understaffed. Although VA guidance calls for at least 2 VA police officers on duty at all times, 21% of respondents said they were aware of a duty shift during which minimum police staffing requirements were not met. About 37% of respondents expressed concerns about the physical security at their facilities. Some pointed out that the lack of VA police on duty could make it difficult to respond to threats like an active shooter.

In May 2022, the VA issued a directive that established minimum police coverage at medical facilities, as well as a police officer staffing decision tool to help determine appropriate officer levels. It required facilities to have an active security presence in their emergency departments around-the-clock by May 2023. As of September 2022, 58% of the facilities’ emergency departments did not yet have a visible security presence.

The teams also found issues with security devices: 19% of all cameras were not functional; at 24 facilities, more than 20% of the cameras were not working. A few facilities had “highly functional” systems that allowed personnel to monitor the campus thoroughly and even search for specific individuals—but they weren’t always operable.

At one western facility, it came down to a problem that would be frustrating at any time, but alarming for security management: Security personnel could not access the monitoring system because the required security certificates had expired, and no one knew the administrative password. If the system went offline, the OIG team was told, no one could fix the problem without password access. Neither VA’s Office of Information and Technology nor the contractor for the facility’s cameras could override the administrative password.

On the bright side, the OIG teams found that camera video feeds were being actively surveilled by security personnel at 60 of 70 facilities. All but 1 site kept camera footage for an average of 2 weeks or more.

VA policy states that, in addition to at least 2 intermediate weapons (such as batons and pepper spray) uniformed officers must always be issued radios for use while on duty. Survey respondents generally indicated they received their equipment and that it was adequate, but 15% said theirs lacked functionality, such as battery life and signal strength.

Based on the teams’ findings, the OIG made 6 recommendations: (1) delegating a responsible official to monitor and report monthly on facilities’ security-related vacancies; (2) authorizing sufficient staff to inspect VA police forces per the OIG’s 2018 unimplemented recommendation; (3) ensuring medical facility directors appropriately assess VA police staffing needs, authorize associated positions, and leverage available mechanisms to fill vacancies; (4) committing sufficient resources to ensure that facility security measures are adequate, current, and operational; (5) directing Veterans Integrated Services Network police chiefs, in coordination with medical facility directors, facility police chiefs, and facility emergency management leaders, to present a plan to remedy identified security weaknesses; and (6) establishing policy that standardizes the review and retention requirements for facility security camera footage.

The VA concurred with all recommendations and submitted corrective action plans.

In 2022, the US Department of Veterans Affairs (VA) Office of Inspector General (OIG) received 36 separate serious incident reports involving 32 medical facilities—including a bomb threat. In response to those reports, OIG teams of auditors and criminal investigators visited 70 VA medical facilities in September 2022 to assess security and to issue a formal report.

Noting that VA policy includes an “extensive list of security safeguards” for medical facilities to implement, the OIG focused its review on those that “a person with a reasonable level of security knowledge could assess.” According to their report, released in February, they identified a variety of security vulnerabilities and deficiencies, ranging from shortages of police officers to radios with poor signal strength.

For one, the OIG says, the facilities were designed to provide a welcoming environment, which means the public can enter the grounds freely at many different points. But the open-campus design makes it more difficult to balance security with easy and prompt access for patients. Consequently, the OIG says, “threats may originate from many locations within the medical facility campus itself or in the nearby community.”

Walking around the perimeters of the facility buildings, the OIG teams assessed the security level of 2960 public and nonpublic access doors. They found that 87% of public doors did not have an active security presence, and of those, 23% also did not have a security camera. Moreover, 17% of nonpublic doors were unlocked; 97% of those did not have a security presence, and 43% did not have a security camera. Even more concerning: Some of those doors led to sensitive or restricted facility areas. For example, at one midwestern facility, an unlocked nonpublic access door led to the surgical intensive care unit.

The OIG teams also assessed training records for 170 police officers across the 70 facilities and found that nearly all officers were compliant with training requirements. Most respondents also reported they received adequate training to perform their job duties and provided numerous positive indicators. Well trained or not, though, a notable problem in maintaining security, the OIG teams found, was there simply weren’t enough officers.

The OIG has repeatedly issued reports on significant police officer staffing shortages since at least 2018. VA police officers are not only empowered to make arrests, carry firearms while on duty, and investigate criminal activity within VA’s jurisdiction, but also assist individuals on medical campuses “in myriad ways,” the OIG notes. Staffing shortages are likely to compromise overall facility security, morale, and staff retention and underscore the need for maintaining communication with local law enforcement agencies for assistance, the OIG report points out.

In the OIG surveys, security personnel often noted they were understaffed. Although VA guidance calls for at least 2 VA police officers on duty at all times, 21% of respondents said they were aware of a duty shift during which minimum police staffing requirements were not met. About 37% of respondents expressed concerns about the physical security at their facilities. Some pointed out that the lack of VA police on duty could make it difficult to respond to threats like an active shooter.

In May 2022, the VA issued a directive that established minimum police coverage at medical facilities, as well as a police officer staffing decision tool to help determine appropriate officer levels. It required facilities to have an active security presence in their emergency departments around-the-clock by May 2023. As of September 2022, 58% of the facilities’ emergency departments did not yet have a visible security presence.

The teams also found issues with security devices: 19% of all cameras were not functional; at 24 facilities, more than 20% of the cameras were not working. A few facilities had “highly functional” systems that allowed personnel to monitor the campus thoroughly and even search for specific individuals—but they weren’t always operable.

At one western facility, it came down to a problem that would be frustrating at any time, but alarming for security management: Security personnel could not access the monitoring system because the required security certificates had expired, and no one knew the administrative password. If the system went offline, the OIG team was told, no one could fix the problem without password access. Neither VA’s Office of Information and Technology nor the contractor for the facility’s cameras could override the administrative password.

On the bright side, the OIG teams found that camera video feeds were being actively surveilled by security personnel at 60 of 70 facilities. All but 1 site kept camera footage for an average of 2 weeks or more.

VA policy states that, in addition to at least 2 intermediate weapons (such as batons and pepper spray) uniformed officers must always be issued radios for use while on duty. Survey respondents generally indicated they received their equipment and that it was adequate, but 15% said theirs lacked functionality, such as battery life and signal strength.

Based on the teams’ findings, the OIG made 6 recommendations: (1) delegating a responsible official to monitor and report monthly on facilities’ security-related vacancies; (2) authorizing sufficient staff to inspect VA police forces per the OIG’s 2018 unimplemented recommendation; (3) ensuring medical facility directors appropriately assess VA police staffing needs, authorize associated positions, and leverage available mechanisms to fill vacancies; (4) committing sufficient resources to ensure that facility security measures are adequate, current, and operational; (5) directing Veterans Integrated Services Network police chiefs, in coordination with medical facility directors, facility police chiefs, and facility emergency management leaders, to present a plan to remedy identified security weaknesses; and (6) establishing policy that standardizes the review and retention requirements for facility security camera footage.

The VA concurred with all recommendations and submitted corrective action plans.