VA Medical Center Security: Progress Made, but Improvements to Oversight of Risk Management and Incident Analysis Still Needed

What GAO Found

The Department of Veterans Affairs (VA) has recently identified improvements for its physical security risk management policy and oversight process for its medical centers but has yet to implement them. In January 2018, GAO reported that VA's risk management policy did not fully reflect federal standards for facility security, such as a requirement to consider all of the undesirable events described in the standards (e.g. active shooter incidents). GAO also reported that while VA conducted some limited oversight of medical centers' risk management activities, it lacked a system-wide oversight strategy. GAO recommended that VA revise its policy to reflect federal standards and develop a system-wide oversight strategy to help to ensure that its approach to risk management will yield the appropriate security posture relative to the different risks at each of its medical centers. In response, as of June 2021, VA has begun to take actions to revise its policy to reflect the standards and fully deploy a risk assessment tool to help oversee risk management processes across medical centers. VA officials said they plan to implement the revised policy and assessment tool in fiscal year 2022.

VA has improved its data collection to support the management and oversight of police officers' use of force but could better track and analyze investigations. VA policy contains a use of force continuum scale to define and clarify the categories of force that officers can use to gain control of a situation.

In September 2020, GAO reported that VA's records of use of force incidents were not complete or accurate. For example, GAO found that 176 out of 1,214 use of force incident reports did not include the specific type of force used. Further, VA did not track incidents by individual medical centers. GAO also reported that VA did not systematically collect or analyze use of force investigation findings from local medical centers or have a database designed for such purposes, limiting VA's ability to provide effective oversight. GAO recommended that VA improve the completeness and accuracy of its data on use of force, analyze that data by facility and geographic region, and implement plans to obtain a database to collect and analyze use of force investigations. As of June 2021, VA took steps to improve the accuracy and completeness of its use of force incident data, and officials stated VA is working to obtain a suitable database to track use of force investigation trends. GAO will continue to review VA's steps to address recommendations from both reports.

Why GAO Did This Study

The Veterans Health Administration provides critical health services to approximately 9-million enrolled veterans at its nearly 170 medical centers. Ensuring safety and security at these medical centers can be complicated because VA has to balance the treatment and care of veterans—a vulnerable population with high rates of post-traumatic stress disorder and substance abuse—while also maintaining order and enforcing the law. Officers may need to use physical force to help bring a violent or hostile situation under control.

This statement focuses on how VA manages and oversees (1) the physical security of medical centers and (2) use of force incidents by police officers. The statement is primarily based on GAO-18-201, issued in January 2018, and GAO-20-599, issued in September 2020. To update this information, GAO reviewed documentation and interviewed VA officials on actions taken to address these reports' recommendations.