[House Hearing, 115 Congress]
[From the U.S. Government Publishing Office]


OVERSIGHT OF IT AND CYBERSECURITY AT THE DEPARTMENT OF VETERANS AFFAIRS

=======================================================================

                                 HEARING

                               BEFORE THE

                            SUBCOMMITTEE ON
                         INFORMATION TECHNOLOGY

                                 OF THE

                         COMMITTEE ON OVERSIGHT
                         AND GOVERNMENT REFORM
                        HOUSE OF REPRESENTATIVES

                     ONE HUNDRED FIFTEENTH CONGRESS

                             FIRST SESSION

                               __________

                            DECEMBER 7, 2017

                               __________

                           Serial No. 115-59

                               __________

Printed for the use of the Committee on Oversight and Government Reform

[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]


         Available via the World Wide Web: http://www.fdsys.gov
                       http://oversight.house.gov
              
              
                               __________
                               

                    U.S. GOVERNMENT PUBLISHING OFFICE                    
30-246 PDF                  WASHINGTON : 2018                     
          
----------------------------------------------------------------------------------------
For sale by the Superintendent of Documents, U.S. Government Publishing Office, 
http://bookstore.gpo.gov. For more information, contact the GPO Customer Contact Center, 
U.S. Government Publishing Office. Phone 202-512-1800, or 866-512-1800 (toll-free). 
E-mail, [email protected].              
              
              
             
              
              Committee on Oversight and Government Reform

                  Trey Gowdy, South Carolina, Chairman
John J. Duncan, Jr., Tennessee       Elijah E. Cummings, Maryland, 
Darrell E. Issa, California              Ranking Minority Member
Jim Jordan, Ohio                     Carolyn B. Maloney, New York
Mark Sanford, South Carolina         Eleanor Holmes Norton, District of 
Justin Amash, Michigan                   Columbia
Paul A. Gosar, Arizona               Wm. Lacy Clay, Missouri
Scott DesJarlais, Tennessee          Stephen F. Lynch, Massachusetts
Blake Farenthold, Texas              Jim Cooper, Tennessee
Virginia Foxx, North Carolina        Gerald E. Connolly, Virginia
Thomas Massie, Kentucky              Robin L. Kelly, Illinois
Mark Meadows, North Carolina         Brenda L. Lawrence, Michigan
Ron DeSantis, Florida                Bonnie Watson Coleman, New Jersey
Dennis A. Ross, Florida              Stacey E. Plaskett, Virgin Islands
Mark Walker, North Carolina          Val Butler Demings, Florida
Rod Blum, Iowa                       Raja Krishnamoorthi, Illinois
Jody B. Hice, Georgia                Jamie Raskin, Maryland
Steve Russell, Oklahoma              Peter Welch, Vermont
Glenn Grothman, Wisconsin            Matt Cartwright, Pennsylvania
Will Hurd, Texas                     Mark DeSaulnier, California
Gary J. Palmer, Alabama              Jimmy Gomez,California
James Comer, Kentucky
Paul Mitchell, Michigan
Greg Gianforte, Montana

                     Sheria Clarke, Staff Director
                  Robert Borden, Deputy Staff Director
                    William McKenna General Counsel
                      Sean Brebbia, Senior Counsel
                         Kiley Bidelman, Clerk
                 David Rapallo, Minority Staff Director
                                 ------                                

                 Subcommittee on Information Technology

                       Will Hurd, Texas, Chairman
Paul Mitchell, Michigan, Vice Chair  Robin L. Kelly, Illinois, Ranking 
Darrell E. Issa, California              Minority Member
Justin Amash, Michigan               Jamie Raskin, Maryland
Blake Farenthold, Texas              Stephen F. Lynch, Massachusetts
Steve Russell, Oklahoma              Gerald E. Connolly, Virginia
                                     Raja Krishnamoorthi, Illinois
                            
                            
                            C O N T E N T S

                              ----------                              
                                                                   Page
Hearing held on December 7, 2017.................................     1

                               WITNESSES

Mr. David A. Powner, Director, IT Management Issues, U.S. 
  Government Accountability Office
    Oral Statement...............................................     4
    Written Statement............................................     6
Mr. Scott Blackburn, Acting Chief Information Officer, Department 
  of Veterans Affairs
    Oral Statement...............................................    39
    Written Statement............................................    41
Mr. Bill James, Deputy Assistant Secretary for the Enterprise 
  Program Management Office, U.S. Department of Veterans Affairs
    Oral Statement...............................................    58
Mr. John Windom, Program Executive for Electronic Health Records 
  Modernization, U.S. Department of Veterans Affairs
    Oral Statement...............................................    58
Mr. Dominic Cussatt, Chief Information Security Officer, 
  Department of Veterans Affairs
    Oral Statement...............................................    74

                                APPENDIX

Ranking Member Kelly Opening Statement...........................    78
Mr. Connolly Opening Statement...................................    80
GAO Chart submitted by Chairman Hurd.............................    82

 
OVERSIGHT OF IT AND CYBERSECURITY AT THE DEPARTMENT OF VETERANS AFFAIRS

                              ----------                              


                       Thursday, December 7, 2017

                  House of Representatives,
            Subcommittee on Information Technology,
              Committee on Oversight and Government Reform,
                                                   Washington, D.C.
    The subcommittee met, pursuant to call, at 2:38 p.m., in 
Room 2154, Rayburn House Office Building, Hon. Will Hurd 
[chairman of the subcommittee] presiding.
    Present: Representatives Hurd, Amash, Gianforte, Kelly, 
Lynch, Connolly, and Krishnamoorthi.
    Mr. Hurd. The Subcommittee on Information Technology will 
come to order. And without objection, the chair is authorized 
to declare a recess at any time.
    Good afternoon. Thank you for being here today.
    Seventy-six years ago to the day, Japan launched a sneak 
attack on the U.S. naval base at Pearl Harbor. By the time the 
sun had set on that infamous day, 2,335 U.S. servicemen had 
been killed and 1,143 had been wounded. The next day, the 
United States of America declared war on Japan. Three days 
later, the world was at war. Over 16 million Americans 
eventually served in that war, the so-called war to end all 
wars. There are only around 624,000 World War II veterans left. 
Most are in their 90s. I want to take this opportunity today to 
thank all of them for their service and their courage.
    Sadly, that war did not end all wars. In 2016, Gulf War 
veterans became the largest group of veterans at over 7 
million. The total number of veterans enrolled in VA's 
healthcare system rose from 7.9 million to almost 9 million for 
fiscal year 2006 through fiscal year 2016. The total veteran 
population currently stands at 20 million people, 20 million of 
our fellow citizens who are willing to put their lives on the 
line for this country and for the rest of us. And for that 
sacrifice, we should honor our promise to provide them with 
world-class health care.
    But the modernization of the VA's legacy technology has 
been a persistent concern that is affecting millions of 
veterans. A veteran should be able to go from active duty on 
base to the VA to a private-sector provider seamlessly. The 
health records should be available and up-to-date no matter 
where the veteran chooses to get health care. A fully 
functional modernized healthcare information system is the 
goal, and today, we are going to talk about some of the 
specifics on how the VA will modernize and upgrade its 
information systems and how we can learn from past mistakes so 
that this time it is going to be a success.
    But let's be honest. There is not a track record of 
successes here. As a result of a GAO review requested by this 
committee back in May of 2016, we have learned that during 
fiscal years 2011 to 2016, VA obligated about $1 billion for 
previous VistA modernization contracts. Seven hundred and forty 
million went to 15 key contractors. Without objection, I would 
like to enter into the record a chart from GAO that lists the 
15 contractors and the amount they received to work on VistA 
modernization and interoperable electronic health records. So 
moved.
    Mr. Hurd. On that list of 15 contractors is the Cerner 
Corporation, which was recently chosen by the VA to provide an 
electronic health record that will be interoperable with the 
Department of Defense and then ultimately be interoperable with 
the private sector. Also on the list are the Mitre Corporation 
and Booz Allen Hamilton. According to the GAO, these companies 
have been awarded program management contracts to develop 
planning and support for the electronic health record 
modernization effort.
    Given the amount of money spent on VistA modernization, the 
lack of return on that investment, we have concerns about this 
rollout. It needs to succeed. The whole country is rooting for 
the VA to succeed. Previous initiatives to modernize VistA and 
to develop and interoperable electronic health record with the 
Department of Defense have been full of missed deadlines, cost 
overruns, and failures to produce. According to the GAO, from 
2011 to 2016, the VA spent about $1 billion for contractors' 
activities on their health information technology systems.
    Additionally, veterans have had difficulties with 
scheduling appointments for far too long. The VA has been 
trying and failing to develop a scheduling system that is 
compatible with VistA since 2000. That is 17 years spent 
working on developing a scheduling system. It is a whole lot of 
money, a whole lot of time, and very little to show for it.
    VA Secretary Shulkin has said that the VA, and I quote, 
``should focus on the things veterans need us to focus on and 
work with companies who know how to do this better than we 
do,'' end of quote. The Secretary is absolutely right. The 
technology and tools to improve the VA's technology and 
cybersecurity exist. What is required is strong leadership at 
the VA to make the tough decisions about pursuing that 
technology. Our veterans deserve a state-of-the-art scheduling 
system, they deserve an interoperable and longitudinal 
electronic health record, and they deserve good quality 
information technology at the agency that exists to serve the 
ones who served.
    I am looking forward to our hearing today. I am looking 
forward to hearing from our witnesses about the future of 
modernization, improvement, and technology at the VA.
    Mr. Hurd. And now, as always, it is my pleasure to 
recognize my friend Robin Kelly for her opening statement.
    Ms. Kelly. Thank you, Mr. Chairman.
    Information technology is critical to improving the service 
and performance of the Federal Government. This is especially 
true at the Department of Veterans Affairs, which is one of the 
largest integrated healthcare systems in the United States, 
serving millions of veterans and their families. The VA's goal 
for modernizing its healthcare IT is full of interoperability, 
which would allow seamless sharing of health information 
between the VA and the Department of Defense, as well as 
private healthcare providers.
    The VA is now in its fourth attempt since 2001 to modernize 
its healthcare IT system. The record has not been good. The VA 
abandoned two earlier attempts at spending billions of dollars. 
This summer, the VA announced that it would scrap its third 
attempt in favor of acquiring the same healthcare IT system as 
the DOD. I do not know what we should make of that since the VA 
previously abandoned the same approach four years ago.
    Chairman Hurd and I requested that GAO examine the VA's 
modernization efforts because of these red flags. We discovered 
that, right now, the VA is relying on 138 contractors to help 
it modernize. Some of them are the very same contractors VA had 
hired and fired after their previous attempts had failed. In 
fact, 34 through 38 repeat contractors make up about $793 
million of the $1.1 billion of the contractual obligations 
related to modernization between fiscal years 2011 through 
2016. This raises serious concerns. Every change in strategy 
delays actually modernizing and makes it harder on veterans who 
rely on the agency for health care. We need to understand 
whether these changes are justified.
    I want to hear today what the agency is doing to hold this 
army of contractors accountable. I also want to hear about the 
progress made toward its interoperability and improving the 
ability to track patient outcomes. Getting these efforts right 
and improving VA operations and information security are 
essential to regaining the trust and confidence of the American 
public that the VA is taking care of our nation's veterans.
    Thank you so much. Thank you for being here, and thank you, 
Mr. Chair.
    Mr. Hurd. The gentlelady yields back.
    And I now am pleased to introduce our witnesses: Mr. Scott 
Blackburn, acting chief information officer at the VA; Mr. 
Dominic Cussatt, is that correct, sir? He is the CISO at the 
Department of Veterans Affairs, the chief information security 
officer; Mr. Bill James, the deputy assistant secretary for the 
Enterprise Program Management Office at the Department of 
Veterans Affairs; and Mr. John Windom, program executive for 
Electronic Health Records Modernization at the Department of 
Veterans Affairs; and the person that wins the award for most 
times testifying in front of OGR, Mr. David Powner, director of 
IT Management Issues at the U.S. Government Accountability 
Office.
    Welcome to you all. And pursuant to committee rules, all 
witnesses will be sworn in before you testify, so please rise 
and raise your right hand.
    [Witnesses sworn.]
    Mr. Hurd. Thank you. Please let the record reflect that all 
witnesses answered in the affirmative.
    And in order to allow time for discussion, please limit 
your testimony to five minutes. I recognize there are only can 
be two statements. And your entire written statement is going 
to be made part of the record. As a reminder, the clock in 
front of you shows your remaining time. The light will turn 
yellow when you have 30 seconds left, and the red when your 
time is up. Please also remember to press the button to turn 
your microphone on before speaking.
    We are going to actually start with Mr. Powner. Mr. Powner, 
it is always a pleasure to have you here, sir. No-shave 
November is over, just for the record. And you are now 
recognized for five minutes, sir.

                       WITNESS STATEMENTS

                  STATEMENT OF DAVID A. POWNER

    Mr. Powner. Chairman Hurd, Ranking Member Kelly, and 
members of the subcommittee, thank you for inviting GAO to 
testify on VA's FITARA progress and their efforts to modernize 
their aging electronic health records system.
    Technology can help make improvements so that ultimately 
our veterans will face shorter wait times to schedule care, 
receive higher-quality care, and have claims processed quicker 
and more accurately. The Department will spend over $4 billion 
on IT this year. That makes them the fifth-highest IT spender 
in the government. Of the $4 billion, only about $360 million 
goes towards developing or acquiring new systems. The remaining 
goes towards operational systems and payroll. Many of these 
operational systems are old, inefficient, and difficult to 
maintain. In addition to its 30-plus-year-old medical 
information system known as VistA, VA has an accounting system 
and a claims processing system that are both more than 50 years 
old.
    In 2015, GAO added two new areas to our high-risk list: 
managing VA health care and managing IT acquisitions and 
operations, which both highlight concerns with VA's IT 
management, including past failures where hundreds of millions 
of dollars were wasted.
    Turning to VA's FITARA progress, VA has historically done a 
good job planning for incremental development and continues to 
do so. Also to their credit they are only one of seven agencies 
to have a complete software license inventory. The area that 
needs the most work is data center optimization. VA has closed 
about 40 of its 415 centers, saved just over $20 million, and 
reports meeting one of OMB's five optimization metrics. Their 
closure savings and optimization metrics all fall short of 
OMB's goals. VA needs to consider more comprehensive data 
center optimization strategy that coincides with their new 
approach of reducing the 130 instances of VistA.
    Now turning to the EHR modernization initiative, I will 
briefly summarize the work we did for you looking at 
contractors involved in previous VA EHR efforts, current plans 
for the new approach, and suggestions for success moving 
forward. My written statement provides details on specific 
contractors and the amounts obligated to VA's EHR efforts over 
the previous six years.
    Here are the highlights: VA obligated approximately $1.1 
billion to 138 contractors between 2011 and 2016. About $740 
million or almost 70 percent of this went to 15 contractors. 
Clearly, we did not get the return needed to modernize 
electronic health records with these previous efforts, but 
that's water over the dam. What's important now is how can we 
improve contractor oversight, performance, and delivery with 
the new effort. The decision by Secretary Shulkin in June to go 
with the same commercial electronic health records system as 
DOD is a good one. Contract award is expected this month. Plans 
are to follow within 90 days, and we understand that initial 
deployment is expected within 18 months with subsequent 
deployments to occur over the next 10 years.
    This is a massive undertaking, and I'd like to mention five 
keys to success. One, continuity of leadership and Executive 
Office of the President involvement. This continuity includes 
the Secretary, CIO, and others. Of particular concern is VA's 
CIO tenure, which is less than two years. They have had nine 
CIOs since 2004. Since leadership change is inevitable, having 
White House involvement could help mitigate setbacks associated 
with this. The current administration has several EOP offices 
whose involvement can help with this important acquisition. 
This includes the Office of Innovation and the American Tech 
Council. We also think that the Federal CIO's involvement is 
important.
    Number two, governance in building a robust Program 
Management Office. We understand that both interagency 
governance is planned, as is governance run by VA's Deputy 
Secretary. In addition, it is important that the PMO ensure 
better collaboration between the Veterans Health Administration 
and the CIO shop than has occurred historically. Also, this PMO 
needs to have a strong focus on contract management to ensure 
that contractors have high levels of productivity, quality, and 
delivery.
    Number three, business change management. A major issue 
with Federal agencies adopting commercial products is their 
unwillingness to change their business processes. This is 
definitely a high-risk area for VA.
    Number four, leveraging lessons from DOD. Since DOD is 
ahead of VA, learning from their experience is essential.
    And lastly, number five, building in appropriate cyber 
security measures. VA's FISMA audit shows several cyber areas 
that need strengthening. Many of these are extremely important 
to the new EHR acquisition, including controls associated with 
network security and controls for monitoring systems hosted by 
contractors.
    Mr. Chairman, this concludes my statement. I look forward 
to your questions.
    [Prepared statement of Mr. Powner follows:]
    
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
    
    Mr. Hurd. Thank you, sir.
    Mr. Blackburn, I have been advised you are going to speak 
for the entire VA team. You are now recognized for five 
minutes. Welcome.

                  STATEMENT OF SCOTT BLACKBURN

    Mr. Blackburn. Will do. Chairman Hurd, Ranking Member 
Kelly, members of the subcommittee, thank you very much for the 
opportunity to discuss OIT transformation with an emphasis on 
IT modernization, cybersecurity, FISMA and FITARA compliance, 
and the electronic health record management initiative.
    I'm accompanied by Mr. James, Mr. Cussatt, and Mr. Windom, 
and then also available to answer questions behind me as Mr. 
John Short, executive director of Information Technology 
Systems Modernization.
    Also, thank you all for the opportunity to meet with you 
one-on-one. The feedback we received was very positive, very 
constructive, and we really appreciate that. We especially 
appreciate your interest to help ensure we get the electronic 
health record modernization effort off on the right foot, along 
with other pressing VA matters.
    VA is in the midst of a turnaround. Trust was broken in 
2014, and helping re-earn that trust is why I left the private 
sector to join the VA in November of 2014. This is personal to 
me as a disabled veteran and as one of five siblings who are 
all either veterans or still serving today in uniform.
    Our first quarterly survey to measure veteran trust two 
years ago revealed that only 47 percent of veterans said that 
they trusted the VA to fulfill our country's commitment to 
veterans. Today, that number is 69 percent with an uptick in 
each of the last seven quarters. OIT has played a major role in 
that improvement. And while 69 percent is great compared to 
where we started, that still means that 31 percent of veterans 
do not trust VA, which means we still have a long way to go, 
and OIT will play an even more important role closing that gap.
    We have a comprehensive IT modernization plan, which is the 
foundation for reducing reliance on the VA legacy systems. We 
will leverage modern technology such as telehealth, cloud, 
robotics, machine learning, mobile, digital services, and 
blockchain. We will stop or migrate 240 of our 299 current 
projects and leverage a buy-first strategy, getting us out of 
the software development business and ensuring we are 
positioned to manage the influx of new technologies and 
innovations.
    I'd like to highlight four areas which align with the 
Secretary's priorities. Number one, the selection of the new 
electronic health record is a major step for VA. A veteran will 
have one single longitudinal lifetime medical record. That 
means a single common system from the time of enlistment or 
commission throughout their service and the remainder of their 
life as a veteran. We realize implementing Cerner Millennium 
across the country's largest integrated healthcare system will 
not be easy, but we strongly believe it is the right thing to 
do. Our new electronic health records system will enable VA to 
keep pace with the improvements in health IT and cybersecurity, 
which the current system VistA is unable to do. Continuing to 
maintain VistA is costly. Transition solutions for nearly all 
VistA modules have been identified with the majority to be 
replaced by the Cerner solution.
    Number two, modernizing our scheduling systems is something 
I am extremely passionate about as a veteran who's received 
treatment at the Washington, D.C., VA Medical Center. This is 
an area where we have made improvements, but much more must be 
done.
    Number three, another OIT commitment is modernizing the 
legacy COBOL-based financial management system to standardize 
and improve accounting and acquisition services.
    And number four involves our benefits delivery network, 
BDN, and modernizing BDN will ensure that VBA-wide--that's our 
benefits administration--wide monthly payment and processing of 
4 million checks remains feasible and that veterans receive 
benefits quickly.
    Additionally, VA cybersecurity program enables data 
protection in the face of threats and is committed to 
safeguarding veteran information. We have recently achieved 
various program capability and policy milestones to advance 
cybersecurity to include just a few hours ago receiving from 
the Federal CIO this memo closing 11 open cyber stat activities 
with OMB.
    VA received a B-plus grade from your FITARA scorecard, and 
while we are proud of that score, we acknowledge that our data 
center consolidation, as Mr. Powner noted, is nowhere near 
where it needs to be, and we are working to fix it. The 
establishment of an OIT-based strategic sourcing division will 
ensure FITARA compliance for all IT acquisitions.
    Thank you again, Chairman and Ranking Member, for the 
opportunity to discuss OIT's transformation efforts. As a note, 
if there are any questions that are acquisitions-sensitive to 
our EHR efforts, we will not be able to discuss those in a 
public session, but we can provide those--that information to 
you in a closed session at a later date.
    Ensuring a safe and secure environment for veteran 
information and improving their experiences our goal. I look 
forward to your questions.
    [Prepared statement of Mr. Blackburn follows:]
    
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
    
    Mr. Hurd. Thank you, Mr. Blackburn.
    And before we turn to Mr. Gianforte for the first round of 
questions, Mr. Cussatt, we know what a CISO does. Mr. James and 
Mr. Windom, can I get you all to explain to the committee what 
your exact role is, who you report to directly? Just take 30 
seconds.
    Mr. James. Yes, Chairman, thank you. The Enterprise Program 
Management Office inside the CIO's organization at the VA, 
we're the control tower for all of the projects, the ongoing 
projects with the exception of the EHR project, which has its 
own BEO. So we track all the project's costs, schedule 
performance that are ongoing today in the IT organization.
    Mr. Hurd. And who is your direct supervisor?
    Mr. James. Scott Blackburn, sir.
    Mr. Hurd. Got you. Mr. Windom?
    Mr. Windom. Sir, recently retired, Captain John Windom, 33 
years United States Navy. I was a program manager that oversaw 
the DOD successful acquisition of the Cerner Millennium 
product. I was brought over in uniform about six months ago at 
the request of Secretary Shulkin from Secretary Mattis to kick 
off if you will the DNF activities and negotiations with 
Cerner. I've been leading that and now in a retired capacity as 
a--as the executive overseeing the entire electronic health 
record modernization, direct report to the Deputy Secretary, 
and so he is who I consider my boss.
    Mr. Hurd. Well, welcome. It is good to have you here.
    Mr. Windom. Thank you.
    Mr. Hurd. It is a mess, and we are glad we have you on 
board to work on this project.
    Mr. Windom. Great to be here, sir.
    Mr. Hurd. The distinguished gentleman from Montana is now 
recognized for five minutes.
    Mr. Gianforte. Okay. Thank you, Mr. Chairman. I want to 
thank each of you for being here. This is a critically 
important topic for us to be discussing. In Montana, we are the 
second-largest per capita of citizens that have served in the 
military. And as I travel the State, the number-one issue I 
hear is health care from the VA in every single meeting, so I 
appreciate you being here.
    And in a rural State like Montana, it can take hours to 
drive to a VA hospital or clinic, so scheduling becomes 
extremely important, particularly advanced notice. It could 
take three days to go to an appointment and come back again. 
So, as we have heard, clearly we can do better, and I 
appreciate your efforts in that regard.
    I come from a software background. I have done literally 
thousands of enterprise-class deployments. One particular one 
was for the Air Force Personnel Center. It was their entire 
records systems for processing all the stuff, so have some 
experience. And that handled all active-duty and all retired 
Air Force personnel, so it was of some scale.
    You have shared that this new Cerner system, Mr. Blackburn, 
will be $10 billion and 10 years to complete. Is that correct?
    Mr. Blackburn. That's correct, sir.
    Mr. Gianforte. Okay. I haven't been through a lot of sales 
cycles on the software side. If I had walked into a boardroom 
and asked for $10 billion and 10 years before we could get a 
system deployed, honestly, I would have gotten laughed out of 
the boardroom. It is difficult to fathom it could take that 
long. And comparing my own experience with the Air Force system 
that we deployed, granted, the entire VA is larger, but what 
you are proposing is not 10 times more expensive, it is not 100 
times more expensive, it is 1,000 times more expensive, three 
orders of magnitude, which provides some level of sticker 
shock.
    Where I want to focus my questioning, Mr. Blackburn, is 
just on what steps you are taking to minimize the cost and get 
functionality in the field so that we can retire this VistA 
system and move on. So the first area I want to speak about is 
just customization of applications. When large enterprise-class 
applications are customized, they tend to become brittle. 
Integrations don't work as well. What percentage--and one 
measure of that is how much of the total fee is going into 
customization versus licenses versus operation and maintenance. 
Can you share with me a little bit of how that $10 billion 
breaks out between license and customization?
    Mr. Blackburn. Well, first of all, thank you for the one-
on-one time. That was very productive, and I really appreciate 
it.
    This is going to be the largest implementation of a 
healthcare system, EHR, ever, and it's going to be a really big 
undertaking. The key difference between previous efforts is 
we're going to be buying the commercial off-the-shelf solution 
and absolutely minimizing the customization.
    I'll ask Mr. Windom to kind of get into some of the 
specifics there.
    Mr. Windom. Sir, I appreciate your question, appreciate the 
opportunity.
    The--I need to make sure there are some facts brought to 
the table. Number one is the VA is three times larger than DOD. 
We awarded the contract for DOD at $4.33 billion, and so the 
complexity is deemed about four times larger in that we have 
well over 100 interfaces. DOD had approximately 25 to 27 
interfaces.
    The $10 billion is not what's needed at contract award. The 
$10 billion is for the duration of the contract. And I'm really 
not at liberty to talk about specifics of the price 
negotiation. We'll gladly come brief you in whatever detail 
you'd like personally and give you a complete breakdown of the 
pricing structure.
    Mr. Gianforte. So just in the initial acquisition, what 
percentage is professional services versus license?
    Mr. Windom. The--sir, that would be crossing me over to 
Procurement Integrity Act because I would be giving you 
contract values. Again, sir, prepared to give you that 
granularity in a private session outside ----
    Mr. Gianforte. Okay.
    Mr. Windom.--the public forum, so I apologize. I guess ----
    Mr. Gianforte. I think with a number that large we are just 
asking to understand.
    Mr. Windom. Well ----
    Mr. Gianforte. And, Mr. Blackburn then, if we--one of the 
recommendations from the GAO here was item 3 to redesign 
business process to conform with commercial off-the-shelf 
software as a way to bring costs down and reliability. What 
business process redesign efforts are you undertaking inside VA 
to conform with best practices and maybe leave behind some of 
those 30-year-old processes and pick up new ones that are 
available to us?
    Mr. Blackburn. Well, one of the big issues that we have is 
we have different processes at each one of our 168 medical 
centers, and so we're not standardized right now across our own 
medical system. What this will force us to do is standardize 
across our medical system and then also in line with the 
workflows of DOD in order to implement this off-the-shelf 
solution.
    Mr. Gianforte. And, Mr. James, is that a primary focus of 
the PMO in doing business process redesign to bring conformity 
across the ----
    Mr. James. Congressman, that would be better addressed by 
the PEO Mr. Windom.
    Mr. Windom. Sir, my primary responsibility is program 
management oversight, as you alluded to. You get what you 
inspect, not expect. I have led to a number of multibillion-
dollar programs and understanding that though we have selected 
a phenomenal partner in Cerner or will award a contract, we've 
got to have the mechanisms in place to oversee their efforts to 
protect the taxpayers' interest and obviously the interest of 
our veterans. So our Program Management Office is going to 
consist of what I believe is you need physics, physicists to 
grade physics homework. So we're going to have the full breadth 
of clinical capabilities and technological capabilities at our 
disposal to oversee the implementation, sir.
    Mr. Gianforte. Okay. Well, I would encourage you that as 
much standardization would be ----
    Mr. Windom. Yes, sir.
    Mr. Gianforte.--helpful in keeping the cost down.
    The last point I just want to ask Mr. Blackburn is we have 
heard before this committee a number of other agencies testify 
about the cost savings increase in reliability and speed to 
deployment when solutions are in the cloud. What percentage of 
the Cerner system will be native in-the-cloud technology?
    Mr. Blackburn. The--Mr. Windom will probably have the best 
information for that, but it's the majority.
    Mr. Windom. Sir, so we're involving with technology. As you 
know, there are a number of inhibitors associated with the 
movement of PII data into the cloud. I can assure you we're 
working ----
    Mr. Gianforte. So is there a percentage?
    Mr. Windom. Sir, I don't have a percentage, but we're going 
to be on premise and in the cloud simultaneously in delivering 
that support. What the ----
    Mr. Gianforte. We have had other agencies testify that 
there are 100 percent in the cloud now.
    Mr. Windom. That's not the case, sir.
    Mr. Gianforte. Okay. Well ----
    Mr. Windom. That would not be the case for us.
    Mr. Gianforte.--I just want to--I will just finish up. I 
have run past my time. Thank you, Mr. Chairman. It is just the 
work you are doing is critically important for our veterans. 
They are not--we all know they are not being served well today. 
Let's work together to make this happen.
    Mr. Blackburn. Absolutely. Absolutely, sir.
    Mr. Gianforte. I yield back.
    Mr. Hurd. The gentleman yields back. Now, I recognize the 
ranking member for her first five minutes of questions.
    Ms. Kelly. Thank you, Mr. Chair.
    The number-one mission of the VA is to care for our 
veterans, and a central part of that mission in delivering 
quality healthcare generally is tracking outcomes. The ability 
to track outcomes help both prevention and treatment. Mr. 
Blackburn, the VA cannot properly care for our veterans and 
track outcomes without the ability to communicate with DOD and 
share information. Can DOD and the VA currently exchange 
patient health data between one another?
    Mr. Blackburn. Thank you, Ranking Member Kelly, and thank 
you also for our one-on-one session.
    The--yes. The answer is yes, that we currently can. My 
doctor in the Orange Clinic of the Washington VAMC, we have 
something called Joint Legacy Viewer in--which allows 
clinicians within DOD and VA to be able to see each other's 
medical records. It's not perfect. It's read-only. It's as good 
as it could possibly get it. I think we have roughly almost 8 
million or so medical records that have been viewed on Joint 
Legacy Viewer.
    Ms. Kelly. Thank you. Do all users have access to 
interoperable electronic health records, the system?
    Mr. Blackburn. The--I think most. John Short, is that all? 
All.
    Ms. Kelly. All? Okay, great.
    Mr. Blackburn. Yes.
    Ms. Kelly. VistA evolution showed progress in achieving the 
ability to share data between DOD and VA. In June of this year, 
however, the Secretary announced that the VA would now acquire 
the same health system as the DOD. This is a rather remarkable 
shift since it was previously planned that DOD and VA would 
have the same healthcare system and that efforts were 
abandoned. Why is the VA going back to this plan that it 
previously abandoned, and why does it believe this is the best 
course of action at this time?
    Mr. Blackburn. The--maintaining our current VistA system is 
not an option. It will be incredibly costly. Matter of fact, we 
had a third-party estimate that took a look at it and estimated 
it would be roughly up to $19 billion to maintain and to 
upgrade our current VistA system. And that would not get us the 
seamless interoperability of--that we're looking for with 
veterans. With--by moving to the same exact product, the same 
exact instance that DOD has, it will all be one record. It will 
be DOD doctors and VA doctors going into the exact same record, 
which will make that seamless.
    Currently, as a veteran, most of my records as a soldier 
were on paper. Those were lost when my parents' basement was 
flooded, so my VA doctor does not have that information. That 
will not be the case for my kids when they go to serve.
    Ms. Kelly. Okay. And, Mr. Blackburn, will the transition 
away from the health management platform that was the key part 
of the VistA evolution affect the interoperability with the 
Department of Defense?
    Mr. Blackburn. Please repeat the question.
    Ms. Kelly. Will the transition away from the health 
management platform that was a key part of VistA ----
    Mr. Blackburn. Yes.
    Ms. Kelly.--evolution, will that affect the 
interoperability with the Department of Defense?
    Mr. Blackburn. We will maintain that ability on Cerner to 
be able to view those records within the Joint Legacy Viewer, 
so we will not lose that data. That will be a key part of our 
implementation.
    Ms. Kelly. And what is your timeline?
    Mr. Blackburn. The timeline overall for implementation of 
Cerner is roughly 10 years ----
    Ms. Kelly. And ----
    Mr. Blackburn.--for the entire thing.
    Ms. Kelly. And what are you doing to achieve 
interoperability with healthcare providers outside of the VA 
and DOD?
    Mr. Blackburn. That's a great question, and that's actually 
something that we're working with the Office of American 
Innovation and the White House on. The Cerner solution, that 
will give us interoperability within the VA, first of all. 
Second, it will give us interoperability with the DOD because 
it's the same record. And then thirdly, the--Cerner has a 
CommonWell solution in which they have their network of private 
hospitals that that will--but it won't give us 100 percent. No 
solution right now will give us 100 percent with the private 
sector. That solution does not exist right now, but I think 
that would be a longer-term goal for our country so that it 
would be completely seamless. And that's actually a problem 
that we're working with the White House on.
    Ms. Kelly. Okay. Thank you. In previous testimony before 
this committee GAO has stated that agencies need, and I quote, 
``To define what they aim to accomplish through these efforts 
and identify meaningful outcome-oriented goals and metrics.'' 
DOD and VA, do you agree with GAO's assessment that outcome-
oriented goals would help measure progress toward 
interoperability and hold your departments accountable for 
their progress?
    Mr. Blackburn. Absolutely. Absolutely agree.
    Ms. Kelly. And what do--well, what does your respective 
agency aim to achieve regarding improved health outcomes and 
delivery from your interoperability efforts?
    Mr. Blackburn. Ask Mr. Windom for specifics there.
    Mr. Windom. The metrics--the right metrics, ma'am, I would 
offer are our primary concerns, so KPPs, SLRs, SLAs, things 
that we can use to clearly identify that we are achieving our 
quality goals on behalf of our beneficiaries.
    We've got what's called a quality assurance surveillance 
plan as part of the contract. Those contracting officer 
representatives, quality assurance representatives will be 
overseeing the delivery of those metrics as the product is 
being rolled out to ensure that we're in fact getting what we 
paid for. So there's a myriad of metrics that add value that 
are not only aligned with the commercial standards that kind of 
reduce that customized problem that we often have when 
implemented business systems but also to leverage what's 
important within the VA with regards to value metrics. So a 
combination of the two, ma'am, and we use the quality assurance 
surveillance plan as that tool to oversee those metrics.
    Ms. Kelly. Can I just ask one more question?
    When I asked about how you are working with outside ----
    Mr. Blackburn. Yes.
    Ms. Kelly.--entities, now in the State of Illinois I 
believe they passed legislation where a veteran could go to 
another hospital or at least they were working on it.
    Mr. Blackburn. Yes.
    Ms. Kelly. How many States is it, do you know, that ----
    Mr. Blackburn. The whole ----
    Ms. Kelly.--can do that? The whole ----
    Mr. Blackburn. The whole country. That's the Veterans 
Choice Program, which has not been perfect. I know in Montana 
it has not been good. It's been terrible. But that's something 
that we're working on, and actually, there's draft proposals of 
bills in place to improve that program right now.
    Ms. Kelly. Okay. Is this--like where I live in the suburbs 
or the south suburbs of Chicago and where the VA hospitals are 
----
    Mr. Blackburn. Yes.
    Ms. Kelly.--downtown and west, so it is an effort to get 
there, not like Montana but ----
    Mr. Blackburn. Yes. So, ma'am, I'm actually a good example. 
I get my primary care at the Washington VAMC, but I get 
physical therapy through the Veterans Choice Program in 
Bethesda closer to where I live. The--and it makes a big 
difference.
    Ms. Kelly. Okay. Thank you.
    Mr. Blackburn. Yes.
    Mr. Hurd. All right. I recognize myself ----
    Mr. Connolly. I am sorry, Mr. Chairman. Did I just hear 
Maryland, not Virginia?
    Mr. Blackburn. That is correct, Mr. Connolly.
    Mr. Connolly. Oh, my Lord. All right.
    Mr. Hurd. Bad move, Mr. Blackburn.
    I recognize myself for five minutes, and I yield to the 
gentleman from Montana.
    Mr. Gianforte. Okay. Thank you, Mr. Chairman.
    I just want to continue the conversation a little bit. And, 
Mr. Blackburn, you testified again this Cerner implementation, 
$10 billion, 10 years, and I understand the VistA system then 
has to stay in place for that entire period of time. And as I 
understand the cost to--annual cost currently for the system is 
between 800 and $900 million a year. Is that correct?
    Mr. Blackburn. Roughly. Roughly. It's multiple hundreds of 
millions of dollars, way too expensive.
    Mr. Gianforte. And aspects of that system are pretty long 
in the tooth, is that correct? It has been around a long time?
    Mr. Blackburn. Oh, it's been around for about 40 years.
    Mr. Gianforte. And it is not working that well?
    Mr. Blackburn. It has worked for 40 years, but it's not 
sustainable. It can't go forward into the future.
    Mr. Gianforte. It has lost its luster at a minimum ----
    Mr. Blackburn. It has.
    Mr. Gianforte.--the 40 years. So here is my--one strategy I 
have seen used in the private sector when you have these 
massive boil-the-ocean kind of projects like the one we are 
undertaking that is 10 years and $10 billion is to use on an 
interim basis best-of-breed technologies to pick off high-value 
components that may be excessively costly or of high value in 
terms of functionality. You mentioned scheduling.
    Mr. Blackburn. Yes.
    Mr. Gianforte. It happens that I had served on a board of 
directors of a medical scheduling company. I am not here to 
advocate for them, but we did scheduling for tens of thousands 
of doctors across the United States completely in the cloud. If 
you were able to spend a small amount of money to do something 
and then throw it away when utopia arrives in 10 years, have 
you considered strategies like this to use best-of-breed 
technology on an interim basis to deliver more value to our 
vets in the short term and save operation and maintenance costs 
out of this $8-900 million a year you are spending on VistA?
    Mr. Blackburn. We have. And scheduling's been a massive 
issue for us. As a matter of fact, we have a board, a visual 
that shows what our previous scheduling system looked like, 
right? This is what doctors had to go and use. What we're 
currently doing right now in 151 out of our 158 facilities is 
we've moved under Mr. James, who has lead this program, to what 
we're calling VSE, VistA--it's an upgraded VistA GUI system on 
top of that. That is a shorter-term bridge as one of the 
efforts we've done on there. There are also a couple of other 
efforts that we have. One is an online scheduling application, 
again, a homegrown system, so ----
    Mr. Gianforte. Okay.
    Mr. Blackburn.--the VSE system is homegrown.
    Mr. Gianforte. To what extent have you looked at commercial 
off-the-shelf ----
    Mr. Blackburn. Yes.
    Mr. Gianforte.--best-of-breed applications to pick off 
either high-cost or high-value components of VistA just on an 
interim--I mean, because 10 years is a long time. I am not sure 
any of us are going to be sitting here in 10 years, but we are 
going to have veterans looking for services. To what extent 
have you implemented that sort of strategy?
    Mr. Blackburn. Yes. Mr. James, do you want to talk a little 
bit about that?
    Mr. James. Sure. We've looked at that over and over again, 
and we can apply, for example, with the VSE, VistA scheduling 
enhancement outlook like GUIDANCE, that type of best-of-breed 
at the top layer, but the problem comes when you have to 
interface it to the 130 different versions of VistA across the 
country, each one of which has 140 to 150 old ----
    Mr. Gianforte. Does that ----
    Mr. James.--applications.
    Mr. Gianforte. That VistA GUI, does that work on mobile 
devices?
    Mr. Blackburn. Yes. Yes, sir.
    Mr. Gianforte. And it works on a web browser?
    Mr. James. Yes, sir.
    Mr. Gianforte. So a veteran can access it from anywhere?
    Mr. James. Yes, sir.
    Mr. Gianforte. And is that deployed in Montana?
    Mr. James. I believe it is. I'd have to confirm ----
    Mr. Blackburn. It's currently deployed in 110 of our sites. 
We'll have to check and make sure Fort Harris ----
    Mr. Gianforte. I am more interested--I ask more from the 
perspective of a rural State ----
    Mr. Blackburn. Yes.
    Mr. Gianforte.--that has a lot of veterans. So I would just 
encourage you to do that. And just in our conversation, to 
summarize, I think--and you have mentioned these things. I 
would just encourage you, minimize customization.
    Mr. Blackburn. Yes.
    Mr. Gianforte. Change business practices to standardize 
them so you are not doing the customization. Get to the cloud. 
That is where the puck is going to be.
    Mr. Blackburn. Yes.
    Mr. Gianforte. We need to skate there. And then I would 
highly encourage you to look at best-of-breed commercial off-
the-shelf apps as gap-fillers between now and utopia that is 
going to show up in 10 years from now.
    Mr. Blackburn. Absolutely. I appreciate that feedback.
    Mr. Gianforte. And, Mr. Chairman, I yield back.
    Mr. Hurd. Reclaiming my time. Mr. Powner, there is a lot of 
conversations going on, a lot of topics hit. Do you have any 
opinion on the comments so far?
    Mr. Powner. Yes. I think clearly the word minimize is--
that's a scary word, okay, because we've heard minimize 
customization with a lot of commercial products in the Federal 
Government, and that's--minimize means a range of activities. I 
think you want to really try to almost eliminate customization. 
You're going to change your business processes anyway 
significantly, so go full bore and eliminate.
    Mr. Hurd. Thank you, Mr. Powner.
    Now, it is a pleasure to recognize my friend from the 
Commonwealth of Virginia, Mr. Connolly, for your round of 
questions.
    Mr. Connolly. I thank my friend from Texas, Mr. Chairman. 
Thank you.
    And welcome. And Mr. Blackburn was also--you made the 
rounds, and good for you.
    Mr. Blackburn. Thank you.
    Mr. Connolly. Mr. Powner, let's begin by--can you summarize 
what kind of performance did we see in the FITARA scorecard for 
VA this time?
    Mr. Powner. Well, on the FITARA scorecard overall B-plus. 
They've consistently scored well on incremental development to 
their credit. Software licensing, they were one of seven 
agencies to have that inventory and do something with it, so 
those areas are very strong. The one area that everyone 
acknowledges that they have a lot of work to do is on data 
center optimization. They fall far short of OMB's goals on 
closures, savings, and also with the optimization metrics.
    Mr. Connolly. And, by the way, just putting that in 
context, if I am correct, GAO reported that, as of August 2017, 
we have identified a total of 12,062 data centers. That is 
2,000 more than a year ago.
    Mr. Powner. Yes, we've been back and forth on the total 
number here. A lot of that's attributed to Treasury where 
you've ----
    Mr. Connolly. Those people ----
    Mr. Powner. They had a number in the inventory, off the 
inventory. They're back in the inventory, so now we are up to 
about 12,000. The good news government-wide is we've closed 
almost half of those, close to 6,000, so that's the good news.
    Mr. Connolly. Right. Okay. And let me see. And, Mr. 
Blackburn, if I understand your inventory, you have got 415 
data centers, correct?
    Mr. Blackburn. Roughly. I think we started with 386, but 
it's an awful lot, way too many.
    Mr. Connolly. And you have closed only 39 as of August?
    Mr. Blackburn. I had 24 but the--roughly correct.
    Mr. Connolly. Mr. Powner, do you want to comment on that?
    Mr. Powner. My numbers are close to about 40 of the 415 --
--
    Mr. Connolly. Right.
    Mr. Powner.--as of August.
    Mr. Connolly. I mean, I am kind of following his numbers, 
but ----
    Mr. Powner. Sure.
    Mr. Connolly.--if your performance is even less stellar --
--
    Mr. Powner. I have even less closures.
    Mr. Connolly. All right. Now, in our conversation you set a 
metric for yourself, and do you want to share that with us? So 
let's call the number somewhere around 400 data centers.
    Mr. Blackburn. Yes.
    Mr. Connolly. What do you want to get it down to and in 
what time frame?
    Mr. Blackburn. We would like to get down to 14 core data 
centers by the end of 2020. In addition to that, we would have 
42 special-purpose data centers. These are things like for our 
mail-order pharmacy and things of that nature, but even that to 
me feels it might be a little high, so I would like to go and 
kind of scrub those with my team. But that would be our goal by 
the end of 2020.
    Mr. Connolly. That is a pretty strong stretch goal to go 
from 400-plus to 20. Mr. Powner, realistic goal?
    Mr. Powner. I believe--here's what's--that makes it 
realistic. When you look at the 130 instances of VistA and a 
lot of the data centers are co-located at these facilities, I 
think the data center consolidation really needs to go hand-in-
hand with this migration to the commercial Cerner product. 
That's where there's a real opportunity to save a lot of money 
in the data center area. We're spending a lot of money, but we 
can get a huge return from a data center point of view.
    Mr. Connolly. What is the estimated savings if Mr. 
Blackburn achieves this goal in three years for the data center 
consolidation? Any estimate?
    Mr. Powner. I don't have a good estimate on that.
    Mr. Connolly. Are you operating on any kind of assumption 
it will save us X?
    Mr. Blackburn. I haven't been able to get an estimate yet. 
I think that's one of the reasons why we have such a low grade 
on FITARA.
    Mr. Connolly. Yes, I think that is really important both 
for ----
    Mr. Blackburn. Yes.
    Mr. Connolly.--incentivization and maybe more important now 
that MGT, the bill we have been working on collectively here, 
hopefully will be law soon.
    Mr. Blackburn. By Tuesday.
    Mr. Connolly. By Tuesday. And that obviously allows you to 
be reinvesting in yourself with the savings effectuated 
pursuant to FITARA. So we--among other things, but I mean I 
would hope that is an incentive for people.
    Mr. Blackburn. Absolutely. We're very excited about that, 
and I think the more positive incentives like MGT that can put 
in place where we can reinvest those savings, we're extremely 
excited, and that will really help us.
    Mr. Connolly. Mr. James, I see you affirming that. You are 
welcome to comment.
    Mr. James. Yes, Congressman. I'm from your district so I 
can dig Scott out of ----
    Mr. Connolly. Excuse me.
    Mr. James.--his Maryland hole.
    Mr. Connolly. This man is only deputy assistant. He needs a 
promotion.
    Mr. James. Congressman, the reason I share the excitement 
in that act is that our Secretary has challenged us to go 
find--ask industry for some innovative ideas, share-in-savings 
types of ideas where we put in some seed money, they find 
savings, and then we share the benefits. We win, they win. And 
the seed money could come from that particular act, and so 
we're--we have a runway in front of us that, with that act, I 
think we can make some headway.
    Mr. Connolly. And you have raised the Secretary, and that 
is good to hear, too. Can you talk a little bit, both you and 
Mr. Blackburn, anyone else who wants to as well, but one of the 
things Mr. Hurd, Ms. Kelly, and Mr. Meadows and I are concerned 
about frankly is the organization chart. Who reports to whom? 
How high up in the hierarchy is the CIO? Because we feel that 
if you don't have the ear of the boss, it is all fascinating 
but no guarantee anyone is going to pay the kind of qualitative 
attention we demand, we want. We think that the CIO has just 
got to be an empowered person and everyone needs to know it. So 
comment a little bit about what is the relationship with the 
Secretary?
    Mr. Blackburn. Yes.
    Mr. Connolly. Let's stipulate the Secretary is wonderful 
and walks on water. We will stipulate that, but what is the 
working relationship and what does it look like on the 
organization chart so the somebody like us, it would leap out 
right away or it wouldn't?
    Mr. Blackburn. So on the organizational chart the CIO 
reports directly to the Deputy Secretary at the VA. The ----
    Mr. Connolly. Which is Mr. James?
    Mr. Blackburn. Which is Mr. Tom Bowman is the Deputy 
Secretary.
    Mr. Connolly. Okay.
    Mr. Blackburn. The ----
    Mr. Connolly. Oh, I'm sorry, you said Deputy Secretary.
    Mr. Blackburn. Yes.
    Mr. Connolly. Right.
    Mr. Blackburn. Yes. Yes. So CIO reports to--I report to Tom 
Bowman. The--Secretary Shulkin is incredibly hands-on involved. 
He and I have a great relationship. I was the interim deputy 
secretary until Mr. Bowman came on board. He has been very, 
very hands-on and active. He is the one that personally made 
the decision to go to the commercial off-the-shelf solution 
with Cerner. He is very comfortable with technology and a big 
proponent of what we're doing.
    Mr. Connolly. Sure. And you concur, Mr. James?
    Mr. James. Yes. Yes, Congressman.
    Mr. Connolly. All right. Anyone else want to comment?
    So, Mr. Powner, we are going to be back here in a year or 
so hopefully with a different grade that is an improved grade 
because of data center consolidation. Do you agree?
    Mr. Powner. Let's hope so.
    Mr. Connolly. All righty. Thank you all so much for being 
here. I do hope--I want to underscore Mr. Hurd, my presence 
here, and Ms. Kelly and Mr. Meadows--who couldn't join us 
today--I don't mean to leave you out. I am just talking about 
the ranking member and the chair. We are committed on a 
bipartisan basis to make this happen, so we have got your back, 
but we will also--we are more than willing to create pressure 
and stress where it is needed to improve performance because we 
are very serious about FITARA and the other related bills. So 
thank you for being here and thanks for your commitment, which 
I think is robust, and I like that in government, so thank you.
    Mr. Blackburn. Thank you, sir.
    Mr. Hurd. I now recognize myself again for five minutes of 
questions. And to follow up on what my friend from Virginia was 
talking about, about the question on coordinating data centers 
with the Cerner rollout, and everybody was shaking their head 
as if this is a good idea. And my question is are we 
coordinating the closure of data centers with the Cerner 
rollout? Mr. Blackburn, maybe that goes to you.
    Mr. Blackburn. We are, and I'll yield to Mr. Windom to talk 
about the Cerner rollout.
    Mr. Windom. Yes, sir. Mr. Chairman, the Cerner solution has 
a platform called Healthy Intent. That's its primary data 
management hosting element that we intend to move our data into 
obviously in a controlled and properly risk-mitigated fashion 
such that we don't compromise that care being delivered. We are 
going to make sure that we--that data is where we want it to be 
and usable before we shut anything down. That's why I believe 
that our data consolidation plan is feasible because we are 
moving that data very similar to the DOD solution into the 
Healthy Intent platform that gives us again that seamless 
movement of data across DOD and VA environments.
    Mr. Hurd. So how long will VistA and the new electronic 
health records system coexist?
    Mr. Windom. Sir, let me--so you have a relative--the DOD--
when we awarded the DOD contract, it's a seven-year rollout for 
about a third of the size of the VA population, 1,600 
facilities on VA side, about 600-plus including ships and 
expeditionary platforms on the DOD side. In addition, we have 
318,000 users relative to about 112,000 users on the DOD side. 
So the answer to your question is is that the plan is going to 
be to roll this out, VistA has to run simultaneously with the 
new solution. That's part of the acquisition curve and that we 
have to keep that solution delivering today.
    Mr. Hurd. Mr. Windom ----
    Mr. Windom. Yes, sir.
    Mr. Hurd.--I understand, and your job is hard.
    Mr. Windom. Yes, sir.
    Mr. Hurd. Nobody questions that. Nobody questions that. But 
the difficulty you are going to have is what I would call the 
incompetence of previous activity, right? And so you are the 
new man, and you have the right credentials to do this, but 
this is the frustration when you see this has been going on for 
a long time because we are solving the problem. So the first--
if the veteran leaves DOD in, let's say, 2019 and they 
transition to the VA, he or she will be moving to the VistA 
system, is that correct?
    Mr. Windom. Potentially. And I say that because one of the 
reasons for our deployment schedule is we're--we intended to 
align as much as possible to the deployment schedule of DOD --
--
    Mr. Hurd. Yes.
    Mr. Windom.--because we want to demonstrate 
interoperability to you immediately.
    Mr. Hurd. So ----
    Mr. Windom. So it depends would be the answer.
    Mr. Hurd. And let's get to interoperability. We are going 
to be here for a while. The JLV is not interoperability. Has 
anybody at this panel set with doctors in a facility and had 
them walk you through the JLV? Mr. Windom?
    Mr. Windom. Yes, sir. I was DOD when we only were moving 50 
records.
    Mr. Hurd. Yes.
    Mr. Windom. Now, we're moving tens of thousands if not 
hundreds of thousands ----
    Mr. Hurd. So ----
    Mr. Windom.--so yes, sir, the answer is yes, sir.
    Mr. Hurd. So you understand the problem. And so we talk 
about JLV like we have already achieved interoperability. We 
haven't. It is the equivalent of using microfiche, and so the 
fact that, yes, it is the right decision to go to one system, 
but that one--so the people that are going to benefit are 
potentially--we are seven years away from that. And yes, 
Healthy Intent is the data platform that you're going to be 
using on Cerner, but what VA and DOD have not proven they can 
do is to integrate that data in one view.
    And so my concern is this is still a problem of data 
interoperability because we have to take all the data that has 
been gathered from VistA and make sure it is viewable through 
Cerner. And there is nothing to date that makes me feel 
comfortable that we know we can do that. And we are sitting 
here saying, yes, it is a big--the largest software sale ever 
in the history of the planet, right? Like I get how big of a 
deal it is, but, number one, why the hell are there 130 
versions of VistA? Now, Mr. Windom, I know that is not your 
problem. That is not your problem. But, Mr. Blackburn, can you 
give me some--like how has that been allowed to continue? I 
don't even know what that means. How would you have 130 
versions of the same program operating in one organization?
    Mr. Blackburn. So my understanding of that--and VistA 
started around the time I was born, so this decision dates back 
to me being a toddler--was--the idea at the time was local 
innovation. VistA was built by doctors, for doctors. Still to 
this day it actually rates as a--doctors rate it as the most 
user-friendly electronic health record.
    Mr. Hurd. It was groundbreaking ----
    Mr. Blackburn. Yes.
    Mr. Hurd.--when it started.
    Mr. Blackburn. Yes.
    Mr. Hurd. Yes. I would agree with that.
    Mr. Blackburn. And they ----
    Mr. Hurd. But 130 versions later is pretty crummy.
    Mr. Blackburn. You're exactly correct, and that means, you 
know, if I go--if I'm getting seen in--right now in Washington, 
they can't--it's difficult if I go to another instance for that 
data to flow seamlessly.
    Mr. Hurd. So what processes were in place or not in place 
that allowed that behavior to continue? Because if we don't 
first identify why that behavior was allowed to happen, we are 
not going to be able to prevent it in the future.
    Mr. Blackburn. The philosophy at the time was we're going 
to push the power of how to run the hospital to the electronic 
health record and their workflow to the local hospitals.
    Mr. Hurd. Sure.
    Mr. Blackburn. So there's the joke if you've seen one VA, 
you've seen one VA. They run completely differently, and then 
they map their health record to how they were run. What we 
are--what we are going to do is standardize workflows and not 
allow that to happen. And matter of fact, DOD and VA will have 
the exact same workflows.
    Mr. Hurd. Now, it is pretty clear from the limited time we 
have in with Mr. Windom that he is high speed, low drag, and my 
question, Mr. Windom, when will we be able to demonstrate for 
one record that we can get the data from a VistA EHR and view 
it through a Cerner application? When will we be able to 
demonstrate the ability to do that for one?
    Mr. Windom. Sir, the timeline for what we call initial 
operating capability, which we anticipate for Pacific Northwest 
is less than 18 months. So we expect to be able to demonstrate 
interoperability. Obviously, we will be doing it in a 
laboratory environment where will be able to demonstrate a 
record, but we want to show you in a real-time environment. And 
so prior to full deployment, we will have achieved IOC at these 
various sites, sir.
    Mr. Hurd. The last time we had this conversation with your 
predecessors, my question was, at its core, this is not a hard 
challenge. You map one data element to another data element. L 
name maps to last name, full name maps to F name. Have we done 
that mapping?
    Mr. Windom. Sir, that alignment--we've got a comprehensive 
data management strategy. You know, your points are right on 
point if you will in that we are not going to put JLV data into 
the Healthy Intent platform. That data is being reconciled such 
that we have transactional capability to move data ----
    Mr. Hurd. Sure.
    Mr. Windom.--to process data between DOD and VA, so it's 
not just--we know--JLV was a--was an interim fix. JLV access 
will exist as we transition because we don't want to destroy 
that existing continuity of data. But the Healthy Intent, it's 
just not going to be load JLV into Healthy Intent. It's going 
to have manipulatable data, transactional data that supports 
the movement of information across the DOD and the VA 
enterprise, sir.
    Mr. Hurd. So is the data architecture of VistA version 1 
different from VistA version 130? So are you working with 130 
different data sets?
    Mr. Windom. Yes, sir. That would be accurate.
    Mr. Hurd. That is crazy.
    I would like to now recognize Mr. Connolly.
    Mr. Connolly. Thank you, Mr. Chairman. Just to humanize 
what you are talking about, Mr. Chairman, Mr. Blackburn, I 
think you shared with me your own personal experience in terms 
of health records. Could you remind me, so you come from 
Massachusetts, God's country, right ----
    Mr. Blackburn. Right.
    Mr. Connolly.--except for Virginia.
    Mr. Blackburn. Yes.
    Mr. Connolly. And your files were in ----
    Mr. Blackburn. Partners Health Care, so Mass General 
Hospital ----
    Mr. Connolly. Right. Okay.
    Mr. Blackburn.--Beth Israel.
    Mr. Connolly. And you need to have someone here look at 
them, right?
    Mr. Blackburn. Yes, so I--and I lived in Cleveland for 10 
years, so I have medical information in the Cleveland Clinic. 
Obviously, I was a soldier in the Army. I get my care at the 
VA. I get some of my care at NovaCare. The--last summer, I 
broke my arm and got rushed to the hospital at a Johns Hopkins 
Hospital, so all my data, my healthcare data is spread out over 
all these different healthcare systems that do not necessarily 
talk to each other.
    Mr. Connolly. So how did that affect in any material way 
the quality of care you were given?
    Mr. Blackburn. Oh, it affects it drastically. The--you 
know, when I came here and enrolled in the Washington VAMC, I 
actually brought a large paper file from the Cleveland Clinic 
that I printed out to my doctor, and he was very appreciative 
of that. The--it's very difficult for them to tell me--to be 
able to see things like x-rays from when I broke my arm, what 
shots I've had. You have to fill out paperwork over and over 
again.
    Mr. Connolly. Which an electronic record-keeping system 
ought to obviate?
    Mr. Blackburn. As long as they talk to each other.
    Mr. Connolly. But they have got to be compatible, which it 
goes to interoperability, right, Mr. Windom?
    Mr. Windom. Yes, sir.
    Mr. Connolly. Well, as we heard, it is not just a nice 
thing to do, and it is not even just that it saves money. It 
also affects quality of care of the veterans we serve ----
    Mr. Blackburn. Yes.
    Mr. Connolly.--so there is a real imperative here. I thank 
you. Thank you, Mr. Chairman.
    Mr. Hurd. The distinguished gentleman from Montana is 
recognized.
    Mr. Gianforte. Thank you, Mr. Chairman.
    Mr. Blackburn, you had said that scheduling is a particular 
area of focus ----
    Mr. Blackburn. Yes.
    Mr. Gianforte.--for you, so a very simple question. Does 
the VA currently have a commercial off-the-shelf scheduling 
pilot in production?
    Mr. Blackburn. We have two. So we have one as mandated by 
the Faster Care for Veterans Act. We actually--it's in test 
mode right now. I believe it just went live just a few days ago 
in three VA hospitals: Minneapolis; Salt Lake City; and 
Bedford, Massachusetts. We also have a pilot going on in 
Columbus, Ohio, with a solution called MASS, which is an Epic-
based, resource-based scheduling system.
    Mr. Gianforte. Okay. So Epic is really a competitor with 
Cerner?
    Mr. Blackburn. They are.
    Mr. Gianforte. Yes, so you are deploying Epic as well as 
Cerner?
    Mr. Blackburn. The Epic is in pilot mode in Columbus. We--
that was actually--that was put in place before the Secretary 
made the Cerner decision.
    Mr. Gianforte. Okay. So that will be phased out and 
converted to Cerner?
    Mr. Blackburn. Depending on how the pilot--we haven't made 
that final decision yet, but we will be making that in the 
spring.
    Mr. Gianforte. Okay. So we have VistA that is 30 years old. 
We are rolling out a $10 billion Cerner project. We are also 
rolling out a competitor in the Epic system. I thought I was 
going to ask about scheduling, but this gives me more concern. 
Why wouldn't you just shut that project down now that you have 
made the decision to go with Cerner?
    Mr. Blackburn. That was one of the options.
    Mr. Gianforte. Is this ----
    Mr. Blackburn. We just haven't made the final decision.
    Mr. Gianforte. Is this taxpayer dollars being well spent on 
a project that is going to get--I, honestly--frankly, I just 
don't understand that decision.
    On the scheduling, you say you have just been live a short 
period of time. Do you have any initial analysis of the 
functionality of this OPSS system that is piloted versus the 
lipstick that was put on the pig on VistA?
    Mr. Blackburn. Mr. James?
    Mr. James. Yes, Congressman. The Faster Care for Veterans 
Act specifies seven capabilities that must be provided by the 
OPSS system, and today, our PM tells me that the OPSS system 
meets those seven requirements. The other part of the Faster 
Care for Veterans Act requires a Mitre in the IVNV mode to 
assess other similar types of scheduling, homebrewed systems if 
you will into VA, and that one is far. And that also has those 
seven capabilities.
    Mr. Gianforte. Okay. So you're just getting started with 
that pilot. What is your first review period of the pilot? Is 
it in 90 days or so?
    Mr. James. Sir, the Secretary must certify according to the 
law that it provides those seven capabilities by December 31 at 
those three sites, and we believe that it is operating today, 
but that's just today. We have some time. Then, subsequent to 
that certification, we have to have an independent validation 
verification of those seven capabilities. That's also in the 
law by an FFRDC. In this case, that's Mitre. So that'll happen 
after the Secretary certifies on--by December 31.
    Mr. Gianforte. Okay. Well, Mr. Chairman, I would just 
suggest that maybe we ask for some feedback on this pilot. We 
have been advocating--earlier, I advocated for commercial off-
the-shelf scheduling applications. This OPSS didn't come up in 
that earlier discussion. It sounds like we are live in a number 
of cities. We ought to know in 90 days if it is working or not 
and is it better than the lipstick we are putting on VistA that 
is costing us so much money. So I thank you for sharing that 
additional information. I yield back.
    Mr. Hurd. I recognize myself for five minutes.
    Mr. James, MGT, what do you need to do in order to ensure 
that you have a working capital fund, an MGT working capital 
fund to take advantage of the savings that Mr. Blackburn and 
Mr. Windom are going to realize through their efforts?
    Mr. James. Thank you. Thank you, Mr. Chairman. I'm not the 
finance guy in OINT. I believe we do have today some working 
capital fund mechanisms in place that we already use. My 
expectation is that MGT would either complement those or 
augment those or be part of those. I can come back with 
additional information.
    Mr. Hurd. Who would be the person that would set that up so 
Mr. Blackburn has his MGT working capital fund?
    Mr. James. Chairman, they're--inside our CIO organization 
we have a finance organization that's dedicated to managing our 
appropriation every year, so that is our--internally, we call 
that ITRM. That's our CFO if you will for our CIO organization. 
He would have that responsibility.
    Mr. Hurd. Well, will you please deliver a message to him 
that this committee is interested in ensuring that Mr. 
Blackburn has a--or Mr. Blackburn's replacement has a working 
capital fund from MGT because there is going to be a whole lot 
of modernization going on in the VA. There is going to be 
savings that are being realized, and because it is such a 
massive enterprise, that will be able to help Mr. Windom 
hopefully beat that 10-year clock ----
    Mr. James. Sure.
    Mr. Hurd.--of getting this implemented.
    Mr. Cussatt, we haven't even gotten to you because there 
are so many questions about the actual deployment. How are you 
ensuring when this deployment is being done, that all the 
appropriate cybersecurity tools and functions are activated and 
live to ultimately protect the health data of our veterans?
    Mr. Cussatt. Thank you, Chairman. So it's--I see it as my 
job as the CISO for the VA to ensure that cybersecurity is not 
a barrier to interoperability and information-sharing but 
instead it's an enabler of it.
    So I came from DOD. I was there for 12 years in the CIO's 
office, and we rewrote all the DOD policy to better employ the 
NIST standards. And in the year-and-a-half I've been at VA, 
we've done the same at VA. So we are ----
    Mr. Hurd. So, Mr. Cussatt, are we going to have a written 
policy on application security for the Cerner implementation?
    Mr. Cussatt. I believe the Cerner application will benefit 
from the policy we have writ large for VA that applies to all 
the systems. We're trying not to build a one--a single instant 
solution for it. We want to build something that's going to 
benefit us across the Department and be interoperable with DOD.
    Mr. Hurd. So, gentlemen, there are so many questions here. 
Mr. Powner, before I close, do you have any further insights on 
the rest of the conversations that have been going on today?
    Mr. Powner. Just a comment about the scheduling situation. 
I mean, you have VSE, we have pilots going on, we clearly have 
a module with Cerner. What needs to occur in the scheduling 
area is direction forward. What's the plan? There needs to be a 
clear plan because right now, it's duplicative. There's no 
other way--it's duplicative. And it's okay to pilot and do 
things and test all this, but we ultimately need a plan going 
forward that's a solid plan with the right solution.
    Mr. Hurd. Good copy, Mr. Powner. One of the things that I 
feel good about is that I love that many of the folks 
intimately involved in this are veterans. You understand the 
type of sacrifices your compatriots have made. You understand 
the interest that this service is to many of our veterans.
    But I would say you all are actually doing something that 
can be life-altering for a lot of folks. A $10 billion project 
to integrate 130 different data sets and achieving true 
interoperability, this will be the model. If we are able to 
integrate DOD in VA, the two largest healthcare providers in 
the world, then we are going to be able to integrate to every 
other system.
    And so the VA is going to be back in setting the curve and 
being on the cutting edge because you all have achieved the 
ability to do a true longitudinal record so everybody is going 
to be able to have better health outcomes because every doctor 
they go to, they are going to be able to see every other time 
they went to the doctor. We are going to be able to do 
virtualized research cohorts based on this information because 
it is in the cloud and we are going to be able to access it. 
Mr. Cussatt is going to make sure it is protected and 
anonymized, and then we are going to be able to bring drugs, 
lifesaving drugs to market faster. And so this is the 
opportunity that we have here, and if we can't do it in 10 
years with $10 billion, then it is never going to get done.
    And so I think you all recognize and understand this issue. 
This committee is going to continue to provide oversight and 
continue to get into the weeds. It is great having the talent 
of folks like my friend from Montana and the gentleman from the 
Commonwealth of Virginia. We are not going to stop.
    So thank you all for being here. Mr. Powner, it is always 
great having you here. This is an important issue, and I know 
many of my friends around the country are hoping you all 
succeed. And we are going to continue to make sure we are doing 
our part to make sure you have the tools to be successful. So I 
thank you all for appearing before us today.
    The hearing record will remain open for two weeks for any 
member to submit a written opening statement or questions for 
the record. And if there is no further business, without 
objection, the subcommittee stands adjourned.
    [Whereupon, at 3:50 p.m., the subcommittee was adjourned.]


                                APPENDIX

                              ----------                              


               Material Submitted for the Hearing Record

[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]

                                 [all]