Year 2000 Computing Challenge: Update on the Readiness of the Department
of Veterans Affairs (Testimony, 10/28/1999, GAO/T-AIMD-00-39).
Pursuant to a congressional request, GAO discussed the Department of
Veterans Affairs' (VA) efforts to address the year 2000 computer
problem, focusing on the: (1) year 2000 readiness of automated systems
that support the delivery of veterans' benefits and health care
services, the compliance status of biomedical equipment used in patient
care, and the year 2000 readiness of the pharmaceutical and
medical-surgical manufacturers on which VA relies; and (2) Food and Drug
Administration's (FDA) year 2000 efforts to address biomedical equipment
and pharmaceutical products.
GAO noted that: (1) VA continues to make progress in addressing the year
2000 problem; (2) it has established a moratorium on software changes
and has developed a Day One plan to minimize risks associated with the
rollover period; (3) however, some critical tasks remain to be
completed; (4) for example, only about 10 percent of the Veterans
Benefits Administration's 58 regional offices have tested their business
continuity and contingency plans; (5) inaccuracies in monthly reports
submitted by the Veterans Health Administration's (VHA) medical
facilities make it difficult to determine their progress in renovating
facility systems, telecommunications systems, commercial-off-the-shelf
software, computer platforms, and medical devices; (6) further, VHA has
not implemented GAO's prior recommendation to review the test results
for biomedical equipment used in critical care/life support
environments; (7) it is crucial that VA address these issues if the
department is to continue to reliably deliver benefits and other health
care services through the turn of the century; (8) FDA, for its part,
had made progress in making compliance information on biomedical
equipment available to users through its Federal Year 2000 Biomedical
Equipment Clearinghouse; (9) it is also conducting surveys to determine
the year 2000 readiness of pharmaceutical, biological, and consumable
medical products manufacturers; (10) FDA has also recently addressed
GAO's concern about the lack of independent verification and validation
of critical care/life support biomedical equipment certified compliant
by manufacturers; (11) specifically, it has reviewed a sample of these
manufacturers' year 2000 activities, including risk management, test
planning and procedures, implementation, and contingency planning; and
(12) in the limited time remaining, FDA still needs to issue its final
report to the Department of Health and Human Services summarizing the
results of its review of manufacturers' year 2000 activities and make
these results available to the public.
--------------------------- Indexing Terms -----------------------------
REPORTNUM: T-AIMD-00-39
TITLE: Year 2000 Computing Challenge: Update on the Readiness of
the Department of Veterans Affairs
DATE: 10/28/1999
SUBJECT: Y2K
Computer software verification and validation
Computer software
Systems conversions
Pharmaceutical industry
Veterans benefits
Medical equipment
Strategic information systems planning
Clearinghouses (information)
IDENTIFIER: FDA/VHA Federal Year 2000 Biomedical Equipment
Clearinghouse
VBA Beneficiary Identification and Record Locator
Subsystem
Y2K
******************************************************************
** This file contains an ASCII representation of the text of a **
** GAO report. Delineations within the text indicating chapter **
** titles, headings, and bullets are preserved. Major **
** divisions and subdivisions of the text, such as Chapters, **
** Sections, and Appendixes, are identified by double and **
** single lines. The numbers on the right end of these lines **
** indicate the position of each of the subsections in the **
** document outline. These numbers do NOT correspond with the **
** page numbers of the printed product. **
** **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced. Tables are included, but **
** may not resemble those in the printed version. **
** **
** Please see the PDF (Portable Document Format) file, when **
** available, for a complete electronic file of the printed **
** document's contents. **
** **
** A printed copy of this report may be obtained from the GAO **
** Document Distribution Center. For further details, please **
** send an e-mail message to: **
** **
** **
** **
** with the message 'info' in the body. **
******************************************************************
Before the Subcommittee on Oversight and Investigations, Committee on
Veterans' Affairs, House of Representatives
For Release on Delivery
Expected at
10 a.m.
Thursday,
October 28, 1999
YEAR 2000 COMPUTING CHALLENGE
Update on the Readiness of the Department of Veterans Affairs
Statement of Joel C. Willemssen
Director, Civil Agencies Information Systems
Accounting and Information Management Division
*****************
*****************
GAO/T-AIMD-00-39
See Year 2000 Computing Crisis: Actions Needed to Ensure Continued
Delivery of Veterans Benefits and Health Care Services (GAO/AIMD-99-190R,
June 11, 1999), Year 2000 Computing Crisis: Action Needed to Ensure
Continued Delivery of Veterans Benefits and Health Care Services (GAO/T-
AIMD-99-136, April 15, 1999), Year 2000 Computing Crisis: Compliance
Status of Many Biomedical Equipment Items Still Unknown
Forward-date testing verifies that the system is able to process using
future dates in
Year 2000 Computing Crisis: Business Continuity and Contingency Planning
Y2K Computing Challenge: Day One Planning and Operations Guide
Mr. Chairman and Members of the Subcommittee:
Thank you for inviting us to participate in today's hearing on the
Department of Veterans Affairs' (VA) efforts to address the Year 2000
(Y2K) computer problem./Footnote1/ My testimony today will focus on the
Y2K readiness of automated systems that support the delivery of veterans'
benefits and health care services, the compliance status of biomedical
equipment used in patient care, and the Y2K readiness of the
pharmaceutical and
medical-surgical manufacturers on which VA relies. I will also share with
you information on the Food and Drug Administration's (FDA) Y2K efforts to
address biomedical equipment and pharmaceutical products./Footnote2/
In brief, VA continues to make progress in addressing the Y2K problem. It
has established a moratorium on software changes and has developed a Day
One plan to minimize risks associated with the rollover period. However,
some critical tasks remain to be completed. For example, only about 10
percent of the Veterans Benefits Administration's (VBA)
58 regional offices have tested their business continuity and contingency
plans. And inaccuracies in monthly reports submitted by the Veterans
Health Administration's (VHA) medical facilities make it difficult to
determine their progress in renovating facility systems,
telecommunications systems, commercial-off-the-shelf (COTS) software,
computer platforms, and medical devices. Further, VHA has not implemented
our prior recommendation to review the test results for biomedical
equipment used in critical care/life support environments. It is crucial
that VA address these issues if the department is to continue to reliably
deliver benefits and other health care services through the turn of the
century.
FDA, for its part, has made progress in making compliance information on
biomedical equipment available to users through its Federal Y2K Biomedical
Equipment Clearinghouse. It is also conducting surveys to determine the
Y2K readiness of pharmaceutical, biological, and consumable
medical/Footnote3/ products manufacturers. FDA has also recently addressed
our concern about the lack of independent verification and validation of
critical care/life support biomedical equipment certified compliant by
manufacturers. Specifically, it has reviewed a sample of these
manufacturers' Y2K activities, including risk management, test planning
and procedures, implementation, and contingency planning. In the limited
time remaining, FDA still needs to issue its final report to the
Department of Health and Human Services (HHS) summarizing the results of
its review of manufacturers' Y2K activities and make these results
available to the public.
VA Is Making Progress on Systems But Critical Tasks Remain
Like many organizations, VA faces the possibility of computer systems
failures at the turn of the century due to incorrect information
processing relating to dates. This could make veterans who are eligible
for benefits and medical care appear ineligible. If this happens, the
issuance of benefits and the provision of medical care that veterans rely
on could be delayed or interrupted.
At your request, Mr. Chairman, we have been monitoring and evaluating VA's
actions to address the Y2K problem since 1996./Footnote4/ We have also
made many recommendations to reduce the risk associated with Y2K failures,
and VA has been responsive to these recommendations. For example, VBA
changed its strategy from relying on new Y2K-compliant systems to fixing
the current systems in order to address the risk that the new systems
would not be completed in time. In 1998, VBA also reassessed its mission-
critical efforts for the compensation and pension on-line application and
the Beneficiary Identification and Record Locator Sub-System, as well as
other technology initiatives to help ensure that these critical
undertakings were completed in time. Simultaneously, VHA issued its
Patient-Focused Year 2000 Contingency Planning Guidebook to its medical
facilities, describing actions they could take to minimize Y2K-related
disruptions to patient care. More recently, both VBA and VHA developed
business continuity and contingency plans that address mission-critical
systems, core business processes, regional offices, and medical facilities.
In addition, VA has reported to the Office of Management and Budget (OMB)
that it completed renovating and implementing the mission-critical
applications supporting its 11 systems areas as of March 31, 1999. As
shown in table 1, VBA has six of these areas, and VHA has two.
Table****Helvetica:x11****1: Reported Status of VA's Mission-Critical
Computer Systems Areas and Their
Applications
------------------------------------------------------------------------
| : Systems area : Number of |
| : : applications |
| : : renovated or replaced |
| : : |
| Component/office : : |
| (number of systems) : : |
|----------------------------------------------------------------------|
| Veterans Benefits : Compensation and : 30 |
| Administration (6) : Pension : |
|----------------------------------------------------------------------|
| : Education : 24 |
|----------------------------------------------------------------------|
| : Insurance : 3 |
|----------------------------------------------------------------------|
| : Loan Guaranty : 19 |
|----------------------------------------------------------------------|
| : Vocational : 4 |
| : Rehabilitation : |
|----------------------------------------------------------------------|
| : Administrative : 27 |
|----------------------------------------------------------------------|
| : Total : 107 |
|----------------------------------------------------------------------|
| Veterans Health : Veterans Health : 105 |
| Administration (2) : Information Systems : |
| : and Technology : |
| : Architecture : |
|----------------------------------------------------------------------|
| : Veterans Health : 95 |
| : Administration : |
| : Corporate Systems : |
|----------------------------------------------------------------------|
| : Total : 200 |
|----------------------------------------------------------------------|
| National Cemetery : Burial Operations : 1 |
| Administration (1) : Support : |
| : System/Automated : |
| : Monument Application : |
| : System : |
|----------------------------------------------------------------------|
| : Reengineer : 1 |
|----------------------------------------------------------------------|
| : Total : 2 |
|----------------------------------------------------------------------|
| Office of : Personnel and : 8 |
| Financial : Accounting : |
| Management (2) : Integrated Data : |
|----------------------------------------------------------------------|
| : Financial Management : 1 |
| : System : |
|----------------------------------------------------------------------|
| : Total : 9 |
|----------------------------------------------------------------------|
| VA total : : 318a |
------------------------------------------------------------------------
aOf this total, 316 applications were renovated and two were replaced.
Source: VA. We have not independently verified this information.
Although VA has made progress, when we testified/Footnote5/ this past
April, the department still had numerous Y2K issues to address.
Specifically, (1) VBA and VHA had not completed testing of their mission-
critical systems to ensure that they could reliably accept future dates,
(2) VHA had not completed assessments of its facility systems,/Footnote6/
(3) VHA's pharmaceutical operations were at risk because the automated
systems supporting its consolidated mail outpatient pharmacies (CMOP) were
not Y2K compliant, (4) VHA had not defined the CMOP systems as mission-
critical in its quarterly report to OMB, and (5) VHA did not know whether
its medical facilities would have a sufficient supply of pharmaceutical
and medical/surgical supplies on hand because it did not have complete
information on the Y2K readiness of these manufacturers. To address these
issues, we made the following recommendations to the Secretary of Veterans
Affairs:/Footnote7/
o complete Y2K testing of VBA and VHA mission-critical systems--including
systems acceptance testing,/Footnote8/ full forward-date
testing,/Footnote9/
end-to-end testing, and business process simulation testing on
compliant platforms;
o set deadlines to complete assessment, renovation, validation, and
implementation of VHA's facility systems;
o develop business continuity and contingency plans for VHA CMOPs to
ensure an uninterrupted supply of medications to veterans in the event
of Y2K problems at these facilities;
o reassess VA's decision not to report CMOP systems as mission-critical;
and
o seek the assistance of FDA and industry trade associations in obtaining
information on the Y2K readiness of specific pharmaceutical and
medical/surgical suppliers/Footnote10/ that did not respond to VHA's
survey, and publicize the results in a single data clearinghouse.
VA Has Been Responsive to Recommendations
-----------------------------------------
VA generally agreed with our recommendations, and actions to implement
them have either been taken or are underway.
o Both VBA and VHA have completed systems acceptance and
forward-date testing. VBA completed systems acceptance testing of
its benefits delivery applications and also tested its payment
systems' ability to process benefits in January 2000, in conjunction
with the Department of the Treasury's Financial Management Service
and the Federal Reserve System. This testing was completed in July
1999. Likewise, VHA completed Y2K systems acceptance testing of its
mission-critical hospital systems. In addition, in August 1999,
VHA's independent verification and validation test group forward-
date tested 56 hospital applications./Footnote11/
o VHA issued a policy directive on July 30, 1999, stating that its
medical facilities had to make a decision on renovation strategies by
September 1, 1999, for those facility systems components and
interfaces whose Y2K status was noncompliant, conditionally
compliant, or unknown. The directive also required these facilities
to establish specific contingency plans for each of these systems.
According to the Y2K project office, all of the medical facilities
have met this requirement.
o VHA's CMOPs have developed business continuity and contingency plans
that address important issues such as the loss of electrical power,
telecommunications with the medical centers, and their automated
dispensing machines. These plans should reduce the risk that Y2K
disruptions will impair the CMOPs' ability to continue filling and
delivering veterans' prescriptions.
o In its August 1999 report to OMB, VA said that renovation of the
vendor-supplied CMOP dispensing systems were on schedule to make all
seven CMOPs Y2K compliant by September 30, 1999.
o VA has worked with FDA and various other industry associations to
obtain and share Y2K-readiness information on the Y2K compliance status
of pharmaceutical and medical-surgical manufacturers. It has posted
results on its Internet home page (www.va.gov).
VA Established a Moratorium on Software Changes
-----------------------------------------------
To minimize possible disruptions to agencies' Y2K readiness resulting from
system changes, OMB, in a May 14, 1999, memorandum to heads of departments
and agencies, requested that agencies establish a process to ensure that
the effect on Y2K readiness is considered prior to establishing new
requirements or changes to information technology systems./Footnote12/ We
had previously testified that agencies should institute such a process to
ensure that software changes do not negatively affect Y2K
readiness./Footnote13/
In response to OMB's memorandum, VA issued a October 14, 1999, memorandum
to department heads imposing a moratorium on implementing new systems,
changes to existing systems, or third-party upgrades to VA's information
technology systems between
October 15, 1999, and March 31, 2000. The intent of the memorandum was to
ensure that the department incorporates Y2K change management procedures.
It further stated that in those instances in which software changes were
necessary--such as when compliant software had to be modified due to
legislative or other agency requirements--it would be necessary to test
all changes and recertify the software's compliance./Footnote14/
VA has also defined a process for requesting waivers for software changes
or upgrades during this time. Specifically, waivers must be justified by
the VA administration requesting them and concurred with by that
administration's chief information officer (CIO), architecture review
board, or senior information technology official. The request is then
submitted to VA's Principal Deputy Assistant Secretary for Information and
Technology for approval.
Prior to the department's issuing this moratorium, VBA had developed and
issued a similar moratorium to all VBA offices on July 29, 1999. This
memorandum imposed a moratorium on the deployment of new application
changes or third-party product upgrades between
September 1, 1999, and April 1, 2000, and stated that exceptions to the
moratorium included emergency fixes and legislatively mandated changes
such as cost-of-living adjustments.
VHA has not yet issued specific instructions on how it will implement the
department's moratorium. However, according to VHA's Y2K project office,
it plans to issue guidance to its offices and medical centers based on
VA's memorandum. According to VHA's Y2K project manager, this guidance was
not developed earlier because VHA was waiting for the department to issue
its memorandum.
VA Has Developed a Day One Strategy
-----------------------------------
As we note in our business continuity and contingency planning
guide,/Footnote15/ developing a Day One risk reduction strategy and
procedures for the period between late December 1999 and early January
2000 is a key element in contingency planning. Earlier this month, we
issued a more specific guide on Day One planning./Footnote16/ In addition,
on October 13, 1999, OMB issued a memorandum to the heads of selected
departments and agencies/Footnote17/ instructing them to develop Day One
plans and encouraging them to use our guide in the development of these
plans. OMB required that the plans address seven areas: (1) schedule of
activity, (2) personnel on call or duty, (3) contractor availability, (4)
workforce communication, (5) facilities and services to support workforce,
(6) security, and (7) public communications.
VA and its agencies have developed a high-level Day One strategy that
should help the department manage risks associated with the
January 1 rollover and better position it to address any potential
disruptions. This strategy addresses each of the seven areas required by
OMB:
o a time line of events between December 31 and January 1;
o a personnel strategy and leave policy that identifies key managerial
and technical personnel available to support Day One operations;
o a statement that its administrations reviewed vendor service agreements
and revised them to ensure that contractor support and other needs for
the rollover period are met;
o a communications structure for workforce reporting during the rollover
period. Under this structure, VBA regional offices plan to report to
regional representatives, who plan to report to a national VBA
information coordination center, located at VBA headquarters in
Washington, D.C.; VHA medical centers plan to report to their Veterans
Information Service Network (VISN)/Footnote18/ representative, who
plans to report to a national VHA information coordination center
located in Martinsburg, West Virginia. The VBA and VHA national
information coordination centers plan to report to the VA national
information coordination center, also located in Martinsburg;
o a statement that its facilities have addressed facility and support
services for its workforce in their business continuity and contingency
plans. In addition, the Day One plan requires regular "health" checks
to ensure that these services remain available during the rollover
period;
o a statement that the VA computer systems and data centers are being
secured and additional security has been extended to the networks to
increase protection during the rollover period; and
o a VA Office of Public Affairs information communications center to
support the VA national information coordination center and direct
public communications through the Joint Public Information Center that
the President's Council on Year 2000 Conversion plans to set up for the
rollover period.
VA's Day One plan also describes preparation activities that VA has
completed or plans to complete in order to help minimize potential Year
2000 disruptions to benefits delivery and health care. For example, VBA
plans to process most of its regular, recurring benefits payments so that
they will be available to veterans on December 30, 1999. This, according
to the plan, will greatly mitigate possible Y2K interruptions of benefits
payments.
VA Has Developed Business Continuity and Contingency Plans
----------------------------------------------------------
According to VA's August 1999 report to OMB, its regional offices and
medical facilities have completed business continuity and contingency
plans. In addition, according to VA, a selected number of these plans have
been reviewed by their respective Y2K project offices. Specifically, VBA's
Y2K project office reviewed the plans of its regional offices and found
that they met VBA requirements. We reviewed 15 of the 58 VBA regional
plans and found that they address resources, staff roles, procedures, and
timetables for implementation, as well as risks and risk mitigation.
In reviewing the 58 medical facilities' business continuity and
contingency plans, VHA's Y2K project office concluded that while overall
the plans adequately addressed contingency planning, the plans of 14
facilities were deficient. These deficiencies included the lack of a
schedule of critical events; lack of a policy statement describing the
authority, responsibility, and procedures for Y2K contingency planning;
and missing contingencies for specific functional areas, such as intensive
care or operating rooms. The project office asked the 14 facilities to
address these deficiencies and submit revised plans, which it is currently
reviewing.
We reviewed the plans of 29 medical facilities to determine their
completeness,/Footnote19/ and found that, in some cases, the schedule of
critical events and execution timelines were not specific to the medical
facility. Additional specificity, such as time lines relevant to the
medical facility and specific dates for accomplishing tasks contained in
the time lines, would help make it easier for facility staff to implement
the plan, and help minimize confusion that might result if plans needed to
be activated. A second issue concerned the lack of medical facility
coordination with VHA's seven CMOPs. This is especially important since
the seven CMOPs supply about 50 percent of VA's prescriptions to veterans.
VHA's guidance, however, only required sites that were co-located with a
CMOP to coordinate their plans with that CMOP alone.
We discussed these issues with representatives of VHA's Y2K project
office. They agreed with our concern regarding the time lines and said
that the sites had been advised to ensure that these were sufficiently
specific. In addition, the VHA Y2K project manager told us that all CMOPs
had been advised to discuss their business continuity and contingency
plans with the medical facilities that they support so that they are aware
of them.
VA Has Not Completed Testing of Its Business Continuity and Contingency
Plans
---------------------------------------------------------------------------
Testing of business continuity and contingency plans is key to determining
whether the contingencies are capable of providing the needed level of
support to core business functions and whether they can be implemented in
a reasonable amount of time. In addition, testing can show where plans
need to be updated or changed. We previously testified that testing of
plans should be completed by September 30, 1999./Footnote20/
As of October 22, 1999, only five of VBA's 58 regional offices had
completed testing of their business continuity and contingency plans. VBA
initially asked that each regional office complete a "desktop"
exercise/Footnote21/ of its plan by September 30, 1999, during which the
business continuity and contingency plan team and other critical staff
would simulate an emergency situation. According to VBA's Y2K project
manager, the project office is now requiring the regional offices to
complete this exercise by November 15, 1999. It is critical that VBA
regional offices test their plans to ensure that their contingencies are
sufficient to maintain an acceptable level of service and that the
contingencies can be implemented in a feasible time frame.
All of VHA's medical facilities reportedly have completed emergency
drills. These drills, conducted under controlled conditions to ensure no
impact on patient safety, required each facility to turn off its local
electric supply and rely on backup generators. The medical facilities
identified deficiencies in their plans as a result of these drills. For
example, one site found that its generator was not capable of powering the
entire hospital.
It has now contracted for an additional backup generator to ensure that
all critical areas can be powered. Other sites found that some of their
mission-critical areas were not linked to the backup generator, and have
since contracted for additional work to link them.
While VHA's medical centers have tested their facilities' ability to
handle power outages, other portions of their business continuity and
contingency plans, such as dealing with potential water and gas shortages,
have not been tested. Losses in these areas can have an impact on patient
care. Specifically, a VHA medical facility recently suffered a loss of
water, resulting in a loss of the steam plant, cooling towers, and fire
suppression system. This facility suggested that other facilities
reevaluate their contingencies in view of these losses.
Monthly Reports Do Not Accurately Reflect Y2K Status of Noncompliant Systems
---------------------------------------------------------------------------
All of VHA's VISNs/medical facilities are required to prepare monthly
reports on their Y2K progress in assessing, renovating, validating, and
implementing compliant systems. Specifically, they report on their Y2K
status in six areas: locally developed software, COTS software, computer
platforms, telecommunications systems, facility systems, and medical
devices. These reports are used by VHA to monitor progress in addressing
Y2K issues and to identify problem areas.
VHA's summary report for August 1999 indicated that the medical centers
had made limited progress in renovating their remaining noncompliant
facility systems and telecommunications systems. Specifically, it showed
that overall, only 43 percent of the facility systems and 41 percent of
the telecommunications systems at the medical facilities had completed
renovation. The numbers were somewhat higher for COTS software, at
55 percent, and computer platforms, at 65 percent. The highest renovation
number was for locally developed software products, at 94 percent. We
discussed these renovation statistics with VHA's Y2K project manager, who
told us that the summary report may not be accurate because facilities are
not clear on whether to report on systems or on the components that make
up the systems.
During visits to selected medical facilities we confirmed that their
individual and summary reports did contain errors. For example, some of
the VISN percentages in the August report exceeded 100. The Y2K office has
also contacted selected medical facilities and acknowledged that the
reports have errors. To address this issue, the Y2K office is currently
contacting and visiting sites to discuss these reporting issues. It is
critical that the medical facilities accurately report their Y2K progress
in renovating their noncompliant systems so that top management within VA
can identify problem areas and take prompt and appropriate action.
VHA Has Made Progress in Determining Y2K Compliance Status of Biomedical
Equipment
The question of whether VHA's medical devices such as magnetic resonance
imaging (MRI) systems, x-ray machines, pacemakers, and cardiac monitoring
equipment can be counted on to work reliably on and after January 1, 2000,
is critical to VHA. To the extent that biomedical equipment uses computer
chips, it is vulnerable to the Y2K problem. In the medical arena, such
vulnerability carries with it possible safety risks.
VA Continues to Collect Compliance Information on Biomedical Equipment
----------------------------------------------------------------------
In April, we testified before this Subcommittee that VHA was continuing to
collect information from biomedical equipment manufacturers on the Y2K
compliance status of equipment in its inventory./Footnote22/ As shown in
table 2, a little over half of the manufacturers in VA's database reported
directly to the department that their products are compliant as of October
25, 1999. Since we last testified, VA has created a new compliance
category to capture the increasing number of manufacturers that have web
sites with Y2K information. VA reported that about 24 percent of the
manufacturers in its database (1,393) are in this new category.
Table****Helvetica:x11****2: Status of Manufacturer Responses to VHA as
of October 25, 1999
-------------------------------------------------------------------------
| Manufacturer response : Number of : Percentage of |
| : manufacturers : manufacturers |
|-----------------------------------------------------------------------|
| Manufacturers with web site : 340 : 24 |
| information : : |
|-----------------------------------------------------------------------|
| Compliant manufacturersa : 720 : 52 |
|-----------------------------------------------------------------------|
| Noncompliant manufacturersb : 33 : 2 |
|-----------------------------------------------------------------------|
| Conditional-compliant : 40 : 3 |
| manufacturersc : : |
|-----------------------------------------------------------------------|
| Pending manufacturersd : 11 : 1 |
|-----------------------------------------------------------------------|
| Manufacturers merged or bought out : 241 : 17 |
|-----------------------------------------------------------------------|
| Nonresponsive manufacturerse : 8 : 1 |
|-----------------------------------------------------------------------|
| Total : 1,393 : 100 |
-------------------------------------------------------------------------
aFor inclusion in this category, 100 percent of a manufacturer's products
had to be considered compliant.
bFor inclusion in this category, only one of a manufacturer's products had
to be considered noncompliant.
cFor inclusion in this category, the manufacturer had to have no
noncompliant devices, no pending devices, and at least one conditional-
compliant device.
dFor inclusion in this category, the manufacturer had to have no
noncompliant devices and at least one device that is pending.
eFor inclusion in this category, VHA had to have not received compliance
information from the manufacturer.
Source: Veterans Health Administration. We did not independently verify
these data.
For nonresponsive manufacturers, VHA's Y2K project manager told us that
the project office had contacted the facilities that reported devices in
their inventories from these manufacturers and instructed them to make a
decision on their disposition. The project manager further stated that
none of these devices was used in critical care or life support functions,
and that the facilities with this equipment had been instructed to plan
for contingencies in the event any of them experience a Y2K-related failure.
In April 1999, VHA issued a policy establishing (1) a review process for
medical devices whose compliance status was unknown, noncompliant, or
conditionally compliant and (2) options for what action should be taken on
these devices. Options included replacing or retiring the equipment, or
using it as-is./Footnote23/ Medical facilities were to complete these
reviews by
June 1, 1999, for equipment whose Y2K compliance status was either unknown
or noncompliant, and September 1 for equipment whose status was
conditionally compliant. In each case, the medical facility director's
approval of the disposition decision was required. For noncompliant
equipment, the medical center was required to assess the level of risk if
it continued to use the equipment, and determine what risk such use posed
to patient health and safety. To make this assessment, medical facilities
were to consider such questions as whether the device is used for critical
care, or if the device used date-sensitive data, such as sequencing
patient data results.
To track the compliance status of its biomedical equipment, VHA uses a
monthly status report on medical devices based on information provided by
the VISNs/medical facilities.
According to the August 1999 report, about 97 percent of the
568,000 medical devices in VHA medical facilities are compliant. The
report indicated that, of about 18,000 noncompliant devices, about 14,000
will be repaired, and about 1,400 will be replaced. The report did not
discuss the renovation status of the remaining 2,200 noncompliant devices.
We were unable to accurately determine the status of medical facilities'
efforts to renovate noncompliant devices. As we discussed previously, the
individual monthly reports submitted by the VISNs/medical facilities were
inaccurate. Specifically, we determined that the June 1999 summary showed
that about 21 percent of medical devices had been renovated was incorrect.
However, according to several medical centers, their renovation
percentages were higher than the numbers reflected in the report. We
pointed this out to the Y2K project manager, who acknowledged that the
percentages were incorrect. He added that the Y2K project office is in the
process of following up with its medical centers to confirm their status
on renovation of biomedical equipment.
VHA Position on Not Testing Biomedical Equipment Unchanged
----------------------------------------------------------
As we reported last September, VHA relies on manufacturers to validate,
test, and certify that equipment is Y2K compliant./Footnote24/ We also
reported that there was no assurance that the manufacturers adequately
addressed the Y2K problem for noncompliant equipment because FDA did not
require medical device manufacturers to submit test results to it
certifying compliance. Accordingly, we recommended that VA and HHS take
prudent steps to jointly review manufacturers' compliance test results for
critical care/life support biomedical equipment. We were especially
concerned that VA and FDA review test results for equipment previously
determined to be noncompliant but now deemed compliant by manufacturers,
or equipment for which concerns about compliance remain. We also
recommended that VA and HHS determine what legislative, regulatory, or
other changes were necessary to obtain assurances that manufacturers'
equipment was compliant, including performing independent verification and
validation of the manufacturers' certifications.
At that time, VA stated that it had no legislative or regulatory authority
to implement the recommendation to review test results from manufacturers.
VA and the Emergency Care Research Institute (ECRI)/Footnote25/ have
stated that manufacturers are best qualified to analyze embedded systems
or software to determine Y2K compliance. Accordingly, they do not
encourage user testing of biomedical equipment for Y2K compliance. ECRI
guidelines, however, suggest that health care facilities should consider
testing interfaces between medical devices in cases where the facility
cannot determine the Y2K compliance of the interface from the device
manufacturer. FDA also agrees with the ECRI position on testing biomedical
equipment and interface testing. Specifically, FDA has taken the position
that manufacturers' submissions of Y2K compliance certifications provide
sufficient assurance of product compliance, and that such testing on the
part of users is not necessary.
According to VHA's chief biomedical engineer, VHA guidance to the VISNs
and medical facilities is not to conduct stand-alone compliance testing of
biomedical equipment in their inventories. VHA's Y2K project manager told
us that VHA relies on the manufacturers' certifications; therefore, there
is no need for such testing. However, he stated, in cases in which one
medical device interacts with other systems or devices, the medical
facilities should test these to ensure proper operation.
In contrast to VHA's and FDA's positions, some hospitals in the private
sector believe that testing biomedical equipment is necessary to prove
that they have exercised due diligence in the protection of patient health
and safety. As we have previously testified, officials at three hospitals
told us that their biomedical engineers established their own test
programs for biomedical equipment and, in many cases, contacted the
manufacturers for their test protocols./Footnote26/ Several of these
engineers informed us that their testing identified some noncompliant
equipment that the manufacturers had earlier certified as compliant.
According to these engineers, the equipment found to be noncompliant all
had display problems; none was critical care/life support equipment. We
were told that equipment found to be incorrectly certified as compliant
included a cardiac catheterization unit, a pulse oxymeter, medical imaging
equipment, and ultrasound equipment.
Our review of manufacturers' web sites disclosed that manufacturers'
opinions vary on whether users should test their biomedical
equipment./Footnote27/ We noted that at least 37 manufacturers provided
information on their web sites about Y2K testing. Of these, 30 encouraged
testing, and 15 of these
30 provided end-users with information such as test protocols and
instructions. Fifteen of the 30 manufacturers also encouraged users to
test their devices in configuration with related equipment to ensure that
the device operated as intended. For example, the web site of a
manufacturer of audiometers stated that "if your equipment is used in a
critical application, we strongly advise you to test the equipment by
simulating the millennium date change yourself." Seven of the 37
manufacturers did not encourage testing; two of these stated that such
testing could disrupt operation of software.
Since some biomedical equipment manufacturers encourage end-user testing
for Y2K compliance of their products, VA should reconsider its decision
not to test equipment in those instances in which the manufacturer
encourages users to test. Such action can provide greater assurance of Y2K
compliance for those items. From an overall perspective, as we testified
in April, the question of whether to independently verify and validate
biomedical equipment that manufacturers have certified as compliant is one
that must be addressed jointly by medical facilities' clinical staff,
biomedical engineers, and corporate management./Footnote28/ The overriding
criterion should be ensuring patient health and safety.
VHA Pharmaceutical Operations Have Made Progress in Addressing Y2K Problem
Another critical component to VA's ability to deliver health care at the
turn of the century is ensuring that the automated systems supporting
VHA's medical facility pharmacies and its CMOPs are Y2K compliant. VHA
reported that in 1998 it filled about 72 million prescriptions for 3.4
million veterans, at an estimated cost of about $2 billion. About half of
the prescriptions were filled by the over 200 pharmacies located at VA's
medical centers, clinics, and nursing homes. These pharmacies rely on the
pharmaceutical applications in their hospital information system for
(1) drug distribution and inventory management, (2) dispensing of drugs to
inpatients and outpatients, (3) patient medication information, and (4) an
electronic connection between the pharmacies and the CMOPs.
The remaining half of VHA's prescriptions are filled by seven CMOPs,
geographically dispersed throughout the United States. These facilities
are supported by automated systems provided by one of two contractors--
SI/Baker, Inc. and Siemens ElectroCom./Footnote29/ For example, the CMOP
electronically receives a prescription for a veteran through the medical
center. The prescription is downloaded to highly automated dispensing
equipment to be filled. The filled prescription is then validated by a
pharmacist who compares the medication against the prescription and a
computerized image of the prescribed medication. Afterward, the
prescription is packaged and an automatically generated mailing label is
applied for delivery to the veteran. Lastly, the medical center is
electronically notified that the prescription has been filled.
As we testified this past April,/Footnote30/ VHA had determined that the
automated systems supporting its CMOPs were not Y2K compliant.
Accordingly, the CMOPs' ability to fill prescriptions and process
management reports could be delayed or interrupted if a Y2K failure
occurred. At that time, we also expressed concern about the mid- to late-
1999 scheduled implementation of compliant systems.
Since our April testimony, VA's contractors have installed and tested
compliant systems at all seven CMOPs. As shown in table 3, as of September
30, 1999, all seven CMOPs have reported their automated systems as
compliant.
Table****Helvetica:x11****3: Actual Completion Dates for Implementing
Compliant Systems and Current Daily
Workload by Consolidated Mail Outpatient
Pharmacies
------------------------------------------------------------------------
| : Actual : Current daily workload |
| : completion date : (prescriptions filled) |
| Location : : |
|----------------------------------------------------------------------|
| Bedford, : August 10, 1999 : 15,000 |
| Massachusettsa : : |
|----------------------------------------------------------------------|
| Dallas, Texasa : August 10, 1999 : 14,000 |
|----------------------------------------------------------------------|
| West Los Angeles, : : |
| : : |
| Californiaa : September 8, : 15,000 |
| : 1999 : |
|----------------------------------------------------------------------|
| Leavenworth, Kansasa : September 30, : 16,000 |
| : 1999 : |
|----------------------------------------------------------------------|
| Murfreesboro, : September 22, : 38,000 |
| Tennesseeb : 1999 : |
|----------------------------------------------------------------------|
| Charleston, South : September 26, : 23,000 |
| Carolinab : 1999 : |
|----------------------------------------------------------------------|
| Hines, Illinoisb : September 26, : 21,000 |
| : 1999 : |
------------------------------------------------------------------------
aSiemens ElectroCom automation.
bSI/Baker, Inc. automation.
Source: VA.
We also testified in April that it was crucial that the CMOPs develop
business continuity and contingency plans to ensure that veterans will
continue to receive their medications should the CMOPs experience a
Y2K-related failure. On September 3, 1999, the national CMOP director
approved the Consolidated Mail Outpatient Pharmacy Year 2000 Contingency
Plan, which (1) defines the responsibilities of the national director, the
local CMOP director, the national Y2K coordinators, the local Y2K
coordinators, and the business resumption team, (2) establishes procedures
for preparing and implementing the contingency plan and implementing it
during the execution phase, and (3) provides a schedule of critical events
and a time line for actions to be taken during the execution phase.
In addition, each of the seven CMOPs drafted contingency plans addressing
core business processes. These plans, along with the Y2K Mail Transfer
Contingency Test Procedures, which are the necessary steps relating to
loss of the wide area network, were forwarded to the medical centers
serviced by each CMOP during July and August of this year. Each medical
center was asked to certify that the CMOP contingency plan had been
reviewed and will be incorporated into the medical center's Y2K
contingency plan. However, according to the national CMOP Y2K coordinator,
as of October 25, 1999, about half of the medical facilities had not
returned their certifications.
According to the CMOP Y2K plan, the CMOPs are expected to completely test
their plans by the end of October. Five CMOPs participated in a live test
last month. Specifically, anticipating a direct hit from Hurricane Floyd,
the Charleston CMOP reallocated the prescriptions for its 21 medical
centers to four other CMOPs--Bedford, Dallas, Hines, and West Los Angeles.
The Charleston CMOP lost 36 hours of production time, and 55,683
prescriptions had to be processed by the other CMOPs.
VA Continues Efforts to Determine Y2K Readiness of Pharmaceutical and
Medical-Surgical Manufacturers
---------------------------------------------------------------------------
Like other users of pharmaceutical and medical-surgical products, VA needs
to know whether it will have a sufficient supply of these items for its
customers. Therefore, it has taken a leadership role in the federal
government in determining whether manufacturers supplying these products
to VHA are Y2K-ready. This information is essential to VHA's medical
facilities and CMOPs because of their "just-in-time"/Footnote31/ inventory
policy. Accordingly, they must know whether their manufacturers'
processes, which are highly automated,/Footnote32/ are at risk, as well as
whether the rest of the supply chain will function properly.
We testified in April that VA's National Acquisition Center/Footnote33/
sent a survey on January 8, 1999, to 384 pharmaceutical firms and 459
medical-surgical firms with which it does business to determine their Y2K
readiness./Footnote34/ The survey contained questions on the firms'
overall Y2K status and inquired about actions taken to assess, inventory,
and plan for any perceived impact that the century turnover would have on
their ability to operate at normal levels. In addition, the firms were
requested to provide status information on progress made to become Y2K
compliant, and a reliable estimated date when compliance would be achieved
for business processes such as
(1) ordering and receipt of raw materials, (2) mixing and processing
product, (3) completing final product processing, (4) packaging and
labeling product, and (5) distributing finished product to
distributors/wholesalers and end customers.
In March the acquisition center sent a second letter to its pharmaceutical
and medical-surgical firms, informing them of VA's plans to make Y2K
readiness information previously provided to VA available to the public
through a web site (www.va.gov/oa&mm/nac/y2k ). VA made the survey results
available on its web site on April 13, 1999./Footnote35/ The letter also
requested that manufacturers that had not previously responded provide
information on their readiness. The acquisition center's executive
director said that he would personally contact any major VA supplier that
did not respond.
According to an August 1, 1999, briefing report on their survey, the
acquisition center reclassified the 517 companies that responded to the
survey into three categories: "pharmaceutical firms,''/Footnote36/
"pharmaceutical, other firms,"/Footnote37/ and "medical-surgical firms."
As shown in table 4, as of August 1, 1999, the latest available date from
VA, about one-third of the pharmaceutical firms, a little over one-third
of the "pharmaceutical, other" and almost 44 percent of the medical-
surgical firms had not responded to the survey.
Table****Helvetica:x11****4: Status of Companies Surveyed by VHA as of
August 1, 1999
------------------------------------------------------------------------
| Responses : Pharmaceutic : Pharmaceutic : Medical |
| : al : al, other : - |
| : : : surgica |
| : : : l |
|----------------------------------------------------------------------|
| Y2K compliant : 55 : 28 : 146 |
|----------------------------------------------------------------------|
| Will be compliant by : 92 : 30 : 79 |
| 1/1/2000 or earliera : : : |
|----------------------------------------------------------------------|
| Provided no compliance date : 39 : 14 : 34 |
|----------------------------------------------------------------------|
| Total number of responses : 186 : 72 : 259 |
|----------------------------------------------------------------------|
| Nonresponses : 90 : 40 : 201 |
|----------------------------------------------------------------------|
| Total number of firms : 276 : 112 : 460 |
| surveyed : : : |
------------------------------------------------------------------------
aEstimated compliance status date ranged from 3/31/99 through 1/1/2000;
about 72 percent of all respondents estimated they would be compliant by
7/31/99. One firm responded that it would be compliant by 1/01/2000.
Source: VA. We did not independently verify these data.
To determine if all respondents who had initially provided an anticipated
compliance date of July 31, 1999, or earlier had met this date, a follow-
up survey was sent to 140 firms on July 20, 1999. As shown in table 5, as
of October 26, 1999, about two-thirds (64 percent) responded to the
survey. A little over half of the respondents (52 percent) completed the
survey, while the remaining respondents forwarded company letters, Year
2000 readiness disclosure statements, and company financial statements
with disclosures on Y2K readiness. Table 5 also shows that about half of
the respondents did not meet the targeted date of July 31, 1999; almost 84
percent, however, anticipate full compliance by September 30, 1999. The
results of this
follow-up survey are not currently available on VA's web site.
Table****Helvetica:x11****5: Status of Companies With July 31, 1999, or
Earlier Anticipated Compliance Dates as of
October 26, 1999
------------------------------------------------------------------------
| : Number of firms : Percentage |
|----------------------------------------------------------------------|
| Total number of surveys distributed: 140 : 100 |
|----------------------------------------------------------------------|
| Number of responses : 90 : 64 |
|----------------------------------------------------------------------|
| Firms completing survey : 47 : 52 |
|----------------------------------------------------------------------|
| Were compliant by 7/31/99 : 25 : 53 |
|----------------------------------------------------------------------|
| Anticipate compliance by 9/30/99 : 19 : 40 |
|----------------------------------------------------------------------|
| Anticipate compliance by fourth : 3 : 6 |
| quarter : : |
|----------------------------------------------------------------------|
| Firms forwarding company letters, : 43 : 48 |
| etc. : : |
|----------------------------------------------------------------------|
| Were compliant by 7/31/99 : 17 : 40 |
|----------------------------------------------------------------------|
| Anticipate compliance by 9/30/99 : 14 : 32 |
|----------------------------------------------------------------------|
| Anticipate compliance by fourth : 3 : 7 |
| quarter : : |
|----------------------------------------------------------------------|
| No date furnished : 9 : 21 |
------------------------------------------------------------------------
Source: VA. We did not independently verify these data.
On a broader level, VHA has taken a leadership role in obtaining and
sharing information on the Y2K readiness of the pharmaceutical industry.
Specifically, VHA chairs the Year 2000 Pharmaceuticals Acquisitions and
Distributions Subcommittee, which reports to the Chair of the President's
Council on Year 2000 Conversion. The purpose of this subcommittee is to
bring together federal and pharmaceutical representatives to address
issues concerning supply and distribution as it relates to the year 2000.
The subcommittee consists of representatives of FDA, federal health care
providers, and industry trade associations such as the Pharmaceutical
Research and Manufacturers of America, the National Association of Chain
Drug Stores, and the National Wholesale Druggists' Association. Several of
these trade associations have surveyed their members on their Y2K
readiness and have made the results available to the public. Further, the
Pharmaceutical Alliance for Y2K Readiness/Footnote38/ announced on
September 22, 1999, that consumers will have access to a substantial
supply of medications during the Y2K date change and there should be no
need for consumers to overbuy medications in preparation for Y2K.
The executive director of the National Acquisition Center told us that,
based on his interactions with the trade associations, as well as results
received from manufacturers, he is confident that there will be no
shortage of medication and medical-surgical supplies. He explained that
the major companies with unique drugs that VA relies on have responded
that they will be ready and have provided the necessary resources and
management attention. Further, he said, all 10 of VA's largest
pharmaceutical and medical-surgical suppliers have responded to the survey
and have taken actions to address the Y2K problem at their firms.
Accordingly, the executive director does not plan to take any further
action, including following up with those manufacturers that did not meet
their anticipated compliance date of July 31, 1999, or September 30, 1999.
We believe that VHA needs to continue to follow up with pharmaceutical and
medical-surgical firms that anticipated having compliant systems by July
31, 1999, and September 30, 1999, to determine whether these firms have
addressed the Y2K problem. This information should also be made available
on VHA's web site.
FDA's Y2K Activities on Biomedical Equipment and Pharmaceutical,
Biological, and Consumable Medical Products Industries Are Focused on
Readiness
Another key player in determining the Year 2000 compliance of biomedical
equipment and pharmaceutical, biological, and consumable medical products
is FDA, which has oversight and regulatory authority in these areas. FDA's
role is to ensure that these products are safe and effective for public
use. In an effort to provide users with Y2K compliance information on
their equipment, FDA has established the Federal Y2K Biomedical Equipment
Clearinghouse. In addition, it has surveyed manufacturers of
pharmaceutical, biological, and consumable medical products, to provide
users with information on their Y2K readiness.
Biomedical Equipment Status Information Available Through FDA Clearinghouse
---------------------------------------------------------------------------
We reported in September 1998 that FDA was working to determine the
compliance status of biomedical equipment; provide a comprehensive,
centralized source of information on the Y2K compliance status of
biomedical equipment used in the United States; and make this information
publicly available on a web site./Footnote39/ However, we also reported
that FDA's database did not include product compliance information from
many manufacturers that had already provided such information to VHA, and
also that VHA was not making this information available to the public. We
therefore recommended that HHS and VHA jointly develop a single data
clearinghouse containing information on the Y2K compliance status of
biomedical equipment, and make this information publicly available. In
response to our recommendation, FDA--in conjunction with VHA--established
the Federal Y2K Biomedical Equipment Clearinghouse. In obtaining
compliance status information from manufacturers, VHA, the Department of
Defense, and the Health Industry Manufacturers Association all assisted
FDA.
We testified last week that, according to FDA, 4,288 biomedical equipment
manufacturers had submitted data to the clearinghouse as of
October 4, 1999./Footnote40/ Based on the data submitted, FDA places a
manufacturer into one of four categories:
o Products that do not employ a date--manufacturer that reported Y2K
status to be "All Products Do Not Use a Date."
o Products that are all compliant--manufacturer that reported products as
Y2K compliant.
o Products with date-related problems--manufacturer that reported its Y2K
status to be "Products With Date Related Problem."
o Product status is on the manufacturer's web page--manufacturer that
reported its Y2K status to be "Product Status Specified on a (Web) Page."
As shown in figure 1, as of October 4, 1999, 61 percent of the
manufacturers reported having products that do not employ a date, while 8
percent
(342 manufacturers) reported having date-related problems such as
incorrect display of date/time. According to FDA, the 342 manufacturers
reported 1,035 specific products with date-related problems.
Figure****Helvetica:x11****1: Biomedical Equipment Compliance-Status
Information Reported to FDA by
Manufacturers as of October 4, 1999
*****************
*****************
Note: Total number of manufacturers = 4,288.
Source: FDA.
Also, according to FDA, as of October 4, 1999, 132 manufacturers had not
responded to the agency's request for product compliance information. A
senior FDA official told us that most of these manufacturers have gone out
of business, do not make computerized products, or just cannot be located.
The official added that FDA continues to follow up with these
manufacturers nevertheless, through letters and telephone contact. The
clearinghouse lists the names of these manufacturers that have not
responded to FDA's requests for product compliance information.
In our September 1998 report, we also noted that information on the FDA
web site was not detailed enough to be useful./Footnote41/ Specifically,
the list of compliant equipment contained no information on the
equipment's make and model. We therefore recommended that VA and HHS
include in the clearinghouse information on the compliance status of all
biomedical equipment by make and model. FDA agreed with this
recommendation, and subsequently requested this information from
manufacturers; users can now find specific information on the make and
model of compliant medical devices on the FDA web site.
As an alternative to obtaining biomedical equipment product compliance
information from manufacturers and posting it to the Federal Y2K
Biomedical Equipment Clearinghouse, FDA accepts equipment manufacturers'
references to their own web sites for compliance information. The
clearinghouse provides users with a link directly to these web sites. As
of October 4, 429 manufacturers had chosen this option.
While FDA is aware of the number of products and their reported compliance
status for those manufacturers providing this information to the Federal
Y2K Biomedical Equipment Clearinghouse, in testimony this past May FDA
officials stated that they did not know the total number of biomedical
equipment products reported by manufacturers on their web sites, or how
many of them were noncompliant. We subsequently reviewed information
available through these web sites and reported in June that the quality of
information available through them varied significantly./Footnote42/
Specifically, we found that while most sites contained compliance
information on at least one product, some sites contained insufficient
information or did not clearly distinguish biomedical equipment from
nonbiomedical products.
We subsequently updated our analysis of the web sites as of
October 1, 1999, and found the following for the 429 manufacturers in
FDA's clearinghouse that refer users to their web sites:
o 354 manufacturers reported compliance status information for at least
33,598 individual biomedical equipment products;/Footnote43/
o 71 manufacturers' web sites either contained insufficient information
on the number of products and their compliance status, or did not
clearly distinguish biomedical equipment from nonbiomedical products;
o 3 web sites were those of vendors or distributors, not manufacturers; and
o 1 manufacturer's web site link in FDA's clearinghouse did not
work./Footnote44/
Because of the limitations cited above for many of the manufacturers' web
sites, our ability to determine the total number of biomedical equipment
products reported and their compliance status was limited. Accordingly,
the actual number of products reported by these manufacturers could be
higher than the 32,598 that we counted.
As shown in figure 2, of the 32,598 products we identified on
manufacturers' web sites, about 54 percent reportedly do not employ a
date, about 29 percent of the products are considered compliant, and about
12 percent are reportedly noncompliant. The compliance status of the
remaining 5 percent of products was unknown for reasons such as the
manufacturer's ongoing assessment of the product.
Figure****Helvetica:x11****2: Biomedical Equipment Compliance-Status
Information Reported on Manufacturers'
Web Sites as of October 1, 1999
*****************
*****************
Note: Total number of products = 32,598.
Source: GAO analysis of manufacturers' web sites.
The 4,053 noncompliant products that we identified were from the web sites
of 214 manufacturers. This number of products is about four times the
number reported directly by FDA in its clearinghouse (1,035). Examples of
these noncompliant products included a bedside monitor, film digitizer,
ultrasound systems, radiology information systems, and laboratory
information systems. Included among noncompliant potentially high-risk
devices reported were ventricular assist devices and hemodialysis
equipment./Footnote45/
In addition to supplying information on noncompliant products, most of the
manufacturers with noncompliant products also provided solutions to
correct the problem. Most (190) of the 214 manufacturers identified with
noncompliant products provided at least one solution to correcting the
problem. The solutions generally involved upgrades to hardware or
software, manual action (such as turning the equipment on and off on
January 1, 2000), or workarounds./Footnote46/
FDA Is Now Reviewing Manufacturers' Y2K Activities
--------------------------------------------------
While compliance information is available through FDA's Federal Y2K
Biomedical Equipment Clearinghouse, we have raised concerns in the past
year about the lack of independent verification and validation of
biomedical equipment that manufacturers have certified as compliant. In
addition to making sure that manufacturers provide detailed information on
their products, we believe that it is essential that FDA provide some
level of confidence that critical care and life support medical devices
will work as intended.
In response to our recommendation to conduct independent verification and
validation of biomedical equipment that manufacturers have certified as
compliant, FDA is taking action to review a sample of biomedical equipment
manufacturers' Y2K activities, such as risk management, test planning and
procedures, and implementation and contingency planning. Specifically,
FDA's acting deputy commissioner for policy testified in May 1999 that FDA
proposed reviewing manufacturers' test results supporting their compliance
certifications for a sample of critical devices. FDA's proposal consisted
of two phases. In the first phase FDA would
o develop a list of the manufacturers of computer-controlled, potentially
high-risk devices (PHRD);/Footnote47/
o from this list of manufacturers, select a sample of 80 manufacturers
for review; and
o hire a contractor to develop a program to assess manufacturers'
activities to identify and correct Y2K problems with PHRDs.
The goal of the first phase of the survey is to extrapolate from the
80 assessments a level of overall confidence in the biomedical equipment
industry's Y2K compliance activities. According to FDA, the second phase
of the evaluation would be undertaken only if the results of the first
phase indicated a need for further review of manufacturer Y2K activities
because of concerns over how manufacturers are addressing product
compliance.
In carrying out its plan to assess manufacturers' Y2K activities, FDA
identified 90 types of PHRD products, and issued a task order on
July 1, 1999, for a contractor, assisted by two subcontractors, to perform
assessments of the Y2K compliance activities for a sample of PHRD
manufacturers. FDA identified 803 PHRD manufacturing sites that produce
equipment sold in the United States./Footnote48/ These were composed of
726 biomedical equipment manufacturing sites and 77 manufacturing sites of
blood and blood products equipment.
FDA's contractor then randomly selected 325 of the 803 sites for possible
assessment. These manufacturing sites were then contacted and asked if
they would volunteer to participate in the process. As of October 4, 1999,
of the 325 randomly selected sites,
o 197 were identified as producing no computer-controlled equipment,
o 80 agreed to participate,
o 26 declined to participate,/Footnote49/
o 18 were duplicates,/Footnote50/ and
o 4 did not respond.
To carry out the on-site assessments of manufacturing sites, the
contractor developed a guide for its examiners. This guide focused on the
firm's Y2K activities in six areas: (1) executive leadership and control,
(2) risk management, (3) corrective and preventive actions, (4) test
planning and procedures, (5) communication with the consignee (user of the
products), and (6) implementation and contingency planning.
After completing these assessments, examiners were required to prepare a
report of concerns in each of the six areas reviewed at each manufacturing
site. Concerns were identified as high, medium, or low, as defined below:
o high--relates to actions that are not timely, inadequate planning,
inadequate or incomplete resources, incomplete or inaccurate
deliverables, unable to validate results, and/or inadequate due
diligence;
o medium--relates to actions that are somewhat late, incomplete planning,
insufficient or incomplete resources, deficiencies in deliverables,
and/or incomplete validation of results; and
o low--relates to actions that are on schedule and have adequate resources.
According to FDA's PHRD survey project manager, as of October 15, 1999,
examiners had completed all 80 manufacturer site assessment visits, and
had prepared 62 assessment reports.
We reviewed the 25 manufacturer site visit reports that were completed by
the examiners and available to us as of September 10, 1999. For 20 of
these assessments, concern was low. At the five remaining sites, the
examiner assessed at least one concern as moderate in one of the six
areas, such as test planning and procedures. According to the FDA PHRD
survey project manager, the areas identified in the site visit reports as
medium risks do not constitute a risk to patient health or safety.
Until recently, none of the site visit reports submitted to FDA contained
a concern assessed as high. However, last week, the PHRD survey project
manager informed us that FDA had received a site visit report with
concerns accessed as high in two areas--leadership and control, and test
planning and procedures. The report stated that the manufacturer's polices
and procedures were found to be inconsistent, ambiguous, and were not
followed in a manner that would meet due diligence requirements. It also
noted that the qualifications of the manufacturer's personnel for
specified tasks were not well defined, and that some personnel assigned to
tasks identified in the policies and procedures were not qualified to
perform those tasks. The report concluded that the manufacturer's
procedures for Y2K assessment and corrective and preventive action were
less than adequate, and that assessment procedures had not been applied
consistently. The manufacturer subsequently told the examiner that action
would be taken on the issues raised.
Late last week, FDA's Senior Associate Commissioner for Policy, Planning,
and Legislation testified that FDA sent an inspector to follow up with
this manufacturer. The FDA official said the inspector determined that the
deficiencies noted would not affect patient safety. He also stated that
FDA would continue to monitor the situation at this site.
Regarding the overall planned phase one report, the project manager told
us that FDA's contractor is in the process of preparing a final report
summarizing the findings from the 80 site visit assessment reports,
detailing any problems encountered during the project and recommending
whether the second phase should be performed. Although FDA initially
expected to submit a final report to HHS by October 1, it has not yet
established a revised deadline. Accordingly, it does not know when this
information will be made available to the public. We believe that this
information should be made available as soon as possible.
To assess how the contractor was executing FDA's task order, we observed
selected site visit assessments. At the five manufacturing site
assessments we observed, the examiners generally followed the contractor-
developed audit guide, and were knowledgeable about information technology
management, Y2K testing, and risk assessment. During our two initial
visits, we noted that the examiners sometimes could not answer questions
from the manufacturers relating to the FDA clearinghouse and the
processing of the final report on the site assessments. We subsequently
shared these observations with FDA official, who agreed to consider our
suggestions, such as better communicating to the firms the final reporting
process and how the FDA Federal Y2K Biomedical Clearinghouse works. During
the later three visits, we did not observe any similar areas of concern.
FDA's Activities to Determine Y2K Readiness of Manufacturers of
Pharmaceutical, Biological, and Consumable Medical Products
---------------------------------------------------------------------------
FDA's oversight and regulatory responsibility for pharmaceutical,
biological, and consumable medical products/Footnote51/ is to ensure that
they are safe and effective for public use. Since our April
testimony,/Footnote52/ FDA has taken action to determine the Y2K readiness
of these industries. Specifically, FDA is conducting voluntary surveys of
manufacturers of pharmaceutical, biological, and consumable medical
products for Y2K readiness. These surveys assess manufacturers' plans and
preparations to continue operations after January 1, 2000.
According to FDA's Senior Associate Commissioner for Policy, Planning, and
Legislation, information obtained from these surveys thus far indicates
that there will likely be no significant disruption of necessary supplies
of pharmaceuticals, biologicals, or consumable medical products as a
result of Y2K. FDA believes that essential medical supplies will be
available, and that the drug supply will be safe and adequate.
To obtain information on the Y2K readiness of the pharmaceutical industry,
on April 21, 1999, the FDA Commissioner sent a letter to the presidents
and CEOs of approximately 4,228 pharmaceutical manufacturers that produce
prescription drugs, over-the-counter medication, bulk drugs, and also to
drug distributors and repackagers, and medical gas manufacturers. In the
letter, the Commissioner requested the assistance of these firms in
assuring the American public that the firms had addressed the Y2K problem
as it affects the adequacy, safety, and effectiveness of the supply of
pharmaceuticals in the United States.
According to FDA's Senior Associate Commissioner for Policy, Planning, and
Legislation, as of October 8, 1999, 3,132 (74 percent) of the firms had
responded to the survey. Of these, 95 percent stated that they would be
Y2K ready by October 31, 1999. According to the senior associate
commissioner, FDA is committed to maximizing the response, especially from
the 274 priority manufacturers who produce sole source, orphan
drugs,/Footnote53/ or the top 200 prescribed medications.
This FDA official testified on October 21, 1999, that, in addition to
conducting the survey of pharmaceutical manufacturers, distributors, etc.,
FDA is taking the additional step of obtaining independent assurance of
these firms' Y2K assessments and corrections. The agency has obtained a
contractor that is auditing each of 160 highest priority pharmaceutical
firms, as well as a random sample of other firms. As of October 8, 1999,
88 percent of these assessments have been completed. The report stated
that the results of their audits to date are positive and confirmed FDA's
expectation that the pharmaceutical industry has taken the necessary steps
to prepare for the year 2000. The interim report/Footnote54/ is available
on FDA's web site./Footnote55/
FDA is also assessing the Y2K readiness of the biologics industry. In
June, the Center for Biologics Evaluation and Research mailed a survey on
Y2K readiness to 1,576 licensed biologics manufacturers and registered
blood establishments. FDA also sent letters to biologics trade
organizations requesting their assistance in encouraging their members to
participate in the survey.
According to FDA's senior associate commissioner, as of October 15, 1999,
it had received responses from 1,483 (94 percent) of the licensed
manufacturers and blood establishments. In addition, as with the
pharmaceutical industry, FDA is conducting follow-up audits of
110 high-priority firms to assess their Y2K readiness. To date, FDA
reports finding no problems with the audited firms. In addition, FDA is
conducting random audits of other firms, and has completed audits of 48 of
these with no problems identified as of October 14, 1999. FDA told us on
October 27 that it plans to publicize the survey and audit results of the
biologics manufacturers, although it has not established a date when this
information will be available. We believe that this information should be
made available as soon as possible.
FDA also mailed Y2K readiness surveys to 3,070 manufacturers of consumable
medical supplies in June./Footnote56/ This survey focused on manufacturers
that produce critical devices that are used and consumed on a recurring
basis during the delivery of essential health care services, as well as
those whose availability is critical to the uninterrupted delivery of
health care and patient welfare. As of October 14, 1999, FDA had received
2,074 responses (68 percent) to its survey. According to FDA's senior
associate commissioner, approximately 90 percent of these respondents
report that they will be ready for Y2K by October 31, 1999.
FDA is also conducting audits of firms that supply medical consumables. It
has given highest priority to 225 firms that produce devices that are only
manufactured by a handful of those firms, as well as 57 manufacturers that
are sole-source suppliers. According to FDA's senior associate
commissioner, to date, 197 of the high-priority firms have responded, and
48 of the 57 sole-source firms have responded. On October 27, 1999, FDA
told us that it plans to make the detailed survey and audit results for
consumable medical products manufacturers available to the public, but it
has not yet determined the date when this will be done. We believe that it
is critical to make this information available.
In summary, VA has made much progress in addressing the Y2K computer
problem. However, some critical tasks remain in the areas of testing
business continuity and contingency plans and reporting Y2K compliance
status of key components such as facility systems at VHA medical
facilities. VHA should also reassess its decision not to test biomedical
equipment in those instances in which the manufacturer encourages such
testing. Additionally, VA needs to continue to follow up with
pharmaceutical and medical-surgical firms that anticipated having
compliant systems by
July 31, 1999, and September 30, 1999, respectively, and make this
information available to the public through its web site.
Compliance status information on biomedical equipment can now be found in
FDA's clearinghouse or on manufacturers' web sites. Also, to its credit,
FDA has assessed the Y2K compliance activities of some PHRD manufacturing
sites. This information should provide the American public with a higher
level of confidence that medical devices will work as intended. FDA now
needs to finalize its overall report on the results of its review of the
PHRD manufacturing sites, and make this information available to HHS and
the public through its web site.
We performed this assignment in accordance with generally accepted
government auditing standards, from May through October 1999. In carrying
out this assignment, we reviewed and analyzed VA's Y2K documents and
plans, comparing them against our guidance on Y2K activities. More
specifically, we observed VBA's "dry run" testing of its benefits payment
systems, VHA's forward-date tests of its hospital information systems, and
tests of CMOP Y2K fixes. We reviewed the test plans, selected test
scripts, and test results for each Y2K test. We also reviewed business
continuity and contingency plans for a sample of for VHA medical centers
and VBA regional offices, as well as VBA data centers. In addition, we
reviewed and analyzed FDA documentation relating to its Y2K efforts on
biomedical devices and pharmaceutical manufacturers. More specifically, we
identified the amount and quality of information on product compliance
information available on biomedical equipment manufacturers' web sites,
reviewed information from those sites to identify the total number of
biomedical equipment products reported, and categorized their compliance
status./Footnote57/ We also reviewed manufacturers' web sites to assess
the clarity and completeness of the information reported.
In addition, we visited selected VHA medical centers, VBA regional
offices, VA data centers, and VHA CMOPs to discuss their Y2K activities,
and interviewed VA and FDA officials about those activities. Finally, we
interviewed selected private hospital officials about their Y2K actions
and pharmaceutical trade associations on their Y2K readiness surveys of
pharmaceutical manufacturers.
Mr. Chairman, this concludes my statement. I would be pleased to respond
to any questions that you or other members of the Subcommittee may have at
this time.
Contact and Acknowledgments
For information about this testimony, please contact Joel Willemssen at
(202) 512-6253 or by e-mail at [email protected]. Individuals
making key contributions to this testimony included Dr. Nabajyoti
Barkakati, Michael Fruitman, Tonia Johnson, Helen Lew, Barbara Oliver,
Mike Resser, and Henry Sutanto.
(511757)
--------------------------------------
/Footnote1/-^As is widely known by now, for the past several decades
computer systems have often used two digits to represent the year, such
as "98" for 1998, in order to conserve electronic data storage and
reduce operating costs. In this format, however, 2000 is
indistinguishable from 1900 because both are represented as "00." As a
result, if not modified, systems or applications that use dates or
perform date- or time-sensitive calculations may generate incorrect
results beyond 1999.
/Footnote2/-^Biomedical equipment refers to both medical devices regulated
by FDA, within the Department of Health and Human Services, and
scientific and research instruments, which are not subject to FDA
regulation. Pharmaceutical products also fall under FDA's regulatory
authority.
/Footnote3/-^Consumable medical products are expendable, disposable, or
nondurable supplies used for the treatment or diagnosis of a patient's
specific illness, injury, or condition. Examples include surgical gloves
and intravenous tubing.
/Footnote4/-^(GAO/AIMD-98-240, September 18, 1998), Year 2000 Computing
Crisis: Progress Made in Compliance of VA Systems, But Concerns Remain
(GAO/AIMD-98-237, August 21, 1998), Veterans Affairs Computer Systems:
Action Underway Yet Much Work Remains to Resolve Year 2000 Crisis (GAO/T-
AIMD-97-174, September 25, 1997), Veterans Benefits Computer Systems:
Risks of VBA's Year-2000 Efforts (GAO/AIMD-97-79, May 30, 1997), and
Veterans Benefits Modernization: Management and Technical Weaknesses
Must Be Overcome If Modernization Is To Succeed (GAO/T-AIMD-96-103).
/Footnote5/-^GAO/T-AIMD-99-136, April 15, 1999.
/Footnote6/-^Facility systems include building-related equipment such as
elevators, heating, ventilating, and air conditioning equipment,
lighting systems, security systems, and disaster recovery systems.
/Footnote7/-^GAO/AIMD-99-190R, June 11, 1999.
/Footnote8/-^Systems acceptance testing verifies that the complete system--
the full component of applications software running on the target
hardware and system software--satisfies specific requirements and is
acceptable to users.
/Footnote9/-^2000 and beyond.
/Footnote10/-^These include manufacturers and distributors.
/Footnote11/-^These 56 applications, which run at most VA health
facilities, were chosen for their date intensiveness and business
criticality. Included among the applications tested were inpatient and
outpatient pharmacy, radiology, laboratory, and surgery.
/Footnote12/-^OMB Memorandum M-99-17: Minimizing Regulatory and
Information Technology Requirements that Could Affect Progress Fixing
the Year 2000 Problem, May 14, 1999.
/Footnote13/-^Year 2000 Computing Crisis: Readiness Improving, But Much
Work Remains to Avoid Major Disruptions (GAO/T-AIMD-99-50, January 20,
1999).
/Footnote14/-^Examples of software that will be modified include
applications affected by cost-of-living adjustments that usually take
effect in January.
/Footnote15/-^(GAO/AIMD-10.1.19, August 1998).
/Footnote16/-^(GAO/AIMD-10.1.22, October 1999).
/Footnote17/-^OMB Memorandum M-00-01: Day One Planning and Request for
Updated Business Continuity and Contingency Plans, October 13, 1999.
/Footnote18/-^VISNs are 22 regional organizations encompassing medical
centers, nursing homes, and domiciliaries.
/Footnote19/-^The plans chosen for review included 19 medical facilities
in the three VISNs that we have been monitoring, and four facilities
that are co-located with a CMOP.
/Footnote20/-^GAO/T-AIMD-99-50, January 20, 1999.
/Footnote21/-^VBA's "desktop" simulation was not to include the actual
establishment of an emergency operations center or emergency backup sites.
/Footnote22/-^GAO/T-AIMD-99-136, April 15, 1999.
/Footnote23/-^Conditionally compliant equipment requires user intervention
to function in all aspects upon the Year 2000 change. These changes
include manufacturer software or hardware updates, or a one-time user
action, such as turning the equipment on/off. Noncompliant equipment
means a medical device will not function properly in all aspects upon
the Year 2000 change and no manufacturer remedy is available. Unknown
equipment means VHA has not been able to determine the compliance status
of equipment because it has not received compliance status information
from the manufacturer.
/Footnote24/-^GAO/AIMD-98-240, September 18, 1998.
/Footnote25/-^This institute is an international, nonprofit health
services research agency. It believes that superficial testing of
biomedical equipment by users may provide false assurances, as well as
create legal liability exposure for health care institutions.
/Footnote26/-^GAO/T-AIMD-99-136, April 15, 1999.
/Footnote27/-^Year 2000 Computing Challenge: Compliance Status Information
on Biomedical Equipment (GAO/T-AIMD-00-26, October 21, 1999).
/Footnote28/-^GAO/T-AIMD-99-136, April 15, 1999.
/Footnote29/-^These include operating systems, databases, and pharmacy
fulfillment application software.
/Footnote30/-^GAO/T-AIMD-99-136, April 15, 1999.
/Footnote31/-^This term refers to maintaining a limited inventory on hand.
/Footnote32/-^Many pharmaceutical manufacturers rely on automated systems
for production, packaging, and distribution of their products, as well
as for ordering of raw materials and supplies.
/Footnote33/-^This organization is responsible for supporting VHA's health
care delivery system by providing an acquisition program for items such
as medical, dental, and surgical supplies and equipment;
pharmaceuticals; and chemicals. The National Acquisition Center is part
of VA's Office of Acquisition and Materiel Management.
/Footnote34/-^Five additional firms were identified from survey responses
received after April 1999.
/Footnote35/-^This site identified the firms that were sent surveys and
those that responded.
/Footnote36/-^Firms that manufacture and distribute both pharmaceuticals
and medical/surgical equipment are included in the pharmaceutical
category.
/Footnote37/-^Pharmaceutical firms that also manufacture and distribute
medical gases and reagents (substances used in chemical reactions to
detect, measure, examine, or produce other substances).
/Footnote38/-^A coalition of drug manufacturers, wholesale distributors,
pharmacies, and health care organizations that are working closely with
government agencies to ensure a continued and substantial supply of
pharmaceuticals through January 1, 2000.
/Footnote39/-^GAO/AIMD-98-240, September 18, 1998.
/Footnote40/-^GAO/T-AIMD-00-26, October 21, 1999.
/Footnote41/-^GAO/AIMD-98-240, September 18, 1998.
/Footnote42/-^Year 2000 Computing Challenge: Concerns About Compliance
Information on Biomedical Equipment (GAO/T-AIMD-99-209, June 10, 1999).
/Footnote43/-^This includes medical devices and scientific and research
instruments, and other supporting products, such as printers and software.
/Footnote44/-^According to FDA, the contractor assisting it with the
clearinghouse verified that this web site link was operable.
/Footnote45/-^A ventricular assist device is a small electromechanical
pump that helps maintain blood circulation in patients suffering from
end-stage heart disease. Hemodialysis equipment cycles blood from a
patient's body to filter out body waste before returning the blood to
the patient.
/Footnote46/-^An example of a workaround is noting on the printout of an
EKG machine the year "2000" instead of "1900."
/Footnote47/-^These medical devices are characterized by their potential
for immediate and serious adverse health consequences for a patient if
they fail to function as designed or expected, including a failure to
initiate or continue operations.
/Footnote48/-^The 803 consisted of those manufacturers that had registered
PHRD products with FDA that were among the 90 types of PHRDs identified.
/Footnote49/-^Reasons given by manufacturers for declining to participate
included scheduling or resource limitations, and recent regular FDA site
inspections. Five manufacturing sites declined without giving a reason.
/Footnote50/-^These sites involved large, multisite manufacturers where
the FDA contractor had already selected two or more of the
manufacturer's sites. According to FDA, the contractor did not assess
duplicates if they came up in later samples.
/Footnote51/-^Biological products include vaccines, blood, and blood
products.
/Footnote52/-^GAO/T-AIMD-99-136, April 15, 1999.
/Footnote53/-^Orphan drugs are those produced under provisions of the
Orphan Drug Act (P.L. 97-414, ****ITCCentury Book:xa4**** 983, as
amended). The act provides incentives for manufacturers to produce drugs
that are used by a small number of patients to treat a specific, but not
widespread, medical condition.
/Footnote54/-^Center for Drug Evaluation and Research's Interim Report:
Assessment of the Pharmaceutical Industry's Readiness for Year 2000,
FDA, October 18, 1999.
/Footnote55/-^The site is located at http://www.fda.gov/cder/y2k.
/Footnote56/-^Consumable medical supplies include such items as
intravenous tubing, kidney dialysis filter units, and blood and blood
product bags.
/Footnote57/-^We summarized the results of our review in four compliance
categories--products that do not employ a date, products that are
compliant, products that are noncompliant, and products whose compliance
status is currently unknown. This last category includes those
manufacturers who reported that they have not completed an assessment of
their products, have discontinued a product, or have a product that is
now obsolete.
*** End of document. ***