“Despite federal requirements, VA could not readily account for the various systems linkages and sharing arrangements,” the report concludes. “VA also could not provide an accurate inventory of the research data exchanged, where data were hosted, or the sensitivity levels of the data. In numerous instances, we identified unsecured electronic and hardcopy research data at VA medical centers and in co-located research facilities.”
The department does not have an effective data governance approach, and does not consistently have formal agreements with partners on protecting sensitive data, the OIG investigation found. Further, a decentralized approach to data collection and oversight does not effectively safeguard information.
The OIG recommends that VA implement a centralized governance model and establish formal agreements with research partners, and the assistant secretary for information and technology “generally concurred” with the recommendations. The OIG’s complete report is available here.
This story originally appeared at Health Data Management.
Joseph Goedert is news editor at Health Data Management.
