bSI/Baker, Inc. automation

Source: VA.

We also testified in April that it was crucial that the CMOPs develop business continuity and contingency plans to ensure that veterans will continue to receive their medications should the CMOPs experience a Y2K-related failure. On September 3, 1999, the national CMOP director approved the Consolidated Mail Outpatient Pharmacy Year 2000 Contingency Plan which (1) defines the responsibilities of the national director, the local CMOP director, the national Y2K coordinators, the local Y2K coordinators, and the business resumption team; (2) establishes procedures for preparing and implementing the contingency plan and implementing it during the execution phase; and (3) provides a schedule of critical events and a time line for actions to be taken during the execution phase.

In addition, each of the seven CMOPs drafted contingency plans addressing core business processes. These plans, along with the Y2K Mail Transfer Contingency Test Procedures, which are the necessary steps relating to loss of the wide area network, were forwarded to the medical centers serviced by each CMOP during July and August of this year. Each medical center was asked to certify that the CMOP contingency plan had been reviewed and will be incorporated into the medical center’s Y2K contingency plan. However, according to the national CMOP Y2K coordinator, as of October 25, 1999, about half of the medical facilities had not returned their certifications.

According to the CMOP Y2K plan, the CMOPs are expected to completely test their plans by the end of October. Five CMOPs participated in a live test last month. Specifically, anticipating a direct hit from Hurricane Floyd, the Charleston CMOP reallocated the prescriptions for its 21 medical centers to four other CMOPs— Bedford, Dallas, Hines, and West Los Angeles. The Charleston CMOP lost 36 hours of production time, and 55,683 prescriptions had to be processed by the other CMOPs.

Like other users of pharmaceutical and medical-surgical products, VA needs to know whether it will have a sufficient supply of these items for its customers. Therefore, it has taken a leadership role in the federal government in determining whether manufacturers supplying these products to VHA are Y2K-ready. This information is essential to VHA’s medical facilities and CMOPs because of their "just-in-time" inventory policy.

Accordingly, they must know whether their manufacturers’ processes, which are highly automated, are at risk, as well as whether the rest of the supply chain will function properly.

We testified in April that VA’s National Acquisition Center sent a survey on January 8, 1999, to 384 pharmaceutical firms and 459 medical-surgical firms with whom it does business to determine their Y2K readiness. The survey contained questions on the firms’ overall Y2K status and inquired about actions taken to assess, inventory, and plan for any perceived impact that the century turnover would have on their ability to operate at normal levels. In addition, the firms were requested to provide status information on progress made to become Y2K compliant, and a reliable estimated date when compliance would be achieved for business processes such as (1) ordering and receipt of raw materials, (2) mixing and processing product, (3) completing final product processing, (4) packaging and labeling product, and (5) distributing finished product to distributors/wholesalers and end customers.

In March the acquisition center sent a second letter to its pharmaceutical and medical-surgical firms, informing them of VA’s plans to make Y2K readiness information previously provided to VA available to the public through a web site (www.va.gov/oa&mm/nac/y2k). VA made the survey results available on its web site on April 13, 1999. The letter also requested that manufacturers that had not previously responded provide information on their readiness. The acquisition center’s executive director said that he would personally contact any major VA supplier that did not respond.

According to an August 1, 1999, briefing report on their survey, the acquisition center reclassified the 517 companies that responded to the survey into three categories: "pharmaceutical firms,’’ "pharmaceutical, other firms," and "medical-surgical firms." As shown in table 4, as of August 1, 1999, the latest available date from VA, about one-third of the pharmaceutical firms, a little over one-third of the "pharmaceutical, other" and almost 44 percent of the medical-surgical firms had not responded to the survey.

Table 4: Status of Companies Surveyed by VHA as of August 1, 1999

To determine if all respondents who had initially provided an anticipated compliance date of July 31, 1999, or earlier had met this date, a follow-up survey was sent to 140 firms on July 20, 1999. As shown in table 5, as of October 26, 1999, about two-thirds (64 percent) responded to the survey. A little over half of the respondents (52 percent) completed the survey, while the remaining respondents forwarded company letters, Year 2000 readiness disclosure statements, and company financial statements with disclosures on Y2K readiness. Table 5 also shows that about half of the respondents did not meet the targeted date of July 31, 1999; almost 84 percent, however, anticipate full compliance by September 30, 1999. The results of this follow-up survey are not currently available on VA’s web site.

Table 5: Status of Companies with July 31, 1999, Or Earlier Anticipated Compliance Date as of October 26, 1999

On a broader level, VHA has taken a leadership role in obtaining and sharing information on the Y2K readiness of the pharmaceutical industry. Specifically, VHA chairs the Year 2000 Pharmaceuticals Acquisitions and Distributions Subcommittee, which reports to the Chair of the President’s Council on Year 2000 Conversion. The purpose of this subcommittee is to bring together federal and pharmaceutical representatives to address issues concerning supply and distribution as it relates to the year 2000. The subcommittee consists of representatives of FDA, federal health care providers, and industry trade associations such as the Pharmaceutical Research and Manufacturers of America, the National Association of Chain Drug Stores, and the National Wholesale Druggists’ Association. Several of these trade associations have surveyed their members on their Y2K readiness and have made the results available to the public. Further, the Pharmaceutical Alliance for Y2K Readiness announced on September 22, 1999, that consumers will have access to a substantial supply of medications during the Y2K date change and there should be no need for consumers to overbuy medications in preparation for Y2K.

The executive director of the National Acquisition Center told us that, based on his interactions with the trade associations, as well as results received from manufacturers, he is confident that there will be no shortage of medication and medical-surgical supplies. He explained that the major companies with unique drugs that VA relies on have responded that they will be ready and have provided the necessary resources and management attention. Further, he said, all ten of VA’s largest pharmaceutical and medical-surgical suppliers have responded to the survey and have taken actions to address the Y2K problem at their firms. Accordingly, the executive director does not plan to take any further action, including following up with those manufacturers that did not meet their anticipated compliance date of July 31, 1999, or September 30, 1999.

We believe that VHA needs to continue to follow up with pharmaceutical and medical-surgical firms that anticipated having compliant systems by July 31, 1999, and September 30, 1999, to determine whether these firms have addressed the Y2K problem. This information should also be made available on VHA’s web site.

INDUSTRIES ARE FOCUSED ON READINESS

Another key player in determining the Year 2000 compliance of biomedical equipment and pharmaceutical, biological, and consumable medical products is FDA, which has

oversight and regulatory authority in these areas. FDA’s role is to ensure that these

products are safe and effective for public use. In an effort to provide users with Y2K compliance information on their equipment, FDA has established the Federal Y2K Biomedical Equipment Clearinghouse. In addition, it has surveyed manufacturers of pharmaceutical, biological, and consumable medical products, to provide users with information on their Y2K readiness.

We reported in September 1998 that FDA was working to determine the compliance status of biomedical equipment; provide a comprehensive, centralized source of information on the Y2K compliance status of biomedical equipment used in the United States; and make this information publicly available on a web site. However, we also reported that FDA’s database did not include product compliance information from many manufacturers that had already provided such information to VHA, and also that VHA was not making this information available to the public. We therefore recommended that HHS and VHA jointly develop a single data clearinghouse containing information on the Y2K compliance status of biomedical equipment, and make this information publicly available. In response to our recommendation, FDA—in conjunction with VHA—established the Federal Y2K Biomedical Equipment Clearinghouse. In obtaining compliance status information from manufacturers, VHA, the Department of Defense, and the Health Industry Manufacturers Association all assisted FDA.

We testified last week that, according to FDA, 4,288 biomedical equipment manufacturers had submitted data to the clearinghouse as of October 4, 1999. Based on the data submitted, FDA places a manufacturer into one of four categories:

• Products that do not employ a date—manufacturer that reported Y2K status to be "All Products Do Not Use a Date."
• Products that are all compliant—manufacturer that reported products as Y2K compliant.
• Products with date-related problems—manufacturer that reported its Y2K status to be "Products With Date Related Problem."
• Product status is on the manufacturer’s web page—manufacturer that reported its Y2K status to be "Product Status Specified on a (Web) Page."

As shown in figure 1, as of October 4, 1999, 61 percent of the manufacturers reported

having products that do not employ a date, while 8 percent (342 manufacturers) reported having date-related problems such as incorrect display of date/time. According to FDA, the 342 manufacturers reported 1,035 specific products with date-related problems.

Reported to FDA by Manufacturers as of October 4, 1999.

Also, according to FDA, as of October 4, 1999, 132 manufacturers had not responded to the agency’s request for product compliance information. A senior FDA official told us that most of these manufacturers have gone out of business, do not make computerized products, or just cannot be located. The official added that FDA continues to follow up with these manufacturers nevertheless, through letters and telephone contact. The clearinghouse lists the names of these manufacturers that have not responded to FDA’s requests for product compliance information.

In our September 1998 report, we also noted that information on the FDA web site was not detailed enough to be useful. Specifically, the list of compliant equipment contained no information on the equipment’s make and model. We therefore recommended that VA and HHS include in the clearinghouse information on the compliance status of all biomedical equipment by make and model. FDA agreed with this recommendation, and subsequently requested this information from manufacturers; users can now find specific information on the make and model of compliant medical devices on the FDA web site.

As an alternative to obtaining biomedical equipment product compliance information from manufacturers and posting it to the Federal Y2K Biomedical Equipment Clearinghouse, FDA accepts equipment manufacturers’ references to their own web sites for compliance information. The clearinghouse provides users with a link directly to these web sites. As of October 4, 429 manufacturers had chosen this option.

While FDA is aware of the number of products and their reported compliance status for those manufacturers providing this information to the Federal Y2K Biomedical Equipment Clearinghouse, in testimony this past May FDA officials stated that they did

not know the total number of biomedical equipment products reported by manufacturers on their web sites, or how many of them were noncompliant. We subsequently reviewed information available through these web sites and reported in June that the quality of information available through them varied significantly. Specifically, we found that while most sites contained compliance information on at least one product, some sites contained insufficient information or did not clearly distinguish biomedical equipment from nonbiomedical products.

We subsequently updated our analysis of the web sites as of October 1, 1999, and found the following for the 429 manufacturers in FDA’s clearinghouse that refer users to their web sites:

• 354 manufacturers reported compliance status information for at least 33,598 individual biomedical equipment products,
• 71 manufacturers’ web sites either contained insufficient information on the number of products and their compliance status, or did not clearly distinguish biomedical equipment from nonbiomedical products,
• 3 web sites were those of vendors or distributors, not manufacturers, and
• 1 manufacturer’s web-site link in FDA’s clearinghouse did not work,

Because of the limitations cited above for many of the manufacturers’ web sites, our ability to determine the total number of biomedical equipment products reported and their compliance status was limited. Accordingly, the actual number of products reported by these manufacturers could be higher than the 32,598 that we counted.

As shown in figure 2, of the 32,598 products we identified on manufacturers’ web sites, about 54 percent reportedly do not employ a date, about 29 percent of the products are

considered compliant, and about 12 percent are reportedly noncompliant. The compliance status of the remaining 5 percent of products was unknown for reasons such as the manufacturer’s ongoing assessment of the product.

Reported on Manufacturers’ Web Sites as of October 1, 1999.

The 4,053 noncompliant products that we identified were from the web sites of 214 manufacturers. This number of products is about four times the number reported directly by FDA in its clearinghouse (1,035). Examples of these noncompliant products included a bedside monitor, film digitizer, ultrasound systems, radiology information systems, and laboratory information systems. Included among noncompliant potentially high-risk devices reported were ventricular assist devices and hemodialysis equipment.

In addition to supplying information on noncompliant products, most of the manufacturers with noncompliant products also provided solutions to correct the problem. Most (190) of the 214 manufacturers identified with noncompliant products provided at least one solution to correcting the problem. The solutions generally involved upgrades to hardware or software, manual action (such as turning the equipment on and off on January 1, 2000), or workarounds.

While compliance information is available through FDA's Federal Y2K Biomedical Equipment Clearinghouse, we have raised concerns in the past year about the lack of

independent verification and validation of biomedical equipment that manufacturers have certified as compliant. In addition to making sure that manufacturers provide detailed information on their products, we believe that it is essential that FDA provide some level of confidence that critical care and life support medical devices will work as intended.

In response to our recommendation to conduct independent verification and validation of biomedical equipment that manufacturers have certified as compliant, FDA is taking action to review a sample of biomedical equipment manufacturers’ Y2K activities, such as risk management, test planning and procedures, and implementation and contingency planning. Specifically, FDA’s acting deputy commissioner for policy testified in May 1999 that FDA proposed reviewing manufacturers’ test results supporting their compliance certifications for a sample of critical devices. FDA’s proposal consisted of two phases. In the first phase FDA would

• develop a list of the manufacturers of computer-controlled, potentially high-risk devices (PHRD);
• from this list of manufacturers, select a sample of 80 manufacturers for review; and
• hire a contractor to develop a program to assess manufacturers’ activities to identify and correct Y2K problems with PHRDs.

The goal of the first phase of the survey is to extrapolate from the 80 assessments a level of overall confidence in the biomedical equipment industry’s Y2K compliance activities. According to FDA, the second phase of the evaluation would be undertaken only if the results of the first phase indicated a need for further review of manufacturer Y2K activities because of concerns over how manufacturers are addressing product compliance.

In carrying out its plan to assess manufacturers’ Y2K activities, FDA identified 90 types of PHRD products, and issued a task order on July 1, 1999, for a contractor, assisted by two subcontractors, to perform assessments of the Y2K compliance activities for a sample of PHRD manufacturers. FDA identified 803 PHRD manufacturing sites that produce equipment sold in the United States. These were comprised of 726 biomedical equipment manufacturing sites and 77 manufacturing sites of blood and blood products equipment.

FDA’s contractor then randomly selected 325 of the 803 sites for possible assessment. These manufacturing sites were then contacted and asked if they would volunteer to participate in the process. As of October 4, 1999, of the 325 randomly selected sites,

• 197 were identified as producing no computer-controlled equipment,
• 80 agreed to participate,
• 26 declined to participate,
• 18 were duplicates, and
• 4 did not respond.

To carry out the on-site assessments of manufacturing sites, the contractor developed a guide for its examiners. This guide focused on the firm's Y2K activities in six areas: (1) executive leadership and control, (2) risk management, (3) corrective and preventive actions, (4) test planning and procedures, (5) communication with the consignee (user of the products), and (6) implementation and contingency planning.

After completing these assessments, examiners were required to prepare a report of concerns in each of the six areas reviewed at each manufacturing site. Concerns were identified as high, medium, or low, as defined below:

• high—relates to actions that are not timely, inadequate planning, inadequate or incomplete resources, incomplete or inaccurate deliverables, unable to validate results, and/or inadequate due diligence;
• medium—relates to actions that are somewhat late, incomplete planning, insufficient or incomplete resources, deficiencies in deliverables, and/or incomplete validation of results; and
• low—relates to actions that are on schedule, and have adequate resources.

According to FDA’s PHRD survey project manager, as of October 15, 1999, examiners had completed all 80 manufacturer site assessment visits, and had prepared 62 assessment reports.

We reviewed the 25 manufacturer site visit reports that were completed by the examiners and available to us as of September 10, 1999. For 20 of these assessments, concern was low. At the five remaining sites, the examiner assessed at least one concern as moderate in one of the six areas, such as test planning and procedures. According to the FDA PHRD survey project manager, the areas identified in the site visit reports as medium risks do not constitute a risk to patient health or safety.

Until recently, none of the site visit reports submitted to FDA contained a concern assessed as high. However, last week, the PHRD survey project manager informed us that FDA had received a site visit report with concerns accessed as high in two areas—leadership and control, and test planning and procedures. The report stated that the manufacturer’s polices and procedures were found to be inconsistent, ambiguous, and were not followed in a manner that would meet due diligence requirements. It also noted that the qualifications of the manufacturer’s personnel for specified tasks were not well defined, and that some personnel assigned to tasks identified in the policies and procedures were not qualified to perform those tasks. The report concluded that the manufacturer’s procedures for Y2K assessment and corrective and preventive action were less than adequate, and that assessment procedures had not been applied consistently. The manufacturer subsequently told the examiner that action would be taken on the issues raised.

Late last week, FDA’s Senior Associate Commissioner for Policy, Planning, and Legislation testified that FDA sent an inspector to follow up with this manufacturer. The FDA official said the inspector determined that the deficiencies noted would not affect patient safety. He also stated that FDA would continue to monitor the situation at this site.

Regarding the overall planned phase one report, the project manager told us that FDA’s contractor is in the process of preparing a final report summarizing the findings from the 80 site visit assessment reports, detailing any problems encountered during the project and recommending whether the second phase should be performed. Although FDA initially expected to submit a final report to HHS by October 1, it has not yet established a revised deadline. Accordingly, it does not know when this information will be made available to the public. We believe that this information should be made available as soon as possible.

To assess how the contractor was executing FDA’s task order, we observed selected site visit assessments. At the five manufacturing site assessments we observed, the examiners generally followed the contractor-developed audit guide, and were knowledgeable about information technology management, Y2K testing, and risk assessment. During our two initial visits, we noted that the examiners sometimes could not answer questions from the manufacturers relating to the FDA clearinghouse and the processing of the final report on the site assessments. We subsequently shared these observations with FDA official, who agreed to consider our suggestions, such as better communicating to the firms the final reporting process and how the FDA Federal Y2K Biomedical Clearinghouse works. During the later three visits, we did not observe any similar areas of concern.

FDA’s oversight and regulatory responsibility for pharmaceutical, biological, and consumable medical products is to ensure that they are safe and effective for public use. Since our April testimony, FDA has taken action to determine the Y2K readiness of these industries. Specifically, FDA is conducting voluntary surveys of manufacturers of pharmaceutical, biological, and consumable medical products for Y2K readiness. These surveys assess manufacturers’ plans and preparations to continue operations after January 1, 2000.

According to FDA’s Senior Associate Commissioner for Policy, Planning and Legislation, information obtained from these surveys thus far indicates that there will likely be no significant disruption of necessary supplies of pharmaceuticals, biologicals, or consumable medical products as a result of Y2K. FDA believes that essential medical supplies will be available, and that the drug supply will be safe and adequate.

To obtain information on the Y2K readiness of the pharmaceutical industry, on April 21, 1999, the FDA commissioner sent a letter to the presidents and CEOs of approximately 4,228 pharmaceutical manufacturers that produce prescription drugs, over-the-counter medication, bulk drugs, and also to drug distributors and repackagers, and medical gas manufacturers. In the letter, the commissioner requested the assistance of these firms in assuring the American public that the firms had addressed the Y2K problem as it affects the adequacy, safety and effectiveness of the supply of pharmaceuticals in the United States.

According to FDA’s Senior Associate Commissioner for Policy, Planning, and Legislation, as of October 8, 1999, 3,132 (74 percent) of the firms had responded to the survey. Of these, 95 percent stated that they would be Y2K ready by October 31, 1999. According to the senior associate commissioner, FDA is committed to maximizing the response, especially from the 274 priority manufacturers who produce sole source, orphan drugs, or the top 200 prescribed medications.

This FDA official testified on October 21, 1999, that, in addition to conducting the survey of pharmaceutical manufacturers, distributors, etc., FDA is taking the additional step of obtaining independent assurance of these firms’ Y2K assessments and corrections. The agency has obtained a contractor that is auditing each of 160 highest priority pharmaceutical firms, as well as a random sample of other firms. As of October 8, 1999, 88 percent of these assessments have been completed. The report stated that the results of their audits to date are positive and confirmed FDA’s expectation that the pharmaceutical industry has taken the necessary steps to prepare for the year 2000. The interim report is available on FDA’s web site.

FDA is also assessing the Y2K readiness of the biologics industry. In June, the Center for Biologics Evaluation and Research mailed a survey on Y2K readiness to 1,576 licensed biologics manufacturers and registered blood establishments. FDA also sent letters to biologics trade organizations requesting their assistance in encouraging their members to participate in the survey.

According to FDA’s senior associate commissioner, as of October 15, 1999, it had received responses from 1,483 (94 percent) of the licensed manufacturers and blood establishments. In addition, as with the pharmaceutical industry, FDA is conducting follow-up audits of 110 high-priority firms to assess their Y2K readiness. To date, FDA reports finding no problems with the audited firms. In addition, FDA is conducting random audits of other firms, and has completed audits of 48 of these with no problems identified as of October 14, 1999. FDA told us on October 27 that it plans to publicize the survey and audit results of the biologics manufacturers, although it has not established a date when this information will be available. We believe that this information should be made available as soon as possible.

FDA also mailed Y2K readiness surveys to 3,070 manufacturers of consumable medical supplies in June. This survey focused on manufacturers that produce critical devices that are used and consumed on a recurring basis during the delivery of essential health care services, as well as those whose availability is critical to the uninterrupted delivery of health care and patient welfare. As of October 14, 1999, FDA had received 2,074 responses (68 percent) to its survey. According to FDA’s senior associate commissioner, approximately 90 percent of these respondents report that they will be ready for Y2K by October 31, 1999.

FDA is also conducting audits of firms that supply medical consumables. It has given highest priority to 225 firms that produce devices that are only manufactured by a handful of those firms, as well as 57 manufacturers that are sole-source suppliers. According to FDA’s senior associate commissioner, to date, 197 of the high-priority firms have responded, and 48 of the 57 sole-source firms have responded. On October 27, 1999, FDA told us that it plans to make the detailed survey and audit results for consumable medical products manufacturers available to the public, but it has not yet determined the date when this will be done. We believe that it is critical to make this information available.

In summary, VA has made much progress in addressing the Y2K computer problem. However, some critical tasks remain in the areas of testing business continuity and contingency plans and reporting Y2K compliance status of key components such as facility systems at VHA medical facilities. VHA should also reassess its decision not to test biomedical equipment in those instances in which the manufacturer encourages such testing. Additionally, VA needs to continue to follow up with pharmaceutical and medical-surgical firms that anticipated having compliant systems by July 31, 1999, and September 30, 1999, respectively, and make this information available to the public through its web site.

Compliance status information on biomedical equipment can now be found in FDA’s clearinghouse or on manufacturers’ web sites. Also, to its credit, FDA has assessed the Y2K compliance activities of some PHRD manufacturing sites. This information should provide the American public with a higher level of confidence that medical devices will work as intended. FDA now needs to finalize its overall report on the results of its review of the PHRD manufacturing sites, and make this information available to HHS and the public through its web site.

We performed this assignment in accordance with generally accepted government auditing standards, from May through October 1999. In carrying out this assignment, we reviewed and analyzed VA's Y2K documents and plans, comparing them against our guidance on Y2K activities. More specifically, we observed VBA’s "dry run" testing of its benefits payment systems, VHA’s forward-date tests of its hospital information systems, and tests of CMOP Y2K fixes. We reviewed the test plans, selected test scripts, and test results for each Y2K test. We also reviewed business continuity and contingency plans for a sample of for VHA medical centers and VBA regional offices, as well as VBA data centers. In addition, we reviewed and analyzed FDA documentation relating to its Y2K efforts on biomedical devices and pharmaceutical manufacturers. More specifically, we identified the amount and quality of information on product compliance information available on biomedical equipment manufacturers’ web sites, reviewed information from those sites to identify the total number of biomedical equipment products reported, and categorized their compliance status. We also reviewed manufacturers’ web sites to assess the clarity and completeness of the information reported.

In addition, we visited selected VHA medical centers, VBA regional offices, VA data centers, and VHA consolidated mail outpatient pharmacies to discuss their Y2K activities, and interviewed VA and FDA officials about those activities. Finally, we interviewed selected private hospital officials about their Y2K actions and pharmaceutical trade associations on their Y2K readiness surveys of pharmaceutical manufacturers.

Mr. Chairman, this concludes my statement. I would be pleased to respond to any questions that you or other members of the Subcommittee may have at this time.

For information about this testimony, please contact Joel Willemssen at (202) 512-6253 or by e-mail at willemssenj.aimd@gao.gov. Individuals making key contributions to this testimony included Dr. Nabajyoti Barkakati, Michael Fruitman, Tonia Johnson, Helen Lew, Barbara Oliver, Mike Resser, and Henry Sutanto.

(511757)

Back to Witness List