Font Size Down Font Size Up Reset Font Size

Sign Up for Committee Updates

 

Witness Testimony of Randall B. Williamson, Director, Health Care, U.S. Government Accountability Office

VA Health Care:  Improvements Needed for Monitoring and Preventing Sexual Assaults and Other Safety Incidents

GAO Highlights

Why GAO Did This Study

During GAO’s recent work on services available for women veterans (GAO-10-287), several clinicians expressed concern about the physical safety of women housed in mental health programs at a Department of Veterans Affairs (VA) medical facility. GAO examined (1) the volume of sexual assault incidents reported in recent years and the extent to which these incidents are fully reported, (2) what factors may contribute to any observed underreporting, and (3) precautions VA facilities take to prevent sexual assaults and other safety incidents.

This testimony is based on recent GAO work, VA Health Care: Actions Needed To Prevent Sexual Assaults and Other Safety Incidents, (GAO-11-530) (June 2011). For that report, GAO reviewed relevant laws, VA policies, and sexual assault incident documentation from January 2007 through July 2010. In addition, GAO visited five judgmentally selected VA medical facilities that varied in size and complexity and spoke with the four Veterans Integrated Service Networks (VISN) that oversee them.

What GAO Recommends

GAO reiterated recommendations that VA improve both the reporting and monitoring of sexual assault incidents and the tools used to identify risks and address vulnerabilities at VA facilities. VA concurred with GAO’s recommendations and provided an action plan to address them.

What GAO Found

GAO found that many of the nearly 300 sexual assault incidents reported to the VA police were not reported to VA leadership officials and the VA Office of the Inspector General (OIG). Specifically, for the four VISNs GAO spoke with, VISN and Veterans Health Administration (VHA) Central Office officials did not receive reports of most sexual assault incidents reported to the VA police. Also, nearly two-thirds of sexual assault incidents involving rape allegations originating in VA facilities were not reported to the VA OIG, as required by VA regulation.

GAO identified several factors that may contribute to the underreporting of sexual assault incidents. For example, VHA lacks a consistent sexual assault definition for reporting purposes and clear expectations for incident reporting across its medical facility, VISN, and VHA Central Office levels. Furthermore, VHA Central Office lacks oversight mechanisms to monitor sexual assault incidents reported through the management reporting stream.

VA medical facilities GAO visited used a variety of precautions intended to prevent sexual assaults and other safety incidents. However, GAO found some of these measures were deficient, compromising medical facilities’ efforts to prevent sexual assaults and other safety incidents. For example, medical facilities used physical security precautions—such as closed-circuit surveillance cameras to actively monitor areas and locks and alarms to secure key areas. These physical precautions were intended to prevent a broad range of safety incidents, including sexual assaults. However, GAO found significant weaknesses in the implementation of these physical security precautions at the five VA medical facilities visited, including poor monitoring of surveillance cameras, alarm system malfunctions, and the failure of alarms to alert both VA police and clinical staff when triggered. Inadequate system configuration and testing procedures contributed to these weaknesses. Further, facility officials at most of the locations GAO visited said the VA police were understaffed. (See table below.) Such weaknesses could lead to delayed response times to incidents and seriously erode VA’s efforts to prevent or mitigate sexual assaults and other safety incidents.

Weaknesses in Physical Security Precautions in Residential Programs and Inpatient Mental Health Units at Selected VA Medical Facilities

Monitoring precautions Security precautions Staff awareness and preparedness precautions
  • Inadequate monitoring of closed-circuit surveillance cameras
  • Alarm malfunctions of stationary, computer-based, and personal panic alarms
  • Inadequate documentation or review of alarm testing
  • Failure of alarms to alert both unit staff and VA police
  • Limited use of personal panic alarms
  • VA police staffing and workload challenges
  • Lack of stakeholder involvement in unit redesign efforts

Source: GAO.


Chairwoman Buerkle, Ranking Member Michaud, and Members of the Subcommittee:

I am pleased to be here today as the Subcommittee discusses policies and actions to prevent sexual assaults and other safety incidents at Department of Veterans Affairs (VA) medical facilities. During our recent work on services available for women veterans in VA medical facilities, several clinicians expressed concern about the safety of women veterans housed in mental health programs at a VA medical facility’s residential mental health unit that also housed veterans who had committed past sexual crimes.[1] Clinicians were also concerned about the adequacy of existing safety precautions to protect women veterans being treated in the inpatient mental health units of this same facility. These concerns highlight the importance of VA having effective security precautions to protect all patients—especially those with residential and inpatient mental health programs—and a consistent way to exchange information about and discuss safety incidents, including sexual assaults.[2],[3]

My testimony today is based on our June 7, 2011 report:[4] (1) the volume of sexual assault incidents reported in recent years and the extent to which these incidents are fully reported, (2) what factors may contribute to any observed underreporting, and (3) the precautions in place in residential and inpatient mental health settings to prevent sexual assault and other safety incidents and any weaknesses in these precautions.

To examine the volume of sexual assault incidents reported to VA in recent years, the extent to which these incidents were fully reported, and factors that may contribute to any observed underreporting, we reviewed relevant VA and Veterans Health Administration (VHA) policies, handbooks, directives, and other guidance documents regarding the reporting of safety incidents.[5] We also interviewed VA and VHA Central Office officials involved with the reporting of safety incidents—including officials with VA’s Office of Security and Law Enforcement (OSLE) and VHA’s Office of the Deputy Under Secretary for Health for Operations and Management and Office of the Principal Deputy Under Secretary for Health.[6] In addition, we conducted site visits to five VA medical facilities. These judgmentally selected medical facilities were chosen to ensure that our sample: (1) had both residential and inpatient mental health settings; (2) reflected a variety of residential mental health specialties, including military sexual trauma; (3) had medical facilities with various levels of experience reporting sexual assault incidents; and (4) varied in terms of size and complexity.[7] During the site visits, we interviewed VA medical facility leadership officials and residential and inpatient mental health unit managers and staff to discuss their experiences with reporting sexual assault incidents. We also spoke with officials from the four Veterans Integrated Service Networks (VISN) responsible for managing the five selected VA medical facilities to discuss their expectations, policies, and procedures for reporting sexual assault incidents.[8] Information obtained from these VISNs and VA medical facilities cannot be generalized to all VISNs and VA medical facilities. In addition, we interviewed officials from the VA Office of the Inspector General’s (OIG) Office of Investigations—Criminal Investigations Division to discuss information they receive from VA medical facilities about sexual assault incidents that occur in these facilities. Further, we reviewed federal statutes related to sexual offenses and sentencing classification for felonies to verify that all rape allegations included in our review met the statutory criteria for felonies under federal law. Finally, we reviewed documentation of reported sexual assault incidents at VA medical facilities provided by VA’s OSLE, the VA OIG, and VISNs from January 2007 through July 2010, to determine the number and types of incidents reported, as well as which VA and VHA offices were notified of those incidents. For this analysis, we used a definition of sexual assault that was developed for the purpose of this report.[9] Our analysis of VA police and VA OIG reports was limited to only those incidents that were reported and cannot be used to project the volume of sexual assault incident reports that may occur in future years. Following verification that VA police and VA OIG incidents met our definition of sexual assault and comparisons of sexual assault incidents reported by the two groups within VA, we found data derived from these reports to be sufficiently reliable for our purposes.

To examine the precautions in place to prevent sexual assault and other safety incidents, we reviewed relevant VA, VHA, VISN, and selected medical facility policies related to the security of residential and inpatient mental health programs. We also interviewed VA, VHA, VISN, and selected VA medical facility officials about the precautions in place to prevent sexual assault incidents and other violent activities in the residential and inpatient mental health units. Finally, to assess any weaknesses in physical security precautions at the VA medical facilities selected for this review, we conducted an independent assessment of the precautions in place at each of our selected medical facilities—including the testing of alarm systems. These assessments were conducted by physical security experts within our Forensic Audits and Investigative Services team using criteria based on generally recognized security standards and selected VA security requirements. Our review of physical security precautions was limited to only those medical facilities we reviewed and does not represent results from all VA medical facilities.

We conducted our performance audit from May 2010 through June 2011 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. We conducted our related investigative work in accordance with standards prescribed by the Council of the Inspectors General on Integrity and Efficiency.

Background

VHA Central Office has responsibility for monitoring and overseeing both VISN and medical facility operations, including security precautions.[10] Day-to-day management of medical facilities, including residential and mental health treatment units, is the responsibility of the VISNs.

Residential Programs

VA has 237 residential programs at 104 of its medical facilities. These programs provide residential rehabilitative and clinical care to veterans with a range of mental health conditions, including those diagnosed with post-traumatic stress disorder and substance abuse. VA operates three types of residential programs in selected medical facilities throughout its health care system:

  • Residential rehabilitation treatment programs (RRTP). These programs provide intensive rehabilitation and treatment services for a range of mental health conditions in a 24 hours per day, 7 days a week structured residential environment at a VA medical facility.
  • Domiciliary programs. In its domiciliaries, VA provides 24 hours per day, 7 days a week, structured and supportive residential environments, housing, and clinical treatment to veterans. Domiciliary programs may also contain specialized treatment programs for certain mental health conditions.
  • Compensated work therapy/transitional residence (CWT/TR) programs. These programs are the least intensive residential programs and provide veterans with community-based housing and therapeutic work-based rehabilitation services designed to facilitate successful community reintegration.[11]

Inpatient Mental Health Units

Most (111) of VA’s 153 medical facilities have at least one inpatient mental health unit for patients with acute mental health needs. These units are generally a locked unit or floor within each medical facility, and the size of these units varies throughout VA. Care on these units is provided 24 hours per day, 7 days a week, and consists of intensive psychiatric treatment designed to stabilize veterans and transition them to less intensive levels of care, such as RRTPs and domiciliary programs. Inpatient mental health units are required to comply with VHA’s Mental Health Environment of Care Checklist that specifies several safety requirements for these units, including several security precautions, such as the use of panic alarm systems and the security of nursing stations within these units.

VA’s Two Reporting Streams for Safety Incidents

Safety incidents, including sexual assaults, may be reported to senior leadership as part of two different streams—a management stream and a law enforcement stream. The management reporting stream—which includes reporting responsibilities at the VA medical facility, VISN, and VHA Central Office levels—is intended to help ensure that incidents are identified and documented for leadership’s attention. In contrast, the purpose of the law enforcement stream is to document incidents that may involve criminal acts so they can be investigated and prosecuted, if appropriate. VHA policies outline what information staff must report for each stream and define some mechanisms for this reporting, but medical facilities have the flexibility to customize and design their own site-specific reporting systems and policies that fit within the broad context of these requirements. (Fig. 1 summarizes the major steps involved in each stream.)

Figure 1: VA Reporting Process for Sexual Assault and Other Safety Incidents

Flow Chart Showing the VA Reporting Process for Sexual Assault and Other Safety Incidents

a Facility reporting processes described in this graphic are based on our review of five selected VA medical facilities.

b VA OIG receives reports of potential felonies through additional reporting streams, including the VA OIG hotline and congressional contacts.

Management reporting stream. Reporting responsibilities at each level for this stream are as follows.

  • Local VA medical facilities. Local incident reporting is typically handled through a variety of electronic facility-based systems. It is initiated by the first staff member who observed or was notified of an incident, who completes an incident report in the medical facility’s electronic reporting system that is then reviewed by the medical facility’s quality manager. VA medical facility leadership is then notified, and is responsible for reporting serious incidents to the VISN.
  • VISNs. VA medical facilities can report serious incidents to their VISN through two mechanisms—issue briefs that document specific factual information and “heads up” messages that allow medical facility leadership to provide a brief synopsis of the issue while facts are being gathered for documentation in an issue brief. VISN offices are typically responsible for direct reporting to the VHA Central Office.
  • VHA Central Office. VISNs typically report all serious incidents to the VHA Office of the Deputy Under Secretary for Health for Operations and Management, which then communicates relevant incidents to other VHA offices, including the Office of the Principal Deputy Under Secretary for Health, through an e-mail distribution list.

Law enforcement reporting stream. Responsibilities at each level are described below.

  • Local VA police. Most VA medical facilities have a cadre of VA police officers, who are federal law enforcement officers charged with protecting the medical facility by responding to and investigating potentially criminal activities. Local policies typically require medical facility staff to notify the medical facility’s VA police of incidents that may involve criminal acts, such as sexual assaults. VA medical facility police also often notify and coordinate with local area police departments and the VA OIG when criminal activities or potential security threats occur.
  • VA’s OSLE. This office is the department-level VA office responsible for developing policies and procedures for VA’s law enforcement programs at local VA medical facilities. VA OSLE receives reports of incidents at VA medical facilities through its centralized police reporting system. Additionally, local VA police are required to immediately notify VA OSLE of serious incidents, including reports of rape and aggravated assaults.
  • VA’s Integrated Operations Center (IOC). The IOC, established in April 2010, serves as the department’s centralized location for integrated planning and data analysis on serious incidents.[12] Serious incidents on VA property are reported to the IOC either by local VA police or the VHA Office of the Deputy Under Secretary for Health for Operations and Management. The IOC then presents information on serious incidents to VA senior leadership officials through daily reports and, in some cases, to the Secretary through serious incident reports.
  • VA OIG. Federal regulation requires that all potential felonies, including rape allegations, be reported to VA OIG investigators.[13] VHA policy reiterates this by specifying that the OIG must be notified of sexual assault incidents when the crime occurs on VA premises or is committed by VA employees.[14] Typically, either the medical facility’s leadership team or VA police are responsible for reporting potential felonies to the VA OIG.[15] Once a case is reported, VA OIG investigators can be the lead agency on the case or advise local VA police or other law enforcement agencies conducting the investigation.

Nearly 300 Sexual Assault Incidents Reported to VA Police, but Many Were Not Reported to VHA or the VA OIG

We found that there were nearly 300 sexual assault incidents reported to the VA police from January 2007 through July 2010—including alleged incidents that involved rape, inappropriate touching, forceful medical examinations, forced or inappropriate oral sex, and other types of sexual assault incidents. Many of these sexual assault incidents were not reported to officials within the management reporting stream and to the VA OIG.

Nearly 300 Sexual Assault Incidents Reported to VA Police From January 2007 Through July 2010

We analyzed VA’s national police files from January 2007 through July 2010 and identified 284 sexual assault incidents reported to VA police during that period.[16],[17] These cases included incidents alleging rape, inappropriate touching, forceful medical examinations, oral sex, and other types of sexual assaults (see table 1).[18] However, it is important to note that not all sexual assault incidents reported to VA police are substantiated. A case may remain unsubstantiated because an assault did not actually take place, the victim chose not to pursue the case, or there was insufficient evidence to substantiate the case. Due to our review of both open and closed VA police sexual assault incident investigations, we could not determine the final disposition of these incidents.[19]

Table 1: Number of Sexual Assault Incidents by Category Reported to VA Police by Year, January 2007 through July 2010

Year

Rapea

Inappropriate touchb

Forceful medical examination

Forced or inappropriate oral sex

Otherc

Total

2010d

14

44

3

5

0

66

2009

23

66

3

3

9

104

2008e

13

42

1

3

1

60

2007e,f

17

33

1

2

1

54

Totalg

67

185

8

13

11

284

Source:  GAO (analysis); VA (data).

Note: In this report, we use the term sexual assault incident to refer to suspected, alleged, attempted, or confirmed cases of sexual assault. All reports of sexual assault incidents do not necessarily lead to prosecution and conviction. This may be, for example, because an assault did not actually take place or there was insufficient evidence to determine whether an assault occurred.

a The rape category includes any case involving allegations of rape, defined as vaginal or anal penetration through force, threat, or inability to consent. For cases that included allegations of multiple categories including rape (i.e., inappropriate touch, forced oral sex, and rape) the category of rape was applied. Cases where staff deemed that one or more of the veterans involved were mentally incapable of consenting to sexual activities described in the case were considered rape.

b The inappropriate touch category includes any case involving only allegations of touching, fondling, grabbing, brushing, kissing, rubbing, or other like terms.

c The other category included any allegations that did not fit into the other categories or if the incident described in the case file did not contain sufficient information to place the case in one of the other designated categories.

d Analysis of 2010 records was limited to only those received by VA police through July 2010.

e Due to the lack of a centralized VA police reporting system prior to January 2009, VA medical facility police sent reports to VA’s OSLE for the purpose of this data request, which may have resulted in not all reports being included in this analysis.

f Our ability to review files for the entire year was limited because VA police are required to destroy files after 3 years under a records schedule approved by the National Archives and Records Administration (NARA).

g Cases not reported to VA police were not included in our analysis of sexual assault incidents.

In analyzing these 284 cases, we observed the following:

  • Overall, the sexual assault incidents described above included several types of alleged perpetrators, including employees, patients, visitors, outsiders not affiliated with VA, and persons of unknown affiliation. In the reports we analyzed, there were allegations of 89 patient-on-patient sexual assaults, 85 patient-on-employee sexual assaults, 46 employee-on-patient sexual assaults, 28 unknown affiliation-on-patient sexual assaults, and 15 employee-on-employee sexual assaults.[20]
  • Regarding gender of alleged perpetrators, we also observed that of the
    89 patient-on-patient sexual assault incidents, 46 involved allegations of male perpetrators assaulting female patients, 42 involved allegations of male perpetrators assaulting male patients, and 1 involved an allegation of a female perpetrator assaulting a male patient. Of the 85 patient-on-employee sexual assault incidents, 83 involved allegations of male perpetrators assaulting female employees and 2 involved allegations of male perpetrators assaulting male employees.

Sexual Assault Incidents Are Underreported to VISNs, VHA Central Office, and the VA OIG

VISN and VHA Central Office officials did not receive reports of all sexual assault incidents reported to VA police in VA medical facilities within the four VISNs we reviewed. In addition, the VA OIG did not receive reports of all sexual assault incidents that were potential felonies as required by VA regulation, specifically those involving rape allegations.

VISNs and VHA Central Office Receive Limited Information on Sexual Assault Incidents

VISNs and VHA Central Office leadership officials are not fully aware of many sexual assaults reported at VA medical facilities. For the four VISNs we spoke with, we examined all documented incidents reported to VA police from medical facilities within each network and compared these reports with the issue briefs received through the management reporting stream by VISN officials. Based on this analysis, we determined that VISN officials in these four networks were not informed of most sexual assault incidents that occurred within their network medical facilities.[21] Moreover, we also found that one VISN did not report any of the cases they received to VHA Central Office. (See table 2.)

Table 2: Sexual Assault Incidents Reported to Four Selected VISNs and VHA Central Office Leadership, January 2007 through July 2010

VISN

Total number of sexual assault incidents reported to VA police from VISN medical facilitiesa,b

Total number of sexual assault incidents reported to VISN leadership by VISN medical facilities

Total number of sexual assault incidents reported by VISNs to VHA Central Office leadership

VISN A

13

0

0

VISN B

21

10

5

VISN C

34

4

4

VISN D

34

2

2

Source: GAO (data and analysis); VA (data).

Note: In this report, we use the term sexual assault incident to refer to suspected, alleged, attempted, or confirmed cases of sexual assault. All reports of sexual assault incidents do not necessarily lead to prosecution and conviction. This may be, for example, because an assault did not actually take place or there was insufficient evidence to determine whether an assault occurred.

a Cases not reported to VA police were not included in our count of sexual assault incidents.

b Due to the absence of systemwide requirements on what medical facilities must report to these VISNs, we could not determine the accuracy of VISN reporting.

VA OIG Did Not Receive Reports of about Two-Thirds of Sexual Assault Incidents Involving Rape Allegations

To examine whether VA medical facilities were accurately reporting sexual assault incidents involving rape allegations to the VA OIG, we reviewed the 67 rape allegations reported to the VA police from January 2007 through July 2010 and compared these cases with all investigation documentation provided by the VA OIG for the same period. We found no evidence that about two-thirds (42) of these rape allegations had been reported to the VA OIG.[22] The remaining 25 had matching VA OIG investigation documentation, indicating that they were correctly reported to both the VA police and the VA OIG.

By regulation, VA requires that: (1) all criminal matters involving felonies that occur in VA medical facilities be immediately referred to the VA OIG and (2) responsibility for the prompt referral of any possible criminal matters involving felonies lies with VA management officials when they are informed of such matters.[23] This regulation includes rape in the list of felonies provided as examples and also requires VA medical facilities to report other sexual assault incidents that meet the criteria for felonies to the VA OIG.[24],[25] However, the regulation does not include criteria for how VA medical facilities and management officials should determine whether or not a criminal matter meets the felony reporting threshold. We found that all 67 of these rape allegations were potential felonies because, if substantiated, sexual assault incidents involving rape fall within federal sexual offenses that are punishable by imprisonment of more than 1 year.

In addition, we provided the VA OIG the opportunity to review summaries of the 42 rape allegations we could not confirm were reported to them by the VA police. To conduct this review, several VA OIG senior-level investigators determined whether or not each of these rape allegations should have been reported to them based on what a reasonable law enforcement officer would consider a felony. According to these investigators, a reasonable law enforcement officer would look for several elements to make this determination, including (1) an identifiable and reasonable suspect, (2) observations by a witness, (3) physical evidence, or (4) an allegation that appeared credible. These investigators based their determinations on their experience as federal law enforcement agents. Following their review, these investigators also found that several of these rape allegations were not appropriately reported to the VA OIG as required by federal regulation. Specifically, the VA OIG investigators reported that they would have expected about one-third (33 percent) of the 42 rape allegations to have been reported to them based on the incident summary containing information on these four elements. The investigators noted that they would not have expected approximately 55 percent of the
42 rape allegations to have been reported to them due to either the incident summary failing to contain these same four elements or the presence of inconsistent statements made by the alleged victims.[26] For the remaining approximately 12 percent, the investigators noted that the need for notification was unclear because there was not enough information in the incident summary to make a determination about whether or not the rape allegation should have been reported to the VA OIG.

VHA Guidance and Oversight Weaknesses May Contribute to the Underreporting of Sexual Assault Incidents

Several factors may contribute to the underreporting of sexual assault incidents to VISNs, VHA Central Office, and the VA OIG—including VHA’s lack of a consistent sexual assault definition for reporting purposes; limited and unclear expectations for sexual assault incident reporting at the VHA Central Office, VISN, and VA medical facility levels; and deficiencies in VHA Central Office oversight of sexual assault incidents.

VHA Does Not Have a Consistent Sexual Assault Definition for Reporting Purposes

VHA leadership officials may not receive reports of all sexual assault incidents that occur at VA medical facilities because there is no VHA-wide definition of sexual assault used for incident reporting. We found that VHA lacks a consistent definition for the reporting of sexual assault through the management reporting stream at the medical facility, VISN, and VHA Central Office levels. At the medical facility level, we found that the medical facilities we visited had a variety of definitions of sexual assault targeted primarily to the assessment and management of victims of recent sexual assaults. Specifically, facilities varied in the level of detail provided by their policies, ranging from one facility that did not include a definition of sexual assault in its policy at all to another facility with a policy that included a detailed definition. At the VISN level, officials with whom we spoke in the four networks said they did not have definitions of sexual assault in VISN policies.[27] Finally, while VHA Central Office does have a policy for the clinical management of sexual assaults, this policy is targeted to the treatment of victims assaulted within 72 hours and does not include sexual assault incidents that occur outside of this time frame. In addition, no definition of sexual assault is included in VHA Central Office reporting guidance.

VHA Central Office, VISNs, and VA Medical Facilities’ Expectations for Reporting Are Limited and Unclear

In addition to failing to provide a consistent definition of sexual assault for incident reporting, VHA also does not have clearly documented expectations about the types of sexual assault incidents that should be reported to officials at each level of the organization, which may also contribute to the underreporting of sexual assault incidents. Without clear expectations for incident reporting there is no assurance that all sexual assault incidents are appropriately reported to officials at the VHA Central Office, VISN, and local medical facility levels. We found that expectations were not always clearly documented, resulting in either the underreporting of some sexual assault incidents or communication breakdowns at all levels.

  • VHA Central Office. An official from VHA’s Office of the Deputy Under Secretary for Health for Operations and Management told us that this office’s expectations for reporting sexual assault incidents were documented in its guidance for the submission of issue briefs. However, we found that this guidance does not specifically reference reporting requirements for any type of sexual assault incidents. As a result, VISNs we reviewed did not consistently report sexual assault incidents to VHA Central Office.
  • VISNs. Officials from the four VISNs we reviewed did not include detailed expectations regarding whether or not sexual assault incidents should be reported to them in their reporting guidance, potentially resulting in medical facilities failing to report some incidents.[28] For example, officials from one VISN told us they expect to be informed of all sexual assault incidents occurring in medical facilities within their network, but this expectation was not explicitly documented in their policy. We found several reported allegations of sexual assault incidents in medical facilities in this VISN—including three allegations of rape and one allegation of inappropriate oral sex—that were not forwarded to VISN officials.[29]
  • VA medical facilities. At the medical facility level, we also found that reporting expectations may be unclear. In particular, we identified cases in which the VA police had not been informed of incidents that were reported to medical facility staff. For example, we identified VA police files from one facility we visited where officers noted that the alleged perpetrator had been previously involved in other sexual assault incidents that were not reported to the VA police by medical facility staff. In these police files, officers noted that staff working in the alleged perpetrators’ units had not reported the previous incidents because they believed these behaviors were a manifestation of the veterans’ clinical condition. In addition, at this same medical facility, quality management staff identified five sexual assault incidents that had not been reported to VA police at the medical facility, despite these incidents being reported to their office.

Oversight Deficiencies at VHA Central Office Contribute to the Underreporting of Sexual Assault Incidents

We found weaknesses both in the way sexual assault incidents are communicated to VHA Central Office and in the way that information about such incidents is collected and analyzed for oversight purposes.

Poor Communication About Sexual Assault Incidents Resulted in Incomplete Reporting Within VHA Central Office

Currently, VHA Central Office relies primarily on e-mail messages to transfer information about sexual assault incidents among its offices and staff. (See fig. 2.) Under this system, VHA Central Office is notified of sexual assault incidents through issue briefs submitted by VISNs via e-mail to the VHA Office of the Deputy Under Secretary for Health for Operations and Management.[30] Following review, the Director for Network Support forwards issue briefs to the Office of the Principal Deputy Under Secretary for Health for distribution to other VHA offices on a case-by-case basis, including the program offices responsible for residential programs and inpatient mental health units. Program offices are sometimes asked to follow up on incidents in their area of responsibility.

Figure 2: VHA Central Office Reporting Process for Sexual Assault and Other Safety Incidents

Flow Chart Showing the VHA Central Office Reporting Process for Sexual Assault and Other Safety Incidents

a Program offices include those responsible for residential programs and inpatient mental health units.

b Office of the Deputy Under Secretary for Health for Operations and Management officials reported that they may distribute issue briefs directly to program officials depending on the severity of the incident.

We found that this system did not effectively communicate information about sexual assault incidents to the VHA Central Office officials who have programmatic responsibility for the locations in which these incidents occurred. For example, VHA program officials responsible for both residential programs and inpatient mental health units reported that they do not receive regular reports of sexual assault incidents that occur within their programs or units at VA medical facilities and were not aware of any incidents that had occurred in these programs or units. However, during our review of VA police files, we identified at least 18 sexual assault incidents that occurred from January 2007 through July 2010 in the residential programs or inpatient mental health units of the five VA medical facilities we reviewed. If the management reporting stream were functioning properly, these program officials should have been notified of these incidents and any others that occurred in other VA medical facilities’ residential programs and inpatient mental health units.[31] Without the regular exchange of information regarding sexual assault incidents that occur within their areas of programmatic responsibility, VHA program officials cannot effectively address the risks of such incidents in their programs and units and do not have the opportunity to identify ways to prevent incidents from occurring in the future.

In early 2011, VHA leadership officials told us that initial efforts, including sharing information about sexual assault incidents with the Women Veterans Health Strategic Health Care Group and VHA program offices, were underway to improve how information on sexual assault incidents is communicated to program officials. However, these improvements have not been formalized within VHA or published in guidance or policies and are currently being performed on an informal ad hoc basis only, according to VHA officials.

VHA Does Not Systematically Monitor and Track Sexual Assault Incidents

In addition to deficiencies in information sharing, we also identified deficiencies in the monitoring of sexual assault incidents within VHA Central Office. VHA’s Office of the Deputy Under Secretary for Health for Operations and Management, the first VHA office to receive all issue briefs related to sexual assault incidents, does not currently have a system that allows VHA Central Office staff to systematically collect or analyze reports of sexual assault incidents received from VA medical facilities through the management reporting stream. Specifically, we found that this office does not have a central database to store the issue briefs that it receives and instead relies on individual staff to save issue briefs submitted to them by e-mail to electronic folders for each VISN. In addition, officials within this office said they do not know the total number of issue briefs submitted for sexual assault incidents because they do not have access to all former staff members’ files. As a result of these issues, staff from the Office of the Deputy Under Secretary for Health for Operations and Management could not provide us with a complete set of issue briefs on sexual assault incidents that occurred in all VA medical facilities without first contacting VISN officials to resubmit these issue briefs.[32] Such a limited archive system for reports of sexual assault incidents received through the management reporting stream results in VHA’s inability to track and trend sexual assault incidents over time. While VHA has, through its National Center for Patient Safety (NCPS), developed systems for routinely monitoring and tracking patient safety incidents that occur in VA medical facilities, these systems do not monitor sexual assaults and other safety incidents. Without a system to track and trend sexual assaults and other safety incidents, VHA Central Office cannot identify and make changes to serious problems that jeopardize the safety of veterans in their medical facilities.

Serious Weaknesses Observed in Several Types of Physical Security Precautions Used in Selected Medical Facilities

Physical precautions in the residential programs and inpatient mental health units at the medical facilities we visited included monitoring precautions used to observe patients, security precautions used to physically secure facilities and alert staff of problems, and staff awareness and preparedness precautions used to educate staff about security issues and provide police assistance. However, we found serious deficiencies in the use and implementation of certain physical security precautions at these facilities, including alarm system malfunctions and inadequate monitoring of security cameras.

Several Types of Physical Security Precautions Are in Place in Selected Medical Facilities

VA medical facilities we visited used a variety of physical security precautions to prevent safety incidents in their residential programs and inpatient mental health units. Typically, medical facilities had discretion to implement these precautions based on their own needs within broad VA guidelines.

In general, physical security precautions were used as a measure to prevent a broad range of safety incidents, including sexual assaults. We classified these precautions into three broad categories: monitoring precautions, security precautions, and staff awareness and preparedness precautions. (See table 3.)

Table 3: Physical Security Precautions in Residential Programs and Inpatient Mental Health Units at Selected VA Medical Facilities

Monitoring precautions

Security precautions

Staff awareness and preparedness precautions

  • Closed-circuit surveillance camera use and monitoring
  • Unit rounds by VA staff
  • Locks and alarms at entrance and exit access points
  • Locks and alarms for patient bedrooms and bathrooms
  • Stationary, computer-based, and portable personal panic alarms
  • Separate or specially designated areas for women veterans
  • Staff training
  • VA police presence on units
  • VA police staffing and command and control operations

Source: GAO.

Note: Physical security precautions varied by VA medical facility and program and were not necessarily in place at all VA medical facilities and programs we visited.

  • Monitoring precautions. These measures were those designed to observe and track patients and activities in residential and inpatient settings. For example, at some VA medical facilities we visited, closed-circuit surveillance cameras were installed to allow VA staff to monitor areas and to help detect potentially threatening behavior or safety incidents as they occur. Cameras were also used to passively document any incidents that occurred.
  • Security precautions. These precautions were those designed to maintain a secure environment for patients and staff within residential programs and inpatient mental health units and allow staff to call for help in case of any problems. For example, the units we visited regularly used locks and alarms at entrance and exit access points, as well as locks and alarms for some patient bedrooms. Another security precaution we observed was the use of stationary, computer-based, and portable personal panic alarms for staff.[33]
  • Staff awareness and preparedness precautions. These measures were designed to educate and prepare residential program and inpatient mental health unit staff to deal with security issues and to provide police support and assistance when needed. For example, there was a regular VA police presence within some residential programs we visited. Also, all medical facilities we visited had a functioning police command and control center, which program staff could contact for police support when needed.

Significant Weaknesses Existed in the Use and Implementation of Certain Physical Security Precautions at Selected VA Medical Facilities

While security precautions have been established in most cases to prevent patient safety incidents, including sexual assaults, these precautions had not been effectively implemented by VA medical facility staff in the five facilities we visited. During our review of the physical security precautions in use at the five VA medical facilities we visited, we observed seven weaknesses in these three categories.[34] (See table 4.)

Table 4: Weaknesses in Physical Security Precautions in Residential Programs and Inpatient Mental Health Units at Selected VA Medical Facilities

Monitoring precautions

Security precautions

Staff awareness and preparedness precautions

  • Inadequate monitoring of closed-circuit surveillance cameras
  • Alarm malfunctions of stationary, computer-based, and personal panic alarms
  • Inadequate documentation or review of alarm testing
  • Failure of alarms to alert both unit staff and VA police
  • Limited use of personal panic alarms
  • VA police staffing and workload challenges
  • Lack of stakeholder involvement in unit redesign efforts

Source: GAO.

Inadequate monitoring of closed-circuit surveillance cameras. We observed that VA staff in the police command and control center were not continuously monitoring closed-circuit surveillance cameras at all five of the VA medical facilities we visited. For example, at one medical facility, the system used by the residential programs at that medical facility could not be monitored by the police command and control center staff because it was incompatible with systems installed in other parts of the medical facility. According to VA police at this medical facility, the residential program staff did not consult with VA police before installing their own system. At another medical facility, where staff in the police office monitor cameras covering the residential programs’ grounds and parking area, we found that the police office was unattended part of the time. In addition, at the remaining three medical facilities we visited, staff in the police command and control centers assigned to monitor medical facility surveillance cameras had other duties, such as serving as telephone operators and police/emergency dispatchers. These other duties sometimes prevented them from continuously monitoring the camera feeds in the police command and control center.[35] Although effective use of surveillance camera systems cannot necessarily prevent safety incidents from occurring, lapses in monitoring by security staff compromise the effectiveness of these systems.

Alarm malfunctions. At least one form of alarm failed to work properly when tested at four of the five medical facilities we visited. For example, at one medical facility, we tested the portable personal panic alarms used by residential program staff and found that the police command and control center could not accurately pinpoint the location of the tester when an alarm was activated outside the building. At another medical facility that used stationary panic alarms in inpatient mental health units, residential programs, and other clinical settings, almost 20 percent of these alarms throughout the medical facility were inoperable. At an inpatient mental health unit in a third medical facility, three of the computer-based panic alarms we tested failed to properly pinpoint the location of our tester because the medical facility’s computers had been moved to different locations and were not properly reconfigured. Finally, at a fourth medical facility, alarms we tested in the inpatient mental health unit sounded properly, but staff in the unit and VA police responsible for testing these alarms did not know how to turn them off after they were activated. In each of the cases where alarms malfunctioned, VA staff were not aware the alarms were not functioning properly until we informed them.

Inadequate documentation or review of alarm system testing. One of the five sites we visited failed to properly document tests conducted of their alarm systems for their residential programs, although testing of alarms is a required element in VA’s Environment of Care Checklist. Testing of alarm systems is important to ensure that systems function properly, and not having complete documentation of alarm system testing is an indication that periodic testing may not be occurring. In addition, three medical facilities reported using computer-based panic alarms that are designed to be self-monitoring to identify cases where computers equipped with the system fail to connect with the servers monitoring the alarms. Officials at all three of these medical facilities stated that due to the self-monitoring nature of these alarms, they did not maintain alarm test logs of these systems. However, we found that at two of these three medical facilities, these alarms failed to properly alert VA police when tested. Such alarm system failures indicate that the self-monitoring systems may not be effectively alerting medical facility staff of alarm malfunctions when they occur, indicating the need for these systems to be periodically tested.

Alarms failed to alert both police and unit staff. In inpatient mental health units at all five medical facilities we visited, stationary and computer-based panic alarm systems we tested did not alert staff in both the VA police command and control center and the inpatient mental health unit where the alarm was triggered. Alerting both locations is important to better ensure that timely and proper assistance is provided. At four of these medical facilities, the inpatient mental health units’ stationary or computer-based panic alarms notified the police command and control centers but not staff at the nursing stations of the units where the alarms originated. At the fifth medical facility, the stationary panic alarms only notified staff in the unit nursing station, making it necessary to separately notify the VA police. Finally, none of the stationary or computer-based panic alarms used by residential programs notified both the police command and control centers and staff within the residential program buildings when tested.[36]

Limited use of portable personal panic alarms. Electronic portable personal panic alarms were not available for the staff at any of the inpatient mental health units we visited and were available to staff at only one residential program we reviewed. In two of the inpatient mental health units we visited, staff were given safety whistles they could use to signal others in cases of emergency, personal distress, or concern about veteran or staff safety. However, relying on whistles to signal such incidents may not be effective, especially when staff members are the victims of assault. For example, a nurse at one medical facility we visited was involved in an incident in which a patient grabbed her by the throat and she was unable to use her whistle to summon assistance. Some inpatient mental health unit staff with whom we spoke indicated an interest in having portable personal panic alarms to better protect them in similar situations.

VA police staffing and workload challenges. At most medical facilities we visited, VA police forces and police command and control centers were understaffed, according to medical facility officials. For example, during our visit to one medical facility, VA police officials reported being able to staff just two officers per 12-hour shift to patrol and respond to incidents at both the medical facility and at a nearby 675-acre veteran’s cemetery. While this staffing ratio met the minimum standards for VA police staffing, having only two police officers to cover such a large area could potentially increase the response times should a panic alarm activate or other security incident occur on medical facility grounds. Also, we found that there was an inadequate number of officers and staff at this medical facility to effectively police the medical facility and maintain a productive police force. The medical facility had a total of 9 police officers at the time of our visit; according to VA staffing guidance, the minimum staffing level for this medical facility should have been 19 officers. Not all medical facilities we visited had staffing problems. At one medical facility, the VA police appeared to be well staffed and were even able to designate staff to monitor off-site residential programs and community-based outpatient clinics.

Lack of stakeholder involvement in unit redesign. As medical facilities undergo remodeling, it is important that stakeholders are consulted in the design process to better ensure that new or remodeled areas are both functional and safe. We found that such stakeholder involvement on remodeling projects had not occurred at one of the medical facilities we visited. At this medical facility, clinical and VA police personnel were not consulted about a redesign project for the inpatient mental health unit. The new unit initially included one nursing station that did not prevent patient access if necessary. After the unit was reopened following the renovation, there were a number of assaults, including an incident where a veteran reached over the counter of the unit’s nursing station and physically assaulted a nurse by stabbing her in the neck, shoulder, and leg with a pen. Had staff been consulted on the redesign of this unit, their experience managing veterans in an inpatient mental health unit environment would have been helpful in developing several safety aspects of this new unit, including the design of the nursing station. Less than a year after opening this unit, medical facility leadership called for a review of the units’ design following several reported incidents. As a result of this review, the unit was split into two separate units with different veteran populations, an additional nursing station was installed, and changes were planned for the structure of both the original and newly created nursing stations—including the installation of a new shoulder-height Plexiglas barricade on both nursing station counters.

In conclusion, weaknesses exist in the reporting of sexual assault incidents and in the implementation of physical precautions used to prevent sexual assaults and other safety incidents in VA medical facilities. Medical facility staff are uncertain about what types of sexual assault incidents should be reported to VHA leadership and VA law enforcement officials and prevention and remediation efforts are eroded by failing to tap the expertise of these officials. These officials can offer valuable suggestions for preventing and mitigating future sexual assault incidents and help address broader safety concerns through systemwide improvements throughout the VA healthcare system. Leaving reporting decisions to local VA medical facilities—rather than relying on VHA management and VA OIG officials to determine what types of incidents should be reported based on the consistent application of known criteria—increases the risk that some sexual assault incidents may go unreported. Moreover, uncertainty about sexual assault incident reporting is compounded by VA not having: (1) established a consistent definition of sexual assault, (2) set clear expectations for the types of sexual assault incidents that should be reported to VISN and VHA Central Office leadership officials, and (3) maintained proper oversight of sexual assault incidents that occurred in VA medical facilities. Unless these three key features are in place, VHA will not be able to ensure that all sexual assault incidents will be consistently reported throughout the VA health care system. Specifically, the absence of a centralized tracking system to monitor sexual assault incidents across VA medical facilities may seriously limit efforts to both prevent such incidents in the short and long term and maintain a working knowledge of past incidents and efforts to address them when staff transitions occur.

In addition, ensuring that medical facilities maintain a safe and secure environment for veterans and staff in residential programs and inpatient mental health units is critical and requires commitment from all levels of VA. Currently, the five VA medical facilities we visited are not adequately monitoring surveillance camera systems, maintaining the integrity of alarm systems, and ensuring an adequate police presence. Closer oversight by both VISNs and VHA Central Office staff is needed to provide a safe and secure environment throughout all VA medial facilities.

To improve VA’s reporting and monitoring of allegations of sexual assault, we are making numerous recommendations—in a report that we issued last week. We recommended VA improve the reporting and monitoring of sexual assault incidents, including ensuring that a consistent definition of sexual assault is used for reporting purposes, clarifying expectations for reporting incidents to VISN and VHA leadership, and developing and implementing mechanisms for incident monitoring. To address vulnerabilities in physical security precautions at VA medical facilities, we recommended that VA ensure that alarm systems are regularly tested and kept in working order and that coordination among stakeholders occurs for renovations to units and physical security features at VA medical facilities.

In responding to a draft of the report on which this testimony is based, VA generally agreed with the report’s conclusions and concurred with our recommendations. In addition, VA provided an action plan, which described the creation of a multidisciplinary workgroup to manage the agency’s response to many of our recommendations. According to VA’s comments, this workgroup will provide the Under Secretary for Health and his deputies with monthly verbal updates on its progress, as well as an initial action plan by July 15, 2011, and a final report by September 30, 2011.

Chairwoman Buerkle, Ranking Member Michaud, and Members of the Subcommittee, this concludes my prepared statement. I would be happy to respond to any questions either of you or other Members of the Subcommittee may have.

Contacts and Acknowledgments

For further information about this testimony, please contact Randall B. Williamson at (202) 512-7114 or williamsonr@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this testimony. Individuals who made key contributions to this testimony include Marcia A. Mann, Assistant Director; Emily Goodman; Katherine Nicole Laubacher; and Malissa G. Winograd.


[1] See GAO, VAHealthCare:VAHasTakenStepstoMakeServicesAvailabletoWomenVeterans,butNeedstoReviseKeyPoliciesandImproveOversightProcesses, GAO‑10‑287 (Washington D.C.: Mar. 31, 2010).

[2] In this report, we use the term safety incident to refer to intentionally unsafe acts—including criminal and purposefully unsafe acts, clinician and staff alcohol or substance abuse-related acts, and events involving alleged or suspected patient abuse of any kind. These safety incidents are excluded from the reporting requirements outlined by the VA National Center for Patient Safety (NCPS).

[3] In this report, we use the term sexual assault incident to refer to suspected, alleged, attempted, or confirmed cases of sexual assault. All reports of sexual assault incidents do not necessarily lead to prosecution and conviction. This may be, for example, because an assault did not actually take place or there was insufficient evidence to determine whether an assault occurred.

[4] See GAO, VAHealthCare:ActionsNeededToPreventSexualAssaultsandOtherSafetyIncidents, GAO‑11‑530 (Washington, D.C.: June 7, 2011).

[5] Within VA, VHA is the organization responsible for providing health care to veterans at medical facilities across the country.

[6] We also spoke with officials from VHA’s Office of Mental Health Services and the Women Veterans Health Strategic Health Care Group.

[7]VA medical facilities were selected to ensure that at least one facility with no experience reporting sexual assault incidents was included in our judgmental sample of facilities. Other selected medical facilities all had some experience reporting sexual assault incidents. To determine facilities’ histories of reporting sexual assault incidents, we reviewed closed investigations conducted by the VA Office of the Inspector General (OIG) Office of Investigations—Criminal Investigations Division. This selection allowed us to ensure that a greater variety of perspectives on sexual assault incidents were captured during our field work.

[8] Two of the facilities we visited were located within the same VISN.

[9] For the purposes of this report, we define sexual assault as any type of sexual contact or attempted sexual contact that occurs without the explicit consent of the recipient of the unwanted sexual activity. Assaults may involve psychological coercion, physical force, or victims who cannot consent due to mental illness or other factors. Falling under this definition of sexual assault are sexual activities such as forced sexual intercourse, sodomy, oral penetration or penetration using an object, molestation, fondling, and attempted rape or sexual assault. Victims of sexual assault can be male or female. This does not include cases involving only indecent exposure, exhibitionism, or sexual harassment.

[10] VHA oversees VA’s health care system, which includes 153 medical facilities organized into 21 VISNs.

[11] Compensated work therapy is a VA vocational rehabilitation program that matches work-ready veterans with competitive jobs, provides support to veterans in these positions, and consults with business and industry on their specific employment needs.

[12] VA defines serious incidents as those that involve: (1) public information regarding the arrest of a VA employee; (2) major disruption to the normal operations of a VA facility;  (3) deaths on VA property due to suspected homicide, suicides, accidents, and/or suspicious deaths; (4) VA police-involved shootings; (5) the activation of occupant emergency plans, facility disaster plans, and/or continuity of operations plans; (6) loss or compromise of VA sensitive data, including classified information; (7) theft or loss of VA-controlled firearms or hazardous material, or other major theft or loss; (8) terrorist event or credible threat that impacts VA facilities or operations; and (9) incidents on VA property that result in serious illness or bodily injury, including sexual assault, aggravated assault, and child abuse. See VA Directive 0321, SeriousIncidentReports (Jan. 21, 2010).

[13] See 38 C.F.R. § 1.204 (2010). Criminal matters involving felonies must be immediately referred to the OIG, Office of Investigations. VA management officials with information about possible criminal matters involving felonies are responsible for prompt referrals to the OIG. Examples of felonies include but are not limited to, theft of government property over $1,000, false claims, false statements, drug offenses, crimes involving information technology systems, and serious crimes against the person, i.e., homicides, armed robbery, rape, aggravated assault, and serious physical abuse of a VA patient. Additionally, another VA regulation requires that all VA employees with knowledge or information about actual or possible violations of criminal law related to VA programs, operations, facilities, contracts, or information technology systems immediately report such knowledge or information to their supervisor, any management official, or directly to the VA OIG. 38 C.F.R. § 1.201 (2010).

[14] VHA Directive 2010-014, AssessmentandManagementofVeteransWhoHaveBeenVictimsofAllegedAcuteSexualAssault (May 25, 2010).

[15] The VA OIG may also learn of incidents from staff, patients, congressional communications, or the VA OIG hotline for reporting fraud, waste, and abuse.

[16] Our analysis was limited to only those reports that were provided by the VA OSLE and does not include reports that may never have been created or were lost by local VA police or VA OSLE.

[17] We could not systematically analyze sexual assault incidents reported through VA’s management stream due to the lack of a centralized VA management reporting system for tracking sexual assaults and other safety incidents.

[18] To conduct this analysis, we placed VA police case files into these categories to describe the allegations contained within them.

[19] We could not consistently determine whether or not these sexual assault incidents were substantiated due to limitations in the information VA provided, including inconsistent documentation of the disposition of some incidents in the police files.

[20] Other allegations by relationship included: 1 employee-on-outsider assault, 2 employee-on-visitor assaults, 2 outsider-on-employee assaults, 2 outsider-on-outsider assaults,
1 outsider-on-patient assault, 1 outsider-on-visitor assault, 3 patient-on-visitor assaults,
3 unknown-on-employee assaults, 3 unknown-on-visitor assaults, 1 visitor-on-employee assault, and 2 visitor-on-patient assaults.

[21] Our review of the reports received by both VISN and VA Central Office officials was limited to only those documented in issue briefs and did not include the less formal heads-up messages. This is because heads-up messages are not formally documented and often are a preliminary step to a more formal issue brief.

[22] We did not require VA OIG to provide documentation for 9 incidents currently under investigation due to the sensitive nature of these ongoing investigations. Since we did not require this documentation, it is possible that some of these 9 ongoing investigations were included in the 42 rape allegations we could not confirm were reported to the VA OIG.

[23] See 38 C.F.R. § 1.204 (2010). Examples of felonies listed in this regulation include theft of government property over $1,000, false claims, false statements, drug offenses, crimes involving information technology systems, and serious crimes against the person,
i.e., homicides, armed robbery, rape, aggravated assault, and serious physical abuse of a VA patient.

[24] The VA Security and Law Enforcement Handbook defines a felony as any offense punishable by either imprisonment of more than 1 year or death as classified under
18 U.S.C. § 3559. See VA Handbook 0730, SecurityandLawEnforcement (Aug. 11, 2000). Federal statutes define certain sexual acts and contacts as federal crimes. See 18 U.S.C.
§§ 2241-2248. All federal sexual offenses are punishable by imprisonment of more than
1 year; therefore all federal sexual offenses are felonies and must be immediately referred to the VA OIG for investigation in accordance with VA regulation.

[25] For the purposes of our analysis, we focused only on sexual assault incidents involving rape allegations. Neither federal statutes nor VA regulations define rape; however, the definition of rape we developed for our analysis falls within the federal sexual offenses of either aggravated sexual abuse or sexual abuse. See 18 U.S.C. §§ 2241 and 2242. These two offenses are felonies under federal statute; therefore, all rapes that meet our definition are felonies.

[26] The VA OIG senior-level investigators who conducted this review noted that they identified at least one incident summary that was readily identifiable as a case currently under investigation by the VA OIG. Due to the general nature of the incident summaries we provided for their review and the sensitive nature of specific details of ongoing investigations, we did not require the VA OIG to provide specific details on exactly how many of the 42 rape allegations we asked them to review were currently under investigation by their office; however, the total number of ongoing sexual assault incident investigations for the time period of our analysis was only 9.

[27] However, some VISN officials stated they used other common definitions, including those from the National Center for Victims of Crime and The Joint Commission.

[28] While two of the four VISN policies reference The Joint Commission’s definition of sentinel events, which includes rape, this definition does not include the broader category of sexual assault incidents as defined in this report.

[29] When asked about these four allegations, VISN officials told us that they would only have expected to be notified of two of them—one allegation of rape and one allegation of inappropriate oral sex—because the medical facilities where they occurred contacted outside entities, including the VA OIG. VISN officials explained that the remaining two rape allegations were unsubstantiated and were not reported to their office; the VISN also noted that unsubstantiated incidents are not often reported to them.

[30] VISNs may also send a heads-up message to this office either by e-mail or phone to inform the Office of the Deputy Under Secretary for Health for Operations and Management of emerging incidents. These heads-up messages are typically the precursor to issue briefs received by the office.

[31] See GAO, InternalControl:StandardsforInternalControlintheFederalGovernment, GAO/AIMD‑00‑21.3.1 (Washington, D.C.: November 1999). Standards for internal control in the federal government state that information should be recorded and communicated to management and others within the agency that need it in a format and time frame that enables them to carry out their responsibilities.

[32] See GAO/AIMD‑00‑21.3.1. Standards for internal control in the federal government state that agencies should design internal controls that assure ongoing monitoring occurs in the course of normal operations, is continually performed, and is ingrained in agency operations.

[33] Stationary panic alarms are fixed to furniture, walls, or other stationary items and can be used to alert VA staff of a problem or call for help if staff feel threatened. Computer-based panic alarms are activated by depressing a specified combination of keys on a medical center keyboard. Portable personal panic alarms are small devices that staff can carry with them while on duty that can also alert VA staff of a problem if activated.

[34] Our review of physical security precautions at the five VA medical facilities we visited was limited to the residential programs, inpatient mental health units, and medical facility command and control centers.

[35] At some facilities, just one person was assigned to serve both functions, while at another location two people were expected to share those functions but only one person was present at the time of our visit due to staffing vacancies, illness, or shortages.

[36] One of the residential programs we reviewed did not use stationary panic alarm systems. This facility relied on portable personal panic alarms for its residential program staff.