Page 28 - Federal Computer Week, January/February 2019

Trending
VA scraps appointment scheduling contract
The Department of Veterans Affairs is canceling a five-year, $624 million medical appointment scheduling contract to fast-track the scheduling module in its Cerner system, according to a VA report to House and Senate appropriators.
The contract was awarded to electronic health records firm Epic in 2015, on the heels of a scandal in which VA officials were shown to be falsifying reports to reduce official accounts of the wait times faced by veterans for medical visits.
Spending on the contract stalled as the VA sought to develop a low-cost in-house alternative. But in 2017, the department spent more than $17 million on the contract to pilot the Epic system in Columbus, Ohio. Overall, VA has spent $30 million on the Epic system, according to spending data on GovWin.
Epic officials have said the Medical Appointment Scheduling System is performing well, interfaces with existing systems across VA and could be fully deployed in two years.
However, in the wake of the decision to sole-source the VA’s EHR system to Cerner, the agency has opted to accelerate the deployment of the Cerner scheduling module. Officials plan to add the module to the first deployment of the new EHR system in 2020, with the scheduling software in place across VA by 2023.
“VA believes there is a return on investment in productivity and efficiency realized by accelerating the scheduling system,” wrote Jerome Pannullo, VA’s acting associate deputy assistant secretary, in a report to Congress.
— Adam Mazmanian
46% of respondents to an FCW survey said their agency’s shutdown plans proved adequate
Red team hackers breach Military Health System’s Genesis
Defense Department cybersecurity testers were able to break into MHS Genesis, the $5.5 billion commercial system being deployed to host the electronic health records of 9.5 million beneficiaries worldwide.
The system “is not survivable in a cyber- contested environment,” according to the unclassified summary of a report by the Director of Operational Test and Evaluation released publicly on Jan. 31.
initial operational capability launch completed last year. The system will be fielded enterprisewide in six waves that are scheduled to be finished by 2022.
“The adversarial assessments, such as the one highlighted in this report, help us develop a proactive and forward- leaning cybersecurity posture,” said Stacy Cummings, program executive officer of DHMS, in an emailed
statement.
More red team probes
of MHS Genesis are coming as a follow-on to the 2017 and 2018 rounds
28
January/February 2019 FCW.COM
That conclusion is
based on an adversarial
assessment conducted
in September 2018 and a red team probe from November 2017 through June 2018. DOT&E said the results of three successful cyberattacks against the system are detailed in a classified report. According to DOT&E’s unclassified summary, “all top-priority software defect incident reports” have been recommended for closure by the Department of Homeland Security.
In response to the results of the tests, the Defense Healthcare Management Systems (DHMS) and the Defense Health Agency established a Cyber Integrated Working Group to tackle high-priority vulnerabilities and flaws. The group assigned 34 tasks for completion in areas including medical device vulnerabilities, configuration management and incident response.
MHS Genesis is based on Cerner’s commercial EHR system and hosted in a special enclave in a Cerner data center in Kansas City, Mo. DOD’s records are physically separated from the data of the company’s commercial clients, and the facility is staffed in part by DOD personnel.
The system was installed at four sites in the Pacific Northwest as part of an
Stacy Cummings
of adversarial testing, according to a DHMS spokesperson.
The DOT&E report also delves into the system’s performance. The results were mixed but show an overall improvement over an April 2018 report that deemed MHS Genesis unsuitable for use and pointed to latency, long login times, system failures and bugs that potentially compromised patient safety.
The earlier report recommends that officials delay fielding the new system until they have addressed core usability problems. The latest report describes the system’s rollout as “not yet operationally effective or operationally suitable,” but it does not push for any delays in deployment.
Users gave MHS Genesis a rating of 40 out of 100 on the system usability scale. It was said to work well in only 18 of 70 clinical areas, and DOT&E’s report notes that “users satisfactorily performed only 45 percent of the medical and administrative tasks used as measures of performance.” Poor training and documentation were cited as problem areas.
— Adam Mazmanian