WASHINGTON -- The Department of Veterans Affairs isn't following certain security standards at its hospitals and clinics that are required of all federal buildings, potentially putting patients and visitors at risk, the Government Accountability Office concluded in a report released Thursday.
The watchdog agency's report detailed shortcomings in VA security, most notably that it does not require facilities to alter security measures based on fluctuating threat levels.
"This could leave staff, patients, and visitors, as well as property, vulnerable to unmitigated risks," wrote Lori Rectanus, a director with the GAO.
The report was sent to congressional committees, VA Secretary David Shulkin and Homeland Security Secretary Kirstjen Nielsen. The VA agreed with the findings and responded that it was re-examining and updating its security policies.
Rectanus wrote in a letter to Rep. Phil Roe, R-Tenn., chairman of the House Committee on Veterans' Affairs, that the hundreds of VA hospital and clinics nationwide recently had been "the target of violence, threats and other security-related incidents -- including bomb threats and violent attacks involving weapons."
She referenced one fatal shooting in 2015, when a psychologist was killed at a VA clinic in El Paso, Texas.
"Ensuring physical security for these medical centers can be complicated because VA has to balance safety and security with providing an open and welcoming healthcare environment," Rectanus said.
The VA requires security cameras, silent distress alarms, perimeter fencing and a police force at all of its hospitals, the report states. But security levels differ at each facility, and there's little oversight.
The agency leaves security decisions to local officials, and it doesn't have system-wide performance measures. That means the VA doesn't have the ability to determine what security measures are effective, the GAO found.
"VA cannot ensure that local physical security decisions are based on actual risk, are appropriate to protect the facility and are effective or whether the variations or the security impact of them are important," the report states.
The type of oversight VA lacks is required of all government agencies by the Interagency Security Committee. The committee is a government body created by former President Bill Clinton in 1995, following the bombing of the Alfred P. Murrah Federal Building in Oklahoma City. Before then, minimum security standards did not exist for non-military federal buildings.
During the GAO review, inspectors traveled to nine VA hospitals from September 2016 to this month. They visited facilities in Bedford, Massachusetts; Houston; Los Angeles; Bay Pines, Florida; Sheridan, Wyoming; Washington, D.C.; Puget Sound, Washington; Orlando, Florida, and Louisville, Kentucky.
The staff levels of the police forces varied at each hospital and all of them had vacancies in their forces because of recruiting difficulties.
The VA agreed to comply with the GAO's recommendations that it change its risk-management policies and better oversee security at all of its hospitals. Gina Farrisee, VA deputy chief of staff, said in a letter that the agency would complete the recommendations by next January.