VA Addresses Security Flaws in Patient Advocate Tracking System, Impacts on Contracts Ahead

The recent findings from the Department of Veterans Affairs Office of Inspector General (VA OIG) concerning the Patient Advocate Tracking System-Replacement (PATS-R) have brought significant attention to both cybersecurity standards and procurement activities related to veteran healthcare technologies. This critical audit revealed alarming security weaknesses that classify the system as a moderate risk, a shift from its previous incorrect designation of low risk. The implications for contractors and firms involved in government healthcare IT provisions are profound; increased security requirements will likely lead to adjustments in existing contracts and the creation of new opportunities focused on compliance and technology security improvements.

The PATS-R system plays a vital role in documenting communications between the Veterans Health Administration (VHA) staff and veterans, which makes its security paramount. The OIG's report illustrates that the system, which stores sensitive health data, had originally been under-classified, allowing it to function without the robust security measures necessary to protect veterans' confidential information. The audit, which spanned from March 2025 through January 2026, prompted immediate action from the VA, compelling the office to reassess its risk management strategies and to aim for stringent compliance with federal cybersecurity standards.

Among the major findings, the OIG reported that approximately 77% of PATS-R users were unaware that they could access veterans' medical records through the system. Alarmingly, 89% indicated that losing access to this capability would not significantly impact their job functions. This lack of awareness not only raises concerns about user training but also poses reputational risks for the VA should there be an incident involving unauthorized access to sensitive data. The OIG underscored the need for procedural governance, better risk management practices, and user-education programs tailored to ensure that employees understand the implications of accessing and handling sensitive information.

The VA has accepted five key recommendations from the OIG aimed at enhancing the overall security framework of the PATS-R. These include enforcing least-privilege access protocols, enhancing governance and oversight measures, and conducting regular reviews of user permissions. Specifically, they must improve user training on both the system’s capabilities and appropriate security measures to mitigate risks in accessing veterans' health records. With these changes, the VA aims not only to protect sensitive information but also to reassure veterans that their data is safeguarded against potential breaches.

From a procurement perspective, this situation signals a growing demand for cybersecurity solutions and compliance-related services among government contractors. Organizations that support VA initiatives should prepare to align their offerings with the new requirements and actively monitor upcoming solicitations related to safeguarded IT solutions. The modifications to security requirements may prompt an increase in contract value and the type of services necessary to comply with strengthened protocols, thus enhancing contractors’ business opportunities.

As the VA transitions to more secure operational methodologies, there is a clear pathway for contractors in the cybersecurity sector to enhance their service offerings—especially those dealing with information technology and regulatory compliance in healthcare settings. Evaluating internal capabilities will be crucial as well, to ensure any bidding process can meet the anticipated heightened standards set forth by the VA. This also presents an opportunity for strategic partnerships with technology providers focusing on security, compliance, and training services.

As the situation surrounding PATS-R evolves, government contractors should remain vigilant and responsive to changes in policy, technology, and the demand for services associated with secure IT systems for veteran healthcare.

• VA OIG identifies security gaps within the PATS-R, initially misclassified as low risk.
• Risk reclassification to moderate risks indicates a urgent need for upgraded cybersecurity measures.
• Five actionable recommendations from the OIG aimed at bolstering security and governance have been accepted by the VA.
• Survey reveals 77% of users were unaware of their ability to view veteran medical records, signaling a training gap.
• VA’s automation of user access deactivation is a step forward, yet additional oversight is recommended.
• Companies active in veteran health IT procurement should reassess their capabilities to align with heightened security protocols.
• Growth in demand anticipated for contract modifications and new solicitations relating to healthcare IT cybersecurity solutions.
• VA confirms intention to strengthen governance around sensitive data accessibility and management.
• Emphasis placed on user education to prevent unauthorized access and safeguard veterans' sensitive information.
• Monitoring and proactive engagement in upcoming procurement opportunities related to regulatory compliance necessary for affected contractors.