Future Warfare: Army Is Preparing for Cyber and Electronic Warfare Threats, but Needs to Fully Assess the Staffing, Equipping, and Training of New Organizations

The rise of great-power competitors, such as China and Russia, prompted the Army to transform the way it plans to fight. The Army is developing a new warfighting concept to guide how its forces will engage jointly with other services in multiple domains, especially in cyber and space.

The House Armed Services Committee included a provision in House Report 115-200 accompanying a bill for the National Defense Authorization Act for Fiscal Year 2018 for GAO to review the Army's implementation of the concept. Among its objectives, this report addresses (1) how the Army is changing its doctrine, organizations, and training in order to execute multi-domain operations; and (2) the extent to which the Army has established new cyber and electronic warfare units, including any challenges faced by these units, and whether the Army assessed risks associated with its plan to establish these units.

GAO reviewed Army concepts, doctrine, force design, and training documents concerning multi-domain operations. GAO also interviewed Army and Department of Defense officials.

The Army is changing aspects of its doctrine, organizations, and training to develop a force that can effectively engage great-power competitors—Russia and China—through multi-domain operations by 2028. Multi-domain operations present adversaries with multiple challenges across multiple domains (land, air, sea, cyber, and space) in contested environments. To this end, the Army is revising its doctrine to guide how the force and specific units will function. The Army is also reorganizing its force by creating new units to conduct missions in multiple domains and by updating the responsibilities of key Army formations, such as Army divisions. Also, the Army is training its combat forces for multi-domain operations in part by increasing the focus on cyber operations.

The Army is establishing new cyber and electronic warfare units for multi-domain operations, but did not fully assess the risk of activating some units at an accelerated pace and is experiencing staffing, equipping, and training challenges. For example, the Army activated a cyber battalion in December 2018, and as of March 2019, this unit was understaffed by more than 80 percent. Army guidance directs the Army staff to conduct assessments on new units to determine whether the Army can staff, equip, and train these organizations. However, Army leadership believed the threats justify developing these units at an accelerated pace. Consequently, the Army did not assess the staffing, equipping, and training risk before activating one unit, and only conducted an initial risk assessment before activating a second unit. As a result, senior Army leaders may not know what other challenges could arise, such as sustainment, as the units grow in capabililty. Army officials told GAO that as these units evolve, it is uncertain when more comprehensive risk assessments would take place. The Army has previously accelerated the activations of other units when it saw fit to do so, and is considering creating other new units for multi-domain operations. If the Army does not assess risks for units activated at an accelerated pace, those units may be unable to effectively conduct multi-domain operations.

GAO is making three recommendations, including that the Army comprehensively assess the risk of staffing, equipping, and training the cyber and electronic warfare units that it has activated at an accelerated pace, and to do so for new organizations it plans to activate in an accelerated manner for multi-domain operations. The Army concurred with one recommendation and partially concurred with two recommendations. GAO clarified the recommendations, as discussed in the report.

In recent years, the Department of Defense (DOD) and the Army have  cited growing concerns about the ability to operate in contested security  environments. After a decade of counterinsurgency operations in Iraq and  Afghanistan, and what the unclassified Summary of the 2018 National  Defense Strategy called strategic atrophy, DOD concluded that its  competitive military advantage is eroding. Several DOD reports,  testimonies, and guidance all refer to the threats posed by both great- power competitors—particularly China and Russia—and other  adversaries, now and into the future. These threats are defined by rapid  technological change, competition with the United States through  operations below the threshold of armed conflict, and potential challenges  from adversaries in every operating domain, especially cyber and space.

Against this backdrop, the Army has been developing a new Army  Operating Concept, which the Army is using to define how its forces will  engage jointly with the other services for the task of deterring and  defeating Chinese and Russian aggression in both competition and  conflict. The Army calls this concept The U.S. Army in Multi-Domain  Operations 2028, and it would enable the Army to confront adversaries in  contested environments by presenting those adversaries with multiple  challenges across multiple domains (land, air, sea, cyber, and space).  The multi-domain operations concept will significantly affect Army  doctrine, organizations, and training in the coming years.

The Army’s effort to rethink its overarching warfighting concept comes at  a time when it is also undertaking a significant effort to modernize the  force, while also rebuilding and sustaining the readiness of the current  force. In September 2018, we reported that the Army had reprioritized  tens of billions of dollars in planned modernization spending for new  priorities that support multi-domain operations, and also had established  a new Army Futures Command to provide additional guidance for its  modernization effort. In that report, we found that the Army had set  decisively defeating great-power competitors as an overarching objective,  but had not established processes for evaluating its modernization efforts  against this objective, and had not completed a cost analysis of its near- term modernization efforts. Further, we also reported in January 2019  that establishing the Army Futures Command creates unique  opportunities for the Army to improve its modernization efforts and that  the Army has generally applied leading management practices, such as  well-defined team goals and senior management support, to its  modernization. However, we also reported that the Army may be  beginning weapon systems development before technology is sufficiently  mature. This raises the risk that the resulting systems could experience cost increases, delivery delays, or failure to deliver desired capabilities.  We also testified on these issues in May 2019.

Recognizing the significance of this effort and the need for multi-service  involvement, the House Armed Services Committee included a provision  in House Report 115-200 accompanying a bill for the National Defense  Authorization Act for Fiscal Year 2018 for us to review the Army’s  progress in implementing the new warfighting concept. This report  addresses (1) how the Army is changing its doctrine, organizations, and  training in order to execute multi-domain operations; (2) the extent to  which the Army has established new cyber and electronic warfare units,  including any challenges faced by these units, and whether the Army  assessed risks associated with its plan to establish these units; and (3)  how the Army has engaged with the Joint Staff and other services to  develop its new warfighting concept.

To address our first objective, we reviewed the Army’s concepts related to  multi-domain operations. We reviewed Army doctrine—the fundamental  principles by which the Army guides actions in support of its objectives— related to overall operations, cyber operations, and fires, which includes  artillery, rockets, and missiles. We reviewed force structure documents,  such as force design updates, Army Structure Memorandums, and other  associated briefings related to planned changes, as well as changes  being considered for the future. We reviewed strategies related to  different types of training, in particular those dealing with cyber operations  training and electronic warfare. We spoke with officials at Army  headquarters, Army Futures Command, and Army Training and Doctrine  Command (TRADOC). At Army headquarters, we met with  representatives in the Deputy Chief of Staff G-3/5/7 and the G-8. At  Army Futures Command, we met with representatives of the Army  Futures and Concepts Center, including the officials who wrote the  Army’s multi-domain-related concepts. Within TRADOC, we spoke with  officials at the Combined Arms Center who focused on doctrine  development and training, as well as the Force Development Directorate,  the Fires Center of Excellence, and the Cyber Center of Excellence. We  also spoke with members of the Army’s Cyber Protection Brigade, Joint  Force Headquarters-Cyber, and members of U.S. Army Pacific.

To address our second objective, we reviewed Army doctrine related to  overall operations, cyber operations, and fires. We reviewed force  structure documents, such as force design updates, Army Structure  Memorandums, and other associated briefings related to planned  changes, as well as changes being considered for the future. We spoke  with Army headquarters officials in charge of building new cyber units, as  well as officials at Army Futures Command and TRADOC. We compared  the Army’s process for establishing new cyber and electronic warfare  units with the Army guidance and the Standards for Internal Control in the  Federal Government.

To address our third objective, we reviewed Army white papers and  concept documents related to multi-domain operations, including the new  Army Operating Concept published in December 2018—TRADOC  Pamphlet 525-3-1: The U.S. Army in Multi-Domain Operations 2028—as  well as related concepts and papers from the Joint Staff and other  services addressing multi-domain operations. We reviewed Army and  Joint Staff guidance on developing concepts to understand existing  requirements and frameworks for inter-service and Joint Staff  collaboration on the development of concepts. We also reviewed other  documentation for evidence of collaboration between the Army and the  Joint Staff and other services, such as working group meetings, after- action reports on tabletop exercises, and agreements. We also met with  Army officials, including officials from Army headquarters and TRADOC,  to determine how the Army is developing its concept, and with Joint Staff  and other services’ officials, including J-7 Joint Concept Development, Air  Force Air Combat Command, Marine Corps Futures Directorate, and U.S.  Navy Fleet Forces, to understand the degree of collaboration, as well as  current challenges and plans for developing multi-domain concepts. We  discussed the results of our assessment with the Joint Staff and officials  from the military services.

We conducted this performance audit from December 2017 to August  2019 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.

According to the Summary of the 2018 National Defense Strategy and the  Army, the character of warfare is changing. For decades, the United  States enjoyed uncontested or dominant superiority in every operating  domain—land, air, sea, cyber, and space—but today every domain is  likely to be contested by other great-power competitors and potential  regional adversaries. Figure 1 below describes these operating domains.

Since at least 2012, DOD began shifting its focus from counterinsurgency  operations in Iraq and Afghanistan to adversaries who possess more  sophisticated capabilities. For example:  In 2012, DOD issued strategic guidance that cited efforts by Iran and  China to pursue cyber and electronic warfare capabilities with the  ability to counter U.S. power projection and limit operational access.

The 2014 Quadrennial Defense Review acknowledged the efforts of  China and others to counter U.S. strengths using anti-access and  area-denial approaches and using new cyber and space control  technologies. The 2014 Quadrennial Defense Review also  addressed the rapid evolution of modern warfare, including  increasingly contested battlespaces in the air, sea, space and cyber  domains.

In 2016, an Army study of Russia’s operations and doctrine concluded  that Russia employs formations, operational concepts, and  capabilities that overmatch U.S. capabilities in range and lethality,  thus challenging the Army’s ability to conduct operations and win  battles.

The 2017 National Security Strategy stated that U.S. advantages are  shrinking as rival states modernize their forces. The 2017 National  Security Strategy identified many of the challenges that China and Russia  pose, including Russia’s use of offensive cyber efforts to influence public  opinion, and how cyberattacks have become a key feature of modern  warfare. A classified National Defense Strategy followed in January 2018,  and the unclassified summary cited challenges to the U.S. military  advantage as a shift in the global environment.

Purpose and Origins of the Multi-Domain Operations Concept

The Army’s multi-domain operations concept originates from an Army  effort to rethink how it will fight in the new, more complex operating  environment. The Army defines multi-domain operations as ways for  confronting adversaries in contested environments by presenting them  with multiple challenges through the combining of multiple capabilities.  This means that ground forces should be able to operate freely in other  warfighting domains and, if necessary, be able to overwhelm an  adversary’s forces by combining capabilities across different domains,  such as land, air, sea, cyber, and space simultaneously.

According to Army officials, in 2014 the then-Deputy Secretary of Defense  tasked the Army to update its warfighting concept to deal with the threats  and challenges posed by great-power competitors in the future operating  environment. The Army officials added that around the same time, the  Army began developing and running a wargame scenario focused on a  threat that employed similar doctrine, tactics, and capabilities as those  used by Russia in Ukraine. In 2016, the Army also assessed the  increasingly sophisticated Russian military capabilities and identified  specific multi-domain challenges that the Army would face if it came into  conflict with Russia. Army officials said that its analysis highlighted the  urgency of updating how it would fight such an adversary. In beginning to  develop this concept, the Army reached out to the Marine Corps, as both  services face similar problems in ground-combat operations.

Since the Army began developing its concept, the Army established a  framework for assessing how the adversary operates and the problems  the Army needs to resolve as a ground force. For example, early on the  Army developed an expanded battlefield that stretches far beyond the  front lines, or “close area”, where ground forces face off against each  other. Under this expanded battlefield, adversaries can use more  sophisticated weapons and cyber capabilities that are based in distant  and protected territories, potentially reaching targets that are located well  behind the front lines, even within the continental United States. Figure 2  below depicts the Army’s new expanded battlefield for multi-domain  operations, including a description of each area of the battlefield.

The Army Is Changing Its Doctrine, Organizations, and Training to Execute Multi-Domain Operations

The Army is changing aspects of its doctrine, organizations, and training  simultaneously to develop a force that can effectively engage great-power  competitors, such as Russia and China, across multiple domains, and  expects this process to continue through the 2020s. Army concepts  propose new approaches for the Army to develop capabilities against  emerging challenges. The new Army Operating Concept built around  multi-domain operations is intended to drive capability development,  which is addressed through changes to the Army’s doctrine,  organizations, and training, among other areas. The Army’s goal is to field  a more lethal and capable force by 2028 that is able to dominate  adversaries in a multi-domain environment. Figure 3 below summarizes  how the Army uses validated concepts to drive changes in capabilities  and the force.

Doctrine. Given the Army’s attention to multi-domain operations, it has  updated or is in the process of updating doctrine that guides how the  Army fights. Primary among this effort is updating the Army’s overarching  operations field manual, which establishes how the Army conducts large- scale ground combat operations against the threat posed by a great- power competitor, among other things. In its most recent revision to its  doctrine, the Army incorporated several aspects of multi-domain  operations, such as the expanded battlefield that includes cyber and the  electromagnetic spectrum. TRADOC officials stated that they are also in the process of updating doctrine related to cyber operations and field  artillery operations in order to build a force that can integrate both cyber  capabilities and long-range fires—such as artillery, rockets, and  missiles—for multi-domain operations. The officials added that the Army  is developing or is planning to develop specific doctrinal guidance for new  Army units that will focus on multi-domain operations in the areas of  intelligence, cyber, electronic warfare, and space.

Organizations. The Army wants to ensure that its warfighting  organizations have the engineering, artillery, air defense, and other  enabling capabilities needed to conduct multi-domain operations. For  example, the Army believes that formations above the brigade level, such  as division headquarters and corps headquarters, must have the ability to  conduct electronic warfare and cyber operations. To that end, the Army is  creating several new organizations focused on cyber and electronic  warfare (discussed later in the report). Additionally, the Army is trying to  align its multi-domain operations concept with a complementary concept  focused on the roles and responsibilities of these organizations above the  brigade level. Expanding the roles and responsibilities of formations  above the brigade level signifies a departure from the Army’s modular  force, which was implemented beginning in 2004. At that time, the Army  embedded “key enablers” such as military intelligence, reconnaissance,  and logistics functions, as well as other specialized personnel and  equipment, into brigade combat teams to provide them independent  capabilities. Moving forward, the Army envisions enhancing the  capabilities of brigade combat teams for multi-domain operations, as well  as providing additional key capabilities to formations above the brigade  level. For example:

Brigade combat teams. Brigade combat teams are the Army’s primary  tactical unit, composed of around 4,400-4,700 soldiers. They are  being adjusted to conduct operations in the cyber domain, including  new platoons focused on electronic warfare.

Army division headquarters. Army divisions command multiple  brigade combat teams. The Army expects division headquarters to  manage the electromagnetic spectrum and to be the primary echelon  for integrating aviation, fires, and electronic warfare into ground  maneuver to defeat enemies in a close fight.

Army corps headquarters. Army corps command multiple divisions.  Under the Army’s concept, the Army corps headquarters will be the  primary echelon for defeating mid- and long-range enemy artillery  fires. The Army corps will also integrate artillery rockets and missiles,  as well as cyber capabilities in support of division or brigade ground  operations.

Field armies. Field armies, which have the ability to command two or  more Army corps, are forward-stationed in regions with capable  threats posed by great-power competitors. They will conduct  campaigns to compete with adversaries short of armed conflict, and  manage the transition to armed conflict should it be needed. The field  army will also direct deception operations and provide long-range  artillery and fires support.

Theater armies. Theater armies are also forward-stationed forces and  will be responsible for managing and combining Army capabilities in  support of information environment operations and space  operations. The theater army must be able to protect joint bases and  networks and enable access to the theater.

Training. The Army is also updating its training across a broad range of  efforts. Army training officials stated that there is a need to train units  collectively under multi-domain operations conditions against great-power  competitors like Russia and China, per guidance from the Chief of Staff of  the Army. The commander of Army Forces Command also issued  guidance for fiscal year 2019 to help train and prepare soldiers to conduct  multi-domain operations. This guidance included increasing the realism  and rigor of every unit rotation to one of the Army’s combat training  centers, as well as designing warfighter exercises that focus on units  conducting operations in contested electronic warfare, cyber, and space  environments. Additionally, the training officials stated that in recent years  the Army has updated its decisive-action training scenarios to include  regional versions for Europe, the Pacific, and Africa that comply with the  multi-domain operations concept. The officials added that, in future  years, several Army organizations will be collaborating to modernize the  Army’s home-station training and combat training centers in support of  fielding a force capable of conducting multi-domain operations. All of  this builds upon the Army’s earlier efforts to shift its training focus to  large-scale combat after a decade of training for counterinsurgency  operations, as we testified to Congress in February 2019.

The Army is also taking steps to revise the training for cyber and  electronic warfare personnel. These steps include revising the U.S. Army  Cyberspace Operations Training Strategy so that it accounts for new  equipment and doctrine, but also for the new organizations being created  and the tasks those units will be expected to perform, according to Army  cyber officials. Additionally, the Army Cyber School is revising its cyber  and electronic warfare training so that personnel will be able to conduct  multi-domain operations. Furthermore, the Army is working on a joint  solution for training cyber personnel on behalf of U.S. Cyber Command,  according to Army Cyber Command officials. The Army’s goal is to  provide the total cyber force with the ability to conduct joint cyber training,  including exercises and mission rehearsals by developing a virtual  training environment that simulates realistic cyber threats. This cyber  training solution, called the Persistent Cyber Training Environment, will  allow for experimentation, unit certification, and assessment and  development of the cyber mission force in a virtual training environment.  The Army’s goal is that the environment will decrease training time,  increase throughput of personnel, and improve training quality. One of the  stated operational imperatives of the Persistent Cyber Training  Environment is to become integrated with multi-domain exercises.

The Army Is Establishing New Cyber and Electronic Warfare Units, but Units Are Facing Staff, Equipment, and Training Shortfalls in Part Due to Incomplete Risk Assessments

The Army Is Activating Several New Cyber and Electronic Warfare Units at an Accelerated Pace and Is Facing Challenges

The Army is seeking to quickly create or design several new cyber and  electronic warfare units in order to execute multi-domain operations;  however, Army leadership is activating some units at an accelerated pace  due to the sense of urgency imposed by the growing capabilities of  potential great-power competitors. Some of these new Army units are  more narrowly focused on a particular domain or skill set, such as the  recently activated 915th Cyber Warfare Support Battalion based out of  Fort Gordon, Georgia, and new Electronic Warfare Companies and  platoons. The 915th Cyber Warfare Support Battalion will focus on  providing offensive cyber capabilities consistent with its authorities to  conduct offensive operations. The battalion is designed to fit with various  Army formations—such as corps, divisions, or brigade combat teams—as  assigned by the Army. The Electronic Warfare Companies, which are  scheduled to be fielded during fiscal years 2023 through 2025 according  to Army officials, will be attached to an Army corps and will be capable of  planning and conducting electronic warfare operations. Electronic  Warfare platoons, which Army officials said are scheduled to be fielded  during fiscal years 2020 through 2022, will provide similar capabilities to  brigade combat teams and other Army tactical-level formations.

Other units are being designed to plan and conduct operations in and  across multiple domains, with specialists in cyber, electronic warfare,  space, and intelligence assigned to the same unit. For example, a  recently activated Intelligence, Cyber, Electronic Warfare, and Space  (ICEWS) unit will be capable of planning and directing operations in any  or all of those areas. The ICEWS unit will function as part of a larger  Multi-Domain Task Force, which will be capable of expanding those  operations into other domains such as land and air. The Army plans to  field at least two of these ICEWS units by the end of fiscal year 2020.  Additionally, the Army is restructuring or creating Cyber, Electromagnetic  Activities planning sections in the headquarters of more than 125 Army  formations, from special forces units up to theater-level Army  headquarters. This restructuring effort will take place during fiscal years  2020 through 2022, according to Army officials.

Army guidance states that a unit’s activation date should be identified 1 to  2 years in advance, according to Army officials, in order to provide time to  build up trained personnel and equipment in the unit before it is activated  and available to be deployed. As a result of accelerating the activation  of these units, the Army is facing interrelated challenges in terms of  staffing, equipping, and training the units, as discussed below.

Accelerated pace creates challenges filling positions. The Army has  had difficulty filling its ICEWS unit and the 915th Cyber Warfare Support  Battalion with personnel to conduct operations. See table 1 below.

By accelerating the activation of the ICEWS unit in October 2018 as a  pilot, or test, program, the Army activated the unit with only 32 percent of  its personnel in place, and Army headquarters officials report that filling  the unit with personnel with the right skills has been a slow process. The  915th Cyber Warfare Support Battalion is facing similar staffing  challenges. As of the end of March 2019, the unit was understaffed by  more than 80 percent as it filled 30 of 171 authorized positions for fiscal  year 2019, according to an Army headquarters official. The official  acknowledged that the 915th Cyber Warfare Support Battalion may not  meet the authorized staffing levels for fiscal year 2019 if higher priorities  arise for the service.

Looking ahead, Army officials said that filling all of these new cyber and  electronic warfare units could be challenging because cyber personnel  are in high demand, with competition for these skilled personnel existing  between the Army, other government entities, and the private sector.  Army headquarters officials said they are exploring options to address the  challenges and have taken steps to retain the personnel that they have,  mostly in the form of retention bonuses and incentive pay. Some of those  incentives are targeted at the senior enlisted levels, which are some of  the personnel that Army officials indicated are in the most demand and of  which they have a shortage.

Accelerated pace creates equipping challenges. Officials with both  Army headquarters and the Army Cyber School cited equipment  challenges as one of the key issues that must be addressed when  activating a unit on an accelerated basis. For example, in November  2018, an Army headquarters’ official responsible for building the ICEWS  unit stated that the Army was having a difficult time identifying where the  unit’s equipment would be coming from. By the end of January 2019, the  official said the situation was improving and that 55 percent of the  equipment had been identified, but the Army was trying to find a source  for the remaining 45 percent. However, most of this is common Army  equipment, such as firearms, according to an Army official; those  percentages do not include the specialized cyber equipment that the unit  will need to perform its missions, such as a communications system  designed to transfer data beyond the line of sight during air defense  operations. An Army headquarters’ official stated that the Army is  prototyping different types of specialized equipment in order to expedite  the acquisition of such capabilities.

Revisions to training not keeping up with activation of units. Army  officials acknowledged the need to update its cyber training, in part  because the doctrine for new units is still being written. Officials with the  Army Cyber School and the Army’s Combined Arms Center stated that  the current U.S. Army Cyberspace Operations Training Strategy did not  foresee all of the new cyber and electronic warfare organizations the  Army now intends to create, including the Cyber Electromagnetic  Activities sections attached to various formations. Army headquarters  officials stated that they are working on a revision to the U.S. Army  Cyberspace Operations Training Strategy to address these issues.  However, the first ICEWS unit and the 915th Cyber Warfare Support  Battalion were activated without this updated training strategy. With other  units scheduled to be activated in fiscal year 2020, it is possible others  may be activated without the training strategy as well. Without the  updated doctrine and subsequent training strategies that will result from it,  TRADOC officials said they would have difficulty designing training for the  new units, and soldiers will not have a clear understanding of their tasks  and missions.

Obtaining equipment also could be a challenge for training  servicemembers before they are assigned to cyber or electronic warfare  units, according to some Army officials. Officials with the Army Cyber  School stated that it could end up growing and producing a workforce that  outpaces its ability to procure equipment. However, Army headquarters’  officials stated that equipping operational units is a higher priority than  providing equipment to the schools for training, and the Army ensures  that those units receiving the equipment get the training they need upon  fielding the equipment. If the Army does not acquire new equipment  quickly enough, the result could be that soldiers in the Army Cyber School  will be trained on outdated equipment, which they will not use when they  get to the field.

The Army Assessed Staffing, Training, and Equipping Risks for Certain Cyber and Electronic Warfare Units, but Its Assessments for Units Activated at an Accelerated Pace Are Incomplete

In the process of creating some new units, the Army assessed the risk of  whether it can meet the units’ staffing, equipping, and training  requirements before the units’ activation date, but it did not do so for  those units activated at an accelerated pace. For example, the Army  conducted risk assessments for some new Electronic Warfare platoons  and Cyber Electromagnetic Activities sections that it plans to begin  activating in fiscal year 2020. Those assessments identified issues and  mitigation strategies for the Army to consider when making fielding and  resource decisions. For example, the risk of finding a sufficient number of  qualified personnel for the Electronic Warfare platoons and Cyber  Electromagnetic Activities sections would be mitigated by spreading the  activations over a minimum of 3 years. The assessment for the Electronic  Warfare platoons also identified some equipping issues that will require  either more senior-level input or extending timeframes for completion.

In contrast, the Army activated the ICEWS unit and the 915th Cyber  Warfare Support Battalion in an accelerated manner because of the  urgent need to develop these organizations, given the growing  capabilities of potential great-power competitors. However, the Army did  so without completely assessing the staffing, equipping, and training risk  to those units over the long term. For example:

According to Army officials, the Army did not perform a risk  assessment for the ICEWS unit currently assigned to and participating  in exercises in the Pacific, because the Army initiated the unit as a  pilot, or test, program. According to Army officials, a risk assessment  was unnecessary prior to activating the unit because the Army  expects to refine the unit’s personnel, equipping, and training  requirements during the pilot program. However, the ICEWS unit is  expected to become part of a larger Multi-Domain Task Force in fiscal  year 2020. Until that occurs, the ICEWS unit is attached to another  active Army unit and, according to Army officials, eligible to be  deployed if needed based on its current capabilities. Unless the Army  assesses the staffing, equipping, and training risks of the ICEWS unit,  the unit may be unable to provide the expected capabilities, either  currently or as part of the larger task force to which it will belong.

The Army performed an initial risk assessment for the 915th Cyber  Warfare Support Battalion before the unit was activated in December  2018. However, Army officials told us that the Army has plans to grow  the unit to as many as 627 personnel by 2024, at which point it would  be considered fully operational. Unless the Army performs a more  complete risk assessment of the 915th Cyber Warfare Support  Battalion’s staffing, equipping, and training requirements prior to  achieving full operational capability, the Army may be poorly  positioned to make decisions about how to use and support the  battalion.

Army guidance states that the Army should assess its ability to support a  new unit’s staffing, equipping, and training requirements, among other  things, so that senior Army leaders can evaluate proposed organizational  changes. For example, under a force integration functional area  analysis, the Army staff evaluates all proposed organizational changes to  ensure that they meet the intent of senior Army leaders, have the  resources available to accomplish their mission, and that their projected  benefits justify increased resources. These assessments analyze the  proposed organization in nine areas, such as staffing, structuring,  equipping, and training, and are intended to give senior Army leaders an  understanding of whether the organizations are affordable, supportable,  and sustainable. According to Army officials, the force integration  functional area analysis is similar to a risk assessment. In addition,  Standards for Internal Control in the Federal Government state that  management should identify, analyze, and respond to the risks related to  achieving the defined objective—in this case quickly fielding a cyber force  to deal with current threats.

Because the Army has not completely assessed the risk of organizing the  ICEWS unit and the 915th Cyber Warfare Support Battalion, senior Army  leaders may be left with an incomplete picture of the challenges in  affording, supporting, and sustaining these units over the long term.  Moreover, senior Army leaders lacked key information needed to  understand the capability and capacity of the units at the time they were  activated. For example, these units currently do not have what they need  in terms of personnel and equipment to conduct their missions  successfully. Further, according to some Army officials, without such an  assessment, the Army does not know whether accelerated activation was  the best course of action; what challenges they may face in staffing,  equipping, and training the units; or how to mitigate challenges that may  arise in other areas, such as deploying and sustainment. Army officials  stated that there is a lot of informal discussion between relevant Army  offices to try to identify and deal with challenges for these units. However,  they also acknowledged the problems inherent in activating a unit by  accelerating timelines.

Such risk assessments also could inform future Army decisions as it  activates new units for multi-domain operations. Given the Army’s  perception of the threat environment, the Army may decide to activate  other multi-domain operations units in an accelerated manner. For  example, the Army is exploring ideas for creating several new units in  future years to enhance its capability in multi-domain operations, such as  a Theater Space Warfare Battalion. The Army also has been running  wargames to see how they would operate new types of units at the  division, corps, and theater level for commanding and operating long- range missiles and rockets.

Army officials stated that as these units grow and evolve, it is uncertain  when more comprehensive risk assessments would take place. If the  Army does not perform a risk assessment for the activated ICEWS unit  before it joins the larger Multi-Domain Task Force, or a more complete  risk assessment for the 915th Cyber Warfare Support Battalion as that  unit matures, the Army may end up fielding units that are not capable of  providing the needed capabilities. Moreover, these risk assessments  could provide vital lessons that could inform future Army decisions on the  development, activation, and fielding of other units focused on enhancing  the Army’s capability to conduct multi-domain operations.

The Army Engaged with the Joint Staff and Other Services and Envisions Opportunities for Further Coordination

The Army engaged with the Joint Staff and other services to develop its  Army Operating Concept and envisions opportunities for further  coordination in the future. The Army’s overarching objective is to field a  multi-domain-capable force by 2028, and it considers further engagement  with the Joint Staff and other services as essential to accomplishing that  goal. According to Army plans, the Army needs to finalize the next version  of its Army Operating Concept by the fall of 2019 in order to incorporate  multi-domain operations into all levels of Army leadership, training, and  education by 2020. The Army plans indicate that maintaining this  schedule is important to have a ready, lethal, and modern force for multi- domain operations by 2028.

From the outset, the Army engaged with the Marine Corps to begin its  concept development. Together the Army and Marine Corps published a  white paper in January 2017 where they unveiled “Multi-Domain Battle”  as a new concept for combat operations against a sophisticated great- power competitor. This white paper highlighted the need for ground  forces to focus on all five warfighting domains and was intended as a first  step toward further multi-domain concept development, wargaming,  experimentation, and capability development.

Once the white paper was written, the Army engaged with the Joint Staff  and the other services in several ways to refine its concept:

Joint Staff collaboration. The Army engaged with the Joint Staff on  an Army-led study of recent contingency operations and used the  lessons to refine the Army Operating Concept’s description of the  emerging operational environment. Based on that study, the Army  also refined some solutions for addressing threats posed by great- power competitors. Joint Staff officials reported that the Army  engaged with the Joint Staff through other collaborative events as  well, including tabletop exercises that tested and refined multi-domain  concept ideas.

Marine Corps collaboration. As the Army moved forward from the  white paper, the Marine Corps’ input informed the concept’s  development in various ways. This included changing the concept’s  title from multi-domain battle to multi-domain operations in April 2018  to better reflect the scope of competition and conflict, as well as the  inherent joint nature of modern warfare. The Marine Corps also  hosted a multi-domain symposium in April 2018 that was attended by  the Army, Air Force, Navy, and Joint Staff.

Air Force collaboration. The Army initially collaborated with the Air  Force Air Combat Command to inform concept-development efforts,  and more recently began working with the Air Force Warfighting  Integration Capability under Air Force headquarters. Also, the Army  and Air Force collaborated on tabletop exercises focused on  simulating multi-domain operations. Army officials told us that this  helped them refine their thinking on how to enhance the  maneuverability of its land forces by combining Army and Air Force  capabilities across domains.

Navy collaboration. The Army and Navy principally collaborated by  testing multi-domain capabilities during real-world exercises. For  example, the Army joined the Navy’s 2018 Naval Rim of the Pacific  exercise to demonstrate capabilities for multi-domain operations in a  real world environment.

While the Army took steps to engage with the Joint Staff and the other  services, it made the decision to move forward with the latest version of  its Army Operating Concept in order to meet its overarching objective to  develop a multi-domain operations-capable force by 2028. Given this  urgency, Army officials told us that they may have missed opportunities to  further refine its Army Operating Concept in 2018 with the perspectives of  the Joint Staff and other military services. Joint Staff officials told us that  by not fully including the Joint Staff in some tabletop exercises, the Army  may have missed the Joint Staff’s perspective on key issues related to  multi-domain operations, such as joint command and control.

As the Army continues to revise its Army Operating Concept, the Army  recognizes the need to continue to engage with the Joint Staff and other  services. Joint Staff officials told us that the Joint Staff has initiated its  own plans to engage with the services to refine key ideas of multi-domain  operations in joint concepts, including logistics, intelligence, and  command and control. Army officials told us that they recognize the  importance of not getting too far ahead of these efforts, or the efforts of  other services related to multi-domain operations. Army officials told us  that the mechanisms built into the Joint concept-development framework  would provide opportunities to engage the services and Joint Staff as the  Army revises its own concept. Army officials added that beginning in the  fall of 2019 the Army will participate with the Joint Staff in a wargame  designed, in part, to analyze how the Army Operating Concept works with  the other military service operating concepts. As a result, the current  concepts are likely to evolve in the future as the Army synchronizes its  efforts with those of the Joint Staff and other services.

Rising threats posed by great-power competitors, particularly China and  Russia, prompted the Army to initiate a profound and fundamental  transformation to the way it plans to fight. The refinement of the Army’s  Operating Concept is beginning to drive changes across the Army. The  Army is making near-term changes by incorporating multi-domain  operations into its doctrine, organizations, and training, which includes the  accelerated creation of new cyber and electronic warfare units. However,  these units are short of both people and equipment. While Army  leadership believes that the urgency to confront threats justifies its  decision to accelerate the development of those units, the Army did not  assess the risks associated with staffing, equipping, and training its  existing ICEWS unit prior to activation to determine whether it is  affordable, supportable, and sustainable, and officials said it was  uncertain when a more comprehensive assessment would take place.  The Army plans to incorporate this unit into the first Multi-Domain Task  Force by the end of Fiscal Year 2020, but in the meantime the unit could  be deployed if needed. The Army did prepare a preliminary risk  assessment for the 915th Cyber Warfare Support Battalion prior to  activation, but it is unclear whether the Army will perform a more  comprehensive risk assessment as the unit matures and nears full  operational capability. For the units already activated, a risk assessment  could benefit the Army by providing insights about the ability to deploy  and sustain the units. It is important for the Army to assess its efforts  before committing resources to activate new units. By formally assessing  the risk of all new units activated in an accelerated manner, the Army will  have the key information its leaders need for making decisions related to  the activation of those units and other related units going forward.

We are making the following three recommendations to the Secretary of  the Army.

The Secretary of the Army should ensure that the Deputy Chief of Staff,  G-3/5/7 assess the risk associated with staffing, equipping, and training  the existing ICEWS unit prior to its incorporation into the first Multi- Domain Task Force in fiscal year 2020. (Recommendation 1)

The Secretary of the Army should ensure that the Deputy Chief of Staff,  G-3/5/7 conduct a comprehensive risk assessment associated with  staffing, equipping, and training the 915th Cyber Warfare Support  Battalion prior to approving the expansion of the unit to its full operational  capability. (Recommendation 2)

The Secretary of the Army should ensure that the Deputy Chief of Staff,  G-3/5/7 assess the risk associated with staffing, equipping, and training of  new units that it plans to activate in an accelerated manner for the  purposes of conducting multi-domain operations, taking into consideration  the assessments performed on the first activated ICEWS battalion and  the 915th Cyber Warfare Support Battalion. (Recommendation 3)

We provided a draft of this report to DOD for review and comment. In its  written comments, reproduced in appendix I, the Army partially concurred  with the first two recommendations and concurred with the third  recommendation.

The Army partially concurred with the first recommendation for it to  conduct a risk assessment, such as a force integration functional area  analysis, for the first activated ICEWS unit. The Army stated in its  comments that it does not perform force integration functional area  analyses for experimental or pilot organizations, and that because the first  ICEWS was activated as a pilot, no such assessment was performed.  The Army added that it would conduct a risk assessment at the  conclusion of the pilot if and when the Army decides to establish such a  unit. We met with Army officials to discuss their comments, during which  they provided additional information and clarification regarding how they  were assessing risks for the unit. Based on this information, we modified  the report to reflect the Army’s position that a risk assessment was  unnecessary prior to activating the unit because the Army plans on using  the pilot period to determine the staffing, equipping, and training  requirements for the unit. We also incorporated additional information on  the status of the ICEWS unit. As a result, we clarified our  recommendation to state that the Army should assess the risk associated  with staffing, equipping, and training the existing ICEWS unit prior to its  incorporation into the first Multi-Domain Task Force in fiscal year 2020.  Army officials generally agreed with the revised recommendation. Moving  forward, it will be important for the Army to implement this  recommendation to ensure the ICEWS unit, which is active and eligible to  be deployed, will be prepared to carry out its mission effectively.

The Army partially concurred with the second recommendation for it to  conduct a risk assessment, such as a force integration functional area  analysis, for the 915th Cyber Warfare Support Battalion. The Army stated  in its comments that it does not perform force integration functional area  analyses for force generating units such as the 915th Cyber Warfare  Support Battalion. Instead, it develops a concept plan, which applies rigor  and analysis to determine the most efficient and effective way of fielding a  new unit. We met with Army officials to discuss their comments, during  which they provided additional information related to assessing risks for  the 915th Cyber Warfare Support Battalion. Specifically, Army officials  said that prior to activating the battalion, leadership approved the  battalion’s concept plan, which included an initial risk assessment. We  reviewed the concept plan for the battalion and found that the  assessment only addressed the risk of not having the unit’s capabilities  activated and in the field for operations. We incorporated this additional  information on this initial risk assessment for the 915th Cyber Warfare  Support Battalion into the report. As a result of this additional information,  we clarified our recommendation to state that the Army should conduct a  comprehensive risk assessment associated with staffing, equipping, and  training the 915th Cyber Warfare Support Battalion prior to approving the  expansion of the unit to its full operational capability. Army officials  generally agreed with this. It will be important for the Army to implement  the revised recommendation to ensure the 915th Cyber Warfare Support  Battalion, which is active and performing operations, will be prepared to  carry out its mission effectively.

The Army concurred with the third recommendation for it to ensure that a  risk assessment is conducted before activating any new organizations it  plans to field in an accelerated manner for the purposes of conducting  multi-domain operations. The Army added that any lessons learned from  the activation of the first ICEWS unit and the 915th Cyber Warfare  Support Battalion will be taken into consideration when assessing the risk  before the activation of these new organizations. It will be important for  the Army to implement the recommendation to ensure that any new  organizations are prepared to carry out their missions, while potentially  avoiding some of the challenges that the ICEWS and 915th Cyber  Warfare Support Battalion have experienced.

Lastly, the Army also recommended that we change the title of our report;  however, we did not accept the title offered by the Army. We believe the  title accurately reflects the issues and recommendations highlighted in the  report.

We are sending copies of this report to the appropriate congressional  committees and to the Secretary of Defense; the Acting Under Secretary  of Defense for Personnel and Readiness; the Chairman of the Joint  Chiefs of Staff; the Acting Secretaries of the Departments of the Air Force  and the Army; the Secretary of the Navy; and the Chief of Staff of the  Army. In addition, the report is available at no charge on the GAO website  at http://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-3489 or pendletonj@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. Staff members making key contributions to  this report are listed in appendix II.

Appendix I: Comments from the Department of the Army

Appendix II: GAO Contact and Staff Acknowledgments

In addition to the contact named above, Kevin O’Neill (Assistant Director),  Matt Spiers (Analyst-in-Charge), Tracy Barnes, Shannon Finnegan,  Christopher Gezon, Ruben Gzirian, J. Kristopher Keener, Alberto Leff,  Joshua Leiling, Amie Lesser, Jon Ludwigson, Ned Malone, and Clarice  Ransom made key contributions to this report.

Great powers—particularly China and Russia—and other adversaries pose current and future threats to the nation. The Defense Department is preparing to meet those threats where they arise, including the cyber domain.

The Army’s preparations include new cyber and electronic warfare units. Some of these units are being created on an accelerated schedule, and in some cases, activated before cyber training and equipment have been updated. Those units are short of people and the Army faces competition finding people with in-demand cyber skills.

We recommended that the Army comprehensively assess the risk of accelerating the creation of the new units.


VA Health Care: Improved Communication about Available Data Needed to Enhance the HIV Screening Process

VHA is the largest single provider of medical care to HIV infected individuals in the nation. In 2018, VAMCs tested approximately 240,000 veterans for HIV and provided HIV care to over 31,000 veterans. Early diagnosis and timely treatment is important for achieving favorable health outcomes and reducing the risk of transmitting the virus to others.

The accompanying Joint Explanatory Statement for the Consolidated Appropriations Act, 2018 included a provision for GAO to examine how VAMCs have implemented VHA's HIV screening policy. This report examines (1) approaches that selected VAMCs use to facilitate HIV screening, and (2) the extent to which VHA monitors HIV screening. GAO analyzed VHA documents, including VHA directives and a nongeneralizable sample of 103 veterans' medical records, to understand how providers made decisions and documented actions related to HIV screening. GAO also interviewed VHA and VAMC officials, the latter from five facilities selected based on factors such as the range of HIV prevalence rates.

Officials from five selected Department of Veterans Affairs (VA) medical centers (VAMC) reported using various approaches to facilitate human immunodeficiency virus (HIV) screening, which involves three stages. For example, for the first stage of HIV screening (providing HIV tests to consenting veterans), officials told GAO that VAMCs use information technology solutions, such as clinical reminders that prompt providers to offer HIV tests to veterans who have not been tested. These clinical reminders can also prompt providers to offer an HIV test on a repeated, rather than a one-time, basis to veterans with known higher risk factors for acquiring HIV.

The Veterans Health Administration (VHA) monitors the first stage of HIV screening by collecting and disseminating data that VAMCs can use to calculate and, if necessary, improve facility HIV testing rates. VHA also collects data on the time frames in which results for eight types of tests are communicated to veterans; these data could indicate how timely test results are being communicated generally (stage two of HIV screening). However, VHA has not effectively communicated the availability of these data to HIV lead clinicians. In addition, VHA does not currently monitor whether VAMCs link veterans who test positive for HIV to care in a timely manner (stage three of HIV screening). VHA officials indicated that they are in the process of building the capacity to collect and disseminate to HIV lead clinicians data on the number of veterans at each VAMC who are linked to HIV care within 30 days, as recommended. However, the time frames for completing these efforts have been extended due to competing priorities, such as implementing required improvements in the diagnosis and treatment of veterans with Hepatitis C. Until VHA improves VAMC staff's access to, or provides them with, these data, it increases its risk that HIV-positive veterans do not receive timely treatment. Such treatment can improve veterans' health outcomes and prevent the transmission of the virus to others.

VA should (1) improve communication regarding the availability of data on the timeliness with which test results are communicated to veterans, and (2) disseminate data to HIV lead clinicians on the timeliness with which veterans are linked to HIV care. VA concurred with GAO's recommendations.

The Department of Veterans Affairs’ (VA) Veterans Health Administration  (VHA) operates one of the largest health care systems in the nation,  serving approximately 9 million veterans. Each year, VA medical centers  (VAMC) test hundreds of thousands of veterans for the human  immunodeficiency virus (HIV), a virus that weakens a person’s immune  system by destroying important cells that fight disease and infection and,  when untreated, can lead to acquired immunodeficiency syndrome  (AIDS). According to VHA, in 2018, VAMCs tested approximately  240,000 veterans for HIV and provided medical care to over 31,000  veterans who tested positive for the virus, making VHA the largest single  provider of medical care to HIV infected individuals in the United States.

Research has shown that avoiding delays in HIV screening—including  delays in testing, diagnosis, and treatment—is important for achieving  favorable health outcomes. Individuals who are diagnosed and treated  before the disease is far advanced can live nearly as long as an individual  who does not have HIV, and HIV treatment helps prevent transmission of  the virus to, for example, a sexual partner.

HIV screening at VAMCs involves three stages. First, a consenting  veteran is tested for HIV. Second, the veteran’s provider communicates  the test result to the veteran. And, third, the provider links the veteran to  HIV care if the result was positive and, thus, a diagnosis was made.  Responsibilities for VAMC providers, VHA program offices, and others  are established in VHA policy that pertains to HIV screening. For  example, under VHA policy, providers are required to offer tests to  veterans at least once as part of routine medical care (a “one-time test”)  and link diagnosed veterans to HIV care expeditiously, ideally within 14  days, but no more than 30 days if possible. VHA’s HIV, Hepatitis, and  Related Conditions Programs (HHRC) within the Office of Specialty Care  Services is responsible for overseeing these aspects of HIV screening,  including collecting data on the timeliness with which providers link  veterans to HIV care. In addition, providers are required to communicate  all test results, including HIV test results, to veterans within established  time frames (e.g., generally within 7 calendar days for positive test results  and 14 calendar days for negative test results). VHA’s Office of Primary  Care (OPC), within the Office of the Deputy Undersecretary for Health  Operations and Management, is responsible for VHA’s policy on the  communication of all test results and collaborates with VHA’s Office of  Reporting, Analytics, Performance, Improvement, and Deployment  (RAPID) to collect related data. VAMC staff who are responsible for  overseeing HIV screening must ensure that the providers at their facilities  communicate HIV test results to veterans and link HIV-positive veterans  to care within recommended time frames. VAMC staff are also directed to  use available data to make screening-related improvements as needed.

The accompanying Joint Explanatory Statement for the Consolidated  Appropriations Act, 2018 included a provision for GAO to review how  VAMCs have implemented VHA’s HIV screening policy, which requires  that VAMCs use the most current recommended HIV test when clinically  indicated. In this report, we examine  1.  approaches that selected VAMCs use to facilitate HIV screening; and  2.  the extent to which VHA monitors the HIV screening performed at  VAMCs.

For each objective, we reviewed VHA policy to understand providers’  requirements related to the three stages of HIV screening and VHA’s  related oversight responsibilities. These requirements and responsibilities  are described in various VHA directives, some of which are specific to  HIV, and others that apply to all medical tests, including HIV tests. Two of  these directives, which were specific to HIV, were consolidated into one  updated directive in August 2019.

We reviewed a nongeneralizable sample of medical records for 103  veterans who were tested for HIV in calendar year 2017 at five selected  VAMCs. We selected the five VAMCs for variation in (1) the HIV  prevalence rate in calendar year 2017 (the most recent year for which  data were available), (2) the HIV testing rate in calendar year 2017 (the  most recent year for which data were available), (3) facility complexity  level, and (4) geographic location. See table 1 for a list of the five  VAMCs we selected and their four associated Veterans Integrated  Service Networks (VISN).

The sample of 103 medical records included two groups: (1) the medical  records for all 38 veterans who tested positive for HIV at the five selected  VAMCs, and (2) a random sample of medical records for 65 veterans who  tested negative for HIV at the same VAMCs. We reviewed their medical  records to understand how providers made decisions and documented  actions related to HIV screening. Examples provided from our review of  veterans’ medical records cannot be generalized.

We took additional steps to address each objective. To describe  approaches that VAMCs have used to facilitate each stage of HIV  screening, we interviewed HHRC officials and officials at the five selected  VAMCs—including primary care providers, infectious disease providers,  and laboratory staff—and their four associated VISNs to understand how  these providers determine if veterans should be offered an HIV test,  obtain veterans’ consent to be tested, and order the most current  recommended test (stage one); communicate HIV test results to veterans  within established time frames (stage two); and ensure that newly  diagnosed veterans are promptly linked to HIV care (stage three). We  identified approaches that were reported by officials from more than one  of the five selected VAMCs, and also reviewed VAMC policies that  describe facility-specific approaches. Perspectives obtained from VAMC  and VISN officials cannot be generalized.

To determine the extent to which VHA monitors HIV screening, we  interviewed HHRC officials regarding the collection and dissemination of  data on HIV testing rates and the availability of the most current  recommended HIV test at VAMCs (stage one) and VAMCs’ timeliness in  linking newly diagnosed veterans to HIV care (stage three), as well as  VAMCs’ use of this data to make related improvements as needed. We  also spoke with officials from VHA’s National Center for Ethics in Health  Care (NCEHC), who are responsible for VHA’s policy on informed  consent for clinical procedures, including HIV testing, and OPC officials  responsible for VHA’s policy on the communication of test results,  including HIV test results, regarding their monitoring of these aspects of  HIV screening (stages one and two). We reviewed VHA documentation  related to relevant monitoring efforts. We then compared these efforts to  VHA policy on the monitoring of HIV screening, including the  development and use of data reports for such monitoring, as well as  federal internal control standards related to monitoring, information and  communication, and risk assessment.

We conducted this performance audit from July 2018 to January 2020 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

VHA recommends that all veterans who receive VHA services be  screened for HIV as part of routine medical care, including those who do  not think they are at risk for acquiring the virus. The aim is to ensure that  veterans who are infected with the virus can be diagnosed as early as  possible, receive life-saving care, and avoid passing the virus on to others. VHA has made earlier diagnosis of HIV a priority for the agency  and established certain requirements for VAMC providers that aim to  achieve early diagnoses and rapid linkages to HIV care for veterans.

HIV screening at VAMCs involves three stages, and related VHA policy  sets forth providers’ requirements related to each of these stages. (See  fig 1.)

Stage one: providing HIV tests to consenting veterans. A provider in  a primary care clinic, a specialty care setting (such as an infectious  disease clinic), or other outpatient setting (such as a women’s health  clinic) offers a voluntary HIV test to an eligible veteran. In accordance  with Centers for Disease Control and Prevention (CDC)  recommendations, VHA policy requires providers to offer a one-time test  to all veterans; annual tests to veterans with known higher risk factors for  acquiring the virus, such as injection drug use; and tests every 3 months  to veterans with known higher risk factors who are prescribed preventive  medication known as pre-exposure prophylaxis (PrEP). Once a provider  obtains consent from the veteran to be tested for HIV, the provider initiates an HIV test order with the laboratory. Although VHA policy  previously required that providers document that they obtained veterans’  verbal consent to be tested for HIV, as of April 2019, providers must  obtain, but no longer need to document, such consent. In addition,  under VHA policy, providers must order the most current CDC- recommended HIV test (which detects HIV antigens and antibodies) when  clinically indicated, and laboratories must follow the CDC-recommended  HIV testing algorithm (see text box). A blood sample is collected from  the veteran, and the laboratory processes the HIV test.

Information Technology Solutions and Contacting Veterans As Needed Are Among the Approaches That Selected VAMCs Use to Facilitate HIV Screening Officials from Selected VAMCs Reported Using Information Technology Solutions, Such as Clinical Reminders, to Facilitate the Provision of HIV Tests for the First Stage of Screening

Officials from the five selected VAMCs reported using information  technology solutions and other strategies to facilitate each of the three  stages of HIV screening: providing HIV tests to consenting veterans  (stage one), communicating HIV test results to veterans (stage two), and  linking HIV-positive veterans to care (stage three).

Officials from multiple VAMCs in our review stated their providers use  information technology solutions, such as clinical reminders, to fulfill their  requirements related to the first stage of HIV screening: offering HIV tests  to veterans, obtaining veterans’ verbal consent to be tested, and ordering  the most current recommended HIV test.

Offering HIV tests to veterans. Officials from three VAMCs in our review  told us that providers often use clinical reminders that were developed  and implemented by the VAMC or associated VISN to prompt them to  offer HIV tests to veterans. (See fig. 2.) According to these officials,  clinical reminders are used to prompt providers to offer a one-time HIV  test to veterans who have not been tested. They can also be used to  facilitate providers’ identification of veterans who are at higher risk for  acquiring HIV and subsequently prompt them to offer these veterans an  HIV test on an annual, rather than a one-time, basis. For example,  officials at two of these three VAMCs indicated that the reminders include  prompts for determining if veterans are at higher risk of acquiring HIV or  fields to document identified risk factors. One of these officials told us that  the recurrence of these clinical reminders can subsequently be increased  or decreased to prompt providers to offer an HIV test to veterans who are  at higher risk of acquiring HIV on a more or less frequent basis,  depending on the risk factors identified over time.

Obtaining veterans’ verbal consent to be tested. According to officials  from the three VAMCs that discussed the use of clinical reminders, this  technology prompts providers to obtain veterans’ verbal consent to be  tested for HIV before ordering tests. Further, the reminders give providers  a way to document that consent was obtained. For example, officials at  one of the three VAMCs stated that providers can access the laboratory  menu, which they use to order an HIV test, through the clinical reminder.  The officials stated that providers must either (a) document that they  obtained veterans’ verbal consent within the clinical reminder before  accessing the menu, or (b) document that verbal consent was obtained  once they have accessed the menu.

Ordering recommended HIV tests. Officials from four of the VAMCs in  our review reported that the facilities’ laboratory menus are designed to  make it easier for providers to order the most current CDC-recommended  HIV test. For example, officials from two VAMCs told us that the most  current CDC-recommended HIV test is either the first result that appears  when searching for an HIV test within the laboratory menu or the first HIV  test that appears within a list of different types of HIV tests. According to  officials from another VAMC, the facility’s laboratory menu includes a  prompt that explains that an HIV viral load test (a test that is primarily  used to monitor an active HIV infection) is not recommended solely to be  used for diagnostic purposes if a provider attempts to order such a test for  this purpose.

Officials from Selected VAMCs Reported Contacting Veterans to Schedule Non-Routine Appointments to Communicate Positive HIV Test Results for the Second Stage of Screening

Officials at each of the five VAMCs in our review told us that staff contact  veterans to schedule non-routine, in-person appointments within the 7  day time frame to inform them that they have tested positive for HIV.  According to officials at four VAMCs, staff first place phone calls to  veterans and request that the veterans schedule face-to-face visits with  providers. Officials at two VAMCs explained that providers attempt to  inform veterans of positive HIV test results in person given the sensitive  nature of the diagnosis, as recommended by VHA policy. If staff cannot  reach the veterans by phone, officials at these two VAMCs indicated that  they send letters to the veterans asking them to contact their providers to  obtain their test results. Further, officials at three VAMCs stated that staff  send letters to veterans to inform them of negative HIV test results within  the required 14 day time frame. Officials from all five VAMCs in our  review also reported using various, additional approaches to  communicating negative HIV test results to veterans, including notifying  them by phone, informing them of test results during face-to-face visits, or  uploading test results into veterans’ personal electronic health records  (EHR).

In addition, all five VAMCs in our review have developed protocols to  prevent delays in the communication of positive HIV test results to  veterans when the provider who ordered the test is unavailable. These  protocols are generally outlined in facility-specific policies, which we  reviewed, that require that a designee communicate positive HIV test  results to veterans in lieu of the ordering provider. According to officials  at three VAMCs, these protocols apply when the ordering provider is  unavailable for a certain number of consecutive days (typically 3 days).  Officials told us that if the designee is not available, their facility’s protocol  requires that VAMC leadership (such as the Chief of Medicine)  communicate the results to the veteran.

Officials from Selected VAMCs Use Referrals to Community Providers and Telecommunications to Link Veterans Newly Diagnosed with HIV to Care for the Third Stage of Screening

Officials from all five VAMCs in our review indicated that providers may  refer eligible HIV-positive veterans to care within the community to ensure  that treatment occurs in a timely manner. According to officials at two of  these VAMCs, these referrals are often made based upon veterans’  preferences or primary care providers’ comfort levels in providing HIV  care to veterans who are also eligible for community care. An official at  another of these VAMCs told us that eligible veterans who live further  distances from the VAMC may ask to be referred to community care.

According to officials from multiple VAMCs in our review, providers may  also use telecommunications to provide HIV care to veterans. For  example, officials from two VAMCs told us that their facilities offer  telehealth consultations with an infectious disease provider to veterans  who live outside the city in which the VAMC is located or who otherwise  find it inconvenient to be seen in-person by an infectious disease provider  at the facility. Telehealth allows infectious disease providers to care for  veterans who would otherwise receive HIV care from primary care  providers or in the community. Officials at another VAMC reported that  infectious disease providers are available via cell phone or Skype  (software that can be used to make one-to-one or group voice or video- based calls from a cell phone or computer) to assist primary care  providers who assume responsibility for veterans’ HIV care.

VHA Facilitates Monitoring of the Provision of HIV Tests, but Has Not Completed All Steps to Enable Monitoring of Subsequent Stages of HIV Screening VHA Collects and Disseminates Data for VAMCs to Use to Monitor the Offering of HIV Tests to Veterans

VHA facilitates monitoring of the first stage of HIV screening by providing  information to VAMCs that include data on the number of veterans who  have been tested for the viral infection. While VHA does not collect data  on the timeliness with which HIV test results are communicated to  veterans, data resulting from VHA’s monitoring of the communication of  other test results may indicate whether veterans are informed of HIV test  results within recommended time frames. However, HIV lead clinicians  may not be aware that they have access to this information. VHA does  not currently monitor whether veterans who test positive for HIV are  linked to care within recommended time frames; however, VHA has taken  steps to collect and disseminate data that can be used to monitor this  stage of screening.

According to HHRC officials, the office collects and disseminates annual  and biannual data to each VAMC’s HIV lead clinician on the offering of  HIV tests to veterans. (See table 2 for information related to VHA’s  monitoring activities.) This includes data on (1) the number of veterans  who are eligible to receive one-time HIV tests, as well as the number of  eligible veterans who were tested, for each VAMC and VISN; and (2) the  number of veterans who are prescribed PrEP who are tested for HIV  every 3 months to document that they are still HIV negative as  recommended by the CDC. HHRC officials told us that they share the  one-time testing rate data with HIV lead clinicians on an annual basis,  and that these clinicians can use the data to calculate their VAMCs’ one- time HIV test rates and, subsequently, compare their rates regionally or to  VAMCs that offer the same complexity of services. According to HHRC  officials, they upload these data to an internal data sharing website and  notify HIV lead clinicians that the data are available via email and during  regularly scheduled conference calls that facilitate the discussion of  issues related to HIV screening. HHRC officials also told us that VHA  uses the same method to share with HIV lead clinicians on a biannual  basis data on the HIV test rate for veterans who are prescribed PrEP.

VISNs and VAMCs have used VHA’s data on the offering of HIV tests to  veterans to support local efforts to improve HIV screening. For example,  HHRC officials told us that VISNs have used data on the number of  veterans who are eligible to receive one-time HIV tests, and who were  tested, to support applications for VHA-sponsored grants intended to  improve the offering of such tests to homeless veterans. Officials from  four VAMCs in our review told us that they have used these data to  identify the need to increase testing, which led to the implementation of  new strategies, such as clinical reminders that prompt providers to offer  one-time and risk-based HIV tests to veterans.

While VHA recently monitored the documentation of verbal consent by  collecting data that VAMCs used to make related improvements, such  monitoring is no longer needed due to a change in VHA policy. Between  fiscal years 2013 and 2016, NCEHC (the VHA office responsible for  VHA’s policy on informed consent) oversaw a system-wide review that led  to improvements in the number of VAMC providers that documented in  veterans’ medical records that they obtained veterans’ verbal consent to  be tested for HIV. In 2019, VHA amended its policy and no longer  requires providers to document that they obtained verbal consent.

In addition, VHA recently monitored VAMC laboratory protocols for HIV  testing, but HHRC noted that this monitoring is no longer needed,  because the recommended testing technologies have been implemented.  In 2018, VHA conducted a one-time review of VAMC laboratory protocols  to ensure that CDC recommendations for the use of HIV tests were  followed at each VAMC, such as recommendations related to the type of  HIV test that providers should order for diagnostic purposes. VAMCs  were required to submit verification to VHA showing that their laboratories  had implemented the most current CDC-recommended testing  technologies. According to HHRC officials, this provided assurance that  providers were ordering the most current CDC-recommended HIV test  and that laboratories were following the CDC-recommended HIV testing  algorithm. VHA’s Director of Pathology and Laboratory Medicine Service  reviewed the verification submitted by each VAMC, and VAMCs were  required to develop action plans to address any identified deficiencies. As  of August 7, 2018, VHA found that all VAMCs were following CDC’s  recommendations related to the availability and use of HIV tests.  According to HHRC officials, VHA does not need to continue its  monitoring effort in this area, since the implementation of recommended  testing technologies by VAMCs was a one-time effort. Further, officials  from the five VAMCs in our review told us that the VAMCs were using the  CDC-recommended HIV test, and nothing inconsistent came to our  attention during our medical records review.

VHA Makes Data on the Timeliness of Communicating Test Results Available, but Has Not Ensured that VAMC Staff Are Aware They Have Access to It

OPC and RAPID (the VHA offices responsible for VHA’s policy on the  communication of test results and related performance measurement)  make data available to VAMC staff that may indicate the timeliness with  which HIV test results are communicated to veterans. OPC and RAPID  publish a quarterly report on the timeliness with which results from the  eight tests that are included in its review of veterans’ medical records are  communicated to veterans at each VAMC. While HIV tests are not one of  the eight tests included in the OPC and RAPID review, VAMC officials we  interviewed told us that VAMC procedures for communicating results are  generally the same for all tests. OPC officials stated that VAMC officials  could use the data to identify needed performance improvement efforts  related to the communication of test results. OPC officials added that  while it is not the primary goal of the OPC and RAPID review, data on the  eight tests included in the review may serve as a sample, providing some  indication as to whether VAMC procedures promote the timely  communication of results of any test to veterans.

Although OPC and RAPID publish a quarterly report on the timeliness of  communicating test results, HIV lead clinicians may not be aware they  have access to this information. OPC and RAPID officials told us that  VAMC staff responsible for serving as liaisons for OPC’s medical records  review are notified by RAPID via email of the report’s availability. RAPID  officials added that any VAMC staff may opt in to the email group that  officials use to notify liaisons that the timeliness data have been  published. HIV lead clinicians we interviewed reported that they did not  know that they can opt in to this email group.

According to RAPID officials, the main mechanism for making VAMC staff  aware that they can join this email group is through their VAMC  colleagues. VHA has not taken steps to more systematically  communicate the availability of these timeliness data to all VAMC staff  (including HIV lead clinicians). Standards for internal control in the federal  government require that agencies communicate necessary information  throughout all agency reporting lines to achieve the agencies’ objectives  and respond to identified risk. VHA policy requires that HIV lead  clinicians serve as VAMC points of contact on HIV testing, diagnosis, and  care, which may include monitoring HIV care.

An HIV lead clinician we interviewed also noted that these data could be  used as an indicator as to whether HIV test results are being  communicated to veterans in a timely manner. Further, having these data  could help staff determine if delays in communicating test results pose  risks to the timely completion of HIV screening, such as whether veterans  who test positive for HIV are linked to care for their diagnosis as  expeditiously as possible. If there are unnecessary delays in  communicating positive HIV test results to veterans, providers may be at  risk of delaying the start of needed HIV treatment. According to VHA  policy, and confirmed by RAPID officials, the timely communication of test  results to veterans is essential for high quality care, and the timely follow- up of positive test results may help veterans achieve favorable health  outcomes.

VHA Does Not Collect or Disseminate Data to Monitor VAMCs’ Timeliness in Linking Veterans Who Test Positive for HIV to Care, but Has Taken Steps to Do So

Linking Veterans to Preventive Care for  Human Immunodeficiency Virus (HIV)  In addition to linking veterans who test  positive for HIV to care for their diagnosis,  Department of Veterans Affairs (VA) medical  centers link veterans who test negative for  HIV to preventive care. The use of preventive  medication, or pre-exposure prophylaxis  (PrEP), reduces the risk of acquiring HIV in  adults.  Officials from VA’s HIV, Hepatitis, and  Related Conditions Programs (HHRC) told us  that they implemented a PrEP quality  improvement initiative in September 2016,  which focuses on increasing the use of PrEP  among veterans who live in areas of the  country with a higher prevalence of HIV  compared to the national average. HHRC  officials told us that the initiative focuses on  providing high quality care to veterans in  accordance with current recommendations on  the use of PrEP. For example, the Centers for  Disease Control and Prevention (CDC) has  recommended that providers prescribe PrEP  medications to individuals who test negative  for HIV within one week of documenting the  test result.  HHRC officials told us that they monitor the  time frames in which veterans are prescribed  PrEP medication by collecting data on a  biannual basis on the date on which veterans’  blood was drawn for the purposes of  conducting an HIV test and the date on which  veterans’ were prescribed the medication.  HHRC officials told us that these data are  disseminated to VA medical center staff  responsible for improving HIV screening to  improve the appropriate use of PrEP as  needed. source of information to determine whether veterans are linked to care  specifically for their HIV diagnosis within the recommended time frame.  According to officials, the data tool was implemented in October 2018,  and as of early November 2019, they were in the process of building the  capacity to generate a report based on these data showing the time  frames in which veterans are linked to HIV care.

HHRC officials initially indicated that they expected to begin monitoring  linkage to HIV care in August or September 2019, but they were not able  to do so for various reasons. According to HHRC officials, the process of  building the new data tool and the capacity to generate a report has been  lengthy due to competing priorities related to VHA’s ongoing development  of a new EHR system. These officials added that they have been  simultaneously focused on implementing required improvements in the  diagnosis and treatment of veterans with Hepatitis C. According to  officials, the time frame to develop the new data tool and report has been  extended due to these competing priorities.

HHRC officials told us that once monitoring begins, they will report on the  number of veterans who are linked to HIV care within the recommended  30-day time frame for each VAMC on an annual basis, retroactive to fiscal  year 2018. According to HHRC officials, the data will be disseminated by  publishing them on an internal data sharing website that each VAMC’s  HIV lead clinician can access. The officials explained that these  clinicians will be notified when the data have been published via email  and during regularly scheduled conference calls with HHRC. HHRC  officials also told us that the data may be used to inform any needed  improvements in the timeliness of linking newly diagnosed veterans to  HIV care.

Standards for internal control in the federal government require that  agencies perform ongoing monitoring activities and evaluate results to  remediate any identified deficiencies on a timely basis. VHA policy  requires that HHRC develop data reports for monitoring the quality of HIV  care that are to be disseminated to the VISNs or VAMCs, among other  entities and individuals, and lead VHA efforts toward meeting the NHAS’s  recommendations. However, until HHRC disseminates data on the  timeliness with which veterans are linked to HIV care, VAMCs are limited  in their ability to identify any delays and take the necessary steps to  ensure that this occurs within recommended time frames, now and in the  future. In our nongeneralizable review of the 38 medical records for  veterans who tested positive for HIV, we observed some instances of  delay. Specifically, we found that six veterans were first seen by an  infectious disease provider, who typically treats HIV, more than 30 days  after being informed of their positive test results. We were unable to  identify a documented explanation in the six medical records for why  linkages to care exceeded 30 days. Delays in linking veterans to HIV care  can increase the risk that veterans are not promptly beginning treatment  to help achieve favorable health outcomes. According to the 2015 NHAS,  evidence shows that earlier treatment reduces the risk that an individual  with HIV will develop AIDS or transmit the virus to others.

Veterans who are voluntarily tested for HIV at VAMCs, informed of  positive HIV test results in a timely manner, and expeditiously linked to  care before their infections progress further have improved health  outcomes, a longer life expectancy, and a reduced risk of transmitting the  virus to, for example, a sexual partner. VHA has monitored the provision  of HIV tests to veterans and reported related improvements resulting from  these monitoring efforts, ensuring that, for example, veterans are  receiving the most current CDC-recommended test. However, VHA’s  dissemination of data on the time frames in which test results are  communicated to veterans and monitoring of the time frames in which  HIV-positive veterans are linked to care specific to their diagnosis needs  improvement.

We are making the following two recommendations to VA:  The Under Secretary for Health should take steps to improve  communication to VAMC staff (including HIV lead clinicians) about the  availability of data on the time frames in which test results are  communicated to veterans. (Recommendation 1)

The Under Secretary for Health should disseminate data to HIV lead  clinicians on the extent to which veterans who test positive for HIV are  linked to care within recommended time frames. (Recommendation 2)

We provided a draft of this report to VA for review and comment. In its  written comments, which are reproduced in appendix I, VA concurred with  our recommendations. VA stated that it will communicate to VAMC staff,  including HIV lead clinicians, how providers may be notified when the  data on the time frames in which test results are communicated to  veterans have been published. Further, VA stated that HIV test results will  be added to the OPC and RAPID quarterly review of such time frames  beginning in the second quarter of fiscal year 2020. VA also indicated that  as of December 2019, the agency began annual monitoring of whether  veterans are linked to HIV care within recommended time frames and will  notify HIV lead clinicians of the availability of the data during conference  calls scheduled to take place in January and March 2020.

We are sending copies of this report to the appropriate congressional  committees and the Secretary of Veterans Affairs. In addition, this report  is available at no charge on the GAO website at https://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-7114 or at DraperD@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix II.

Appendix I: Comments from the Department of Veterans Affairs

In addition to the contact named above, Hernán Bozzolo (Assistant  Director), Karen Belli (Analyst-in-Charge), Hannah Grow, Cathy Hamann,  and Tatyana Walker made key contributions to this report. Also  contributing were Jacquelyn Hamilton, Diona Martyn, and Vikki Porter.

The Veterans Health Administration is the largest single provider of medical care to HIV infected individuals in the nation. VA medical centers in 2018 provided care to over 31,000 HIV-positive veterans. Those who receive health care before their infections progress have better health, longer lives, and a lower chance of transmitting HIV.

Among other things, we found VA does not track whether HIV-positive veterans began treatment within 30 days of their diagnosis—VA’s recommended maximum. We recommended that VA communicate to key VA staff whether veterans are being linked to care in the recommended period.