Healthcare Security Gaps: Lessons From the VA Spokane Inspection

In February 2026 the Department of Veterans Affairs Office of Inspector General (VA OIG) published an inspection of information security at the VA Spokane Healthcare System in Washington. An earlier version of this article credited the report to the HHS Office of Inspector General. That was wrong: the VA has its own inspector general, and this was its report (No. 25-00975-234, dated February 18, 2026).

A VA medical center is far bigger than a med spa or a five-provider clinic. But the problems the inspectors found are the same ones that show up in small offices: patches that slip, staff who keep access they no longer need, and network gear sitting where anyone can reach it. This guide walks through what the report found and turns it into a practical checklist.

What the inspectors looked at

The OIG team visited the Mann-Grandstaff VA Medical Center in Spokane from January 29 to February 6, 2025. The facility served about 27,000 patients in fiscal year 2024 and had more than 1,300 employees.

The OIG chose Spokane for two reasons, according to the report. It had not been visited as part of the annual federal security audit (required under FISMA, the Federal Information Security Modernization Act), and it is one of six VA healthcare systems running the new federal electronic health record (EHR).

The inspection covered three control areas: configuration management, security management, and access controls. The OIG found deficiencies in all three and made seven recommendations. The report also notes that in the VA's fiscal year 2024 FISMA audit, 21 of 23 recommendations were repeats from earlier years, which says a lot about how hard these fixes are to make stick.

The findings, in plain terms

1. Vulnerabilities left open past the deadline

VA policy gives staff 60 days to fix critical and high-severity vulnerabilities (the VA lengthened the critical window from 30 to 60 days in April 2024). When a fix cannot be made in time, staff are supposed to log it in a plan of action with milestones. The inspectors found multiple critical and high vulnerabilities across numerous systems that were past the deadline with no plan on file. Some systems were also running unsupported software.

2. Devices not matching secure baselines

The team scanned the core network device and several databases. Some configuration settings did not meet the approved security baseline. A baseline is simply the documented "this is how this device should be set up" standard, and drift from it is one of the most common ways small gaps open up.

3. Too many people could see too much

Some users of the federal EHR, including volunteers and scheduling clerks, still had access to a screen showing unredacted personal information. A supervisor told inspectors the access was granted years earlier to pull records from a legacy system and was no longer needed. Nobody had taken it away.

4. Physical controls that did not hold up

The OIG found four access control problems:

The same people who cut facility keys also held the blank key stock, and there was no inventory of blanks, so unauthorized keys could not be detected.
Network equipment was not secured in a closet or approved enclosure at two locations.
Of 31 communications closets tested (out of 36), 11 did not meet grounding requirements, and staff were unaware.
A fuel tank lacked the anti-ram barriers VA guidelines call for.

Where things stand

In December 2025 the VA concurred with all seven recommendations. The OIG closed recommendation 7 after the VA documented the fix and kept recommendations 1 through 6 open until the VA shows evidence of progress.

Why this matters outside the VA

The VA inspection measured the facility against FISMA, NIST guidance and VA policy, not against HIPAA. Still, the HIPAA Security Rule asks private practices to manage the same risks. The rule requires covered entities and business associates to:

Conduct an accurate and thorough risk analysis of potential risks and vulnerabilities to electronic protected health information (ePHI), and manage those risks down to a reasonable level.
Regularly review records of system activity, such as audit logs and access reports.
Terminate access when someone leaves or no longer needs it.
Train the whole workforce, including management.
Perform periodic technical and nontechnical evaluations.
Control physical access to facilities, workstations and devices.

The current rule does not set a fixed scan or test schedule. In January 2025, HHS proposed a major update that would, among other things, require a written asset inventory and network map, automated vulnerability scans at least every six months, and penetration testing at least every 12 months. As of mid-2026, HHS had moved its target for final action to July 2027, and it is not clear which parts will survive. Treat those numbers as a sign of where regulators are heading, not as current law.

Enforcement already focuses on the basics. The HHS Office for Civil Rights (OCR) launched a Risk Analysis Initiative in late 2024; its first action was a $90,000 settlement with an Oklahoma ambulance authority that, according to OCR, had never conducted a risk analysis before a ransomware attack.

Current HIPAA penalty figures

HHS adjusts HIPAA civil money penalties for inflation each year. The most recent adjustment, published January 28, 2026 (applying the 2025 inflation multiplier), sets these per-violation ranges:

Culpability tier	Minimum per violation	Maximum per violation
Did not know	$145	$73,011
Reasonable cause	$1,461	$73,011
Willful neglect, corrected within 30 days	$14,602	$73,011
Willful neglect, not corrected	$73,011	$2,190,294

The regulatory calendar-year cap for identical violations is $2,190,294. Separately, under a 2019 Notice of Enforcement Discretion, HHS applies lower annual caps for the first three tiers: $25,000, $100,000 and $250,000 before inflation adjustment, with $1.5 million for the top tier. The older "$100 to $50,000 per violation" figures still quoted on many sites are out of date.

A practical checklist for practices

These items mirror what the VA inspectors tested. They are a starting point for a conversation with your IT provider and counsel, not a compliance certification.

Patching and configuration

Keep a written list of every device and system that touches patient data, including phones, tablets, cloud apps and the router.
Set your own patch deadline for critical and high-severity issues, write it down, and track exceptions with a date and an owner.
Retire or isolate anything running software the vendor no longer supports.
Record how key devices should be configured and spot check them after changes.

Access

Review who can see what in your EHR and practice management system on a set schedule, and after any role change.
Remove access the same day someone leaves.
Ask whether front desk, scheduling or volunteer roles really need full demographic screens, Social Security numbers or payment details.
Give each person a unique login and turn on multi-factor authentication where the system supports it.

Physical security

Keep network equipment in a locked closet or cabinet, not under a desk in a shared area.
Separate who issues keys or badges from who controls the blanks, and keep an inventory.
Lock screens automatically and keep workstations out of patient sight lines.

Documentation

Run and document a risk analysis. The free HHS and ONC Security Risk Assessment Tool is built for small and medium practices.
Keep a short log of fixes, exceptions and who approved them. The VA case shows that undocumented exceptions are what auditors flag.

Where NutriCove fits

NutriCove sets up AI automation for medical offices, such as AI receptionists, missed-call text back, follow-up and booking. Each of those tools is another system that may handle patient information, so it belongs in your asset list, access reviews and risk analysis. Our medical office page explains that GoHighLevel needs its HIPAA add-on and a signed business associate agreement before any PHI goes in. If you are planning automation for your office, see how we set it up for medical practices.

Sources

This article is general information, not legal or medical advice. Talk to a qualified attorney or licensed professional about your situation.