VA medical facilities “have been the target of violence, threats, and other security-related incidents” but the department is not in compliance with government-wide policies to assess and address such threats and thus “does not know if its medical centers are adequately protected,” GAO has said.

GAO noted bomb threats in recent years and violent attacks involving weapons, including a 2015 incident in which a psychologist was fatally shot while working at a VA medical clinic. Such incidents are not unique to the VA network of course. A 2017 Healthcare Crime Survey from the IAHSS found that about 90 percent of assaults at US hospitals are directed at “employees by customers, clients, patients, students, inmates, or any others for whom an organization provides services.” Few assaults take place between employees, and apparently few are the result of visitors attacking staff.

An interagency security committee in 2013 set standards and best practices that agencies are to follow when developing and conducting risk assessments but the VA does not take all of those indicators of risk into account, GAO said, nor does it include performance measures, such as the number of countermeasures in use or the percentage of facility assessments completed.

The nine sites GAO reviewed “conducted their security assessments differently, and none of the assessments indicated that all of the threat categories in VA’s policy were reviewed,” it added.