Summary

  • VA did not pause a routine software installation in April 2023. It halted most future deployments after clinicians and veterans reported that the new EHR was not meeting expectations. By then, formal records had linked the system to missing clinical orders, medication and allergy data problems, scheduling failures, repeated performance incidents, workarounds, and low user satisfaction.
  • The strongest independent incident record is the September 2024 VA Office of Inspector General audit. It counted 826 VA- or Oracle Health-responsible major performance incidents from October 24, 2020 through March 31, 2024, with a summed 1,909 hours and 26 minutes in which the system was affected. Those figures are not a count of patients harmed and not all incidents were complete outages. They establish scale, duration, and the need for disciplined incident control.
  • Confirmed patient-safety evidence is more specific. The OIG unknown-queue review found that thousands of orders went to an undetectable location and that VHA reviews identified 149 patient-harm events. A separate OIG scheduling inspection found that an EHR error prevented a missed mental-health appointment from reaching a queue and, together with inadequate care, contributed to a patient's death. The system error was one contributor, not the only cause.
  • VA and Oracle Health have evidence of repair. VA renegotiated the contract into annual option periods, introduced performance thresholds and possible invoice credits, reported sustained reliability improvements, closed most recommendations in the major-incident audit, and resumed deployments at eight medical centers in Michigan, Ohio, and Kentucky during April and June 2026.
  • Repair is not yet equivalent to closure. A December 2025 GAO readiness record said VA had not fully implemented 16 of 18 prior GAO recommendations. As of July 15, 2026, two of nine recommendations from the major-incident OIG audit remained open, including real-time incident-data sharing and effective notification and resolution metrics that apply regardless of incident owner. The public record cited here also does not yet contain an independent, longitudinal patient-safety assessment of the eight 2026 deployment sites.
  • Durable accountability therefore requires more than uptime and a successful cutover weekend. It requires auditable links from every significant incident to clinical effects, named control owners, tested downtime and reconciliation procedures, enforceable vendor remedies, user and patient outcomes, independent verification, and public disclosure of what remains unresolved.

What an EHR reset failure means

The word "reset" in this case has two meanings that should not be confused. It can describe the act of restarting or recovering a system after a technical disruption. More importantly, VA used "Reset" as the name of the program-wide intervention announced in April 2023: future deployments would stop while the department and its contractor repaired reliability, usability, workflow, governance, and patient-safety problems at the five sites then using the new EHR.

This article uses "reset failures" to mean failures serious enough to force that program reset, together with failures in the evidence and controls intended to make the reset credible. It does not claim that every incident was caused by a literal reboot.

The modernization objective was legitimate. In May 2018, VA signed a Cerner contract with a ceiling of $10 billion over ten years. The aim was to replace locally varied instances of the Veterans Health Information Systems and Technology Architecture, or VistA, with the same core platform used by the Department of Defense. A common longitudinal record was supposed to reduce manual exchange and reconciliation as service members moved into veteran care, while improving access to records from community providers.

That objective does not answer the accountability question. A platform can promise interoperability and still introduce unsafe order routing, confusing medication views, scheduling gaps, interface defects, or downtime burdens in a particular implementation. VA has unique clinical workflows, governance, staffing patterns, local integrations, patient populations, and legal duties. The relevant unit of analysis is therefore the operating care system: software, configuration, interfaces, data, policy, training, staffing, incident management, local adaptation, and vendor performance together.

The reset was necessary because the gap between the promised common record and the operating record became too large to treat as normal adoption friction. VA's April 21, 2023 reset announcement said the new EHR was not meeting veteran and clinician expectations. It set readiness tests around clinician and veteran experience, sustained high performance and reliability, and restored productivity. It also said VA and Oracle Cerner were working toward a contract amendment that would increase contractor accountability. These were promises to produce evidence, not declarations that the underlying issues had already been solved.

An auditable timeline from award to resumed rollout

Date Confirmed event Accountability significance
May 17, 2018 VA awarded Cerner the EHR contract, with a $10 billion ceiling over ten years. VA chose the acquisition model, core platform, contractual requirements, and initial allocation of control.
October 24, 2020 The new EHR went live at Mann-Grandstaff VA Medical Center in Spokane. The first operating site became the first real test of configuration, training, workflow, and incident response.
June-December 2021 VHA began clinical reviews of orders sent to the unknown queue and later rated the risk major in severity, frequent, and very difficult to detect. A hidden routing condition became a patient-safety and disclosure problem, not merely a support ticket.
February 1, 2022 GAO reported migrated-data quality and reporting problems, including errors involving allergy, medication, and immunization data that could pose patient-safety risks. Data migration became a measurable safety control, not an assumed benefit of using a common platform.
March-June 2022 VA deployed the EHR at Walla Walla, Columbus, Roseburg, and White City. Oracle acquired Cerner in June 2022. Deployment expanded while responsibility for the contractor passed to Oracle Health. Acquisition did not erase VA's duties or the inherited contract record.
July 14, 2022 OIG published the unknown-queue report and identified 149 patient-harm events. The record established confirmed harm and a failure to inform end users about a queue they needed to monitor.
July 2022-April 2023 VA delayed additional deployments, conducted an "assess and address" period, and then announced the full reset. A sequence of pauses showed that readiness could not be inferred from elapsed time or prior go-lives.
May-June 2023 VA modified contract controls, including reliability measures and financial-credit mechanisms, and shifted from a five-year term to annual option periods. The reset acquired a contractual enforcement layer, although later audits found gaps in data access and metric enforcement.
March 9, 2024 VA and DOD deployed the Federal EHR at the joint Lovell Federal Health Care Center while the broader pause continued. Lovell became an internal comparison site for whether stronger preparation could support a complex go-live during the reset.
March 21, 2024 OIG published reports on pharmacy safety, a scheduling-related death, and scheduling challenges. The record connected software behavior to medication, follow-up, staffing, and clinical-policy controls.
June 13, 2024 VA awarded an 11-month second contract option with an emphasis on fiscal and performance accountability. Annual options created a recurring decision point, but extension still depended on VA's ability to verify reported performance.
September 23, 2024 OIG reported inadequate controls over major incidents and persistent staff concerns at live sites. Reliability, downtime, post-incident analysis, staffing, productivity, and patient-safety linkage remained governance issues.
December 20, 2024 VA began planning 2026 deployments at four Michigan facilities and published improvement claims. The reset moved from repair toward scale, increasing the importance of independent readiness evidence.
March-May 2025 GAO reported incremental improvement but major open work; VA then awarded Oracle Health a third annual option. Contract continuation and rollout acceleration proceeded while cost, schedule, user satisfaction, and recommendation gaps remained.
September-December 2025 OIG found Lovell interface-test documentation deficiencies; GAO said 16 of 18 EHR recommendations were not fully implemented as of December. A successful launch claim did not eliminate the need for complete test evidence or closure of independent recommendations.
April 11, 2026 Four Michigan medical centers went live. This was the first multi-site deployment wave after the pause and the first major scale test of reset controls.
June 6, 2026 Four medical centers in Ohio and Kentucky went live. VA accelerated to a second four-site wave before a public independent longitudinal review of the Michigan sites appeared.
June 26-July 15, 2026 VA said the EHR was active at 14 medical centers and 75 clinics serving more than 515,000 veterans; five more 2026 sites were planned but not yet live by the cutoff. Deployment success is now a continuing clinical-outcome question, not a one-week implementation milestone.

This timeline is deliberately conservative. It does not infer hidden incidents between public dates, and it does not treat an oversight recommendation's closure as proof that no related risk can recur. It identifies when control claims entered the public record and what evidence would be needed to test them.

Control was distributed, but it was not ownerless

The VA Secretary and Deputy Secretary controlled strategic continuation, deployment pace, senior governance, contract options, and the standard for declaring readiness. They could halt deployment, direct a reset, consolidate decision-making, require performance evidence, and decide whether the claimed benefits justified further scale. Those powers create responsibility for the deployment gate. They do not make senior leaders the operators of every clinical queue or database, but they make them accountable for ensuring that the people who do operate those controls have authority, resources, and measurable obligations.

The EHR Modernization Integration Office controlled program integration. Its responsibilities included translating clinical and operational requirements into configuration and contract work, coordinating national and local stakeholders, tracking change requests, managing deployment preparation, verifying contractor service levels, and integrating evidence from support, safety, and operations. The OIG major-incident audit is especially important here because it found that VA relied on Oracle Health reporting and lacked a formal procedure to verify some contractor performance metrics and credits.

As of July 15, 2026, OIG marked the procedure for verifying metrics and associated credits closed, but still listed its recommendation for contractually committed real-time incident data as open.

The Veterans Health Administration controlled clinical policy, patient-safety processes, staffing expectations, downtime procedures, medication reconciliation requirements, patient notification, and the standards applied when digital workflows failed. This control boundary matters because software did not decide how many follow-up attempts were required after a missed mental-health appointment, how pharmacists should check cross-system medication data, or how facilities should reconcile paper records after downtime.

VHA could not repair Oracle code by itself, but it could establish mandatory clinical safeguards, monitor compliance, and refuse to treat improvised workarounds as a permanent operating model.

Oracle Health controlled major parts of the technology and service operation: vendor-owned code, database behavior, hosting and platform performance, defect remediation, vendor ticketing, operational analysis, and delivery under the contract. Cerner held that role when the first deployments and unknown-queue problem emerged; Oracle acquired Cerner in June 2022 and inherited the contract and ongoing remediation responsibilities. The Oracle contract-extension announcement argued that the platform had been fortified, that Lovell exceeded expectations, and that the same core system served DOD at large scale. Those are relevant vendor assertions. They do not replace VA-specific audit evidence, because configuration, integrations, governance, and workflows differ.

Local medical-center leaders controlled go-live preparation within their facilities, role assignment, training attendance, local staffing, escalation, downtime workgroups, reconciliation practices, and the immediate response to safety concerns. Their authority was real but bounded. A facility director could tell staff to stop relying on suspect electronic data, as happened during one incident reviewed by OIG, but could not alone repair a national code defect or rewrite the contract.

Local accountability should therefore be judged on readiness, escalation, mitigation, and honest reporting, not on whether a facility absorbed every national defect without complaint.

Clinicians, pharmacists, schedulers, health-information staff, and support personnel controlled individual actions within approved workflows. They could report incidents, monitor queues, perform medication checks, use downtime forms, reconcile records, and escalate anomalies. They should be accountable for professional duties they could reasonably perform. They should not become the default liability sink for a design that depends indefinitely on vigilance, duplicate entry, manual searches, or local memory.

A workaround is evidence that staff protected patients under constrained conditions; it is not proof that the upstream control was adequate.

Congress, GAO, and OIG controlled oversight tools rather than clinical operations. Congress could mandate reports, condition funding, hold hearings, and legislate disclosure. GAO could test program management against leading practices and track recommendations. OIG could investigate safety and contract controls, publish findings, and close recommendations when VA supplied sufficient evidence. None of these bodies could operate the EHR for VA, but their records defined evidence VA and Oracle could not fairly replace with promotional claims.

Veterans and caregivers controlled almost none of the system architecture. They could call, return for care, use a portal, correct information they noticed, or complain after a delay. They did not select queue behavior, medication-data mapping, interface tests, outage response, staffing, or the pace of rollout. Accountability should therefore follow the actors with practical control over prevention, detection, mitigation, disclosure, and repair, not the people asked to detect an institutional failure from the patient side.

The harm record has several distinct layers

The unknown queue is the clearest confirmed example of a control failure becoming patient harm. OIG found that the new EHR sent thousands of orders for medical care to an undetectable location rather than the intended destination. VHA's clinical reviews found 149 patient-harm events attributable to orders routed there. OIG also found that Oracle Cerner failed to inform VA end users about the queue, placing the mitigation burden on VHA. By May 2022, more than 200 orders were still found in it despite mitigation work.

The public record does not identify every patient, order type, severity, or long-term consequence, and this article does not invent those details.

The queue failure shows why availability alone is an incomplete safety measure. A clinician could log in and enter an order while the system remained "up," yet the intended service might never receive the work. The relevant control chain was order validation, routing, exception visibility, queue ownership, monitoring, escalation, clinical review, and disclosure. A high uptime percentage would not detect a silently misrouted order. Durable repair therefore needs transaction-level completion evidence and an accountable owner for every exception queue.

The scheduling-death record requires equal precision. OIG examined a patient who died from an accidental inhalant overdose about seven weeks after a missed appointment. It found that an EHR error prevented the missed appointment from being routed to a queue that would prompt rescheduling efforts. It also found inadequate mental-health care, fewer required contact attempts at new-EHR sites than at legacy sites, incomplete assessment and supervision, and failures involving caring communications. The report's conclusion was contributory and multi-factor. It does not support the simplified claim that software alone caused the death.

It does support the conclusion that a scheduling defect can become clinically consequential when policy, follow-up, supervision, and escalation controls also fail.

The pharmacy record shows a different class of risk. The March 2024 OIG pharmacy inspection found that a software coding error transmitted inaccurate medication and allergy information from new-EHR sites to legacy sites. It reported that affected patients had not been notified of their risk at the time examined and described recommended provider mitigations as unsustainable. OIG also linked operational inefficiency to added pharmacist staffing, workarounds, educational materials, burnout, job dissatisfaction, and lower morale. All nine recommendations were later listed as closed, with the final closures in 2025. Closure is material repair evidence, but the durable test is whether cross-system medication accuracy and staffing capacity remain within safe limits as the number of EHR sites rises.

Scheduling challenges extended beyond one adverse outcome. The OIG scheduling advisory described displaced-appointment queue problems, inaccurate patient information, difficulty changing appointment types, communication problems between providers and schedulers, inability to automate some reminder letters, and the need for additional staffing and overtime to reach pre-deployment appointment levels. These are not all patient-harm findings. They are risk pathways: each can produce delay, duplicate work, missed follow-up, or uncertainty unless a monitored control closes the loop.

Data migration created another layer. GAO's 2022 data-management review found errors involving allergy, medication, and immunization data and called for performance measures and goals for migrated-data quality. Data migration is often described as a one-time technical task, but in a national health system it is a clinical reconciliation program. Accuracy, completeness, provenance, duplicate handling, patient identity, and correction workflows must remain auditable as records cross VA, DOD, community, legacy, and new-system boundaries.

System interruption is the broadest layer. OIG's major-incident dataset counted 826 incidents for which VA or Oracle Health was responsible from the first go-live through March 31, 2024: 172 assigned to VA and 654 to Oracle Health. The summed period in which the system was affected was 1,909 hours and 26 minutes, and individual incidents ranged from one minute to 27 hours and seven minutes. Some incidents were categorized in more than one way, and the total includes performance degradation and incomplete functionality as well as outages.

It is therefore wrong to translate 1,909 hours into an equal number of hours of complete clinical shutdown, or to multiply it by a guessed patient count.

Even with that boundary, the exposure was substantial. During one system-change incident, OIG reported that the Mann-Grandstaff director told personnel to stop using the EHR and consider electronic patient data corrupted or inaccurate, and many appointments had to be rescheduled. OIG also found that facilities used inconsistent downtime procedures and lacked a fully effective interoperable read-only backup.

If clinicians cannot trust current electronic data, patient safety depends on how quickly the problem is declared, what trustworthy data remains available, whether medication and order activity can continue, and how every paper or temporary record is reconciled after restoration.

The September 2024 facility-concerns memorandum shows that harm and cost also accumulated in work systems. Leaders and staff at Walla Walla and Southern Oregon described persistent problems involving efficiency, productivity, staffing, finances, and patient safety. Those interviews do not quantify the entire national program and should not be generalized beyond their evidence. They do show that a technical reliability trend can improve while clinical labor and local financial consequences remain unresolved.

Cost was transferred as well as incurred

The public cost record contains numbers that refer to different things. The original 2018 contract had a ceiling of nearly $10 billion over ten years. VA's January 2019 total life-cycle estimate was about $16.1 billion, combining the contract with infrastructure readiness and program-management support. In 2022, the Institute for Defense Analyses produced an independent $49.8 billion life-cycle estimate: $32.7 billion for thirteen years of implementation and $17.1 billion for fifteen years of sustainment. These are not interchangeable figures, and none is a final invoice.

GAO's December 2025 readiness testimony reported that VA had obligated about $13.84 billion from fiscal year 2018 through the second quarter of fiscal year 2025. It broke that figure into about $5.85 billion for the EHR contract, $3.35 billion for IT infrastructure, $1.48 billion for program management, $2.85 billion for VHA, and $324 million for VA's Office of Information and Technology. As of December 2025, GAO said VA still had not provided an updated total life-cycle cost estimate, and the program had not supplied detailed schedule documents sufficient for GAO to assess the schedule against leading practices.

Direct program spending is only one cost category. Clinical staff spent time monitoring queues, checking medication data, learning new workflows, entering or scanning downtime records, handling support tickets, rescheduling appointments, and restoring productivity. Facilities used overtime and additional pharmacy staffing. Veterans absorbed waiting, rescheduling, repeated contact, uncertainty about whether an order arrived, and the risk that inaccurate data followed them across systems.

The public record does not provide a reliable national dollar total for those burdens, so the costs should be named without pretending they have been fully monetized.

Lock-in is another cost. Once data, interfaces, training, workflows, portals, and DOD interoperability depend on a common platform, changing direction becomes more expensive even when performance disappoints. That does not make continuation irrational. It makes annual option decisions more consequential. VA must compare the incremental cost and safety of repairing and scaling Oracle Health against the cost and safety of extending VistA, running parallel environments, or procuring a replacement. The reviewed public record does not contain a current, complete comparative estimate for those alternatives.

The legal and oversight record changed the accountability structure

The EHR program is not governed only by press releases. The VA Electronic Health Record Transparency Act of 2021, enacted as Public Law 117-154 in June 2022, requires periodic reports to the House and Senate Veterans' Affairs Committees on program costs, performance metrics, and outcomes. The required performance record includes quality, performance, safety, and value measures, supporting data, changes to those measures, and lists of patient-safety reports, incidents, alerts, or disclosures at each implemented facility. That law turned transparency from a discretionary communication practice into a recurring statutory duty until full implementation is certified.

Congress added a funding lever in Public Law 118-42, the 2024 appropriations law. It conditioned availability of relevant modernization funds on reports about the causes of the April 2023 deployment delay, reset metrics and progress, clinical and product standardization, performance against pre-deployment baselines, and a written certification about whether the system was stable, ready, and optimized for further deployment. This did not make Congress the system operator. It established that deployment readiness had financial and reporting consequences.

The contract became more enforceable during the reset. VA's June 2024 second-option announcement said the agreement emphasized fiscal and performance accountability and described the shift from a five-year term to five one-year terms. The May 2023 modification raised the outage-free target from 99.9 percent to 99.95 percent, added an incident-free measure, and strengthened potential financial credits. The May 2025 third-option announcement continued the annual review model and said negotiations focused on cost efficiencies and optimization.

Enforceability still depends on evidence. GAO found that outage and incident thresholds could trigger invoice offsets, while some ticket-resolution thresholds during the examined period did not carry financial consequences. OIG found that VA needed its own verification procedure, real-time operating data, consistent prioritization, owner-neutral response metrics, and complete post-resolution reporting. As of the cutoff, the verification procedure, prioritization, and post-resolution-report recommendations were closed. Real-time data sharing and effective notification and resolution metrics remained open.

The public record reviewed here does not establish a final court judgment allocating civil liability between VA and Oracle Health for these failures, nor a criminal finding against either institution. OIG recommendations, GAO recommendations, statutory reports, appropriations conditions, and contract remedies are different mechanisms from a damages judgment. Their importance is practical: they can require disclosure, delay funds, change contract economics, and force evidence production before a court ever allocates loss.

Repair evidence is real, but it has different strengths

GAO's March 2025 reset assessment documented meaningful improvement and remaining weakness. By June 2024, VA had implemented more than 1,500 configuration changes. As of July 2024, program officials said nine of fourteen highest-priority patient-safety enhancement requests were closed. Six of seven identified pharmacy enhancements had been delivered. VA had also created service-level thresholds for ticket resolution, outage-free time, and incident-free time.

The same report prevents an overly favorable reading. As of February 2025, about 1,800 complex configuration-change requests had not been addressed. At the end of 2024, two of the five remaining top patient-safety enhancements were pending closure and three were not fully resolved. In September 2024, 75 percent of surveyed users disagreed or strongly disagreed that the EHR made them as efficient as possible. Only 23 percent agreed or strongly agreed that it enabled high-quality care, below VA's 27 percent reset target. Four of the five initial sites remained below their pre-go-live productivity baselines as of August 2024.

Reliability measures improved but did not initially meet every month. GAO found that VA's greater-than-99.95-percent outage-free threshold was met in fifteen of eighteen months from April 2023 through September 2024. The 95-percent incident-free threshold was met in thirteen of eighteen months. VA officials attributed incidents to database bugs, code defects, processing backlogs, and an attack affecting a data-exchange partner. These metrics are useful because they are defined and contract-linked.

They still require independent verification and clinical context: an incident-free percentage does not prove that every order, medication, result, or appointment reached the correct destination.

VA's December 2024 restart-planning release reported stronger results. It said veteran trust scores had increased at all live sites, outages had fallen, average user interruptions were near zero, and clinician satisfaction had improved. These are party-reported measures, although VA said the trust figures came from veteran surveys. They count as repair evidence, but they should be reconciled with definitions, denominators, site-level variation, and the independent user-satisfaction findings in GAO's report.

VA made an even stronger reliability claim in March 2026. The Deputy Secretary said the system achieved the outage-free target in 27 of 31 months from June 2023 through December 2025, met ticket-management targets for 30 consecutive months, and met incident-free time for every month from March 2024 through December 2025. The statement also described a single governance council, standardized baseline, closer senior engagement, and local-site visits. These claims are specific enough to test. The durable question is whether the underlying incident data, exclusion rules, ownership assignments, and clinical impact links are available to VA and independent reviewers.

OIG recommendation closure provides another repair signal. By July 15, 2026, seven of nine recommendations from the 2024 major-incident audit were listed as closed and implemented. The closed work included metric-and-credit verification, incident prioritization, post-resolution information, national downtime procedure familiarization, backup-system training, review of identified patient-safety reports, and a mechanism to connect major incidents with negative patient outcomes.

The two open recommendations matter because they sit at the vendor-government boundary: real-time incident-data sharing and effective notification and resolution metrics that work regardless of who owns the incident.

Lovell provides a mixed internal test. The September 2025 OIG interface memorandum confirmed that VA and Oracle Health conducted the correct tests and applicable retesting for the 24 reviewed interfaces. It also found inadequate documentation, conflicting "no run" and "passed" notations for four interfaces, and missing functionality in two VA-DOD interfaces where testers had not accounted for joint workflows. This is neither a failed deployment verdict nor clean exoneration. It shows that testing may occur while the audit trail remains too weak to prove exactly what was tested and accepted.

Deployment itself resumed. VA reported that four Michigan centers went live on April 11, 2026 and that four centers in southern Ohio and northern Kentucky went live on June 6. The latter release described peer support, earlier activation of command operations, and centralized monitoring. By June 26, VA said the system was active at 14 medical centers and 75 clinics serving more than 515,000 veterans, and that the early Spokane version lacked 13,000 upgrades now incorporated.

Those deployments are operational evidence that VA could cut over multiple sites after the reset. They are not yet durable patient-safety proof. Five more sites were scheduled for August and October 2026, after this article's cutoff. The cited public record does not yet include an independent, multi-month comparison of safety reports, medication reconciliation, appointment completion, order closure, downtime reconciliation, productivity, staffing, and patient experience at the eight 2026 sites. Early success should be recorded as early success, not converted into a final verdict.

GAO's December 2025 snapshot adds the strongest caution. It said sixteen of eighteen recommendations from five major EHR reviews were not fully implemented, including twelve priority recommendations. VA had closed the recommendation to set baselines and targets for all nine reset measures, but cost, schedule, change management, user satisfaction, ticket timeliness, independent operational assessment, data quality, testing, and stakeholder-participation recommendations remained open or partly implemented. GAO said it planned to observe sustained resolution of significant test findings in the 2026 deployments.

That planned observation is part of the missing verification record as of July 15.

The most recent independent scheduling context also counsels against assuming that one platform eliminates fragmentation. GAO's June 2026 scheduling testimony described dozens of VA scheduling systems and tools, noted that the Oracle Health rollout had been delayed by technical and performance issues, and discussed ongoing work to standardize self-scheduling across legacy and Oracle Health sites. A common EHR can reduce fragmentation over time, but the transition period itself contains multiple portals, scheduling rules, interfaces, and site states that must be governed.

Counterfactual comparisons clarify what success would mean

The first counterfactual is continuing the pre-reset deployment schedule. If VA had kept adding sites in 2023 while unknown-queue, pharmacy, scheduling, incident-response, user-satisfaction, and productivity issues remained unresolved, more veterans and staff would have entered the exposure perimeter before controls were standardized. The pause imposed delay and transition cost, but the official record supports the inference that it constrained blast radius. The unknown is how many events the pause prevented; no public source can supply that number.

The second counterfactual is treating VistA as a risk-free fallback. It was not. VA pursued modernization because locally varied legacy instances created interoperability, maintenance, security, and longitudinal-record limits. Retaining VistA indefinitely would preserve familiar workflows for many users but would also preserve fragmentation and require continuing investment.

The responsible comparison is not "new bad, old good." It is whether a staged Federal EHR transition, a prolonged hybrid state, a redesigned procurement, or continued legacy modernization produces the best verified clinical outcome per dollar and per unit of disruption.

The third comparison is DOD's deployment of the same core commercial platform. Oracle's 2024 statement said the system was live across 3,890 DOD garrison facilities with more than 197,200 users serving over 9.5 million beneficiaries. That scale is evidence that the core product can operate in a large federal environment. It is not proof that VA's implementation was safe at every point. VA and DOD differ in configuration, integrations, governance, staffing, clinical pathways, patient demographics, legacy data, and local operating models.

The comparison shifts the question from whether the product can ever scale to why the VA-specific sociotechnical system produced the documented failures and whether those causes were repaired.

The fourth comparison is Lovell versus the first five sites. Lovell went live during the reset, had no critical or high-severity test findings reported at go-live, and was presented by VA and Oracle as a stronger deployment. OIG later confirmed appropriate testing for the interfaces it sampled but found documentation and functionality deficiencies. The lesson is not that Lovell succeeded or failed in a binary sense. It is that a better deployment can still leave proof gaps, and those gaps should be corrected before the method is copied across larger waves.

The fifth counterfactual is a stricter deployment gate. VA could have required closure of every priority GAO recommendation, both remaining major-incident OIG recommendations, an independent operational assessment, current life-cycle cost and integrated schedule, and multi-month site-level outcome evidence before accelerating. That approach could reduce uncertainty but would extend the hybrid environment, increase delay costs, and postpone interoperability benefits. A defensible decision can accept some open work only if each exception has a named owner, bounded risk, compensating control, deadline, and transparent rationale.

"Open" should never mean ownerless.

Confirmed facts, supported inference, and unknowns

Confirmed facts. VA awarded Cerner a ten-year EHR contract in May 2018, first deployed the system in Spokane in October 2020, expanded to four more sites in 2022, and halted most future deployments in April 2023. Oracle acquired Cerner in June 2022 and became responsible for the contractor role. VA continued with Lovell in March 2024, began planning a broader restart in December 2024, and deployed at eight additional medical centers in April and June 2026.

Confirmed facts include OIG's finding that thousands of clinical orders were routed to an unknown queue and that VHA reviews identified 149 patient-harm events. Confirmed facts include the scheduling inspection's conclusion that an EHR error and inadequate mental-health care contributed to a patient's death. Confirmed facts include the pharmacy report's finding that a coding error transmitted inaccurate medication and allergy information between new- and legacy-EHR sites, as well as its findings about workarounds, staffing, and staff burden.

Confirmed facts include OIG's count of 826 VA- or Oracle Health-responsible major performance incidents through March 31, 2024 and the summed 1,909 hours and 26 minutes the system was affected. Confirmed facts include GAO's findings that VA implemented more than 1,500 configuration changes by June 2024, had about 1,800 unaddressed complex change requests as of February 2025, and still had substantial user dissatisfaction in September 2024. Confirmed facts also include VA's later publication of improved reliability measures, although those remain VA-reported measures rather than independent conclusions.

Confirmed legal and governance facts include the statutory quarterly reporting duties, 2024 appropriations conditions, annualized contract option structure, contract performance thresholds, OIG recommendation closures, and open recommendations. Confirmed cost facts include the original contract ceiling, the different life-cycle estimates, and VA's reported obligations through the second quarter of fiscal year 2025. Each figure measures a different scope.

Supported inference. The failures were sociotechnical, not exclusively software defects or exclusively user errors. Product behavior, configuration, data conversion, interfaces, contract design, incident information, clinical policy, training, staffing, local workflow, and follow-up interacted. This inference is supported because the oversight record identifies weaknesses in all of those layers and because different incidents crossed more than one control boundary.

It is also supported inference that the 2023 reset reduced immediate exposure by delaying expansion while VA and Oracle made changes. It is supported inference that annual options and SLA credits improve leverage only when VA can independently verify data and apply remedies. It is supported inference that stronger uptime does not by itself prove order completion, medication accuracy, safe scheduling, or effective downtime reconciliation. The ONC 2025 SAFER Guides support this broader standard by treating EHR safety as a combination of organizational responsibility, contingency planning, system management, order entry, result follow-up, patient identification, and clinician communication.

It is supported inference that the eight 2026 go-lives are meaningful but incomplete repair evidence. Multi-site operation without an immediate public crisis is relevant. A durable conclusion requires enough time and data to detect low-frequency harm, workarounds, delayed follow-up, productivity effects, and the recurrence of exception-queue or cross-system problems.

Unknowns. The public record does not disclose complete incident logs, all vendor telemetry, every change-control decision, all root-cause analyses, all patient-safety reports, every affected patient, or complete severity distributions for the 149 unknown-queue harm events. It does not establish the full causal contribution of the EHR to every delayed appointment, staffing problem, adverse event, or clinical outcome.

The current record does not provide a complete and independently validated life-cycle cost estimate reflecting the reset and the accelerated schedule. It does not provide complete invoice-credit totals, a public mapping from every SLA miss to a remedy, or the full commercial allocation of loss between VA and Oracle Health. It does not reveal all internal deliberations behind annual option awards or deployment decisions.

The record cited here does not yet provide multi-month independent outcome comparisons for the Michigan and southern Ohio/Kentucky deployments, full evidence for the five sites scheduled later in 2026, or proof that every closed recommendation remains effective under greater load. It does not establish that modernization is finished, that every prior defect is cured, or that future incidents will not occur. These unknowns should remain visible rather than being filled with assumptions about motive, competence, or hidden harm.

A durable accountability test for the next deployment wave

The first test is clinical transaction closure. VA and Oracle should be able to show that orders, referrals, test results, prescriptions, messages, and appointments reach an accountable destination. Exception queues must be visible, staffed, aged, and reconciled. A transaction should not count as successful merely because the originating screen accepted it. Safety measures should report completion, delay, rerouting, and manual intervention by site and clinical risk.

The second test is incident-to-outcome linkage. Every major incident needs a common identifier across VA and Oracle ticketing, precise start and end times, affected functions, sites, users, clinical workflows, workarounds, and corrective actions. VA's patient-safety system should be able to associate adverse events and close calls with that identifier without a manual keyword hunt. The two remaining OIG recommendations should close only when real-time data access and owner-neutral metrics are operating, not merely designed.

The third test is downtime continuity and reconciliation. Each site should demonstrate that clinicians can access a trustworthy read-only record, use standardized forms, continue high-risk medication and order processes, identify what changed during downtime, and reconcile every temporary record after restoration. Exercises should cover partial degradation as well as total outage, because a slow, incomplete, or mistrusted EHR can be more ambiguous than a clearly unavailable one.

The fourth test is medication and identity integrity across boundaries. VA should continuously sample medication, allergy, immunization, demographic, and patient-identity data as they move among DOD, Oracle Health, VistA, community care, pharmacy modules, and patient portals. Averages are limited public evidence for high-consequence fields. The system needs thresholds, exception review, patient notification rules, and evidence that a correction propagates everywhere it should without overwriting authoritative data.

The fifth test is human workload. Readiness should include staffing, overtime, time in the EHR per patient, queue backlog, ticket burden, turnover, burnout indicators, and local productivity. A workflow that is safe only because pharmacists, schedulers, or nurses add permanent manual checks has not been fully repaired. Staffing can be a valid compensating control during transition, but its cost, duration, and exit condition must be explicit.

The sixth test is independent operational verification. VA should publish or provide to oversight bodies an independent assessment of the 2026 sites after enough operating time to observe ordinary and peak conditions. That review should reconcile VA's reliability claims with raw definitions, excluded incidents, vendor ownership, patient-safety reports, and site outcomes. It should test whether a standardized national baseline is actually used and whether necessary local variation is governed rather than hidden.

The seventh test is contract consequence. Annual options should disclose what performance evidence justified continuation, which thresholds were missed, what credits or other remedies applied, which defects remain accepted, and who approved each exception. A service-level agreement without verified data and predictable enforcement is a reporting convention, not accountability. A contract remedy also should not substitute for clinical correction; an invoice offset cannot repair a missed order.

The eighth test is cost and schedule truth. VA needs a current, independent life-cycle estimate and an integrated schedule that includes the hybrid period, site preparation, infrastructure, clinical staffing, sustainment, future acquisition after current options, and retirement of legacy systems. Decision-makers should see ranges and uncertainty, not one headline number. A faster rollout can reduce years of dual-system cost, but it can also multiply remediation cost if readiness assumptions are wrong.

The ninth test is transparent deployment gates. Before each wave, VA should publish the metrics, thresholds, unresolved issues, compensating controls, responsible executives, and independent evidence used to approve go-live. After each wave, it should publish the same measures against pre-deployment baselines. If a threshold is waived, the waiver should identify the clinical rationale, expiration, and escalation path.

The final test is whether control and burden are aligned. VA owns the public mission, clinical policy, procurement, and deployment decision. Oracle Health owns contracted technology and service obligations. Facilities own local execution within national controls. Clinicians own professional actions they can reasonably perform. Congress and independent auditors own oversight. Veterans own none of the hidden system mechanics. A durable accountability regime prevents the last group from paying, through delayed care or uncertainty, for failures controlled by the others.

As of July 15, 2026, the evidence supports a balanced conclusion. The early program produced confirmed patient harm, serious incident-control failures, large public cost, and a reset that was justified. It also produced measurable improvements, stronger contract structure, recommendation closures, and eight new 2026 go-lives. What remains unproven is durability at national scale.

VA and Oracle Health will pass the accountability test only when each new deployment adds not just users and sites, but independently verifiable evidence that clinical transactions close, incidents link to outcomes, staff can recover safely, remedies are enforced, and unresolved risks stay visible until they are actually controlled.