The VA EHR Program Has Reached Its Trust Deadline

The latest congressional pressure on the Department of Veterans Affairs is not really about whether the agency should modernize its electronic health record. That argument was settled years ago. The real question now is whether the current path, built around Oracle Health, still deserves the benefit of assumption. A House discussion draft released for a March 18 legislative hearing would prevent the VA from exercising new option periods, optional tasks, or contract extensions after two years unless the department can prove measurable improvement and successfully deploy the system at at least two high-complexity facilities. That is not routine oversight language. It is Congress acknowledging that the program has crossed from delay risk into credibility risk.

The proposed guardrails are unusually specific for a reason. The bill would require the VA to establish a baseline of clinical and business workflows, set healthcare quality metrics, transmit independent verification and validation results to Congress, and certify before future launches that site preparation is complete, adverse effects have been mitigated, and the system has achieved 99.9 percent uptime for four consecutive months. A modernization effort that needs Congress to legislate uptime, workflow baselines, and fallback accountability is a modernization effort that has already spent too much of its institutional trust.

Why the pressure hardened

The congressional move is not arriving in a vacuum. The VA’s own Federal EHR overview says the system is live at only six VA medical centers and 26 associated clinics, serving more than 188,000 veterans. At the same time, the agency’s 2026 deployment schedule still calls for 13 new medical centers to go live this year, beginning with four Michigan sites in April and continuing through Ohio, Indiana, Kentucky, and Alaska. The ambition is clear. So is the mismatch between the scale of the next rollout wave and the modest footprint achieved so far.

VA leaders insist the reset has changed the trajectory. In a recent VA news post defending the accelerated relaunch, Deputy Secretary Paul Lawrence wrote that the system had operated without systemwide outages for 27 of the previous 31 months and pointed to sustained ticket-management performance and incident-free time. In a separate VA release on the 2026 deployment plan, the department said it would use a standardized national baseline of products, workflows, and integrations to accelerate implementation and support future optimization.

That is the right language. It is also the language that should have been backed by harder program discipline much earlier. When Congress starts drafting conditional-termination language, the issue is no longer whether the agency can articulate a vision. The issue is whether policymakers believe the vision is adequately tied to independently verifiable performance.

The program still lacks the basic oversight tools it should already have

That is where the case for tougher guardrails becomes strongest. In a March 2025 report, the Government Accountability Office said the VA had made incremental improvements, including more than 1,500 configuration changes, but still had about 1,800 unresolved configuration change requests as of February 2025. More importantly, GAO said the department still needed an updated independent life-cycle cost estimate and integrated master schedule, and that its planned updates did not extend beyond May 2028 even though not all VA medical centers would be live by then.

That finding matters more than any one headline cost estimate. The program began with a contract that GAO says was worth nearly $10 billion over 10 years. VA’s 2019 life-cycle estimate was $16.1 billion. Then, as GAO’s high-risk update noted, the Institute for Defense Analyses estimated in 2022 that the full life-cycle cost could reach $49.8 billion. The most important point is not which number becomes the final one. It is that a project of this scale still lacks the cost and schedule clarity expected of a program already moving back into broader deployment.

That is precisely why the House draft does something more interesting than threaten contract limits. It tries to force the program into a more disciplined operating model. By requiring a clinical-workflow baseline, quality metrics, and independent verification, lawmakers are effectively saying the VA should not be allowed to manage this as a technology rollout alone. It has to be managed as a clinical, operational, and financial transformation with evidence attached.

Patient safety changed the politics

The hardest truth in the VA EHR story is that the politics changed because the risk changed. Delayed IT projects are common in government. Patient-safety concerns are not politically survivable in the same way. In a September 2024 audit, the VA Office of Inspector General said the department needed stronger controls around major performance incidents, including real-time data sharing, contractor accountability metrics, better post-resolution reporting, and mechanisms to identify incidents linked to negative patient outcomes. That language is not about inconvenience. It is about the consequences of failure inside a live care environment.

Even GAO’s more measured assessment made the same basic point. The agency said in its March 2025 report that much more remained to be done to reduce EHR risks and deliver a quality system. That is why the congressional bill ties future launches to proof that adverse effects on health outcomes, coordination of care, wait times, patient safety, and veteran experience have been mitigated. The new legislation is treating the EHR not as a software procurement issue but as a care-delivery risk with contract implications.

That is the correct frame. A federal EHR can no longer be judged mainly by whether it eventually replaces a legacy platform. It has to be judged by whether it improves care, reduces variation, supports staff, and does not introduce new hazards faster than the organization can control them. The discussion draft’s stated purposes reflect exactly that, tying modernization to health outcomes, coordination, timely access, employee productivity, interoperability, collections, and cybersecurity. Congress is not merely asking whether the software works. It is asking whether the program still serves the mission it was supposed to advance.

What real accountability would look like

The strongest part of the House draft is not the threat. It is the structure. A meaningful restart of the VA EHR program would require national workflow baselines before site-by-site improvisation, measurable quality targets before celebratory rollout claims, and independent validation before expansion. It would also require candor about alternatives. The draft bill goes further than many oversight efforts by requiring a report on at least two alternative modernization strategies, including one that contemplates modernizing VistA alongside other health IT and another that considers a different commercial path if the current program cannot meet the required certifications.

That may be the clearest signal of all. Once Congress demands alternative strategies and annual reporting on maintaining VistA, the current contract is no longer being treated as the inevitable destination. It is being treated as one possible route that still has to justify itself.

The VA may yet prove that the restart is real. Its own deployment plan and recent performance claims suggest leaders believe the system is more stable, more standardized, and more ready than it was during the earlier troubled phases. But belief is no longer the scarce resource in this story. Proof is. After years of delays, changing cost expectations, open watchdog recommendations, and lingering patient-safety concerns, the next phase of modernization cannot run on confidence alone.

The VA’s EHR effort does not mainly need another defense. It needs a passing grade on trust. That is what the House bill is trying to force, and it is why the threat of conditional termination should be read less as congressional hostility than as a last attempt to make accountability arrive before another nationwide wave of disruption does.