0 for 30: GAO Carried a Weapon Into Every VA Hospital It Tested

GAO covert testers carried a prohibited weapon into 30 VA medical facilities. Staff detected it zero times — including two facilities with metal detectors. Drinking from a vodka bottle in plain view drew a confrontation once in 26 tries.

GAO reviewed security at VA medical facilities — the largest integrated health-care system in the country, 1,300+ facilities serving 9 million enrolled veterans — and then it tested the security the way an adversary would.

In covert tests at 30 facilities, investigators carried a prohibited weapon inside. Staff detected it in none of them — including two facilities equipped with metal detectors. In 25 of 26 additional tests, an investigator drinking in plain view from a bottle labeled vodka was never confronted.

The backdrop: VA police recorded around 74,700 crimes at medical facilities across FY2024 and FY2025, mostly nonviolent — disorderly conduct, theft, drug offenses. GAO found VA had not fully implemented the federal Interagency Security Committee risk-management standard it is required to follow, including documenting which security strategies it will adopt and measuring whether they work. Two of 18 regions missed the security-gap planning goal for three straight years, and headquarters never told them. VA provided no comments on the report.

"VA staff didn’t detect a prohibited weapon that our investigators carried into 30 facilities"
— GAO-26-107952

Source: GAO — Facility Security: VA Should Fully Implement Federal Security Requirements and Improve Performance Reporting. Part of the VA Fraud library — see also the case files for the prosecutions these systems produced.