VA Health Care: Prevalence Information Needed to Better Understand and Address Harassment Involving Veterans

Overview

The GAO reviewed VA processes and found that the Department of Veterans Affairs (VA) has a 2022 policy to end harassment-related behaviors at VA medical centers, and VA data show over 31,000 reported incidents from fiscal years 2020–2025. Most reported incidents involved veterans (or other patients) engaging in harassment-related behaviors against staff, but GAO and stakeholders conclude that reported incidents likely undercount actual occurrences because many affected individuals do not notify institutions. GAO and stakeholders point to anonymous or confidential surveys as a way to measure systemwide prevalence and to distinguish increases in reporting from actual increases in incidence. For contractors operating in Healthcare Services, Veterans Healthcare, Healthcare IT, Survey and Data Collection Services, Healthcare Analytics, or Behavioral Health Services, this creates near-term demand signals for survey design, secure data collection, analytics, and policy-compliant incident-mitigation services. Monitor solicitations and policy updates from the VA and position offerings around privacy-preserving prevalence measurement, staff training, and prevention/mitigation program support. See Winning Federal Contracts Guide (/insights/winning-federal-contracts) for capture fundamentals.

Immediate Actions (This Week)

• [ ] Monitor for the official solicitation or VA guidance announcing any systemwide prevalence assessment or contract opportunities; subscribe to agency alerts and saved searches.
• [ ] Inventory your relevant past performance and capabilities in survey design, confidential/anonymous data collection, healthcare analytics, and behavioral-health programs; map these to the market segments listed in the event tags.
• [ ] Review HIPAA, Privacy Act, and FISMA obligations that will apply to any engagement involving VA medical centers or veteran data; identify any current gaps in your privacy/security posture.
• [ ] Confirm current eligibility and contract vehicles you hold or can access that are relevant to VA medical services opportunities (e.g., VA T4NG, VECTOR, IDIQ (Indefinite Delivery/Indefinite Quantity) - VA Medical Services) and mark them for tracking.
• [ ] Prepare a short capability brief (1–2 pages) focused on privacy-preserving prevalence measurement (anonymous surveys, confidentiality controls) and how you would protect veteran and staff data.

Short-Term Actions (30 Days)

• [ ] Draft a technical approach template for an anonymous/confidential prevalence survey: sampling approach, instrument development, validation method, and analysis plan.
• [ ] Create a privacy & security plan aligned to HIPAA, the Privacy Act, and FISMA for any data-collection effort involving veterans or VA systems, including data minimization, consent/notice mechanics, incident response, and access controls.

Long-Term Actions (90+ Days)

• [ ] Develop a pilot-ready survey and analytics package (protocol, IRB-style review checklist or privacy review, anonymous response system, data analysis pipeline) that can be proposed or demoed to VA stakeholders.
• [ ] Build internal training, staffing, and escalation procedures for working with VA medical centers on harassment prevalence and mitigation support, including integration points with clinical and safety teams.
• [ ] Prepare a capture plan targeting VA solicitations and contract vehicles identified earlier, including pricing assumptions for multi-site systemwide surveys and longer-term prevention/mitigation services.

Compliance Checklist

• [ ] HIPAA: Ensure protections for any protected health information (PHI) collected or handled — data minimization, encryption at rest/in transit, access logging, and breach response procedures.
• [ ] Privacy Act: For personally identifiable information (PII) about veterans or VA staff collected on behalf of or through VA systems, confirm authority to collect, notice and access processes, and records handling consistent with Privacy Act requirements.
• [ ] FISMA: For any work that touches VA information systems, document information security controls, continuous monitoring plans, and incident reporting aligned with federal security expectations.
• [ ] Data minimization and de-identification: Where feasible, design surveys and analytics to operate on de-identified datasets and use aggregation to reduce re-identification risk.

Resources

• VA policy and GAO findings — search the VA and GAO sites for the 2022 VA policy and the GAO report on harassment-related behaviors (GAO analysis covered fiscal years 2020–2025 and reported over 31,000 incidents).
• Winning Federal Contracts Guide (/insights/winning-federal-contracts)
• CMMC (Cybersecurity Maturity Model Certification) Compliance Guide (/insights/cmmc-compliance-guide)
• CUI (Controlled Unclassified Information)-Safe CRM Guide (/insights/cui-safe-crm-guide)

How Cabrillo Club Automates This

• Cabrillo Signals War Room — This event was detected and delivered as an alert by the War Room within minutes. War Room will keep you informed of VA policy updates, GAO follow-ups, and any public solicitations or amendments related to systemwide prevalence assessments at VA medical centers. For subscribers, War Room maintains a running incident brief and will push priority changes so capture teams can react quickly.
• Cabrillo Signals Match Engine — Match Engine will automatically rescore your existing opportunity pipeline when this VA/harassment-prevalence event changes the competitive landscape. Opportunities that map to Healthcare Services, Veterans Healthcare, Healthcare IT, Survey and Data Collection Services, Healthcare Analytics, and Behavioral Health Services will get boosted relevance scores; Match Engine will surface gaps in past performance and flag which existing vehicles (for example, VA T4NG, VECTOR, IDIQ - VA Medical Services if you hold them) increase your bid/no-bid probability.
• Cabrillo Signals Intelligence Hub — Use the Intelligence Hub to track affected agencies, NAICS codes, and contract vehicles tied to this event. Save a search for VA solicitations and GAO/agency policy updates referencing harassment-related behaviors, anonymous prevalence surveys, or systemwide assessments to receive alerts when matching solicitations or guidance appear on SAM.gov (System for Award Management) or agency sites.
• Proposal Studio (Proposal OS) — Proposal Studio will help you generate compliant first-draft technical approaches and compliance matrices tailored to privacy-preserving survey efforts. It pulls relevant past performance entries from your library, populates a win theme about veteran-centered, privacy-first measurement, and auto-generates a baseline staffing and pricing outline you can refine. Use Proposal OS to rapidly produce an initial response or capability statement for outreach to VA stakeholders.
• Proposal Studio Workflow Tracker — When you decide to pursue an opportunity, Workflow Tracker enforces a 9-gate capture process: opportunity intake, win strategy, compliance review (HIPAA/Privacy Act/FISMA alignment), technical draft, pricing, legal/contract review, final review, submission, and post-submission archive. It routes tasks to your contracts and legal reviewers, tracks supplier certifications, and produces an audit-ready package documenting how you addressed privacy and security requirements.

Call to action: Contact your Cabrillo Club account team to enable the saved searches and signal subscriptions for this VA event and to start a Proposal Studio project template for a prevalence-survey capture. See the linked guides in Resources for related compliance and capture best practices.