Statutory powers and responsibilities do not bestow competence.

The General Assembly created the Office of the State Inspector General (OSIG) within the Office of the Governor in 2011. The powers and duties of that office are defined in Code of Virginia § 2.2-309. The role focuses on detecting fraud, waste, and abuse in the executive branch. Additional duties are assigned, one of which will be the primary focus of this article.

State agencies, officers, and employees are directed to cooperate with OSIG investigations, and the Governor is prohibited from interfering with any such investigation. OSIG is granted police and subpoena powers.

Wow, huh?

Pretty scary. It is meant to be.

This reporter has found that the issues some might consider government “fraud, waste, or abuse” most often involve misfeasance – carelessness or negligence in the performance of a lawful act. He figures that OSIG must have the same experience. Misfeasance is a mistake, not a crime.

But State Inspectors General are necessary. The issue in Virginia is that the OSIG’s responsibilities are both overly broad and have not been executed well.

2019 JLARC assessment

The Joint Legislative Audit and Review Commission (JLARC) has not been kind in its reviews of OSIG. The criticism has been strikingly direct.

In 2019, JLARC found OSIG had failed in three key missions:

• OSIG is not adequately fulfilling its intended role as a centralized investigative agency
• OSIG has struggled to build a fully effective performance audit function, and
• OSIG has not adequately fulfilled its statutory responsibility to oversee behavioral health and developmental services facilities and providers

A personal note. If the author, twice in command during his naval career, had received such a review, he would have been summarily relieved. He would have deserved it.

Things have not gotten noticably better since.

OSIG’s evolving role in behavioral health and disability services

OSIG’s role in behavioral health and disability services oversight and inspection, as well as its Health Care Unit (HCU), is simultaneously redundant, counterproductive, and poorly executed. Its duties under Virginia law effectively add OSIG as a new echelon of command over the Department of Behavioral Health and Disability Services, displacing the Secretary of Health and Human Resources.

Among its original 2011 roles under Code of Virginia was § 2.2-309.1., Additional powers and duties; behavioral health and developmental service, OSIG:

2. inspect(s), monitor(s), and review(s) the quality of services provided in state facilities and by providers as defined in § 37.2-403, including licensed mental health treatment units in state correctional facilities;

Inspections of state facilities operated by DBHDS are conducted annually by the national organization, The Joint Commission (TJC). OSIG has claimed to use TJC criteria in its own inspections. Reading a book by Aaron Judge does not make one a home run hitter.

OSIG operates the hotline for complaints of “abuse, neglect, or inadequate care” in behavioral health and disability services, against both DBHDS hospitals and its licensed providers, directly hampering DBHDS’s ability to do its job.

Despite the 2019 JLARC report, § 2.2-309.1 was heavily modified in 2020 to add duties. Among them:

5. Provide oversight of the Department of Behavioral Health and Developmental Services and community-based providers to identify system-level issues and conditions affecting quality of care and safety and provide recommendations to alleviate such issues and conditions;

6. Implement a program to promote awareness of the complaints line operated by the Office of the State Inspector General among residents of facilities operated by the Department of Behavioral Health and Developmental Services and persons receiving services from community-based providers regulated by the Department of Behavioral Health and Developmental Services (emphasis added);

That entire “additional” mission of OSIG has proven to be a mistake.

2020 – OSIG inspects DBHDS hospitals for COVID readiness

The Commissioner of DBHDS publicly rebuked OSIG in its response contained in OSIG’s 2020 report on its COVID-related infection-control inspections of DBHDS hospitals. He had a point.

In that report, OSIG called out DBHDS for sharing the questions it posed during the inspections. In a display of official petulance, the IG refused to share the results of the inspections that had been “invalidated” by the questions being shared. The inspections were indeed invalid, but not for the reasons the IG cited.

Below is what was shared among DBHDS hospitals.

FROM OIG VISIT AT ESH TODAY. OIG is expected to visit PGH next week.

Hi team, same feedback from the other directors so far for our visit. They (two auditors, lead auditor is (xxx) showed up about 9:15, and they are walking out now (10) asked about COVID, nothing else.

These are the questions verbatim:

1. What is your policy/procedure for PPE for Staff and Employee?
2. What is your policy for staff that test positive?
What is your policy for patients that test positive?
3. Do you take new admits currently?
4. What is the process for managing COVID positive patients?
5. How do you handle restraints on COVID/quarantine units?
6. Do you have anti-ligature hardware throughout?
7. Are there hand sanitizer stations throughout the buildings?
8. How do you handle transfering COVID positive patients to hospitals?
9. Do you have signs or a way of reminding patients to use hand sanitizer often?
10. Did you provide masks to patients and are they required to wear them?
11. Do you allow visitors currently?
12. Do you have ID/DD patients and how do you handle that group relative to COVID?
13. Are genders mixed in common areas?
14. Do you have signs in patient areas to remind them of group size limitations due to COVID?

They will ask that you email (xxx) your copies of any of the above-mentioned policies/procedures. What they do is watch a few minutes of video footage, looking for staff wearing masks.

CMS provides an online Hospital Infection Control Worksheet. Compare it with the questions OSIG asked. The OSIG inspection lasted 45 minutes, setting a new standard for “cursory.” Bottom line, OSIG did not conduct the inspection required to save lives. They have to live with that. Some may have died because of it.

Getting back to the OSIG report itself, the IG expressed outrage:

Due to the collusive actions of some DBHDS personnel, OSIG is unable to determine the adequacy of COVID-19-related measures at the remaining 11 facilities and is unable to provide any recommendations for potentially needed improvements.

“Unable?” With COVID raging and the Northam administration struggling in its response, OSIG refused to reveal what it found. IG Michael Westfall signed that nonsense in a letter to the Governor. The DBHDS response was rightfully incredulous.

In that exchange, OSIG revealed a fundamental misunderstanding of the nature of inspections of organizations subject to laws and regulations. Hospitals, nursing homes, home health agencies, hospices, and other institutions have been inspected for infection-control measures before, during, and after COVID-19.

At the risk of being pedantic,

1. Those being inspected are expected to know the questions about infection control measures and all other areas subject to inspection. Government regulations are available in, well, government regulations. The question “Do you have any ID/DD (intellectually disabled/developmentally disabled) patients?” posed to Eastern State Hospital (ESH) likely drew laughter. By that time, over 90% of ESH patients were “forensic patients,” directly referred by a court for evaluation to determine whether they were fit to face trial and, if necessary, for treatment to make them so.
2. Inspectees are sometimes not supposed to know the date of the visit. That is why they are called surprise inspections. But there should be no surprise questions.

2023

In 2023, JLARC, not OSIG, issued an excellent and troubling report on Virginia’s state psychiatric hospitals. One of the findings:

OSIG receives hundreds of complaints but independently investigates only a relatively small portion of them. … OSIG’s approach to handling complaints that it receives does not ensure that complaints are independently or thoroughly investigated, counter to the General Assembly’s intent.

JLARC investigators must have been shaking their heads in disbelief.  A recommendation from that report:

Direct OSIG to develop and submit a plan to fulfill its statutory obligation to fully investigate complaints of serious allegations of abuse, neglect, or inadequate care at any state psychiatric hospital, and develop and submit annually a report on the number of complaints it has received and fully investigated.

Seems reasonable as long as that is one of OSIG’s missions.

2025

Department of Behavioral Health and Developmental Services, State Operated Facilities Abuse and Neglect Investigations Performance Audit September 2025. 

That report confirmed allegations reported to OSIG by a whistleblower as early as August 2022.  This author can confirm that because the same whistleblower, frustrated with OSIG’s inaction, reported the allegations to him in 2023. 

2026 – Lucas Lodge

The reference to § 37.2-403 authorizes OSIG to inspect and investigate more than 1,000 providers licensed by DBHDS.

In practice, DBHDS, not OSIG, conducts annual, unannounced inspections of the organizations it licenses. DBHDS’s reports on some inspections are highly critical, citing multiple violations of state regulations.

OSIG did not need a hotline to alert it to the situation at Lucas Lodge.

Indeed, DBHDS reports formed the basis of this reporter’s March 2026 articles on the subject. Over a period of five years, DBHDS inspectors reported a very large number of deaths and injuries at Lucas Lodge facilities, as well as repeated violations of specific Virginia regulations governing the operations of those programs. The citations included serial failures to comply with corrective action plans submitted to the state, a major step towards the loss of a license.

But DBHDS does not have police powers; OSIG does.  It appears OSIG has not used those powers to investigate the Lucas Lodge case that DBHDS handed to it over those five years.  In a Sunday article in the Virginian Pilot, Sen. Lucas’ daughter revealed that the FBI seized medical records from Lucas Lodge.  

OSIG was not reported to have participated in the raid.

Recommendations

There are obvious, well-established alternatives to OSIG misfeasance. The changes to Virginia law suggest themselves.

1. The General Assembly can repeal in its entirety Code of Virginia § 2.2-309.1. Additional powers and duties; behavioral health and developmental services.
2. The Joint Commission (TJC) already inspects and accredits DBHDS hospitals annually. When tailored inspections are desired, some states contract with TJC to incorporate state-specific regulations into accreditation surveys. TJC will align its survey process with state licensure requirements, enabling a consolidated, non-duplicative inspection that covers both national standards and state-specific rules.
3. OSIG has a Health Care Unit (HCU) that investigates complaints of “abuse, neglect, and inadequate care” at DBHDS hospitals for the Governor. Note that fraud is apparently not within the HCU’s scope. The Office of Licensure and Certification (OLC), part of the Virginia Department of Health (VDH), administers five state licensing programs that cover nursing facilities, home care organizations, hospitals, hospice programs, and outpatient surgical hospitals.  It is the official state survey agency for the federal Centers for Medicare and Medicaid Services (CMS).  In that role, OLC already certifies for Medicaid and investigates complaints of abuse, neglect, and inadequate care against Intermediate Care Facilities for Individuals with Intellectual Disability (ICF/IID).  It is very good at its job.  OLC can integrate HCU investigators and their funded positions into its team and provide appropriate supervision of their work investigating complaints against DBHDS hospitals while The Joint Commission continues to accredit them.
4. Any badge-carrying medical fraud investigators and their funded positions on the OSIG team can be transferred to the Attorney General’s Medicaid fraud unit, where they can be put to good use.
5. The evidence shows that OSIG needs close oversight, as would any agency with its powers. JLARC has demonstrated excellent skill in providing it. The General Assembly can consider revising the Code of Virginia, Title 30, Chapter 7 et seq., to require JLARC to report annually to the Governor and the General Assembly on OSIG performance.
6. Referring the above issues to the Joint Commission on Health Care for study in 2027 will delay reform by a year. That Commission has the flexibility to take them up this year.

Finally, in his 2025 Annual Report, IG Michael Westfall touted “Growth in our public profile.” This article is not what he meant.

Update at 14:45 on May 18.  Michael Westfall announced his retirement two weeks ago on LinkedIn.   It appears unusual that the Governor has not yet officially announced either his retirement or his replacement.  Most of the people behind the events in this article are still there, so OSIG authorities should be restructured as recommended above.  His retirement may make that easier.