Oracle's VA EHR Contract Is a Broken State Machine: Congress Is the Fallback

The House is calling Larry Ellison to testify about the Veterans Affairs electronic health record rollout. The public framing is cost overruns, schedule slippage, clinical safety. The private framing is accountability. The technical framing is far more serious: the VA's healthcare record system is a centralized state transition function with a single point of control, closed-source logic, and no independent verification layer. The proof of failure is not in the hearing room. It is in the go-live delays. It is in the uptime logs. It is in the clinical workarounds that nurses and doctors have silently built for years. In 2017, I spent six months inside the constant-time arithmetic of Zcash's Groth16 implementation. I found a side-channel flaw not by reading a press release, but by dissecting the scalar multiplication routine line by line. The patch I submitted reduced proof generation latency by fifteen percent. No committee required. No executive testimony. The code was the evidence. The VA system has no equivalent. Nobody outside Oracle can inspect the exact lines that process a veteran's protected health data. Congress does not have source code access. The GAO does not have source code access. The only people who know the true state of the system are the same people being investigated. That is a circular dependency, and a circular dependency is not a trust model. The project itself has a familiar shape. In 2018, the VA awarded Cerner a contract to replace VistA, the 1990s-era system. Oracle acquired Cerner in 2022. The contract went with the acquisition. Now, Congress wants to know why a multi-billion-dollar project that should have modernized veteran care has instead produced pauses, budget overruns, and delays. The legal scaffolding around this project is dense. The Federal Acquisition Regulation governs every step. The Federal Information Security Management Act imposes security controls. HIPAA covers the privacy of patient records. The Congressional Review Act and the Legislative Reorganization Act give the committee its oversight jurisdiction. All of these instruments assume that a written agreement between a single buyer and a single vendor can produce reliable infrastructure. That assumption is demonstrably false. It was false in private enterprise. It is false in government procurement. And it is false in exactly the same way that a monolithic blockchain protocol with a single sequencer is false. Let me walk through the core structural failure. The VA EHRM is not a software product. It is a ledger. The state is the set of all patient medical records across the VA system. The state transition function is Oracle's proprietary Millennium logic. The sole operator is Oracle. The VA is merely a spectator that pays invoices. In distributed systems we would classify this as a permissioned network with one validator. The validator does not need consensus. The validator does not expose a fraud proof. The validator does not even allow the owner to run a shadow node. The only way for the VA to verify correctness is to ask Oracle nicely. And when things go wrong, the only way to trace the failure is to file a FOIA request. Now look at the acquisition event. When Oracle bought Cerner, the government had to approve the transfer of the contract under FAR Subpart 42.15. This novation process is, in practice, a paperwork exercise. It checks signatures and confirms that the new entity will honor the old contract. What it does not do is reassess the technical capability of the new contractor. Oracle is a database and enterprise software company. Cerner was a healthcare IT company. The cultures are different. The compliance frameworks are different. Oracle has deep experience in license audits; Cerner had deep experience in hospital workflows. Novation ignored that mismatch. Nobody modeled the attack surface that appears when a large enterprise vendor absorbs a healthcare mission-critical platform. The hidden focus of the House audit may well be this exact transition. But the hearing will not be about FAR Subpart 42.15. It will be about Larry Ellison's personal responsibility. That is part of a broader trend. Congress has learned that corporate entities cannot be shamed. Individuals can. We saw it after the FTX collapse. The focus on Sam Bankman-Fried produced a conviction, but the underlying centralized control mechanism that made FTX possible remains untouched in dozens of other platforms. Similarly, drumming Ellison out of a hearing may satisfy public anger, but it will not change the architecture of the VA system. The system will still have a single integrator. The contract will still careen from milestone to milestone. The code will still be a black box. The proof is silent; the code screams the truth. From a cryptographic perspective, the absence of transparency is not a bug. It is the control layer. The vendor's market power depends on opacity. If the VA were able to verify every state transition, it would no longer need Oracle as the sole gatekeeper. Interoperability would become possible. Small specialized vendors could plug into modular components. Performance benchmarks could be independently audited. But that is not the world of FAR contracts. The world of FAR contracts is a world of earned value management reports and corrective action plans. Those are not technical verification mechanisms. They are narrative backports designed to explain why a failure was not a failure. I do not trust the contract; I audit the logic. The logic of the VA EHRM is the logic of vertical integration: one entity controls the database, the application, the interface, and the clinical workflow definitions. Any flaw in the top of the stack cascades downward. The blast radius is the entire national veterans' healthcare network. In 2020, I spent three weeks modeling flash loan attack vectors on Compound Finance. The key insight was not the reentrancy vulnerability itself. The key insight was that a single front-running condition could amplify a small liquidity flaw into a $50 million exploit. The precision of the model mattered. In a centralized health record system, the same principle applies. A small configuration error in medication ordering logic can turn into a systemic patient safety event. The difference is that Ethereum attacks are bounded by the state size; in the VA system, the state size is human lives. Now we reach the contrarian angle. The House scrutiny may actually help Oracle. By focusing on Ellison's personal accountability, Congress constructs a narrative that replacing the CEO will solve the problem. This is the same error the SEC makes when it indicts a token project's founder but leaves the protocol's incentive landscape untouched. A CEO is a mutable variable. The architecture is an immutable constant. You can hot-swap leadership every quarter and the project will still terminate for default because the fundamental governance model—one vendor, one sealed codebase, one opaque delivery schedule—cannot satisfy the verification needs of a critical public health infrastructure. The true solution is not more accountability. It is less centralization. The VA should require modular contracts. Each module should have a defined interface, an open specification, and a requirement for a reference implementation. Patient data should be portable. Workflow definitions should be independently testable. The state transition function should be inspectable by third-party auditors under a confidential disclosure agreement. None of this requires blockchain. But it requires the mindset of distributed systems engineering. That mindset is currently absent from federal procurement. What will happen next? The committee will issue statements. Ellison will offer contrition and vague promises. The Office of Inspector General will produce a report with recommendations. And the project will continue in its broken form, because termination for default carries an adversarial risk: if the government terminates Oracle, it loses the accumulated clinical data configuration and must start over. That lock-in is the final weapon. The audit trail does not bluff. The data gravity is the security. I have seen this dynamic before. In 2021, I spent two months prototyping an ERC-721 improvement that reduced batch gas costs by forty percent. The proposal was rejected because of backward compatibility concerns. Legacy inertia won. The system remained less efficient, but at least it did not change. That is exactly where the VA EHRM sits. Every reform is blocked by the cost of transition. There is no clean revert. There is only a long, painful migration. The proof is silent; the code screams the truth. The central lesson is not about Oracle. It is about the crypto industry's own claims. The promise of blockchain was never just about currency. It was about replacing opaque, single-party trust with transparent, multi-party verification. The Oracle VA contract is a perfect control case. It is a system where trust was placed in a single notarized contract, and that trust has failed. The question we should all be asking is not whether Ellison is guilty. It is whether any centralized system, no matter how well-lawyered, can deliver mission-critical integrity without a verifiable state transition function. I already know my answer. The code gave it to me a long time ago.