Health records for veterans don't require a security clearance to be managed. (Personnel records for active military only require a Secret level clearance) You'll wanna take it up with whoever manages security for the VA about the 'massive liability' involved.
https://www.va.gov/securityinvestigationscenter/frequently_asked_questions.asp#q006
Oh that's not nearly the only thing javascript fucks up about their Date() implementation. https://jsdate.wtf/