Indian Health Service
IHS Mismanagement Led to Millions of Dollars in Lost or Stolen Property Gao ID: GAO-08-727 June 18, 2008In June 2007, GAO received information from a whistleblower through GAO's FraudNET hotline alleging millions of dollars in lost and stolen property and gross mismanagement of property at Indian Health Service (IHS), an operating division of the Department of Health and Human Services (HHS). GAO was asked to conduct a forensic audit and related investigations to (1) determine whether GAO could substantiate the allegation of lost and stolen property at IHS and identify examples of wasteful purchases and (2) identify the key causes of any loss, theft, or waste. GAO analyzed IHS property records from fiscal years 2004- 2007, conducted a full physical inventory at IHS headquarters, and statistically tested inventory of information technology (IT) equipment at 7 IHS field locations in 2007 and 2008. GAO also examined IHS policies, conducted interviews with IHS officials, and assessed the security of property.
Millions of dollars worth of IHS property has been lost or stolen over the past several years. Specifically, (1) IHS identified over 5,000 lost or stolen property items, worth about $15.8 million, from fiscal years 2004 through 2007. These missing items included all-terrain vehicles and tractors; Jaws of Life equipment; and a computer containing sensitive data, including social security numbers. (2) GAO's physical inventory identified that over 1,100 IT items, worth about $2 million, were missing from IHS headquarters. These items represented about 36 percent of all IT equipment on the books at headquarters in 2007 and included laptops and digital cameras. Further, IHS staff attempted to obstruct GAO's investigation by fabricating hundreds of documents. (3) GAO also estimates that IHS had about 1,200 missing IT equipment items at seven field office locations worth approximately $2.6 million. This represented about 17 percent of all IT equipment at these locations. However, the dollar value of lost or stolen items and the extent of compromised data are unknown because IHS does not consistently document lost or stolen property and GAO only tested a limited number of IHS locations. Information related to cases where GAO identified fabrication of documents and potential release of sensitive data is being referred to the HHS Inspector General for further investigation. GAO also found evidence of wasteful spending, including identifying that there are about 10 pieces of IT equipment for every one employee at headquarters. GAO's investigation also found computers and other IT equipment were often assigned to vacant offices. GAO identified that the loss, theft, and waste can be attributed to IHS's weak internal control environment. IHS management has failed to establish a strong "tone at the top," allowing property management problems to continue for more than a decade with little or no improvement or accountability for lost and stolen property and compromise of sensitive personal data. In addition, IHS has not effectively implemented numerous property policies, including the proper safeguards for its expensive IT equipment. For example, IHS disposed over $700,000 worth of equipment because it was "infested with bat dung."
RecommendationsOur recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.
Director: Team: Phone:GAO-08-727, Indian Health Service: IHS Mismanagement Led to Millions of Dollars in Lost or Stolen Property
This is the accessible text file for GAO report number GAO-08-727
entitled 'Indian Health Service: IHS Mismanagement Led to Millions of
Dollars in Lost or Stolen Property' which was released on July 21, 2008.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as part
of a longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
Report to Congressional Requesters:
United States Government Accountability Office:
GAO:
June 2008:
Indian Health Service:
IHS Mismanagement Led to Millions of Dollars in Lost or Stolen
Property:
GAO-08-727:
GAO Highlights:
Highlights of GAO-08-727, a report to congressional requesters.
Why GAO Did This Study:
In June 2007, GAO received information from a whistleblower through
GAO‘s FraudNET hotline alleging millions of dollars in lost and stolen
property and gross mismanagement of property at Indian Health Service
(IHS), an operating division of the Department of Health and Human
Services (HHS). GAO was asked to conduct a forensic audit and related
investigations to (1) determine whether GAO could substantiate the
allegation of lost and stolen property at IHS and identify examples of
wasteful purchases and (2) identify the key causes of any loss, theft,
or waste.
GAO analyzed IHS property records from fiscal years 2004-2007,
conducted a full physical inventory at IHS headquarters, and
statistically tested inventory of information technology (IT) equipment
at 7 IHS field locations in 2007 and 2008. GAO also examined IHS
policies, conducted interviews with IHS officials, and assessed the
security of property.
What GAO Found:
Millions of dollars worth of IHS property has been lost or stolen over
the past several years. Specifically:
* IHS identified over 5,000 lost or stolen property items, worth about
$15.8 million, from fiscal years 2004 through 2007. These missing items
included all-terrain vehicles and tractors; Jaws of Life equipment; and
a computer containing sensitive data, including social security
numbers.
* GAO‘s physical inventory identified that over 1,100 IT items, worth
about $2 million, were missing from IHS headquarters. These items
represented about 36 percent of all IT equipment on the books at
headquarters in 2007 and included laptops and digital cameras. Further,
IHS staff attempted to obstruct GAO‘s investigation by fabricating
hundreds of documents.
* GAO also estimates that IHS had about 1,200 missing IT equipment
items at seven field office locations worth approximately $2.6 million.
This represented about 17 percent of all IT equipment at these
locations.
However, the dollar value of lost or stolen items and the extent of
compromised data are unknown because IHS does not consistently document
lost or stolen property and GAO only tested a limited number of IHS
locations. Information related to cases where GAO identified
fabrication of documents and potential release of sensitive data is
being referred to the HHS Inspector General for further investigation.
The figure shows examples of the lost and stolen property GAO
identified during the audit.
Figure: Examples of Lost and Stolen Property Identified at IHS:
Illustrations of the following:
Caterpillar tractor;
All-terrain vehicle;
Pickup truck;
Jaws of life;
Laptop;
Digital camera.
Source: GAO; Art Explosion.
[End of figure]
GAO also found evidence of wasteful spending, including identifying
that there are about 10 pieces of IT equipment for every one employee
at headquarters. GAO‘s investigation also found computers and other IT
equipment were often assigned to vacant offices.
GAO identified that the loss, theft, and waste can be attributed to
IHS‘s weak internal control environment. IHS management has failed to
establish a strong ’tone at the top,“ allowing property management
problems to continue for more than a decade with little or no
improvement or accountability for lost and stolen property and
compromise of sensitive personal data. In addition, IHS has not
effectively implemented numerous property policies, including the
proper safeguards for its expensive IT equipment. For example, IHS
disposed over $700,000 worth of equipment because it was ’infested with
bat dung.“
What GAO Recommends:
GAO makes 10 recommendations to the IHS to update IHS policy, and
enforce management policies such as conducting physical inventories,
properly tracking inventory, and safeguarding assets. Although HHS
agreed to 9 recommendations, HHS stated that the report contained
inaccuracies and misinterpretations that they believe seriously weaken
the conclusions. GAO disagrees with their assessment and reiterates
support for all recommendations.
To view the full product, including the scope and methodology, click on
GAO-08-727. For more information, contact Gregory Kutz at (202) 512-
6722 or kutzg@gao.gov.
[End of section]
Contents:
Letter:
Results in Brief:
Background:
IHS Has Had Millions of Dollars in Property Lost or Stolen and Has Made
Wasteful Purchases:
Weak Tone at the Top and Other Control Weaknesses Leave IHS Highly
Vulnerable to Loss, Theft, and Waste:
Conclusions:
Recommendations for Executive Action:
Agency Comments and Our Evaluation:
Appendix I: Scope and Methodology:
Appendix II: Comments from the Department of Health & Human Services:
Appendix III: GAO Contacts and Acknowledgments:
Tables:
Table 1: Sample Results of Seven IHS Field Locations:
Table 2: 95 Percent Confidence Intervals for Statistical Sample
Estimates:
Figures:
Figure 1: Example of Questionable Receiving Report:
Figure 2: Storage of Excess Recent-Model Computers and Monitors:
Figure 3: Excess Computers at Albuquerque, New Mexico Field Location:
Figure 4: Unused 23-Inch Widescreen Monitor at Gallup, New Mexico Field
Location:
Figure 5: IHS Report Writing Off Thousands of Dollars in IT Equipment
Inventory Without Holding Anyone Accountable:
Figure 6: Pictures of Unsecured IT Equipment at IHS Headquarters:
Abbreviations:
HHS: Department of Health and Human Services:
HIPAA: Health Information Portability and Accountability Act of 1996:
IHS: Indian Health Service:
IT: information technology:
OIG: Office of Inspector General:
PAO: Property Accountable Officer:
PDA: Personal Digital Assistant:
PMIS: Property Management Information System:
PSC: Program Support Center:
[End of section]
United States Government Accountability Office:
Washington, DC 20548:
June 18, 2008:
The Honorable Henry A. Waxman:
Chairman:
Committee on Oversight and Government Reform:
House of Representatives:
The Honorable Nick J. Rahall, II:
Chairman:
Committee on Natural Resources:
House of Representatives:
In June 2007, we received information from a whistleblower through
GAO's FraudNET hotline alleging gross mismanagement of property and
wasteful spending at the Indian Health Service (IHS). Specifically, the
whistleblower, who was a cognizant property official, alleged that IHS
headquarters could not locate 1,180 pieces of accountable personal
property, including computers and other potentially sensitive
information technology (IT) equipment, valued at over $1.8 million. The
whistleblower also claimed that officials at IHS headquarters wrote off
millions of dollars worth of missing inventory without holding anyone
financially liable. Based on the significance of these claims, you
asked us to (1) determine whether we could substantiate the allegation
of lost or stolen property at IHS and identify examples of wasteful
purchases and (2) identify the key causes of any loss, theft, or waste
we detect.
To do this, we analyzed IHS property documents that identified lost or
stolen property from fiscal year 2004 through fiscal year 2007. We
conducted a full physical inventory of property at IHS headquarters
[Footnote 1] and performed random sample testing of IT equipment
inventory at seven IHS field locations[Footnote 2] that we selected
based on book value of inventory and geographic proximity.[Footnote 3]
We limited the scope of our work to testing IT equipment because it is
highly pilferable, can be easily converted to personal use, and
potentially contains sensitive information that may be used for
identity fraud or other malicious purposes. We did not attempt to
quantify the level of waste at IHS, but we identified instances of
waste through observations during our equipment inventories at
headquarters and random sample testing at the selected field locations.
Although we did not perform a systematic review of IHS internal
controls, we identified the key causes of lost and stolen property and
waste by examining IHS policies and procedures, conducting interviews
with IHS officials, and assessing the physical security of property
through our inventory testing.
We conducted this forensic audit and related investigations from
September 2007 to June 2008 in accordance with generally accepted
government auditing standards.[Footnote 4] Those standards require that
we plan and perform the audit to obtain sufficient, appropriate
evidence to provide a reasonable basis for our findings and conclusions
based on our audit objectives. Despite IHS efforts to obstruct our
audit by making misrepresentations and fabricating hundreds of
documents, we were still able to accomplish our objectives. We believe
that the evidence obtained provides a reasonable basis for our findings
and conclusions based on our audit objectives. We performed our
investigative work in accordance with standards prescribed by the
President's Council on Integrity and Efficiency. A detailed discussion
of our scope and methodology is presented in appendix I.
Results in Brief:
We confirmed the whistleblower's allegation of gross mismanagement of
property at IHS. Specifically, we found that thousands of computers and
other property, worth millions of dollars,[Footnote 5] have been lost
or stolen at IHS over the past several years. The number and dollar
value of items that have been lost or stolen since 2004 is likely much
higher because IHS did not consistently document lost or stolen
property items and did not provide us all the reports that IHS field
offices used to document lost or stolen property since fiscal year 2004
as requested. Specifically, we found the following:
* We analyzed IHS reports from fiscal year 2004 through fiscal year
2007 and identified over 5,000 lost or stolen property items, worth
approximately $15.8 million. These items included all-terrain vehicles,
tractors, and pick-up trucks worth around $6 million; and "Jaws of
Life" equipment worth over $20,000. In addition, a desktop computer
that contained sensitive information (e.g., social security numbers and
medical information) on 849 uranium miners was reported stolen in April
2007 and to date has not been found. In addition to these reports, the
IHS Finance department recently reported a missing Personal Digital
Assistant (PDA) in March 2008 when they requested a replacement. The
PDA contained medical information and names of patients at a Tucson,
Arizona area hospital. According to the IHS IT official, the device
contained no password or data encryption. This was in violation of
federal policy and increased the risk that sensitive information could
be disclosed to unauthorized individuals.[Footnote 6] Both of these
cases have already been reported to the Department of Health and Human
Services (HHS) by the IHS Office of Information Technology. The total
dollar value of lost or stolen items and extent of compromised data are
unknown because IHS does not consistently document lost or stolen
property.
* Of the 3,155 pieces of IT equipment that were on the books at IHS
headquarters in 2007, 1,140 items, or about 36 percent, were lost,
stolen, or unaccounted for. These missing items, valued at about $2
million, include computers, computer servers, video projectors, and
digital cameras. According to IHS records, 64 of the items we
identified as lost or stolen during our physical inventory were "new"
in April 2007. Further, IHS officials attempted to obstruct our
investigation by making misrepresentations and fabricating documents to
conceal this lost or stolen property.
* Based on our random sample of IT equipment at the 7 selected IHS
field locations, we estimate that about 1,200 items worth approximately
$2.6 million were lost, stolen, or unaccounted for at these locations.
[Footnote 7] This represents about 17 percent of all IT equipment at
the 7 field locations we visited. Because we only looked at 7 of the
163 IHS locations, the number and value of lost or stolen equipment is
likely much higher. The missing equipment we identified included IHS
hospital laptops, which may contain patients' social security numbers
and medical histories. In order to avoid duplicating missing property
items and dollar amounts, we did not combine the total amount of
missing items and dollar values from our review of IHS documentation,
physical inventory at IHS headquarters, and sample testing at the 7
field locations.
IHS's ineffective management over IT equipment has also led to wasteful
spending. Our analysis of IHS records indicates that there are
approximately 10 pieces of IT equipment for every one employee at IHS
headquarters.[Footnote 8] We also found numerous pieces of recent-model
equipment at IHS headquarters, including 25 brand new computers--with a
combined value of about $30,000--that were not issued to any employees
and were collecting dust in a store room.
The lost or stolen property and waste we detected at IHS can be
attributed to the agency's weak internal control environment and its
ineffective implementation of numerous property policies. IHS
management has failed to establish a strong "tone at the top" by
allowing inadequate accountability over property to persist for years
and by neglecting to fully investigate cases related to lost and stolen
items. Furthermore, IHS management has not revised its personal
property management policies since 1992[Footnote 9]. Moreover, we found
that IHS did not (1) conduct annual inventories of accountable
property; (2) use receiving agents for acquired property at each
location and designate property custodial officers in writing to be
responsible for the proper use, maintenance, and protection of
property; (3) place bar codes on accountable property to identify it as
government property; and (4) maintain proper user-level accountability,
including custody receipts, for issued property. IHS personnel also did
not implement proper physical security controls to safeguard property.
For example, we observed computers worth thousands of dollars set aside
in unsecured storage areas and hallways. Furthermore, IHS failed to
migrate data to the new inventory management system by not properly
recording certain property in its Property Management Information
System (PMIS),[Footnote 10] leaving about $48 million in inventory
outside of this database and at an increased risk of loss or theft.
[Footnote 11] Some examples of property that we identified as not being
recorded in PMIS included a $145,000 ultrasound unit, a $140,000 X-ray
unit, and a $61,000 anesthesia machine.
We are recommending that the Director of IHS update IHS policy, and
enforce property management policies such as conducting physical
inventories, enforcing user-level accountability, properly tracking
inventory, and safeguarding assets. In the case where we identified
that an individual fabricated hundreds of documents and cases where
there was a potential release of sensitive data--including employee
social security numbers and patient information regarding missing
computers from the human resource department and from IHS hospitals--we
are making referrals to the HHS Office of Inspector General (OIG) for
further investigation.
We provided a draft copy of our report to HHS for review and comment.
While they believe that our report contains inaccuracies and
misrepresentations, they agreed with 9 of our 10 recommendations. HHS
did not agree with our recommendation to establish procedures to track
all sensitive equipment such as blackberries and cell phones even when
they fall under HHS's accountable dollar threshold criteria.
Additionally, HHS commented that our report contained inaccuracies and
misinterpretations by not considering IHS's unique property management
system due to its collaboration with Indian Tribes; the implementation
and reconciliation of IHS's new inventory tracking system; and
depreciation value of lost and stolen items. Additionally, HHS cited
six cases that they believe were misrepresented in our case studies. We
believe that we fairly characterized and conservatively estimated our
findings and reiterate support for all recommendations. See the Agency
Comments and Our Evaluation section of this report for a more detailed
discussion of the agency comments. We have reprinted HHS's written
comments in appendix II.
Background:
IHS, an operating division of HHS, is responsible for providing health
services to federally recognized tribes of American Indians and Alaska
natives. In 2007, IHS provided health services to approximately 1.9
million American Indians and Alaska natives from more than 562
federally recognized tribes. As an operating division of HHS, IHS is
included in the agency's consolidated financial statement and has not
been audited independently since 2002.
IHS is divided into 12 regions and operates 163 service units
throughout the country.[Footnote 12] Service units may contain one or
more health facilities, including hospitals, health centers, village
clinics, health stations, and school health centers. There are 114 IHS-
operated health facilities and 565 tribally operated health facilities.
The IHS budget appropriation in 2007 was $3.2 billion, approximately 54
percent of which was administered by tribes through various contracts
and compacts with the federal government.[Footnote 13]
IHS Has Had Millions of Dollars in Property Lost or Stolen and Has Made
Wasteful Purchases:
We substantiated the allegation of gross mismanagement of property at
IHS. Specifically, we found that thousands of computers and other
property, worth millions of dollars, have been lost or stolen. We
analyzed IHS reports for headquarters and the 12 regions from the last
4 fiscal years which identified over 5,000 property items, worth about
$15.8 million, that were lost or stolen from IHS headquarters and field
offices throughout the country. The number and dollar value of this
missing property is likely much higher because IHS did not conduct full
inventories of accountable property[Footnote 14] for all of its
locations and did not provide us with all inventory documents as
requested. Despite IHS attempts to obstruct our investigation, our full
physical inventory at headquarters and our random sample of property at
seven field locations identified millions of dollars of missing
property. We also found that IHS has made wasteful purchases over the
past few years. For example, IHS has bought computer equipment that is
currently unused in its original box and has issued IT equipment to its
employees that duplicate the equipment already provided to them.
IHS Records Indicate at Least $15.8 Million of Property Has Been Lost
or Stolen:
Our analysis of Report of Survey[Footnote 15] records from IHS
headquarters and field offices shows that from fiscal year 2004 through
fiscal year 2007, IHS property managers identified over 5,000 lost or
stolen property items worth about $15.8 million.[Footnote 16] Although
we did receive some documentation from IHS, the number and dollar value
of items that have been lost or stolen since 2004 is likely much higher
for the following reasons. First, IHS does not consistently document
lost or stolen property items. For example, 9 of the 12 IHS regional
offices did not even perform a physical inventory in fiscal year 2007.
Second, for each year since fiscal year 2004, an average of 5 of the 12
regions did not provide us with all of the reports used to document
missing property since fiscal year 2004, as we requested.
The following cases provide information on five of the egregious
examples of lost and stolen property we identified. In each case, IHS
has not held any staff accountable for the missing items. In some of
the cases, IHS did not even perform an investigation to try and locate
the missing items or determine what actions should be taken.
* IHS staff held a "yard sale" of 17 computers and other property worth
$16,660 in Schurz, Nevada, between June and July 2005. According to an
IHS property manager, the equipment was advertised to the public via
fliers indicating that excess federal property was to be given away for
free. To date, IHS has not completed the investigation or held any IHS
personnel responsible and, according to a 2006 report, intends to
writeoff the missing equipment. According to the Phoenix area property
manager, the 17 computers identified as missing were transferred from a
youth patient center and could contain sensitive youth patient
information because the computers were never "cleaned" before being
transferred to the Schurz service unit. We are referring this potential
release of patient data to the HHS OIG for further investigation.
* From 1999 through 2005, IHS did not follow required procedures to
document the transfer of property from IHS to the Alaska Native Tribal
Health Consortium, resulting in an unsuccessful 5-year attempt by IHS
to reconcile the inventory. Our analysis of IHS documentation revealed
that about $6 million of this property--including all-terrain vehicles,
generators, van trailers, tractors, and other heavy equipment--was lost
or stolen.
* In April 2007, a desktop computer containing a database of uranium
miner names, social security numbers, and medical histories was stolen
from an IHS hospital in New Mexico. According to an HHS report, IHS
attempted to notify the 849 miners whose personal information was
compromised, but IHS did not issue a press release to inform the public
of the compromised data. In addition to this incident, the IHS Finance
department recently reported a missing Personal Digital Assistant (PDA)
in March 2008 when they requested a replacement. The PDA contained
medical information and names of patients at a Tucson Area Hospital.
According to the IHS IT official, the device contained no password or
data encryption. This was in violation of federal policy and increased
the risk that sensitive information could be disclosed to unauthorized
individuals. Both of these cases have already been reported to HHS by
the IHS Office of Information Technology.
* In September 2006, IHS property staff in Tucson attempted to write
off over $275,000 worth of property, including Jaws of Life equipment
valued at $21,000. The acting area director in Tucson refused to
approve the write-off because of the egregious nature of the property
loss. However, no investigation has been conducted to date.
* According to an IHS June 2006 report, a $4,000 Apple Powerbook laptop
was stolen from an employee's vehicle in the Navajo area. Despite the
lack of authorization, the employee took the laptop for use during off-
duty hours--in violation of IHS policy. Because the employee violated
IHS policy, IHS's initial determination, with which the employee
agreed, was that the employee was responsible for the loss and
therefore should reimburse the federal government for the value of the
stolen computer. However, the IHS approving official reversed the
initial determination decision stating that the employee had since
resigned and the loss was due to theft.
GAO Inventory Testing Reveals Lost or Stolen IT Equipment at IHS
Headquarters:
To substantiate the whistleblower's allegation of missing IT equipment,
we performed our own full inventory of IT equipment at IHS
headquarters. Our results were consistent with what the whistleblower
claimed. Specifically, of the 3,155 pieces of IT equipment recorded in
the records for IHS headquarters, we determined that about 1,140 items
(or about 36 percent) were lost, stolen, or unaccounted for. These
items, valued at around $2 million, included computers, computer
servers, video projectors, and digital cameras. According to IHS
records, 64 of the items we identified as missing during our physical
inventory were "new" in April 2007. Furthermore, we found that some of
the missing computers were assigned to the IHS human resources
division. These computers likely contained sensitive employee data
including names and Social Security numbers protected under the Privacy
Act of 1974.[Footnote 17] We are referring these cases where there was
a potential release of sensitive data including employee social
security numbers to the HHS OIG for further investigation.
During our investigation of the whistleblower's complaint, IHS made a
concerted effort to obstruct our work. IHS officials made
misrepresentations and fabricated documents to impede our work.
Specifically,
* The IHS Director responsible for property claimed that IHS was able
to find about 800 of the missing items from the whistleblower's
complaint. However, based on our physical inventory testing at
headquarters, we found that this statement was a misrepresentation and
that only some of these items have been found.
* An IHS property specialist attempted to provide documentation
confirming that 571 missing items were properly disposed of by IHS.
However, we found that the documentation he provided was not dated and
contained no signatures. When we questioned the official about these
discrepancies, he admitted that he fabricated the documents. We are
referring this individual to the HHS OIG for further investigation.
* According to IHS policy, receiving reports are always signed by an
authorized employee. As part of our inventory, we requested receiving
reports for three recent purchase orders. For one purchase order, IHS
was not able to provide us with any receiving reports. For the other
two purchase orders, IHS provided us with receiving reports that were
not properly completed; e.g., the reports were not signed by the person
who received the property and did not contain the date that the
property was received. When we questioned these discrepancies, IHS sent
us "new" receiving reports for the three purchase orders, but all of
them contained questionable dates and signatures. For example, figure 1
shows the fabricated receiving report for a shipment of new scanners
delivered to IHS.
Figure 1: Example of Questionable Receiving Report:
[See PDF for image]
This figure is an illustration of a questionable receiving report, and
includes the following information:
Receiving report chronology:
* October 2007: IHS provides incomplete information packet including
blank receiving report;
* December 4, 2007: GAO questions blank receiving report;
* December 4, 2007: IHS completes fabricated receiving report (see
below) on the same day as the GAO request.
Fabricated receiving report:
Date received: Indicated as September 16, 2007;
Signature date: Indicated as December 4, 2007.
Source: GAO analysis of IHS data.
[End of figure]
As shown in figure 1, there is almost a 3-month gap between the date
the equipment was received in September and the date that the receiving
report was completed and signed in December---even though the document
should have been signed upon receipt. In fact, the new receiving report
IHS provided was signed on the same date we requested it, strongly
suggesting that IHS fabricated these documents in order to obstruct our
investigation. Further, after testing one of the other two fabricated
receiving reports, we found that 10 brand new desktop computers worth
almost $12,000 could not be located even though the receiving report
indicated that they were "received" in July 2007.
GAO Testing Identifies Lost or Stolen IT Equipment at Seven IHS Field
Locations:
We selected a random sample of IT equipment inventory at seven IHS
field offices to determine whether the lack of accountability for
inventory was confined to headquarters or occurred elsewhere within the
agency.[Footnote 18] Similar to our finding at IHS headquarters, our
sample results also indicate that a substantial number of pieces of IT
equipment were lost, stolen, or unaccounted for. Specifically, we
estimate that for the seven locations, about 1,200 equipment items,
with a value of $2.6 million were lost or stolen.[Footnote 19] As shown
in table 1, our estimates are based on a statistical sample of 250
items from a population of 7,211 IT equipment items worth over $19
million recorded in property records for IT equipment at the seven
field office locations. Of the 250 items that we sampled, IHS could not
locate or substantiate the disposal of 42 items, or about 17 percent of
the sample population.
Table 1: Sample Results of Seven IHS Field Locations:
Total IT items selected in sample: 250;
Items physically observed during inventory: 166;
Items observed via picture with bar code and serial number: 25;
Items with documentation to support disposal: 17;
Total lost or stolen items: 42.
Source: GAO.
[End of table]
Furthermore, some of the missing equipment from the seven field
locations could have contained sensitive information. Although personal
health information requires additional protections from unauthorized
release under the Health Information Portability and Accountability Act
of 1996 (HIPAA) and implementing regulations,[Footnote 20] we found
that many of the missing laptops were assigned to IHS hospitals and,
therefore, could have contained patient information, social security
numbers, and other personal information. We are referring these cases
where there was a potential release of sensitive data including patient
information to the HHS OIG for further investigation.
Wasteful Purchases Identified During Inventory Tests:
IHS has also exhibited ineffective management over the procurement of
IT equipment, which has led to wasteful spending of taxpayer funds. IHS
purchased excessive amounts of IT equipment for its staff, most notably
at the headquarters office. An IHS official stated that IHS purchased
new computers using "end of the year dollars." Some examples of
wasteful spending that we observed during our audit of headquarters and
field offices include the following:
* Approximately 10 pieces of IT equipment, on average, are issued for
every one employee at IHS headquarters.[Footnote 21] Although some of
these may be older items that were not properly disposed, we did find
that many employees, including administrative assistants, were assigned
two computer monitors, a printer and scanner, a blackberry, subwoofer
speakers, and multiple computer laptops in addition to their computer
desktop. Many of these employees said they rarely used all of this
equipment and some could not even remember the passwords for some of
their multiple laptops.
* IHS purchased computers for headquarters staff in excess of expected
need. For example, IHS purchased 134 new computer desktops and monitors
for $161,700 in the summer of 2007. As shown in figure 2, as of
February 2008 25 of these computers and monitors--valued at about
$30,000--were in storage at IHS headquarters. An IT specialist stated
that the computers and monitors were "extras." In addition, we
identified 7 new laptops that were stored in an unlocked cabinet at
headquarters and never used.
Figure 2: Storage of Excess Recent-Model Computers and Monitors:
[See PDF for image]
This figure contains two photographs depicting the storage of excess
recent-model computers and monitors.
Source: GAO.
[End of figure]
* Computers and other IT equipment were often assigned to vacant
offices. For example, many of the computer desktops and monitors
purchased in the summer of 2007 for IHS headquarters were assigned to
vacant offices. In addition, as shown in figure 3, we found two
computers, two monitors, and three printers in an employee's office at
the Albuquerque field location we visited. The IHS area property
manager stated that this equipment was issued to an employee who spends
a majority of his time on travel to training and treatment centers.
Figure 3: Excess Computers at Albuquerque, New Mexico Field Location:
[See PDF for image]
This figure contains a photograph of excess computers at the
Albuquerque, New Mexico field location.
Source: GAO.
[End of figure]
* An official for the IHS National Program stated that IHS purchased
new computers using "end of the year dollars." For example, as shown in
figure 4, one field office employee in Gallup, New Mexico had an
unwrapped, 23-inch, widescreen monitor worth almost $1,700 in her
office. The employee stated that she did not know why IT sent her the
monitor and she claimed that it has never been used.
Figure 4: Unused 23-Inch Widescreen Monitor at Gallup, New Mexico Field
Location:
[See PDF for image]
Photograph of an unused 23-inch widescreen monitor at the Gallup, New
Mexico field location.
Source: GAO.
[End of figure]
Weak Tone at the Top and Other Control Weaknesses Leave IHS Highly
Vulnerable to Loss, Theft, and Waste:
The lost or stolen property and waste we detected at IHS can be
attributed to the agency's weak internal control environment and its
ineffective implementation of numerous property policies. In
particular, IHS management has failed to establish a strong "tone at
the top" by allowing inadequate accountability over property to persist
for years and by neglecting to fully investigate cases related to lost
and stolen items. Furthermore, IHS management has not properly updated
its personal property management policies, which IHS has not revised
since 1992. Moreover, IHS did not (1) conduct annual inventories of
accountable property; (2) use receiving agents for acquired property at
each location and designate property custodial officers in writing to
be responsible for the proper use, maintenance, and protection of
property; (3) place bar codes on accountable property to identify it as
government property; (4) maintain proper individual user-level
accountability, including custody receipts, for issued property; (5)
safeguard IT equipment; or (6) record certain property in its property
management information system (PMIS).
Weak tone at the top: The importance of the "tone at the top" or the
role of management in establishing a positive internal control
environment cannot be overstated. GAO's internal control standards
state that "management plays a key role in demonstrating and
maintaining an organization's integrity and ethical values, especially
in setting and maintaining the organization's ethical tone, providing
guidance for proper behavior, removing temptations for unethical
behavior, and providing discipline when appropriate." However, IHS
management has failed to establish and maintain these ethical values.
As far back as 1997, an IHS memo by the then Acting Director stated
that the agency had problems with lost and stolen property at IHS
headquarters. The memo also stated that unused equipment was not
safeguarded against loss or theft. However, we found little corrective
action was taken by IHS. For example, management failed to update IHS
personal property management policies, which have not been revised
since 1992. In addition, IHS has historically shown little motivation
to hold its employees liable for missing property. Instead of
investigating the circumstances surrounding missing property, IHS
writes off the losses without holding anyone accountable. As a result,
an IHS property official admitted to us that there is no accountability
over IHS property. For example, figure 5 shows a report used to write
off almost $900,000 worth of missing IT equipment in 2004, including
laptop and desktop computers, servers, cameras, routers, and fax
machines. This is just one of four reports that IHS used in 2004 to
write off a combined total of $1.8 million dollars worth of IT
equipment.
Figure 5: IHS Report Writing Off Thousands of Dollars in IT Equipment
Inventory Without Holding Anyone Accountable:
[See PDF for image]
This figure is an illustration of an IHS report writing off thousands
of dollars in IT equipment inventory without holding anyone
accountable.
An excerpt from page two of the report reads: ’No one individual or
group of individuals should be held responsible for the loss, however,
a concentrated effort should be undertaken to prevent the turn in,
transfer, donation of equipment without the proper property
documentations being completed.“
The amount written of is $899,592.00.
Source: IHS.
[End of figure]
As shown in the figure, the report does not hold anyone responsible for
the missing inventory, but it does call for the improvement of controls
over property management. However, as shown by our audit and related
investigations, IHS has made minimal efforts to improve property
management and oversight. Despite this fact, IHS rewarded the
individuals responsible for these functions in its property group with
about $40,000 in merit awards from 2003 through 2007.
No annual inventories: HHS and IHS policies require IHS personnel to
conduct annual inventories of accountable personal property, including
property at headquarters and in field offices. However, IHS
headquarters did not conduct any annual inventories from fiscal years
2004 through 2006. In addition, property managers were not able to
accurately document the findings of their fiscal year 2007 inventory
nearly a year after it was conducted. Moreover, in fiscal year 2007,
only 3 out of 12 regions conducted a full physical inventory.[Footnote
22] Consequently, the extent of missing property at IHS is unknown.
Failure to use receiving agents and to designate property custodial
officers: IHS policy requires that each accountable area[Footnote 23]
designate at least one receiving agent to receive purchased property.
The receiving agent is responsible for documenting the receipt of the
property (i.e., receiving report) and then distributing the property to
its intended user. However, we found that acquired property is often
sent directly to the user, bypassing the receiving agent. For example,
the IT department sometimes receives new computers and IT equipment
directly instead of utilizing the receiving agent. In addition, HHS
requires the designation of property custodial officers in writing to
be responsible for the proper use, maintenance, and protection of
property. However, an IHS official said that property custodial
officers have not formally been designated for headquarters because of
high staff turnover.
Lack of property bar codes: HHS and IHS policy mandate that all
accountable property have a bar code identifying it as government
property. However, in our audit of IHS headquarters inventory, we
identified over 100 pieces of IT equipment, including blackberries and
digital cameras, that were not properly bar coded. Much of this
equipment likely did not receive a bar code because, as discussed
earlier, IHS does not receive property in a central location.
Lack of personal custody property records: HHS requires the use of hand
receipts, known as HHS Form 439, any time property is issued to an
employee. This form should be retained by a property official so that
property can be tracked at the time of transfer, separation, change in
duties, or when requested by the proper authority. By signing this
form, an IHS employee takes responsibility for the government-issued
equipment. According to an IHS property official, IHS headquarters does
not use the HHS Form 439, nor do they use any other type of hand
receipt. Officials from several IHS regions stated that they use the
form only in limited cases. Without the issuance of this form, there is
no documentation as to where the equipment is located and no mechanism
to hold the user accountable for the equipment.
Lack of user-level accountability: HHS requires IHS to document
information on the user of equipment, including building and room
number, so that property can be tracked and located. However, IHS did
not properly maintain this information. Property personnel instead
relied on their personal recollection to locate property items. For
example, on several occasions during our headquarters inventory, IHS
property staff could not identify the property user. As a result, the
property staff had to make inquiries with other staff to obtain
information on the user of the equipment. Further, IHS personnel in the
field offices stated that it took them several days to locate items
that were included in our sampled inventory.
Furthermore, according to the IHS policy manual, when equipment is no
longer needed by the user, a request for property action should be
submitted in writing to the Property Accountable Officer (PAO). The PAO
then determines if the item can be transferred to another user within
IHS. However, in many cases, equipment is redistributed by the IT
department or sent to another user without PAO approval. In our audit
of IHS headquarters inventory, we found some items that were issued to
an unspecified user or to employees who had retired or left the agency.
To locate these items, IHS Headquarters staff had to inquire with the
employee's colleagues to determine the location of the equipment. In
several cases, IHS was not able to locate the equipment assigned to
separated employees, raising the possibility that the equipment was
stolen. For example, one IHS employee stated that equipment had
"disappeared" from an office vacated by a former employee.
Weaknesses in physical security of IT equipment: According to the
Indian Health Manual, property is to be adequately protected "against
the hazards of fire, theft, vandalism, and weather commensurate with
the condition and value" of the property. However, during our inventory
review at both IHS headquarters and field office locations, we found
that IHS did not follow this policy. Specifically, we found that IHS
did not properly secure expensive IT equipment leaving them vulnerable
to loss and theft. For example we found that:
* Surplus IT equipment that should have been disposed of was stored in
unlocked employees' offices, suite areas, conference rooms, and storage
rooms. For example, figure 6 shows computer equipment stored in an
unlocked multipurpose storage room at IHS headquarters. In addition, an
IHS headquarters employee had newly purchased unsecured equipment,
including a large flat screen TV, dual monitors, a printer, a scanner,
a desktop, a subwoofer, a video camera, and a back-up power supply.
Figure 6: Pictures of Unsecured IT Equipment at IHS Headquarters:
[See PDF for image]
This figure contains three photographs of unsecured IT equipment at IHS
Headquarters.
Source: GAO.
[End of figure]
* IHS did not establish proper safeguards for storing IT equipment in
IHS facilities or employees' offices. For example, at one of the IHS
hospitals we visited, the IT department did not lock its storage area,
leaving several computers unsecured.
* Because equipment was not protected against damage or destruction,
IHS had to dispose over $700,000 worth of equipment because it was
"infested with bat dung."
Failure to use accountable property management system: HHS policy
requires that all accountable property with a value of $5,000 or
greater and all sensitive items[Footnote 24] with a value of $500 or
greater be tracked by the PMIS property management system. [Footnote
25] The PMIS system is intended to improve accountability and
standardize property records across HHS. Equipment that is not recorded
in PMIS is not inventoried or otherwise controlled, placing it at
increased risk of loss or theft. Although IHS had 2 years to migrate
from legacy systems to the new inventory system, it has not yet fully
converted to the PMIS system.[Footnote 26] Furthermore, officials from
two field locations stated that they are not adding new equipment to
the system because IHS headquarters told them not to use the system
until further notice.
Because it has not entered all property information into PMIS, IHS does
not have reliable inventory records related to expensive, sensitive,
and pilferable property. Specifically, IHS has failed to enter over
18,000 items, worth approximately $48 million, from headquarters and
the sites we reviewed. Furthermore, we found that over half of the
items we selected while performing our random sample testing of the
seven field locations were not recorded in PMIS. The types of equipment
that were not entered into PMIS include a $145,000 ultrasound unit, a
$140,000 X-ray unit, and a $61,000 anesthesia machine. In addition,
although items such as blackberries, cell phones, and digital cameras
do not meet the criteria for inclusion in PMIS, these items are highly
sensitive and should be accounted for by IHS. Furthermore, the
magnitude of equipment that was not entered into the system is likely
much higher because we did not analyze data from IHS locations not
included in our statistical sample.
Conclusions:
Our audit confirmed the whisteblower's allegation of gross
mismanagement of property at IHS. IHS has exhibited a weak control
environment and disregard for basic accountability over its inventory.
As a result, IHS cannot account for its physical property and is
vulnerable to the loss and theft of IT equipment and sensitive personal
data. Further, IHS' wasteful spending of IT equipment and lack of
discipline or personal accountability for lost and stolen property and
personal data has set a negative tone at the top that the status quo is
acceptable. Moreover, intentional attempts of some IHS employees to
thwart our investigation lead us to question the integrity and
transparency of certain functions within the agency's property
management group and call for stronger leadership to strengthen tone at
the top as well as throughout property management functions.
Recommendations for Executive Action:
We recommend that the Director of IHS strengthen IHS's overall control
environment and "tone at the top" by updating and enforcing its
policies and procedures for property management. As part of this
effort, the Director of IHS should direct IHS property officials to
take the following 10 actions:
* Update IHS personal property management policies to reflect any
policy changes that have occurred since the last update in 1992.
* Investigate circumstances surrounding missing or stolen property
instead of writing off losses without holding anyone accountable.
* Enforce policy to conduct annual inventories of accountable personal
property at headquarters and all field locations.
* Enforce policy to use receiving agents to document the receipt of
property and distribute the property to its intended user and to
designate property custodial officers in writing to be responsible for
the proper use, maintenance, and protection of property.
* Enforce policy to place bar codes on all accountable property.
* Enforce policy to document the issuance of property using hand
receipts and make sure that employees account for property at the time
of transfer, separation, change in duties, or on demand by the proper
authority.
* Maintain information on users of all accountable property, including
their buildings and room numbers, so that property can easily be
located.
* Physically secure and protect property to guard against loss and
theft of equipment.
* Enforce the use of the PMIS property management database to create
reliable inventory records.
* Establish procedures to track all sensitive equipment such as
blackberries and cell phones even if they fall under the accountable
dollar threshold criteria.
Agency Comments and Our Evaluation:
We received written comments on a draft of this report from the
Assistant Secretary for Legislation of the Department of Health and
Human Services (HHS). HHS agreed with 9 of our 10 recommendations.
However, HHS stated that our report contained inaccuracies and
misinterpretations that it believes seriously weaken our conclusions.
In its response to our draft report HHS cited three limitations. First,
HHS stated that our report did not appreciate the fact that IHS
property management is a unique system in its collaboration with Indian
Tribes and that it operates its service units throughout the country.
Second, HHS said that unaccountable property may be lower than what our
report identified because the ongoing process of reconciling the prior
system to the new system makes it more likely that the number of
currently unaccounted for property items will be reduced rather than
increase as the reconciliation progresses. Further, they state that the
implementation process for the new system made it more difficult for
IHS to provide GAO with the necessary documentation for audit. Third,
HHS also stated that we overstated the net worth of unaccounted for
items by not taking into account the depreciated value of those items.
In addition, HHS response also cited six specific cases that they
believe were misrepresented in our case studies.
In response to HHS's first limitation, we do not believe that we
mischaracterized the uniqueness of IHS's collaboration with Indian
Tribes and the fact that it has service units throughout the country.
In the report, we state that over half of IHS's budget is administered
by the tribes through various contracts and compacts with the federal
government. We also state that IHS operates 163 service units that
include one or more health facilities, such as hospitals, health
centers, village clinics, health stations, and school health centers.
Furthermore, the scope of our audit only included testing IHS property,
which does not include the Tribal communities. However, we believe that
because IHS operates in this type of control environment, IHS should
have strong internal controls over its property and not the weak
controls that were apparent in our audit.
HHS also contends that the unaccountable property will be reduced from
the reconciliation of the prior property system to the new system.
However, we disagree--the lost or stolen property that was identified
in our report came from IHS's Report of Surveys, our full physical
inventory of all equipment at IHS headquarters, and random sample
testing of IT equipment at 7 field locations. Reports of Survey only
identify specific property items that were written off IHS's inventory
books from physical inventories or other circumstances. Our physical
inventory testing at IHS headquarters and random sample testing of IT
equipment at the 7 field locations verify that there were additional
missing property items to those identified in Reports of Survey.
Furthermore, as stated in our report and HHS's response, IHS did not
perform complete physical inventories of equipment for most of its
regional offices. Specifically we identified that 9 of the 12 regions
did not perform a physical inventory in 2007. In addition, we reported
that IHS did not complete the investigations of about $11 million of
inventory shortages where a physical inventory was performed. As such,
our estimate does not include lost or stolen property where physical
inventories were not performed or where IHS did not complete its
investigation of inventory shortages. Further, we do not believe that
IHS's conversion to a new system should impact IHS's ability to
maintain basic inventory documentation that is subject to audit.
Without such documentation, IHS has no accountability of equipment that
the American taxpayers entrusted to the agency. Thus, we believe that
we likely underestimated, not overestimated, the amount of lost or
stolen property.
Finally, in its written response to our draft report HHS states its
belief that our report overstates the net worth of unaccounted for
items by not taking into consideration the depreciation value of these
items. While we agree that the actual "loss" is less because of
depreciation, we consider acquisition cost very relevant because, if
property that IHS has lost or is stolen was necessary, IHS will need to
buy new replacement property. It is likely that replacement costs are
as much, or more, than acquisition costs in this scenario. Furthermore,
in our use of acquisition costs for property, IHS generally provided us
the acquisition cost of equipment. IHS provided us little data that
contained depreciation or fair market value of the equipment.
Therefore, we modified our report to state that the value of lost or
stolen property was represented as the acquisition cost.
We disagree with HHS's portrayal of the six specific cases cited in
their response to our draft report. Specifically:
* Report of survey for Alaska tribal self-determination award: In its
response, HHS stated that most of the $6 million that was written off
in the Report of Survey was transferred from IHS to local Tribal
communities, the U.S. Air Force, or abandoned on an IHS construction
site. As stated in our report, none of these transfers or disposals
were properly documented. Without proper documentation, it is
impossible to determine what happened with the property, which is why
we consider it to be lost or stolen. Although HHS's comments state that
these items were old and had little remaining useful value, IHS
continues to purchase new property to replace old, necessary items--in
which case it is likely that replacement costs are as much (or more)
than acquisition cost. Furthermore, analysis of IHS's response raises
concerns about the nature of disposal for these items, including
vehicles and machinery, which could cause environmental hazards as a
result of abandonment.
* Tucson Report of Survey and jaws of life: HHS stated that 45 items,
including the "jaws of life" equipment that we reported as lost or
stolen in our draft report, have been recently found. We identified
that these items were lost or stolen because they were documented in a
September 2006 Report of Survey. We followed up on the status of these
property items on our site visits to Tucson on two occasions in late
2007 and early 2008. On both occasions, IHS confirmed that these items
had not been found and that an investigation into their loss had not
been performed. Based on this timeline, these items were lost for
almost 2 years. IHS has not provided us any documentation to
substantiate the location of the jaws of life or any other property
identified in the Tucson Report of Survey. Therefore, we cannot
validate that these items were found.
* Allegation of misrepresentation by IHS property staff: HHS stated
that the majority of the 1,180 items that were not accounted for in the
April 2007 inventory had been located and reconciled by January 2008.
Additionally in our report, we state that the IHS Director responsible
for property claimed that IHS was able to find about 800 of these
missing items. However, based on our physical inventory testing at
headquarters, which included verifying IHS's reconciled items in
January 2008, we found that only some of these items have been found.
We also identified items missing from IHS's April 2007 inventory in
addition to the 1,180 shortage identified by IHS. Specifically, of the
3,155 pieces of IT equipment recorded in the records for IHS
headquarters, we determined that about 1,140 items (or about 36
percent) were lost, stolen, or unaccounted for. Part of the discrepancy
can be attributed to the fact that we did not accept fabricated
documents that the IHS property management specialist provided us as
discussed below. We continue to believe that the IHS Director
responsible for property attempted to thwart our investigation through
misrepresentations.
* Allegation of fabricated documents: HHS stated that IHS generated
disposal records in January 2008 to "establish an audit trail" showing
that 571 items missing during our inventory work were disposed of
properly. However, when these documents were presented to us, they were
identified as the actual supporting documents, not an "audit trail."
Additionally, HHS fails to acknowledge that the disposal records were
not dated and contained no signatures approving of the disposal.
Because these records clearly did not meet evidence standards, we asked
the IHS property employee who gave us the documents about their origin.
He admitted to fabricating them in order to satisfy our request for the
disposition of the property. By focusing on the January 2008 date of
our request, HHS is missing the point of our finding--that an IHS
employee tried to make the missing property properly accounted for by
generating documents and representing them as authentic disposal
records. We have referred the matter to the HHS Office of Inspector
General for further investigation.
* Allegation of wasteful purchases: HHS stated that it initiated a
procurement strategy to increase the cost efficiency of replacing
computer technology for its employees by buying in bulk so it can take
advantage of pricing discounts and reduce the critical down time for IT
tools. It also stated that the 25 on-hand "spare computers" noted in
the report were an acceptable level of inventory. We agree that
outdated technology should be replaced by taking advantage of bulk
purchases. We also agree that there should be some inventory held in
reserve for emergency needs that arise during the year. However, as
stated in the report, we found that there were 3 computers for every
person at IHS headquarters--a ratio that bulk ordering policies do not
adequately explain. In addition to the 25 new and unused computers
cited by HHS in its response, we identified several other examples of
waste at IHS headquarters including computer equipment items issued to
vacant offices and 7 new and unused laptops stored in an unlocked
cabinet. We also noted examples of waste at the field locations, such
as an unwrapped, 23-inch, widescreen monitor worth almost $1,700. The
employee in possession of the monitor stated she did not know why IT
sent her the monitor and claimed that it had never been used. We
believe that such examples exemplify wasteful purchases of equipment
rather than a prudent procurement strategy.
* Yard Sale: HHS stated that IHS headquarters staff have no knowledge
of a "yard sale" of computers and other property in Nevada. We reported
on this "yard sale" based on the confirmation of eight IHS property
officials, including the Phoenix Area executive officer. In its
response, HHS claimed that the 17 computers sold at this "yard sale"
were used for educational purposes and thus likely did not contain
sensitive information. The computers were located at a Youth Wellness
Center and, according to the Phoenix area property manager, were never
"cleaned" before transfer outside of the center. Hence, we continue to
believe that the potential release of patient data and the obvious
impropriety of holding a "yard sale" for government equipment make it
prudent for the HHS OIG to investigate the matter.
Finally, HHS disagreed with our recommendation to establish procedures
to track all sensitive equipment such as blackberries and cell phones
even if they fall under the accountable dollar threshold criteria. We
made this recommendation because we identified examples of lost or
stolen equipment that contained sensitive data, such as a PDA
containing medical data for patients at a Tucson, Arizona area
hospital. According to an IHS official, the device contained no
password or data encryption, meaning that anyone who found (or stole)
the PDA could have accessed the sensitive medical data. While we
recognize that IHS may have taken steps to prevent the unauthorized
release of sensitive data and acknowledge that it is not required to
track devices under a certain dollar threshold, we are concerned about
the potential harm to the public caused by the loss or theft of this
type of equipment. Therefore, we continue to believe that such
equipment should be tracked and that our recommendation remains valid.
As agreed with your office, unless you publicly release its contents
earlier we plan no further distribution of this report until 30 days
from the date of this letter. At that time, we will send copies of this
report to the Secretary of the Department of Health and Human Services,
the Director of IHS, and other interested parties.
The report is also available at no charge on the GAO Web site at
[hyperlink, http://www.gao.gov]. If you have any questions concerning
this report, please contact either Gregory D. Kutz at (202) 512-6722 or
kutzg@gao.gov. Contact points for our Offices of Congressional
Relations and Public Affairs may be found on the last page of this
report. GAO staff who made major contributions to this report are
listed in appendix III.
Signed by:
Gregory D. Kutz:
Managing Director:
Forensic Audits and Special Investigations:
[End of section]
Appendix I: Scope and Methodology:
To substantiate the allegation of lost or stolen property and wasteful
spending at the Indian Health Service (IHS),[Footnote 27] we analyzed
IHS documents of lost or stolen property from fiscal year 2004 through
fiscal year 2007.[Footnote 28] We also conducted a full physical
inventory of property at IHS headquarters and statistically tested
information technology (IT) equipment inventory at seven selected IHS
field locations. To identify specific cases of lost or stolen property
and wasteful spending, we analyzed IHS documents and made observations
during our physical inventory and statistical tests.
We performed a full physical inventory at IHS headquarters because the
whistleblower specifically identified problems at that location.
Specifically, we tested all 3,155 headquarters property items which
were largely comprised of IT equipment that IHS had recorded in its
property records as of April 2007. We physically observed each item and
its related IHS-issued bar code and verified that the serial number
related to the bar code was consistent with IHS's property records.
Although IHS property in the field locations includes inventory items
such as medical equipment and heavy machinery, we performed a
statistical test of only IT equipment inventory at seven IHS field
locations to determine whether the lack of accountability for inventory
was pervasive at other locations in the agency. We limited our scope to
testing only IT equipment items which are highly pilferable and can be
easily converted to personal use such as laptops, desktop computers,
and digital cameras. We selected the seven field locations based on
book value of inventory and geographic proximity.[Footnote 29] We
selected five field office locations because they had the highest
dollar amount of IT equipment according to IHS's property records. We
selected the two additional sites based on their geographic proximity
to the other field locations being tested. Our findings at these seven
locations cannot be generalized to IHS's other locations.
To estimate the extent of lost or stolen property at these seven
locations, we selected a probability sample of 250 items from a
population of 7,211 IT items that had a book value of over $19 million.
Because we followed a probability procedure based on random selections
with each item having an equal chance of being selected, our sample is
only one of a large number of samples that we might have drawn. Since
each sample could have provided different estimates, we express our
confidence in the precision of our particular sample's results as a 95
percent confidence interval. This is the interval that would contain
the actual population value for 95 percent of the samples we could have
drawn. As a result, we are 95 percent confident that each of the
confidence intervals in this report will include the true values in the
study population. Based on this sample, we estimate the number, the
percent, and the dollar amount of lost or stolen property at IHS. The
95 percent confidence intervals for each of these estimates is
summarized below:
Table 2: 95 Percent Confidence Intervals for Statistical Sample
Estimates:
Description: Estimated lost items;
Estimate: 1,211;
Lower endpoint of 95 percent confidence interval: 893;
Upper endpoint of 95 percent confidence interval: 1,588.
Description: Estimated percentage items lost;
Estimate: 17;
Lower endpoint of 95 percent confidence interval: 12.4;
Upper endpoint of 95 percent confidence interval: 22.0.
Description: Estimated dollar amount of lost or stolen;
Estimate: $2,598,613;
Lower endpoint of 95 percent confidence interval: $1,389,012;
Upper endpoint of 95 percent confidence interval: $4,531,133.
Source: GAO.
[End of table]
We considered equipment to be lost or stolen if (1) we could not
physically observe the item during the inventory; (2) IHS could not
provide us with a picture of the item, with a visible bar code and
serial number, within 2 weeks of our initial request; or (3) IHS could
not provide us with adequate documentation to support the disposal of
the equipment.[Footnote 30]
We performed appropriate data reliability procedures for our physical
inventory testing at IHS Headquarters and sample testing at the seven
case study locations including (1) testing the existence of items in
the database by observing the physical existence of all items at IHS
headquarters and IT equipment selected in our sample, and (2) testing
the completeness of the database by performing a 100 percent floor-to-
book inventory at IHS headquarters and judgmentally selecting inventory
items in our sample to determine if these items were maintained in IHS
inventory records. Although our testing of the existence and
completeness of IHS property records determined that IHS inventory
records are neither accurate nor complete, we determined that the data
were sufficient to perform these tests and project our results to the
population of IT equipment. In addition, we interviewed IHS agency
officials, property management staff, and other IHS employees. We also
interviewed Department of Health and Human Services (HHS) officials
concerning the migration of the Property Management Information System
(PMIS) and officials at the Program Support Center (PSC).[Footnote 31]
Although we did not perform a systematic review of IHS internal
controls, we identified key causes of lost and stolen property and
wasteful spending at IHS by examining IHS and HHS policies and
procedures, conducting interviews with IHS officials, and our
observations of property through our inventory testing.
We conducted our forensic audit and related investigations from June
2007 to May 2008 in accordance with generally accepted government
auditing standards. Those standards require that we plan and perform
the audit to obtain sufficient, appropriate evidence to provide a
reasonable basis for our findings and conclusions based on our audit
objectives. Despite IHS efforts to obstruct our review, we were still
able to accomplish our objectives. We believe that the evidence
obtained provides a reasonable basis for our findings and conclusions
based on our audit objectives. We performed our investigative work in
accordance with standards prescribed by the President's Council on
Integrity and Efficiency.
[End of section]
Appendix II: Comments from the Department of Health & Human Services:
The Secretary Of Health And Human Services:
Washington, DC 20201:
May 23, 2008:
Gregory D. Kutz:
Managing Director:
Forensic Audits and Special Investigations:
U.S. Government Accountability Office:
Washington, DC 20548:
Dear Mr. Kutz:
Enclosed are the Department's comments on the U.S. Government
Accountability Office's (GAO) draft report entitled, "IHS Management
Led to Millions of Lost or Stolen Property" (GAO-08-727).
The Department appreciates the opportunity to review and comment on
this draft before its publication.
Sincerely,
Signed by:
Jennifer R. Luong, for:
Vincent Ventimiglia, Jr.
Assistant Secretary for Legislation:
Attachment:
Comments Of The Department Of Health And Human Services (HHS) On The
U.S. Government Accountability Office's (GAO) Draft Report Entitled:
"IHS Mismanagement Led To Millions Of Lost Or Stolen Property" (GAO 08-
727):
IHS appreciates the opportunity to respond to GAO's report on IHS
property management. IHS has been and remains committed to proper and
accountable property management. To this end, IHS Headquarters and Area
Offices have fully cooperated with GAO in the audit and investigation
by providing detailed records, performing extensive data
reconciliations upon request of the GAO, and participating in multiple
and extended staff interviews.
Overview of the IHS inventory system:
IHS is responsible for a national, comprehensive health care delivery
system serving American Indians and Alaska Natives. The Agency
structure is a decentralized organization, with a central Headquarters
office located in Rockville, Maryland and 12 regions (Areas) throughout
the United States. Each of the 12 regions is overseen by a senior Area
Director, who reports to the IHS Director. IHS employs approximately
15,000 employees and the budget is approximately $4 billion annually.
IHS currently uses the HHS Property Management Information System
(PMIS) to inventory personal Federal property. The PMIS was first
implemented in FY 2005, and continues to improve accountability of
property at IHS.
Indian Tribes are authorized by Public Law 93-638, "Indian Self-
Determination and Education Assistance Act," to assume control of
programs administered by the IHS, including administrative support
functions. The statute also permits IHS to transfer title to both real
and personal Federal property associated with the operation of the
contracted program.
Also, Public Law 86-121, "Indians, Sanitation Facilities," authorizes
IHS to transfer property to Indian Tribes in order to maintain
sanitation facilities. Additional authority for providing equipment to
Tribes is found in the Public Law 94-437, "Indian Health Care
Improvement Act," as amended, at 25 U.S.C. 1632, regarding safe water
and sanitary waste disposal facilities, where the Secretary, acting
through the Service, is authorized to provide under section 2004a of
Title 42 P.L. 86-121], financial and technical assistance to Indian
Tribes and communities in the establishment, training, and equipping of
utility organizations to operate and maintain Indian sanitation
facilities.
In early FY 2005, HHS made a decision to utilize PMIS, a global system
to be used by HHS Operating Divisions, including IHS. At that time, the
IHS was focused on migrating then-current property data into the new
PMIS. At implementation, the IHS-wide inventory was comprised of
approximately 121,000 items with an original acquisition cost of $302
million prior to assigning new and higher HHS accountability thresholds
and assessing value of depreciation.
At the time, IHS believed that the migration process would only take a
few months to complete. Once migrated to the new PMIS, a physical
inventory could be taken using the new system. IHS Property Managers in
all 12 Areas were advised by HHS that our efforts should focus on
preparing the property data for migration, and the conduct of physical
inventories should be the second priority after data migration.
Unfortunately, the migration of property data took nearly two years to
complete, and there were several problems with the data that prevented
approximately 20,000 records from being migrated. Some of these
problems included lack of information for required data fields and the,
need to update their catalog of item descriptions to accommodate the
IHS inventory by the HHS Program Support Center, which administers the
new PMIS.
The implementation of the new HHS consolidated PMIS, including staff
training, took an extensive amount of time and resources. Training is
still ongoing and is a continuous process. Conducting physical
inventories using the new system therefore lagged and many IHS Areas
reverted to some legacy systems that had not been decommissioned. The
process for conducting wall-to-wall physical inventories became more
challenging due to turnover of IHS staff and depletion of experienced
property management personnel, along with remaining property personnel
being required to perform additional duties with multiple collateral
responsibilities. Using and maintaining legacy property systems became
too difficult to manage a large number of assets. As a result, some IHS
Areas did not have the resources to conduct a wall-to-wall inventory on
an annual basis.
The new HHS logistics management policy mandates that all "accountable"
and "sensitive" property (not all Government equipment) be tagged with
a Government decal. Accountable property is any item with an
acquisition cost of $5,000 or more. Sensitive property is an item
identified to be tracked with an acquisition cost between $500 and
S4,999 that requires stricter inventory control. If a property item
meets the new, higher dollar threshold or the sensitive items criteria,
then a barcode tag is affixed to the property item and entered into the
PMIS. After applying the new HHS accountability thresholds, the IHS
inventory is comprised of approximately 49,000 items with a total
original acquisition cost of $205 million. The PMIS includes a
depreciation expense feature which will adjust the book value of the
IHS inventory when it has been fully implemented, a feature which was
unavailable in the legacy property system.
In 2007, a physical inventory was completed for 100% of
accountable/sensitive property in 5 of the 14 accountable areas
throughout the MIS, including IHS HQ. An additional 5 accountable areas
completed partial inventories (50-90% of accountable/sensitive
property) and the remaining 4 accountable areas examined 15% or less of
their accountable/sensitive property in 2007.
Response to GAO Report:
IHS believes that GAO's report continues to include many inaccuracies
and misinterpretations. GAO itself acknowledges various limitations to
its audit and investigation, some of which are listed below. These
limitations seriously undercut GAO's conclusions.
* The report fails to appreciate that IHS property management is a
unique system compared to most other Federal agencies where interaction
involves collaboration with sovereign nations which grew out of the
special Government-to-Government relationship between the Federal
Government and Indian Tribes. IHS operates service units comprised of
health facilities, such as hospitals, health centers, village clinics,
health stations, and school health centers throughout the country. More
than half of the IHS budget is administered by Tribes through various
contracts and compacts with the Agency.
* The report repeatedly notes that IHS did not consistently document
"lost or stolen" property items and concludes that the number of
currently unaccounted for items might actually be higher than GAO has
identified. This fails to recognize the impact on IHS property
management of the implementation of a new inventory tracking system in
2005. In fact, the ongoing process of reconciling the prior system to
the new system makes it far more likely that the number of currently
unaccounted for items will be reduced rather than increase as the
reconciliation progresses. En addition, the implementation and
reconciliation process has made it more difficult to provide GAO with
the necessary documentation for the audit.
* The report also overstates the net worth of currently unaccounted for
items by not taking into consideration the depreciation value of these
items. Some items referenced in the report are 15 to 35 years old, and
yet are assigned their original acquisition cost. For example, some of
the large, non-IT items of inventory, such as all terrain vehicles
(ATVs) are valued at the original acquisition cost despite the fact
that the actual equipment was acquired between 1974 and 1999, well past
their useful life expectancy of 8 years.
While GAO and IHS have met on multiple occasions to discuss specific
situations addressed in the report, we believe that GAO continues to
inaccurately describe some of the situations described below.
Alaska Tribal Self-Determination Award:
At the time of the transfer of IHS property to the Alaska Tribal
compact in 2000, personal property in use in Alaska reflected a non-
depreciated value of approximately $13 million, of which approximately
$7 million was transferred to the Alaska Tribal compact under the new
agreement/award. The remaining $6 million of this original amount
(representing l,197 items) was written off the IHS inventory on a
single Report of Survey in 2006, after several years of intensive on-
site research and reconciliation performed by IHS and Tribal health
officials on site in Alaska. On this Report of Survey, it clearly
states that of the $6 million written off; most of the items were
disposed of either by (I) transfer to local Tribal communities; (2)
transfer to a local Air Force Base; or (3) "abandoned" on an IHS
construction site due to the extraordinary expense associated with the
removal of the equipment, leaving $177,000 (68 items) that were
identified as missing. The ATVs and tractors referred to in the report
as "lost or stolen," were not among the 68 items that IHS identified as
missing. Rather, they were identified on the 2006 Alaska Report of
Survey as "transferred" or "abandoned in place". Some of the large
construction equipment in the extremely isolated locations in Alaska
has to be flown in, or shipped by barge. The acquisition dates of these
1,197 items span 15-35 years. The useful life and actual "value" of the
items to be written-off were considered by the Board of Survey and the
Determining Authority in the final decision to write-off the inventory.
Tucson Report of Survey and Jaws of Life:
The 2006 Report of Survey for the entire Tucson Area reflected 114
items unaccounted for, or 3.5% of the total items in the Tucson Area
inventory. The original acquisition cost of' these items was $275,757.
which represents 4.2% of the total original acquisition cost of the
Area-wide inventory. The Tucson Area property staff is in the final
stages of completing the 2008 physical inventory which includes
reconciling any differences between the physical inventory and the
property records. The initial work on the 2008 reconciliation process
has resulted in locating and accounting for 45 items representing
$114,601 that were listed on the 2006 Report of Survey, however, the
report does not reflect this. Included in the items located are all of
the Jaws of Life extrication equipment which the report characterizes
as "lost or stolen." The Jaws of Life equipment is used in ambulances
that are an integral part of an emergency medical services program
operated by IHS in the Tucson Area. At the completion of the 2008
physical inventory and reconciliation process, the Tucson Area will
prepare a final Report of Survey to list all items not accounted for.
Allegation of misrepresentations made by IHS property staff:
When the GAO investigation commenced in August 2007, IHS property staff
were starting to make progress on the reconciliation of the April 2007
physical inventory of IHS HQ. The initial results in April 2007
indicated that l,180 items were still listed on the inventory, but were
not located on site, and over 500 items were found on site, but were
not listed on the HQ inventory. The inventory reconciliation process
was delayed by several months, but by July 2007 IHS staff started to
make significant progress on their research of inventory differences.
The basic research included reviewing alternate records to determine
if, perhaps, the unaccounted for items were in fact proper disposals
that had not been documented, or if the items might have been missed in
the initial physical inventory. After the basic research was completed
IHS was able to account for the majority of the l,180 items originally
identified as unaccounted for.
More specifically, at the time GAO arrived on site in August 2007,
efforts were already well underway by IHS staff to obtain verification
from the Director of the HHS Federal warehouse where IHS turns in its
surplus equipment. Independent verification with the Federal warehouse
provided evidence in 2007 that 498 items had in fact been properly
disposed of as turn-ins to the warehouse. Additionally, in a subsequent
inspection by IHS staff in late 2007, 222 items were found on site in
IHS HQ that had been missed in the initial physical inventory taken in
April 2007. The entire reconciliation process was completed in January
2008 and updated information was provided at that time to the GAO.
Nevertheless, the report continues to categorize these items as "lost
or stolen."
GAO's Allegation of Fabricated Documents:
In January 2008, an IHS property staff member, in his effort to ensure
that GAO received the needed information in a form he believed they
would accept, generated blank disposal records and recorded the
disposal information that was provided from the HHS Federal warehouse
onto the HHS 22 forms. When these "HHS 22s" were provided to GAO, they
reflected a current date of January 2008 and were clearly represented
as having been created for purposes of establishing an audit trail
using the independent warehouse verification. Although they were not
backdated or otherwise falsified, GAO accused the property staff person
of "fabricating disposal records" No one in IHS conveyed to GAO that
these documents were anything but newly generated documents. IHS does
not condone the actions of the staff person who generated the HHS-22s
well after the fact, for the purpose of recording otherwise verified
information for the review of the GAO, but we do not believe there was
intent to deceive or mislead the investigators.
Allegation of "wasteful" purchases:
In 2007, IHS Headquarters initiated a procurement strategy to increase
the cost efficiency of the replacement of computer technology used by
all its employees. The useful life of many desktop computers and
smaller portable devices is 3-5 years. By buying in bulk to meet needs
in advance, IHS can take advantage of bulk price discounts, and reduce
critical down time of vital IT tools. The 25 on-hand "spare computers"
noted in the report as "excess" and examples of "wasteful" purchases,
represents roughly 6% of the total number of desktops deployed at IHS
Headquarters. In the opinion of the IHS Chief Information Officer, this
is an acceptable level of inventory. IHS makes only one bulk purchase
of desktops each year in order to take advantage of bulk price
discounts. Only the numbers of desktops that have exceeded their useful
life are replaced in the annual bulk purchase. A very few additional
computers must be purchased for emergent needs that arise during the
year, such as new employees or to replace faulty equipment. IHS also
uses those few additional computers, pending deployment to individual
staff, for IT training purposes of all staff at both the Albuquerque
and Rockville Headquarters locations.
Yard Sale:
We have requested, but have not received, a copy of the "flier" that
GAO references in the report. To date, staff at IHS Headquarters have
not seen this flier and have no knowledge of the alleged yard sale.
However, information regarding the property that is discussed in this
section of the GAO report is described below. We have a written
statement from the employee in the Phoenix Area property office that
transferred the computers at issue from the Desert Vision Youth
Wellness Center to the Schurz Service Unit in 2005. He has verified
that these computers were used for educational purposes at the Wellness
Center, and were not used in a clinical setting in which the computers
would more likely be used to store sensitive data.
HHS Response to GAO Recommendations:
We concur with nine of the ten GAO recommendations addressed in the
report to the Director of IHS to strengthen overall control environment
for property management. We address individual recommendations below:
* Update IHS personal property management policies to reflect any
policy changes that have occurred since the last update in 1992.
- Concur. We have initiated this process. The revision process was
started in 2002, however, was put "on hold" pending the implementation
of a new property system that would inevitably change some of the
business processes that would need to be addressed in the new policy.
Additionally, recent revisions of the HHS Logistics Management Manual
must be considered when revising the IHS policy.
* Investigate circumstances surrounding missing or stolen property
instead of writing off losses without holding anyone accountable.
- Concur. IHS will continue to accomplish the needed investigations
regarding property that is unaccounted for, prior to write-off, and
will hold employees accountable as deemed appropriate throughout the
Report of Survey process.
* Enforce policy to conduct annual inventories of accountable personal
property at headquarters and all field locations.
- Concur. instructions for conducting the 2008 physical inventory
utilizing the PMIS have been distributed to the Area Property
Management Officers. A personal property certification statement was
included in the instructions that require the Property Custodial
Offlcer/Asset Center Representative and the Area Property Management
Officer to sign and date, certifying the physical inventory was
conducted.
* Enforce policy to use receiving agents to document the receipt of
property and distribute the property to its intended user and to
designate property custodial officers in writing to be responsible for
the proper use, maintenance, and protection of property.
- Concur. Receiving agents and Property Custodial Officers will be
assigned, trained and held accountable.
* Enforce policy to place barcodes on all accountable property.
- Concur. IHS will continue to utilize the HHS policy to tag and
control all accountable and sensitive property.
* Enforce policy to document the issuance of property using hand
receipts and make sure that employees account for property at the time
of transfer, separation, change in duties, or on demand by the proper
authority.
- Concur. IHS uses a clearance form for separating employees. This
policy and the use of this form will be enforced prior to an employee's
last day of work.
* Maintain information on the user of all accountable property,
including building and room number, so that property can easily be
located.
- Concur. This information will be reviewed as the 2008 physical
inventory is conducted and any updates to the PMIS will be made to
reflect the current location of all accountable and sensitive property.
* Physically secure and protect property to guard against loss and
theft of equipment.
- Concur. IHS will continue to safeguard all property and plans to send
a Special General Memorandum to all IHS employees reminding them of
their personal responsibilities to safeguard property.
* Enforce the use of the PMIS property management database to create
reliable inventory records.
- Concur. Training and system implementation is nearly completed. As
stated above, instructions for conducting the 2008 physical inventory
utilizing the PMIS have been distributed to the Area Property
Management Officers.
* Establish procedures to track all sensitive equipment such as
blackberries and cell phones even if they fall under the accountable
dollar threshold criteria.
- Do Not Concur. IHS will continue to follow the HHS Policy for
Sensitive Equipment and track only sensitive equipment that meets the
criteria established by HHS for property accountability. Currently this
policy requires sensitive items such as blackberries and cell phones to
be tracked only if the purchase price is $500 or more, however, we
agree it is important to protect all data that is considered sensitive.
The following information describes security measures that are in place
for sensitive IT equipment, and those planned for the future. IHS
employs a number of management and technical measures to ensure a high
degree of security for IT equipment. This includes: 1) All IHS laptops
are equipped with hard-drive encryption software; and 2) IHS policy
prohibits the use or storage of sensitive information on mobile devices
(e.g., blackberries) and portable media (e.g., CD/DVD). If a waiver is
required, the mobile device or portable media must be encrypted. Plans
are currently being developed to deploy software on all desktops for
the encryption of portable media. Additionally, plans are currently
under development for the encryption of hard-drives for IHS desktop
computers that could contain sensitive information.
[End of section]
Appendix III: GAO Contacts and Acknowledgments:
GAO Contact:
For further information about this report, please contact Gregory D.
Kutz at (202) 512-6722 or kutzg@gao.gov.
Acknowledgments:
In addition to the individual named above, the following made
contributions to this report: Verginie Amirkhanian, Erika Axelson,
Joonho Choi, Jennifer Costello, Jessica Gray, Richard Guthrie, John
Kelly, Bret Kressin, Richard Kusman, Barbara Lewis, Megan Maisel,
Andrew McIntosh, Shawn Mongin, Sandra Moore, James Murphy, Andy
O'Connell, George Ogilvie, Chevalier Strong, Quan Thai, Matt Valenta,
and David Yoder.
[End of section]
Footnotes:
[1] IHS headquarters property consists mostly of IT equipment.
[2] We considered equipment to be lost or stolen in our physical
inventory testing and random sample testing of seven field locations if
we could not observe the item to confirm bar code and serial number, or
if IHS could not provide us with adequate documentation to support the
disposal of the equipment.
[3] The seven sites we selected account for 35 percent of the IT
equipment items or 40 percent of the value of IT equipment. The seven
locations we tested included both IHS area offices and service units
such as hospitals and supply centers.
[4] A forensic audit is a systematic evaluation of the effectiveness of
internal controls over a program, process, and/or policies and
procedures. Forensic audits identify ineffective controls and
vulnerabilities and use data mining and investigations to expose areas
of fraud, waste, abuse, and security vulnerabilities to show the effect
of inadequate controls.
[5] The amount of lost or stolen property stated throughout the report
was valued at acquisition cost, which is how IHS typically values the
property in its records.
[6] OMB Memorandum M-07-16, Safeguarding Against and Responding to the
Breach of Personally Identifiable Information (May 22, 2007).
[7] Because these estimates are based on a probability sample, they are
subject to sampling error. For example, we are 95 percent confident
that missing IT equipment is valued between $1.39 million and $4.53
million. Likewise, we are 95 percent confident that between 12 and 22
percent of the IT equipment items were lost or stolen. Additional
information on our sample and estimates is presented in appendix I.
[8] More specifically, IHS has issued approximately three computers per
employee.
[9] Indian Health Manual, Part 5, Chapter 12, "Personal Property
Management" (Apr. 29, 1992).
[10] HHS mandated the property management information system, PMIS,
which was implemented over a 2-year process effective October 18, 2007,
and contains IHS personal property, including inventory that is
capitalized and sensitive.
[11] While performing our random sample testing of the seven field
locations, we also found that over half of the items we selected were
not in PMIS.
[12] IHS area offices are located in Aberdeen, South Dakota; Anchorage,
Alaska; Albuquerque, New Mexico; Bemidji, Minnesota; Billings, Montana;
Nashville, Tennessee; Oklahoma City, Oklahoma; Phoenix, Arizona;
Portland, Oregon; Sacramento, California; Tucson, Arizona; and Window
Rock, Arizona.
[13] Additionally, IHS reported about $ 800 million in third-party
collections.
[14] Accountable personal property is personal property with an
acquisition value of $5,000 or greater and all sensitive items with a
value of $500 or greater.
[15] A Report of Survey is the document used to record and present
findings and recommendations concerning the loss, theft, damage, or
destruction of government property; to approve corrective actions,
including financial recovery efforts; and to approve the resulting
adjustments to property accountability records.
[16] In addition to the $15.8 million in lost or stolen property items
that we identified in the Report of Surveys, we also found about $11
million in additional inventory shortages in the regional offices from
our analysis of Inventory Status Reports provided to us by IHS.
However, we did not include this amount in our estimate of lost or
stolen property because IHS has not made a final determination on this
missing property.
[17] Privacy Act of 1974, Pub. L. No. 93-579, § 3, codified, as
amended, at 5 U.S.C. § 552a.
[18] We selected the seven field locations based on book value of
inventory and geographic proximity. Five field office locations were
selected because they had the highest dollar amount of IT equipment. We
selected two additional sites because of their geographic proximity to
the other field offices being tested.
[19] Because these estimates are based on a probability sample, they
are subject to sampling error. For example, we are 95 percent confident
that missing IT equipment is valued between $1.39 million and $4.53
million. Likewise, we are 95 percent confident that between 12 and 22
percent (or between 893 and 1588) of the IT equipment items were lost
or stolen. Additional information on our sample and estimates is
presented in appendix I.
[20] HIPAA, Pub. L. No. 104-191, § 264, The Secretary of Health and
Human Services has prescribed standards for safeguarding medical
information in the HIPAA Medical Privacy Rule. See 45 C.F.R. pt. 164.
[21] More specifically, IHS has issued approximately three computers
per employee.
[22] In addition, one region did conduct a partial inventory of its
property.
[23] An accountable area is an area specifically defined by
organizational or geographic limits throughout which property
accountability is assigned to a designated accountable official.
[24] Sensitive items are property items that are especially vulnerable
to loss, theft, or misuse.
[25] Prior to the implementation of the PMIS system, each of the 12 IHS
regions and IHS headquarters maintained separate property databases
using different software programs.
[26] The official scheduled date that IHS was supposed to decommission
the legacy systems and start using PMIS exclusively was October 18,
2007.
[27] The scope of our audit only included testing IHS property, which
does not include the Tribal communities.
[28] We analyzed Report of Survey documents identifying property as
lost, stolen, missing, or shortages.
[29] The seven sites we selected account for 35 percent of the IT
equipment items or 40 percent of the value of IT equipment. The seven
locations we tested included both IHS area offices and service units
such as hospitals and supply centers.
[30] To be conservative, we accepted properly documented disposed
items, even though it is considered a poor property management
practice.
[31] PSC is the support center within HHS that maintains PMIS.
[End of section]
GAO's Mission:
The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting
its constitutional responsibilities and to help improve the performance
and accountability of the federal government for the American people.
GAO examines the use of public funds; evaluates federal programs and
policies; and provides analyses, recommendations, and other assistance
to help Congress make informed oversight, policy, and funding
decisions. GAO's commitment to good government is reflected in its core
values of accountability, integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each
weekday, GAO posts newly released reports, testimony, and
correspondence on its Web site. To have GAO e-mail you a list of newly
posted products every afternoon, go to [hyperlink, http://www.gao.gov]
and select "E-mail Updates."
Order by Mail or Phone:
The first copy of each printed report is free. Additional copies are $2
each. A check or money order should be made out to the Superintendent
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or
more copies mailed to a single address are discounted 25 percent.
Orders should be sent to:
U.S. Government Accountability Office:
441 G Street NW, Room LM:
Washington, D.C. 20548:
To order by Phone:
Voice: (202) 512-6000:
TDD: (202) 512-2537:
Fax: (202) 512-6061:
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]:
E-mail: fraudnet@gao.gov:
Automated answering system: (800) 424-5454 or (202) 512-7470:
Congressional Relations:
Ralph Dawn, Managing Director, dawnr@gao.gov:
(202) 512-4400:
U.S. Government Accountability Office:
441 G Street NW, Room 7125:
Washington, D.C. 20548:
Public Affairs:
Chuck Young, Managing Director, youngc1@gao.gov:
(202) 512-4800:
U.S. Government Accountability Office:
441 G Street NW, Room 7149:
Washington, D.C. 20548:
