U.S. Department of Health and Human Services 
Office of Inspector General 
 
Indian Health Service 
Has Strengthened 
Patient Protection 
Policies but Must Fully 
Integrate Them Into 
Practice and 
Organizational Culture  
 
Joanne M. Chiedi 
OEI-06-19-00330 
Acting Inspector General 
December 2019 
 
oig.hhs.gov  Report in Brief  U.S. Department of Health and Human Services 
December 2019 
Office  of Inspector General 
OEI-06-19-00330 
 
 
IHS Has Strengthened Patient Protection 
Why OIG Did This Review 
Policies but Must Fully Integrate Them Into 
In recent years, the Indian Health 
Service (IHS) has had a number of 
Practice and Organizational Culture 
cases of healthcare providers 
abusing patients under facility care, 
What OIG Found 
including a pediatrician who was 
Key Takeaway 
OIG found that IHS policies to prevent and  convicted of multiple counts of child 
In early 2019, IHS updated its 
address child sexual abuse included similar  sexual abuse.  In February 2019, the 
policies to prevent and address 
elements of policies developed by  Deputy Secretary of the Department 
child sexual abuse by 
benchmark organizations.  of Health and Human Services 
healthcare providers, 
Sufficiency of Policies.  IHS included  strengthening patient  requested that the Office of 
Inspector General (OIG) assess IHS 
provisions for provider-patient boundaries,  protections and IHS staff 
policies and procedures for 
medical examination precautions, reporting  reporting responsibilities.  
preventing, reporting, and 
responsibilities, and protections for patients  These policies are now largely 
addressing patient abuse.  In the 
and staff.  In a few cases, IHS policies were  consistent with policies of 
same month, the Senate Committee 
stricter and more detailed than those of  benchmark organizations, but 
on Indian Affairs also requested that 
other organizations.  However, IHS policies  they have coverage gaps and 
OIG review applicable IHS policies, 
do not explicitly address other types of  are still early in 
procedures, standards, and other 
abuse, adult victims, or perpetrators who  implementation.  IHS must 
requirements intended to prevent 
are not healthcare providers.   expand its efforts to overcome 
and address misconduct.  This study 
challenges and integrate these 
Implementation of Policies.  Some IHS-
identifies strengths and gaps in IHS 
policies into practice and 
operated healthcare facilities are early in 
policies, and progress and challenges 
organizational culture.      
implementation and have not updated 
in their early implementation.  
their individual facility policies, largely due 
to staffing shortages and turnover of facility leadership.  IHS has trained staff  How OIG Did This Review 
on its updated policies and provided outreach to Tribal communities, but 
We based our findings on document 
faces challenges that may discourage reporting of abuse, including difficulty 
reviews and interviews with 
ensuring anonymity, fear of retaliation, and communication barriers 
45 officials and staff at IHS 
(e.g., language, stigma), among others.  In addition, we found significant 
headquarters and Area Offices, 
shortcomings in IHS systems for storing and tracking patient abuse reports 
conducted in JulyAugust 2019.  We 
and confusion about roles and responsibilities related to such tasks.  IHS has 
also reviewed IHS policies and other 
initiated efforts to strengthen systems and oversight.  
relevant documents and compared 
them to similar policies from three 
What OIG Recommends and How the Agency Responded  
benchmark organizations: the 
To address these issues and further protect patients from abuse, we 
American Academy of Pediatrics, the 
recommend that IHS: 
American Medical Association, and 
  the National Council of State Boards 
extend policies to address more types of perpetrators, victims, and abuse; 
of Nursing.  Topics for our interviews 
 
ensure that the new incident reporting system is effective and addresses 
with IHS officials and staff included 
the risks identified in the current system;  
implementation of IHS patient 
 
designate a central owner in IHS headquarters to ensure clear roles and 
protection policies and procedures, 
responsibilities for shared ownership in implementing patient protection 
strategies for and challenges to 
policies, and managing and responding to abuse reports; 
implementation, and other IHS 
improvement efforts related to 
preventing and addressing patient 
abuse in IHS facilities.        
   
continue to actively promote an organizational culture of transparency, 
and work to resolve barriers to staff reporting of abuse; and 
 
conduct additional outreach to Tribal communities to inform them of 
patient rights, solicit community concerns, and address barriers to 
reporting of patient abuse. 
This evaluation also provides additional support and urgency to a prior OIG recommendation that IHS has not yet 
implemented.  In July 2019, OIG recommended that IHS, as a management priority, develop and implement a staffing 
program for recruiting, retaining, and transitioning staff and leadership to remote hospitals. 
IHS concurred with our recommendations, and reported actions taken and planned to implement the recommendations, as 
of December 2019. 
 
Full report can be found at oig.hhs.gov/oei/reports/oei-06-19-00330.asp   
TABLE OF CONTENTS 
BACKGROUND  1 
Methodology  7 
   
FINDINGS   
IHS has strengthened its patient protection policies, but gaps in coverage remain and some  8 
facilities have yet to update their local policies 
IHS has trained staff on the updated policies directed at child sexual abuse but faces  16 
challenges to integrating these policies into practice and organizational culture 
IHS systems for storing and tracking patient abuse have shortcomings, and the agency has  21 
initiated efforts to strengthen systems and oversight 
   
CONCLUSION AND RECOMMENDATIONS   
Extend policies to address more types of perpetrators, victims, and abuse  25 
Ensure that the new incident reporting system is effective and addresses the risks identified  26 
in the current system 
Designate a central owner in IHS headquarters to ensure clear roles and responsibilities for  26 
shared ownership in implementing patient protection policies, and managing and 
responding to abuse reports 
Continue to actively promote an organizational culture of transparency and work to resolve  27 
barriers to staff reporting of abuse 
Conduct additional outreach to Tribal communities to inform them of patient rights, solicit  27 
community concerns, and address barriers to reporting of patient abuse 
   
AGENCY COMMENTS AND OIG RESPONSE  29 
   
APPENDIX   
Agency Comments  31 
   
ACKNOWLEDGMENTS  36 
 
ENDNOTES  38 
   
BACKGROUND 
Objective 
To assess Indian Health Service (IHS) policies and procedures for 
preventing, reporting, and addressing patient abuse and identify 
progress and potential challenges to their effective implementation.  
Indian Health  IHS is responsible for providing Federal health services to American 
Indians and Alaska Natives (AI/AN) and has an annual budget of  
Services 
$5.6 billion.1  In partnership with the 573 federally recognized Tribes, IHS 
provides free primary and preventive healthcare services to approximately 
2.6 million AI/ANs living in the United States.2  IHSs mission is to raise 
the physical, mental, social, and spiritual health of AI/ANs to the highest 
level.3  
Recent cases of patient abuse by IHS employees have raised concerns 
about protecting the AI/AN population.  The convictions of a former IHS 
pediatrician in September 2018 and 2019 brought attention to the issue 
and shed light on areas requiring improvement within IHS.4, 5  At 
congressional hearings in April and May 2019, the IHS Principal Deputy 
Director noted that the agency does not tolerate sexual assault and 
abuse in its facilities and had begun efforts to ensure safe and quality 
care for its patients, including implementing stronger requirements for 
IHS employees to report suspected sexual abuse of children.6, 7  IHS has 
also developed and enhanced systems that support identification of 
problem providers and patient abuse reporting.8, 9 
Organizational Structure.  IHS headquarters (HQ) provides general 
direction, policy development, and support to each of 12 Area Offices and 
their IHS-operated healthcare facilities, which may include hospitals, 
urgent-care clinics, and/or other types of facilities.10  Area Offices oversee 
the delivery of health services and provide administrative and technical 
support to the facilities.  IHS maintains its current policies, procedures, 
and operating standards in the Indian Health Manual (IHM).  IHS policy 
directs that the IHM is the primary reference for IHS staff regarding IHS-
specific policy and procedural information.11   
IHS-Operated Facilities.  IHS provides healthcare services to AI/ANs 
directly through IHS-operated facilities or provides financial support for 
the Tribes to operate their own healthcare systems.12, 13  The IHS federal 
system of IHS-operated facilities includes 24 hospitals, 51 health centers, 
24 health stations, and 2 school health centers.14   
IHS Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into Practice and Organizational Culture  1 
OEI-06-19-00330   
Medicare Conditions  IHS requires all IHS-operated facilities to be certified by the Centers for 
Medicare & Medicaid Services (CMS) or accredited by an accrediting 
of Participation 
organization that supports the reimbursement requirements established 
by CMS.15, 16  Among these requirements are the Conditions of 
Participation (CoPs), a set of minimum quality and safety standards.  The 
CoPs include requirements such as establishing an effective governing 
body legally responsible for the performance of the facility, protecting 
and promoting patients rights, and maintaining an organized medical 
staff responsible for the quality of patient medical care.17  
CMS and accrediting organizations monitor IHS healthcare facilities 
compliance with the CoPs through periodic onsite surveys.18  Surveyors 
observe how facilities provide care to patients, and assess whether that 
care meets the needs of the patients and is in compliance with all 
requirements.  To indicate noncompliance, surveyors cite facilities with 
deficiencies that facilities must correct in a timely manner to continue 
participating in Medicare.  If surveyors identify an immediate jeopardy 
(noncompliance with one or more requirements that caused, or is likely to 
cause, serious injury, harm, impairment, or death to a patient), the facility 
must immediately develop and implement a plan of correction to remove 
the immediate jeopardy or face termination from the Medicare program 
by CMS.19 
Cases of Patient  Over the years, there have been several allegations of patient abuse 
committed by IHS employees, some of which have involved minors.  For 
Abuse at IHS 
example, Stanley Patrick Weber, a former IHS physician was found guilty 
on September 6, 2018, of sexually abusing patients while he was a 
pediatrician at the Blackfeet Community Hospital in Montana between 
1992 and 1995.20, 21  On September 27, 2019, Dr. Weber was also found 
guilty of sexually abusing minors at the Pine Ridge Hospital in South 
Dakota, where he worked from 1995 until he resigned in 2016.22  The 
crimes for which he was convicted occurred both at the hospital and in his 
home.  This case was particularly troubling given that hospital staff raised 
suspicions, on multiple occasions, that Dr. Weber was abusing children, 
yet he continued to work as a pediatrician at IHS hospitals until his 
resignation, which allowed him to treat and victimize children for more 
than two decades.23   
In addition to Dr. Weber, other IHS healthcare providers have been 
accused of patient abuse over the last two decades.  In 2013, IHS fired a 
physician after receiving complaints of sexual misconduct involving 
patients.  In 2005, an adult patient sued a physician working under a term 
contract with IHS, for sexual assault; the suit was later settled out of 
court.24, 25  In 1999, IHS settled a lawsuit involving a teenage patient and 
an IHS psychologist.26, 27   
IHS Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into Practice and Organizational Culture  2 
OEI-06-19-00330   
Request for OIG  Dr. Webers case has specifically raised concerns about IHS actions and 
efficacy of policies and procedures for addressing patient abuse in its 
Evaluation 
facilities.  In February 2019, the Office of Inspector General (OIG) received 
a request from the Deputy Secretary of the Department of Health and 
Human Services (HHS) to review IHSs newly implemented series of 
system-wide policies and procedures designed to promote a zero-
tolerance for patient abuse.  In the same month, OIG also received a 
congressional request asking OIG to evaluate applicable IHS policies, 
procedures, standards, and other requirements intended to prevent, 
address, and correct misconduct present in the Weber case.  
IHS Actions to  As a result of the Weber and other patient abuse cases, IHS initiated 
several efforts in 2017 to further address and prevent patient abuse in its 
Address and Prevent 
facilities.28  In 2018, IHS leadership notified all staff of the agencys zero-
Patient Abuse 
tolerance policy, which prohibits staff from engaging in intimate physical 
relationships with patients and requires staff to report, investigate, and 
follow up on any concerns of patient abuse.29   IHS also announced plans 
to train its Federal employees and contractors on how to identify and 
report suspicions of abuse based on system-wide reporting 
responsibilities.  Additionally, IHS revised policy documents and systems, 
including methods for screening providers and reporting allegations of 
abuse.30, 31 
New IHM Policies on Preventing Child Sexual Abuse.  In February 2019, IHS 
issued new policies in the IHM, entitled Protecting Children from Sexual 
Abuse by Health Care Providers, which include guidance specific to 
provider interactions with children.32, 33  The policies serve as an update to 
prior policies about patient abuse in the IHM and also provide greater 
specificity, outlining roles and reporting responsibilities for leadership and 
staff at all levels of the agency to protect children from sexual abuse and 
exploitation in IHS-operated healthcare facilities.34  They also include 
provisions for the use of chaperones during medical exams and guidance 
regarding staff rights.35   
Informed Patient Consent.  The IHM has had guidelines for ensuring 
protection of patient rights related to informed consent since July 2010.36  
The policies, entitled Health Information Management, contain a 
provision stating that all health records must include evidence that 
informed consent was obtained from the patient or personal 
representative prior to undertaking any treatment or procedure.37  If the 
patient is a minor, a parent or legal guardian may act on the patients 
behalf and can consent or reject medical treatment.38    
Ethical Standards.  The IHS Division of Personnel Security and Ethics 
(DPSE), formerly known as the Personnel Integrity and Ethics Staff, 
administers and manages ethics programs at IHS, including training and 
directives for the agencys ethical conduct standards.39  Along with 
IHS Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into Practice and Organizational Culture  3 
OEI-06-19-00330   
following IHS policies, most IHS staff working in IHS-operated healthcare 
facilities must also adhere to Federal requirements for reporting 
suspected child abuse and neglect.40   
The IHM has had guidelines for reporting and responding to violations of 
ethical standards in place since August 2004.41, 42  The policies, entitled, 
Ethical and Professional Conduct of Health Care Providers, detail the 
reporting structure for allegations of unethical conduct and state that it 
is unethical not to report known violations of misconduct or violations of 
ethical standards.43  The policies dictate that facility staff immediately 
report allegations of misconduct or violations of ethical standards to their 
supervisor or other appropriate officials, and the supervisors must then 
report the allegations to senior leadership in the facility and/or the Area 
Office.  They also require that chief executive officers (CEO) of the IHS-
operated facilities report all allegations to their respective Area Office, 
OIG, and/or DPSE.  Once Area Offices are notified, the Area Directors must 
report the allegations to DPSE and/or OIG and to the appropriate 
professional organizations and State licensing/certification boards.44 
Reporting Allegations of Abuse.  Under the most recent policies for 
protecting children from sexual abuse, all staff, including healthcare 
providers, with reasonable cause to suspect that a provider has sexually 
abused a child must report the incident to child protective services and/or 
law enforcement, as well as OIG.45  IHS defines a healthcare provider as 
anyone who provides physical or behavioral health treatment to patients 
(e.g., physicians, nurses, dentists, psychologists).46  All staff, including 
supervisors, are also responsible for ensuring that all reported incidents of 
inappropriate sexual contact are documented in the IHS incident 
reporting system.47   
In December 2018, IHS awarded a contract for a new adverse events 
reporting and tracking system to replace WebCident, IHSs longstanding 
incident reporting system.48, 49, 50  IHS plans for the new system to have an 
improved interface with various data collected from IHS-operated 
facilities, including patient safety errors and adverse events.51  
IHS and OIG also provide telephone hotlines that IHS staff, contractors, 
patients, and others can use to file complaints and report allegations of 
patient abuse involving IHS staff.52  Callers can be anonymous and may 
use the hotlines to elevate concerns regarding fraud, waste, and 
mismanagement at IHS.  Complaints and reports can also be submitted 
electronically on the IHS and OIG websites.53, 54   
Whistleblower Protections.  The new IHM policies for protecting children 
from sexual abuse prohibit administrative or adverse action against an 
employee who reports an allegation.55  Federal law further provides 
whistleblower protections to most Federal employees, Commissioned 
Corps Officers, and employees of Federal contractors, subcontractors, 
IHS Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into Practice and Organizational Culture  4 
OEI-06-19-00330   
grantees, and subgrantees.  These protections bar retaliation for reporting 
protected disclosures, including violations of law.56, 57, 58  Officials who 
retaliate against whistleblowers may be subjected to corrective or 
disciplinary action to be imposed on those who retaliate against these 
individuals.59  OIG has a Whistleblower Protection Coordinator (formerly 
Ombudsman), who is responsible for educating HHS employees on their 
whistleblower protections.60 
Patient Protection  Other professional organizations have developed policies for preventing, 
reporting, and addressing patient abuse in healthcare settings, including: 
Policies from 
National    American Academy of Pediatrics (AAP) 
AAP works with government, community, and other national 
Organizations 
organizations on child health and safety issues and has developed 
detailed guidance for protecting children from sexual abuse by 
healthcare providers.  It was founded in 1930 and is made up of about 
67,000 pediatricians.61, 62 
  American Medical Association (AMA) 
AMAs mission is to promote the art and science of medicine and the 
betterment of public health through advocacy and the use of its 
Code of Medical Ethics.  The Code provides guidance for members 
about ethical principles of the medical profession, including for 
patient-physician relationships, consent, and communication.63 
  National Council of State Boards of Nursing (NCSBN) 
NCSBN promotes patient safety and public protection by providing 
education and research to its nursing regulatory bodies.  These 
include bodies in the States, the District of Columbia, and U.S. 
territories that regulate more than 4.8 million licensed nurses.64, 65 
These nationally recognized healthcare organizations have a long history 
of providing policy guidance to various healthcare entities and have 
developed specific guidance on patient abuse. 
Other External  In May 2019, IHS awarded a contract for an independent medical quality 
assurance review that will assess IHS adherence to laws, policies, and 
Evaluators of IHS 
procedures aimed at protecting patients from sexual abuse.66  The review 
Patient Protection 
will largely be retrospective and will include medical record reviews from 
Policies  1986 to present.  The independent contractor will identify system failures 
that may have contributed to IHSs inability to prevent or address  
Dr. Webers patient abuse, as well as determine any further improvements 
that IHS can implement to better protect patients.67, 68    
The U.S. Government Accountability Office (GAO) also has work underway 
in this area, in response to a request from the Senate Committee on 
Indian Affairs in May 2019 to review IHS policies and actions for 
addressing and documenting personnel performance and misconduct 
IHS Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into Practice and Organizational Culture  5 
OEI-06-19-00330   
issues.69, 70  The Committee raised concerns about IHS use of transfers, 
duty reassignments, and administrative leave to address poor 
performance and misconduct, and asked GAO to determine the extent of 
such activity since 2010, when the Committee initially identified this issue.  
The Committee also requested that GAO assess whether a new centralized 
credentialing system adopted by IHS captures performance and 
misconduct information and is accessible across facilities.  
Additionally, in March 2019, the White House formed the Presidential 
Task Force on Protecting Native American Children in the IHS System.  
The task force, comprised of top-level officials from the White House, U.S. 
Attorneys Office for the Northern District of Oklahoma, Bureau of Indian 
Affairs, Federal Bureau of Investigation (FBI), IHS, and Office of 
Management and Budget, meets periodically to discuss how to better 
protect AI/AN children from abuse while under the care of IHS.  The Task 
Forces goal is to develop and recommend policies, protocols, and best 
practices for future implementation.71   
Related OIG Work  This study expands on prior and ongoing work by OIG.  Since 2016, OIG 
has focused largely on IHS management of hospitals, and issued 
companion reports describing lack of quality oversight and a number of 
challenges that affect IHS hospitals ability to provide quality care and 
maintain compliance with Federal requirements.72, 73  Recently published 
OIG reports include a case study of IHS management of a 7-month 
closure of the Rosebud Hospital emergency department and a 
management review of IHS HQ operations and organizational 
challenges.74, 75  Other ongoing work includes a medical record review that 
will determine the incidence of patient harm (adverse events) in IHS 
hospitals.  OIG plans to continue this body of work with a review of the 
implementation of IHS patient protection policies and procedures at the 
facility-level.   
Scope of Inspection  This study examines the sufficiency and implementation of IHS policies 
and procedures to prevent, report, and address patient abuse.  We 
inventoried and assessed IHS patient protection policies and procedures 
currently in place, with special attention to any policies added or updated 
since 2017 (when Dr. Weber was initially indicted).  As part of our 
assessment of sufficiency, we compared IHS policies to the policies of 
three nationally recognized professional healthcare organizations 
(i.e., AAP, AMA, and NCSBN) as a benchmark.   
We also examined IHS's progress in communicating and operationalizing 
these policies across the agency, facilities, and Tribal communities, 
including IHS officials perspectives on challenges or barriers to full 
implementation of the policies into practice and organizational culture.  
 
IHS Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into Practice and Organizational Culture  6 
OEI-06-19-00330   
Methodology  Data Collection and Analysis 
Interviews.  We conducted interviews with 45 officials and staff at IHS HQ 
and Area Offices in JulyAugust 2019 to inventory IHSs policies and 
procedures on patient abuse, and other related improvement efforts.  This 
included interviews with officials who were instrumental in developing 
and implementing IHSs updated patient protection policies and new 
incident reporting system.  
During these interviews, we discussed recent patient protection policy 
changes, communication with staff regarding the changes, strategies, and 
challenges for implementing the updated policies and procedures at the 
facility-level.  We employed semi-structured interview protocols that 
allowed us to follow up on additional issues as we learned new 
information and identified key issues.   
Document Reviews.  We reviewed national IHS policies and procedures for 
preventing, reporting, and addressing patient abuse and supporting 
documentation outlining IHS implementation efforts.  We also reviewed 
patient protection policies used by at least two of the three selected 
benchmark organizations to identify relevant policies for comparison with 
IHS policies. 
Data Analysis.  We conducted a qualitative analysis of interview data and 
policy documents to identify policy gaps and mechanisms in place to 
prevent, report, and address patient abuse.   
Limitations 
We did not assess potential breakdowns that contributed to the Weber 
case or review any earlier improvement efforts undertaken by IHS to 
address patient abuse before his indictment in 2017.  Further, we did not 
review patient protection policies and procedures in tribally operated 
healthcare facilities.   
Standards  We conducted this study in accordance with the Quality Standards for 
Inspection and Evaluation issued by the Council of the Inspectors General 
on Integrity and Efficiency.    
IHS Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into Practice and Organizational Culture  7 
OEI-06-19-00330   
FINDINGS 
IHS has strengthened  The indictment of Dr. Weber ignited IHSs efforts to identify and mitigate 
gaps in its policies and procedures and enhance the protections of 
its patient protection 
children from sexual abuse and exploitation by healthcare providers.  In 
policies, but gaps in 
developing the 2019 policies, IHS officials reported researching best 
coverage remain and  practices and consulting with stakeholders, such as the AAP Committee 
on Native American Child Health (CONACH), an advocacy group for AI/AN 
some facilities have 
children comprised of pediatric providers.76   
yet to update their 
local policies   The new policies apply to all providers, including those employed or 
contracted by IHS, and outline roles and responsibilities for leadership 
  and staff at all levels of the agency to protect children from abuse in IHSs 
care.  However, the policies do not explicitly address perpetrators who are 
not healthcare providers (e.g., administrative staff), other types of abuse 
(e.g., physical), or adult victims.  
The development of the new policies is an important step to prevent and 
address patient abuse, but at the time of our review, facilities as a whole 
were still early in implementation, and some facilities had not updated 
their local policies and procedures to include the new agency guidelines.    
IHS policies and procedures for preventing and addressing child 
sexual abuse by providers are now largely consistent with policies 
of benchmark organizations 
With the addition of the new policies for protecting children from sexual 
abuse, we found that policies in the IHM closely aligned with the broader 
policies of the three healthcare organizations we selected for comparison: 
AAP, AMA, and NCSBN.  IHS included provisions, similar to the benchmark 
organizations, for provider-patient boundaries, medical examination 
precautions, reporting responsibilities, and protections for patients and 
staff.  In a few cases, provisions of the IHS policies were stricter or more 
detailed than those of the other organizations.   
Provider-Patient Boundaries.  The IHM provided guidelines for boundaries 
on romantic, social, and economic relationships between providers and 
patients.  IHS longstanding policies on ethical and professional conduct of 
healthcare providers prohibited providers from engaging in romantic or 
sexual relationships with patients and outlined limitations around medical 
treatment of patients with whom the providers have a personal 
relationship, including the providers family members.   
The new IHS policy provisions on preventing child sexual abuse by 
healthcare providers included further directions for limiting 
communication between providers and patients outside of the 
professional setting and detailed different scenarios of inappropriate 
IHS Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into Practice and Organizational Culture  8 
OEI-06-19-00330   
contact and gifts.  Those scenarios included providing childcare outside of 
the IHS facility, providing transportation in personal vehicles, inviting 
children to locations outside of the IHS facility (e.g., personal home), 
sharing personal information or problems, sharing personal contact 
information, interacting on social media, and taking or possessing images 
of patients on personal devices.  We found that the IHS guidance was 
stricter than its counterparts regarding gifts.  While the policies of the 
other organizations allowed providers to accept nominal gifts from 
patients, IHS prohibited any form of gift exchange between providers and 
patients.   
Medical Examination Precautions.  The IHM included provisions on 
precautionary measures for medical examinations, including guidelines for 
providing chaperones during medical exams and obtaining patient 
consent.  The updated provisions stated that chaperones should be 
provided when requested by a patient, parent, or caregiver, and offered to 
minors during a medical exam.  If a patient refuses a chaperone, a support 
person of the patients choosing (e.g., parent, caregiver) could serve as an 
alternative.   
The policy provisions also stated that any providers in contact with or 
control over a child who have a pending background investigation must 
be within sight and under the supervision of a chaperone with a favorably 
adjudicated background investigation on file.  To help ensure that 
facilities follow these provisions, IHS officials reported that providers and 
their supervisors, as well as facility CEOs and Area Directors, must sign a 
provisional chaperone form for providers with a pending background 
investigation. 
Longstanding IHS policies on health information management included 
guidance on informed consent, the process of ensuring that patients 
understand and agree with the examination and treatment.  Obtaining 
patient consent and preparing patients for a medical exam or procedure, 
particularly one that involves the genital area, is important because 
patients may not know what to expect and therefore may not recognize if 
a provider is sexually violating them.  In interviews, an IHS official reported 
that the agency was working to strengthen this provision following a 
recent incident at an IHS hospital, where local law enforcement ordered 
IHS staff to draw fluids from a patient who did not consent to the 
procedure.  (See Exhibit 1 for further details regarding this incident.)   
IHS Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into Practice and Organizational Culture  9 
OEI-06-19-00330   
Exhibit 1: A recent patient consent incident at an IHS hospital 
In a root cause analysis conducted by the hospital, staff described that 
local law enforcement officers and nursing staff in the emergency 
department (ED) forcibly restrained and catheterized a teenage patient to 
conduct a urine drug screening without consent by the patient or a legal 
guardian.  Although the officers did not have legal support, according to 
the hospitals report, they ordered the test to gain medical clearance to 
transfer the patient to a youth shelter.  In conducting the root cause 
analysis, the hospital identified several breakdowns that contributed to 
the incident, including lack of hospital policies, processes, and staff 
knowledge on patient rights of minors in police custody.  The hospital 
developed a corrective action plan in response to the incident, which 
included updating its policies and staff training related to patient consent. 
 
In September 2019, IHS issued a special general memorandum in the IHM 
reminding staff of the requirement to obtain informed consent prior to 
providing medical or surgical procedures or treatment.  With limited 
exceptions, providers must inform patients about the procedures or 
treatment and ask for consent, which patients usually provide by signing a 
consent form.  In the memo, IHS further clarified that law enforcement 
cannot order IHS staff to perform a medical procedure on a patient 
without the patients informed consent, or in the case of a minor, the 
consent of a parent or guardian, unless there is a court order or search 
warrant signed by a Federal judge requiring the procedure.77 
Reporting Responsibilities.  The IHM provided detailed guidelines on roles 
and responsibilities for reporting patient abuse.  As outlined by the new 
policy guidelines, all staff must report, within 24 hours, any incident or 
reasonable suspicion of sexual abuse of a child by a healthcare provider 
directly to the appropriate child protective services (CPS) and/or law 
enforcement authorities, as well as the OIG hotline.  Staff must also report 
to their supervisor or facility CEO and to the IHS hotline within the same 
day of the incident, and document the report in the IHS incident reporting 
system within 5 business days.  The updated policies expand on the 
longstanding IHS policy provisions for reporting unethical and 
unprofessional conduct by expediting the reporting deadlines, which 
according to an IHS official, has resulted in IHS leadership finding out 
about things much more rapidly than ever before.  (See Exhibit 2 for IHS 
reporting responsibilities from the 2019 IHS policies on protecting 
children from sexual abuse.)   
 
 
 
IHS Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into Practice and Organizational Culture  10 
OEI-06-19-00330   
Exhibit 2: IHS Reporting Responsibilities for Incidents or Suspicions of 
Sexual Abuse of Children by Healthcare Providers 
Report to CPS and/or law enforcement, and OIG hotline within 24 hours
Report to supervisor or CEO, and IHS hotline, within same day of incident
All Staff Document report in IHS incident reporting system within 5 business days
Ensure reported incidents are documented in IHS incident reporting system
Notify licensing board(s) and National Practitioner Data Bank of any 
Supervisor disciplinary actions
Ensure all incidents or suspicions of abuse are reported to IHS regional and 
HQ human resources offices, law enforcement and/or CPS, licensing boards, 
CEO IHS hotline, and OIG
Report any issues with IHS staff to the Deputy Director for Field Operations 
Area  (DDFO) and other senior leaders
Director
Alert IHS senior leaders of any reports of sexual abuse by healthcare 
providers received from Area Directors
DDFO
 
Source: IHS, IHM, pt. 3; Ch. 20; section 3-20.2 (Responsibilities).  IHS training, Protecting Children from 
Sexual Abuse in Health Care Settings  Supporting a Culture of Community Safety, June 28, 2019.  
Protections for Patients and Staff.  The updated IHS policy provisions 
provide measures for ensuring confidentiality and protecting patients and 
staff involved in or affected by patient abuse allegations.  The provisions 
stated that providers must immediately be removed from duties involving 
patient care when there is a report of child sexual abuse.  An IHS official 
noted that in abuse cases, the number one priority is to protect patients 
and eliminate providers access to more victims.   
To remove access to patients, IHS officials explained that they would 
typically assign providers to administrative duties or place them on 
investigative leave, up to 90 days, while OIG investigates the allegation.  
To protect staff who report patient abuse, the updated policies included a 
non-retaliation clause that strictly prohibits any form of reprisal or 
coercion of those staff who report abuse.  According to the provisions, 
retaliation against staff could result in disciplinary action.  
Unlike the selected healthcare organizations, the IHS policies did not have 
guidelines for investigating allegations.  However, in interviews, IHS 
officials reported that they deferred all criminal investigations to OIG 
because IHS staff are not trained investigators and should not conduct 
IHS Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into Practice and Organizational Culture  11 
OEI-06-19-00330   
internal investigations that could potentially jeopardize OIGs criminal 
investigation.  Officials explained that if OIG decides to pursue criminal 
action, the CEO of the facility where the alleged abuse took place, with 
input from OIG and in collaboration with the Area Office, would work with 
human resources staff to determine what, if any, administrative actions to 
take.  If OIG determines that there is no criminal basis for an allegation, 
IHS could still take disciplinary action if the provider violated agency 
policies.   
Gaps remain in IHS policy coverage for different types of abuse 
and circumstances  
IHSs updated policies address sexual abuse of children perpetrated by 
healthcare providers employed by or under contract with IHS.  The agency 
defines a healthcare provider as anyone who provides physical or 
behavioral health treatment to patients (e.g., physicians, nurses, dentists, 
psychologists).  We found that the policies did not explicitly address 
abuse by other types of IHS staff or contractors.  In addition, the policies 
lacked provisions for other types of abuse, such as physical abuse that is 
not sexual in nature, and abuse against adult patients.   
Weve had a lot of focus on healthcare providers and not enough focus on 
nonclinical staff.  Area official 
An IHS official explained that the reason for focusing on clinical providers 
was that the unique and powerful relationship that exists between 
providers and patients was thought to pose a greater risk.  Leadership in 
one Area Office stated that focusing solely on providers addressed the 
immediate concern stemming from the Weber case, but did not address 
the vulnerability in protecting patients from abuse by other staff.  As 
evidenced by a recent allegation involving an IHS maintenance worker 
and an underage patient at a youth residential substance abuse treatment 
facility, the potential for exploitation or abuse of patients is not limited to 
healthcare providersany employee could be a potential perpetrator.  
Similarly, individuals other than children could be victims of abuse.  A 
recent allegation of repeated abuse of an adult patient at an IHS hospital 
illustrates the importance of expanding policies to cover more types of 
abuse and adult patients.  (See Exhibit 3 for further details regarding this 
case.)    
 
IHS Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into Practice and Organizational Culture  12 
OEI-06-19-00330   
Exhibit 3: A recent case of alleged patient abuse at an IHS hospital  
During a recent CMS survey at an IHS hospital, surveyors found that an 
adult patient had, on multiple occasions, reported to hospital staff 
allegations of physical and verbal abuse committed by a nurse, and that 
the hospital failed to take action to protect the patient and investigate the 
allegations in a timely manner.  Surveyors found that hospital staff did not 
file a grievance or report the allegations in WebCident, IHSs longstanding 
incident reporting system, and failed to adequately remove the nurse from 
the patients care.  Further, surveyors found that hospital officials had not 
trained staff on how to recognize, report, and investigate abuse.  CMS 
cited the hospital with deficiencies at the immediate jeopardy-level for 
failing to develop and implement policies and procedures to identify, 
report, investigate, and respond to allegations of patient abuse.  CMS 
removed the immediate jeopardy one day later after verifying that the 
hospital had implemented an acceptable plan of correction. 
 
Although the new IHS-wide policies are specific to sexual abuse of 
ch ildren by healthcare providers, some Area Offices and specific facilities 
may be applying them more broadly.  For example, several Area Offices 
said they follow the same reporting structure for all patient abuse 
allegations, including those involving adult patients and other types of 
staff (e.g., administrative, maintenance).  Leadership at one IHS facility 
described updating the facilitys policies to include all types of abuse of 
minors (mental, physical, and sexual abuse and neglect) committed by any 
paid or unpaid staff working in the facility.  In interviews, IHS HQ officials 
reported that they were in the process of assessing the agency-wide 
policies to possibly expand them to additional types of abuse, victims, and 
perpetrators.  
While some IHS facilities have updated their facility-specific 
processes to align with the agency-wide policies, other facilities 
are still in early stages of revising their local policies 
To ensure agency-wide adherence to the new policies, IHS required that 
facility CEOs establish local policies and procedures that incorporate the 
new policy content.  This included creating guidelines for mandatory 
reporting to the appropriate child protective and law enforcement 
authorities (including OIG), Area Director, Area governing board, and IHS 
Office of Human Resources; and posting information for staff, patients, 
and caregivers about the reporting requirements that include the IHS and 
OIG hotlines.  At the time of our review, Area Offices stated that 
healthcare facilities were at different stages of implementing the new 
policy provisions.  According to Area officials, some facilities had fully 
incorporated the new guidelines into their existing policies, and others 
had yet to begin that process.   
IHS Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into Practice and Organizational Culture  13 
OEI-06-19-00330   
In implementing the updated policies, some facilities revised their local 
policies to both ensure compliance with the new IHS-wide requirements 
and to specify how they would be carried out within the facilitys structure 
and systems and align with applicable State laws.  In some facilities, these 
revisions resulted in guidelines that included more detail and were more 
comprehensive than the agency-wide policies.   
For example, leadership at one facility described how they tailored the 
updated policies to fit the facilitys reporting structure and align with State 
laws.  As noted above, this included expanding the policy guidelines to 
include all types of abuse of minors committed by any staff working in the 
facility.  The facility also added provisions to the chaperone guidelines, 
requiring providers to document, in the visit notes, the name of the 
chaperone who accompanied the provider or whether the patient refused 
a chaperone.   
For those facilities that had yet to revise their local policies, IHS officials 
attributed the delay to staffing shortages and turnover of facility leadership.  
In August 2019, IHS had a 21 percent vacancy rate across the agency; 
many of these vacancies included clinical staff.  One official noted that 
some facilities struggled with the competing challenges of treating 
patients and finding time for training and education on new policies and 
procedures with the low staffing levels.  Leadership in one Area Office also 
reported challenges in institutionalizing new practices because of staffing 
instability and expressed concerns about sustainability of policy and 
procedural changes at the facility-level.   
When you have acting or revolving leadership, that seems to be  
the biggest challenge to the operation of any health system,  
let alone enacting policies.  HQ official 
Although IHS filled some of its vacancies with temporary contracted staff 
and leaders in acting capacity, in a 2019 OIG report that identified 
organizational challenges to improving quality of care in IHS hospitals, we 
found that temporary leaders sometimes struggled to institute policies 
because their newness to the position and temporary status made it 
difficult for them to understand the requirements and tasks at hand and 
enforce accountability.  We also found that IHS officials considered it 
routine to operate outside of stated policies and procedures.78  Our case 
study of the performance problems that led to the 7-month closure of the 
Rosebud Hospital emergency department, also issued in 2019, found that 
not long after IHS corrected the problems at the hospital, similar issues 
emerged when a new hospital leadership team arrived and did not follow 
policies and discontinued previously established improvement efforts.79  
IHS Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into Practice and Organizational Culture  14 
OEI-06-19-00330   
Area Offices reported that they monitored facility adoption of the new 
agency-wide policies through their governing boards, and some reported 
assisting facilities in updating local policies.  To ensure that facilities adopt 
and comply with the new policies, IHS requires Area Directors to review 
facility compliance on an annual basis.  In interviews, Area Directors 
explained that they provided this oversight through their governing 
boards, chaired by Area Directors and composed of Area and facility 
leadership and staff.  In one Area, where all facilities reportedly 
implemented the updated policy provisions, Area leadership described 
how they verified compliance by requiring facilities to demonstrate how 
the new guidelines were incorporated into their local policies and 
procedures.   
In addition to oversight, some Area Offices reported providing guidance 
and assistance to help facilities incorporate the new guidelines into their 
local policies.  For example, leadership in one Area Office reported that 
after receiving numerous inquiries about the new policies from facility 
staff who previously did not have mandatory reporting responsibilities, 
such as administrative staff, they developed guidance that detailed how to 
identify patient abuse warning signs and what to do if suspecting abuse.   
Another Area Office reported that it was developing an Area-wide patient 
abuse and neglect policy to ensure that all facilities have a uniform policy 
that aligns with the new guidelines.  The Area Director explained that this 
policy would replace individual facility policies and cover all patients, 
including adults, from abuse by anyone, including staff, students, 
volunteers, other patients, visitors, and family members.  By having a 
uniform policy across the facilities, the Area Director believed that the 
Area Office could more easily assess its effectiveness and make updates 
as needed.  The Area Director also noted that the Area Office had plans to 
share this policy with some of the tribally operated facilities in the Area 
who had expressed interest in adopting a similar policy. 
 
 
 
 
 
 
 
 
 
IHS Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into Practice and Organizational Culture  15 
OEI-06-19-00330   
IHS has trained staff  Shortly after issuing the new policies, IHS assembled a team of clinical 
subject matter experts and legal staff tasked with developing a 
on the updated 
comprehensive agency-wide training on the policy content and related 
policies directed at 
reporting requirements.  IHS launched the mandatory training in June 
child sexual abuse  2019.  To keep staff apprised of the revised policy provisions and training, 
IHS officials provided frequent updates and reminders through various 
but faces challenges 
means of communication, both directly and with the assistance of Area 
to integrating these 
Offices and facility CEOs.   
policies into practice 
Despite these efforts, IHS officials reported barriers, both within IHS and 
and organizational 
among the patients and Tribal communities that the agency serves, that 
culture  
may discourage staff and patients from reporting patient abuse.  Barriers 
for IHS staff include concerns about lack of anonymity in small facilities, 
 
fear of retaliation, lack of trust in appropriate response, traditional power 
discrepancies between physicians and other staff, and confusion about 
jurisdictional boundaries and reporting channels.  Barriers for patients and 
their families include perceptions of power imbalances between IHS 
providers and patients, limited means of reporting in remote areas, 
language and communication barriers, and sensitivities and stigmas 
surrounding sexual abuse. 
Efforts to promote an organizational culture of transparency and instill 
expectations for reporting and addressing problems are especially 
important given the circumstances of past and recent patient abuse cases, 
and OIGs prior findings about IHSs organizational challenges.  OIG 
previously found that the agencys organizational culture did not always 
encourage candid discussion of problems, and breakdowns in 
communication between IHS HQ, Area Offices, and facilities sometimes 
affected the agencys ability to effectively address problems.80, 81   
Given the urgency and sensitivity of the new policies, IHS 
required all staff to complete mandatory web-based training, 
which some Area Offices supplemented with in-person training 
The mandatory training, which all IHS employees and contractors had to 
complete by September 30, 2019, included information on indicators of 
abuse, warning signs and common perpetrator behaviors, organizational 
safeguards for ensuring patient safety, and reporting guidelines for 
suspected sexual abuse.  To illustrate what suspicious provider behavior 
may look like, the training included different case scenarios that outlined 
the appropriate actions staff should take in such situations.  IHS officials 
reported that they also included resources that staff could access if they 
struggled emotionally with the training content, given that the training 
could re-traumatize staff if they themselves had been victims of abuse.  
Officials stated that moving forward, the new training will be part of the 
agencys new employee orientation and annual training requirements.     
IHS Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into Practice and Organizational Culture  16 
OEI-06-19-00330   
At the time of our review, not all staff had completed the mandatory 
training, but Area Offices reported tracking facility completion to ensure 
that all staff met the September deadline.  IHS officials noted that some 
facilities experienced challenges taking the web-based training because of 
staffing shortages and technical problems, such as not having enough 
bandwidth to effectively stream the training.  One Area Director stated 
that bandwidth and cell phone coverage issues in remote facilities are 
critical challenges and limits the way information can be communicated 
across the agency.   
Some Area Offices reported providing additional training at the facilities to 
clarify expectations and assess understanding of the new policy provisions.  
Leadership in one Area Office noted that the mandatory training was 
important to reach all employees, but training was most effective in 
person as it allowed Area leadership to gauge facility execution and 
understanding of the updated policies.  Another Area Office explained 
that in-person training provided an opportunity for Area leadership to talk 
through potential abuse scenarios with facility staff and clarify roles and 
responsibilities.   
To drive a point, you need to provide opportunities for feedback, questions, 
problems, understanding...more human to human contact  Area official 
In some cases, Area Offices collaborated with other entities to provide the 
in-person training.  For example, one Area Office reported working with 
Tribal CPS to educate facility staff on mandatory reporting requirements 
and was in the process of launching additional policy training led by 
regional human resources staff.  Leadership in another Area Office 
reported coordinating training with OIG investigators to educate clinical 
staff on how to report suspected abuse and what information to include 
in the report, a training effort that the Area Office hoped to continue on 
an annual basis.    
Despite IHS efforts to communicate policy requirements and 
create an organizational culture of transparency, barriers may 
discourage staff and patients from reporting abuse 
To ensure that information on the new policies and training requirements 
reached everyone in the agency, IHS officials reported using multiple 
prongs, such as emails, meetings, videos, newsletters, and social media, to 
communicate with staff and leadership across the organization.  As one 
official stated, the emphasis on the reporting requirements was infused in 
all communication from IHS HQ.  Officials in one Area Office noted that 
IHSs efforts to prevent and address patient abuse significantly enhanced 
the agencys dissemination of information and increased communication 
IHS Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into Practice and Organizational Culture  17 
OEI-06-19-00330   
from IHS leadership, which was a positive change for the agency.  From 
interviews, we also found that Area Offices and facility leadership played a 
large role in disseminating information across the agency through their 
chain of command and regular meetings with facility leadership and staff.    
To keep Tribal communities informed of the updated policies, IHS officials 
reported communicating the new policy provisions with Tribal leaders 
during their monthly calls, in letters, and at national meetings.  At the time 
of our review, IHS had held its annual National Combined Councils 
meeting, which providers of varying disciplines from IHS and Tribes 
attended to discuss the agencys clinical and administrative healthcare 
needs.  An IHS official stated that the agency used this opportunity to 
again address the updated policies and remind the attendees of the 
mandatory reporting requirements.   
According to an IHS official, the agency received several reports of patient 
abuse allegations following the issuance of the new policies and the 
agency-wide communication regarding the reporting requirements.  IHS 
cited legal protections at 25 U.S.C.  1675 as preventing public disclosure 
of how many reports it received, but one official stated that the agency 
should expect to see more reporting as it continues to develop a culture 
of transparency where employees feel safe to report issues.   
Adding to the inherent time and effort needed to change the culture in 
any organization, IHS officials identified the following specific barriers to 
IHS staff and patients reporting abuse, which the agency must overcome 
to ensure that all patient abuse allegations are identified and addressed in 
a timely and effective manner.   
Difficulty ensuring anonymity of reporters in small, remote facilities and 
fear of retaliation may discourage staff from forwarding abuse allegations.  
Although the updated policies and mandatory training emphasize 
confidentiality and clearly state that reprisals are prohibited, officials 
stated that it can be challenging to ensure anonymity of staff who report 
patient abuse, particularly in small facilities in isolated communities where 
everyone knows everyone.  Because many staff are part of the 
communities they serve, they may be reluctant to report suspicious 
behaviors.  Leadership in one Area Office further explained that staff may 
be discouraged from reporting if they are unsure about the consequences 
of the report for themselves and the suspect, especially if their suspicions 
are unsubstantiated, or if they lack trust in their supervisor to properly 
address their concerns.   
IHS Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into Practice and Organizational Culture  18 
OEI-06-19-00330   
Truly feeling safe in reporting wrongdoing is probably the biggest barrier 
to overcome in peoples minds.  I cant say that retaliation is a problem, but 
the feelings about it is.  HQ official 
Traditional power discrepancies within the medical profession could make 
staff more hesitant to report suspected abuse.  Leadership in one Area 
Office stated that there is a traditional power discrepancy in healthcare 
settings between doctors and other clinicians (e.g., nurses) who assist 
them, where the other clinicians may not feel empowered to question a 
doctor or report suspicious behavior because of the doctors perceived 
higher placement in the hierarchy.  Such a barrier is crucial to address 
because as leadership in another Area Office stated, nursing staff are the 
ones that really know the [doctors], the ins and outs, and how theyre 
interacting with the patients.  For similar reasons, one Area Director 
reported that in-person training at the facilities was important because it 
provided an opportunity to discuss the power dynamics and ensure that 
staff understood the trust relationship between providers and patients. 
Confusion in some facilities about jurisdictional boundaries may also delay 
reports from getting to the appropriate authorities.  An IHS official reported 
that variation in law enforcement jurisdictions across facilities may cause 
confusion for facility staff in identifying which law enforcement entity to 
contact for criminal matters, such as patient abuse.  The official explained 
that in some locations, the Department of Interior or FBI may have 
jurisdiction, while in other areas, Tribal law enforcement agencies may 
have that authority.  According to another official, confusion about 
jurisdictional boundaries recently caused reporting delays for an 
allegation involving employee-on-employee abuse.   
Although IHS has emphasized in its agency-wide communication that 
staff must report all incidents to OIG, the facility staff contacted other law 
enforcement agencies, who after several weeks advised the facility to 
contact OIG, after determining that they were unable to investigate the 
incident.  This caused a significant delay in OIGs investigation of the 
incident.  To address this issue, the Area Office sent a memo to all 
facilities in the Area, clarifying the reporting structure and the importance 
of immediately notifying OIG of any incidents.  To avoid similar scenarios, 
one official suggested that IHS should conduct outreach to the various 
law enforcement agencies and discuss expectations and jurisdictions and 
clarify IHSs role and responsibilities.  
IHS Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into Practice and Organizational Culture  19 
OEI-06-19-00330   
Perceived power imbalances between providers and patients, limited ways 
to report abuse, stigma, and language barriers may deter patients from 
reporting.  Like some staff, some patients and their families may also be 
reluctant to report abuse involving providers in IHS facilities because they 
may not feel empowered to question an authority, such as a doctor, which 
one official stated makes patients who have this perception particularly 
vulnerable.  Another official noted that some patients may not feel 
comfortable to raise concerns with facility staff in person and may lack 
phone and internet services to report abuse anonymously from the 
privacy of their home.  The official stated that much of IHSs focus has 
been on staff reporting, but more should be done to ensure that patients 
and their families have multiple avenues for reporting abuse by IHS 
employees or contractors.  IHS officials also reported that patients, and 
sometimes staff, may not recognize abuse and therefore may not know 
whether a providers behavior was appropriate or if a medical exam was 
even needed.   
Im always worried that there might be something else taking place that 
someone might be in fear of reporting.  HQ official 
Furthermore, Area Offices noted that sensitivities and stigmas 
surrounding sexual abuse persist for some patients and in some Tribal 
communities, which could discourage reporting and exacerbate language 
and communication barriers.  Leadership in one Area Office reported how 
the sensitive nature of sexual abuse was notably difficult when the Area 
Office tried to create signage on the new policy for healthcare facilities to 
post inside their buildings.  Another Area Office described how language 
barriers sometimes created difficulties for Area and facility staff to 
communicate about patient abuse with certain Tribes whose native 
languages do not have words that correspond to the English language 
words.  Such language barriers could be particularly challenging when 
communicating about something as important and sensitive as sexual 
abuse.  To overcome language barriers and stigma, the Area Office 
reported working closely with Tribes in the Area to communicate 
information in their native languages and conducting outreach to school-
based programs in Tribal communities to educate children about abuse 
and how to report such incidents.   
 
 
 
 
 
 
IHS Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into Practice and Organizational Culture  20 
OEI-06-19-00330   
IHS systems for  In the past few years, IHS began focusing more intensely on improving 
overall patient safety and oversight of its healthcare facilities, partially 
storing and tracking 
driven by the indictment of Dr. Weber.  Part of the agencys efforts 
patient abuse have 
included awarding a contract to build a new incident reporting system to 
shortcomings, and  better track patient safety errors, adverse events, and abuse; establishing 
a new Office of Quality, responsible for the agencys quality- and safety-
the agency has 
related work; and forming a new Quality Assurance Risk Management 
initiated efforts to 
Committee, tasked with examining high-risk administrative and clinical 
strengthen systems 
incidents, including patient abuse.  While these efforts are promising to 
and oversight  improve the agencys ability to track patient abuse reports and address 
and prevent such incidents, some efforts had not been fully integrated or 
 
were under development at the time of our review.  In the meantime, IHS 
is using reporting and tracking systems that have significant 
shortcomings. 
Shortcomings in IHS's systems for storing and tracking patient 
abuse create inefficiencies and raise risks of ineffective or 
inappropriate handling of abuse allegations 
The new policies on patient abuse require staff to report any incident or 
suspected sexual abuse of a child by a healthcare provider to the OIG and 
IHS hotlines and document the report in WebCident.  The IHS hotline and 
WebCident operate independent of each other, and both require manual 
tracking and management of report data.  The IHS Office of Human 
Resources operates the IHS hotline and receives reports by phone or 
through its website, and sometimes directly from OIG.  The IHS Office of 
Quality operates WebCident and receives reports from IHS staff as well as 
patients and families.  When the hotline receives an allegation, staff are to 
report the allegation immediately to OIG, notify IHS leadership through 
the Quality Assurance Risk Management Committee, and enter the 
information into WebCident.   
From interviews, we identified shortcomings in this process that create 
inefficiencies and pose risks for the handling of patient abuse allegations: 
  Reporting functions have no central owner or dedicated resources.  
Some officials expressed confusion having multiple systems and 
individuals in different offices tracking patient abuse cases.  As one 
official stated, it was unclear who was the central owner of all 
information and who should know what about the reports.  Another 
official noted that the agencys new efforts were taxing on some 
officials and staff who now had to fill several roles because of the lack 
of designated positions and dedicated resources to perform such 
functions.  In the 2019 OIG report that examined IHSs organizational 
structure, we found similar concerns about IHS officials and staff 
lacking clear roles and responsibilities.  The lack of structure 
sometimes led to inefficiency and poor coordination.82  Unclear 
IHS Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into Practice and Organizational Culture  21 
OEI-06-19-00330   
ownership of patient abuse reports could result in overlooked reports 
and duplicative or inefficient efforts.   
  Systems were not designed for patient abuse allegations.  According to 
IHS officials, the agency lacks a single, centralized system to capture 
all patient abuse reports, including those made to outside entities 
(e.g., law enforcement agencies), and does not have a reliable way to 
count abuse reports or compare such numbers over time.  Neither the 
IHS hotline nor WebCident were designed to capture patient abuse 
reports.  One official noted that the hotline was initially intended for 
waste, fraud, and management abuse but over time it evolved to 
include other types of abuse, including patient abuse.  The official 
expressed concerns about this evolvement because staff tasked with 
operating the hotline are not trained healthcare professionals.  
WebCident stores patient abuse reports and other types of incidents 
that any IHS employee can upload.  According to IHS officials, the 
system is obsolete and was initially created for work-related events 
(e.g., employee injuries), but eventually evolved to include patient-
related incidents.  Not having systems specifically designed to capture 
patient abuse allegations could result in IHS inadvertently missing 
reports.  
  IHS lacks capability to systematically track, categorize, and query data.  
To ensure that the agency addressed all patient abuse allegations 
from the IHS hotline and WebCident, IHS officials reported assigning 
staff to monitor the systems and manually forward any reports of 
patient abuse to the newly formed Quality Assurance Risk 
Management Committee for review.  IHS officials explained that the 
WebCident system is no longer supported and lacks the capability to 
categorize reports, query data, and send automatic notifications when 
a report is entered into the system.  IHS dependence on manual 
monitoring of the systems and data extraction could lead to 
inefficiencies and error in data management.  Given that all patient 
abuse reports are intended to be entered into WebCident, the lack of 
functionality of the system likely inhibits IHS staff responsible from 
identifying incidents efficiently and effectively.   
  Systems and data may not be secure.  To track patient abuse reports 
received through the IHS hotline, staff described manually entering 
information into a spreadsheet, which one official noted was not ideal 
given that spreadsheets are like notebook paper that can be easily 
erased or modified.  Staff also reported using a separate spreadsheet 
for reports forwarded from the OIG hotline.  The lack of an 
established, secure database to track sensitive information, such as 
patient abuse and unsubstantiated allegations, could result in risks of 
inappropriate access, misuse of information, inadvertent or intentional 
overwriting or deleting of information.   
IHS Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into Practice and Organizational Culture  22 
OEI-06-19-00330   
At the time of our review, IHS was working with a contractor to develop a 
new and improved incident reporting system, estimated to be completed 
in late 2019 and rolled out in early 2020.  Until IHSs launch of the new 
system, officials stated that the agency would continue to use WebCident 
and had assigned staff to conduct surveillance of the data, to ensure that 
no patient abuse reports in WebCident were missed.  Due to WebCidents 
inability to query and systematically pull data, one official explained that 
staff manually conducted surveillance by using key word searches related 
to sexual abuse and assault.  Some Area Offices also reported conducting 
daily surveillance of WebCident to ensure timely and proper response to 
any incidents at their facilities.   
The new incident reporting system, specifically designed for 
patient safety and healthcare, is intended to provide IHS with 
real-time surveillance and added functionality  
Through the new incident reporting system, which will reside in the Office 
of Quality, IHS expects to be able to track any patient-related incidents, 
including patient safety errors, adverse events, and abuse.  Although the 
new incident reporting system is an improvement from WebCident, we 
found it unusual to include patient abuse incidents in the same system as 
clinical care types of events (e.g., medication errors, surgery infections).  In 
a prior OIG report about hospital incident reporting systems nationwide, 
OIG found that all of the systems in sampled hospitals were designed to 
capture problems with clinical care.  None of the hospital incident reports 
reviewed for that study included patient abuse reports.83       
In interviews, IHS officials described plans for the new incident reporting 
system to have specific fields for patient abuse with multiple drop-down 
menus and open text options to capture as many details as possible 
regarding an event.  Unlike WebCident, IHS would be able to query 
reports and aggregate data from the new system, which would help the 
agency to identify potential patterns and vulnerabilities.  All employees 
would be able to record incidents in the new system, but to maintain 
confidentiality, only certain staff and officials will have access to view 
report details.   
While Area Offices would be able to view reports involving their individual 
facilities, leadership in IHS HQ will have access to all facility reports.  
Officials noted that the new incident reporting system would also have an 
automatic notification function for when incidents are recorded.  For 
sexual abuse reporting, IHS plans to design a specific workflow, in which 
the system would email a select group of officials and staff and alert them 
of any new reports uploaded in the system, to ensure immediate response 
to such incidents. 
IHS Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into Practice and Organizational Culture  23 
OEI-06-19-00330   
IHS formed the Quality Assurance Risk Management Committee 
to enhance leadership oversight and management of patient 
abuse reports   
In early 2019, IHS established a new committee, comprised of senior-level 
officials in IHS HQ, tasked with reviewing high-risk issues facing the 
agency, such as patient abuse allegations and significant fraud, waste, and 
abuse.  An IHS official stated that the agency was working on finalizing 
the charter for the committee and explained that the intent for this new 
level of oversight was to ensure agency accountability, enhance 
effectiveness of reporting systems and processes, and expedite corrective 
actions.   
At the time of our review, the committee convened several times per 
month to discuss new reports and ongoing efforts to resolve previously 
identified issues.  During these meetings, the committee would look at 
agency policies and procedures to determine whether there were any 
gaps that IHS needed to address.  To prepare for the meetings, one 
official reported compiling reports and relevant information from all 
available sources, including the IHS hotline, WebCident, and OIG, using a 
spreadsheet to track all high-risk incidents.  IHS also shared this tracking 
spreadsheet with OIG investigators to ensure that they were informed of 
any incidents. 
 
   
IHS Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into Practice and Organizational Culture  24 
OEI-06-19-00330   
CONCLUSION AND RECOMMENDATIONS 
Since the indictment of Dr. Weber in 2017, IHS has made important 
strides to address and prevent child sexual abuse in its healthcare 
facilities, strengthening its policies on patient protections and staff 
reporting responsibilities.  IHS issued new policies specific to preventing 
and addressing child sexual abuse that, together with its other policies, 
address the types of protections set forth by nationally recognized 
professional organizations.  However, the IHS policies have gaps in the 
types of abuse and circumstances that they cover.    
IHS is also taking important steps toward integrating these policies into 
practice and organizational culture throughout IHS.  For example, IHS 
provided mandatory training on the updated policy provisions to all staff 
and contractors employed by the agency.  Some Area Offices and facilities 
have also updated their local policies and provided additional training to 
their staff.  IHS is also bolstering its oversight of patient abuse reports and 
response through its newly established Quality Assurance Risk 
Management Committee. 
However, IHSs successful implementation of these policies faces some 
significant challenges within and outside the organization.  Staffing 
shortages and frequent changes in leadership for some facilities may 
inhibit agency-wide implementation and sustainability of the new policies 
and systems.  The agency also faces challenges that may discourage staff 
and patients from reporting patient abuse, including difficulty ensuring 
anonymity, fear of retaliation, perceived or real power imbalances, and 
communication barriers, among others.  In addition, IHS's current systems 
for storing and tracking patient abuse allegations fall short in ways that 
create inefficiencies and raise risks of ineffective or inappropriate handling 
of abuse allegations.  To overcome these challenges, IHS must work with 
urgency to resolve barriers and ensure full incorporation of policies and 
systems into agency-wide practice and culture.   
To address the issues identified in this report and further protect IHS 
patients from abuse, we make five new recommendations to IHS: 
Extend policies to address more types of perpetrators, victims, 
and abuse  
While it is understandable that IHS prioritized protections against sexual 
abuse of children by healthcare providers in updating its policies, it is 
crucial that IHS does not stop there.  Given that abuse can take many 
forms, as evident in past and recent cases, IHS should further update its 
policies to explicitly address abuse by nonmedical staff and contractors, 
various types of abuse, and abuse of adults.  Such policies could better 
IHS Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into Practice and Organizational Culture  25 
OEI-06-19-00330   
ensure reporting of and appropriate response to any type of abuse, 
consistent with the agencys zero-tolerance approach regarding abuse.   
Ensure that the new incident reporting system is effective and 
addresses the risks identified in the current system 
IHS has invested in improving its incident reporting system, but the 
system is still under development and has yet to be launched.  Once the 
new system is implemented, IHS should assess how well it is working and 
whether it achieves its intended improvements to capture all allegations 
of patient abuse, including its capabilities to automatically notify 
appropriate leadership and staff of new abuse reports and query and 
aggregate data to identify potential patterns and vulnerabilities.  Based on 
these assessments, IHS should update and make any necessary changes 
to the system, as needed.   
To fully integrate the new incident reporting system across the agency, 
IHS should develop policies that provide guidance on how to operate the 
system, specifying relevant roles and responsibilities of staff and 
leadership across IHS.  To ensure that staff at all levels of the agency are 
versed in the new system when launched, IHS should also provide 
agency-wide training on its use. 
Designate a central owner in IHS HQ to ensure clear roles and 
responsibilities for shared ownership in implementing patient 
protection policies, and managing and responding to abuse 
reports  
IHS has enhanced its oversight of patient abuse reports by manually 
conducting surveillance of the IHS hotline and WebCident and forming 
the senior-level Quality Assurance Risk Management Committee to review 
allegations of abuse.  However, having multiple systems and staff in 
different offices tracking patient abuse cases on separate spreadsheets 
was sometimes confusing and burdensome on staff because there were 
no designated positions to carry out those tasks and it was unclear who 
was the central owner of all information.   
To avoid confusion and overlap in tracking and managing patient abuse 
reports, IHS should designate a central owner in HQ to ensure clear roles 
and responsibilities for shared ownership in implementing patient 
protection policies, and managing and responding to abuse reports.  This 
would improve coordination between the different offices and individuals 
involved and enhance oversight of agency-wide policy implementation.  
This could include adding provisions to new or existing policies that 
clearly define roles and actions to take when tracking and responding to 
allegations after abuse reports have been made. 
IHS Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into Practice and Organizational Culture  26 
OEI-06-19-00330   
Continue to actively promote an organizational culture of 
transparency and work to resolve barriers to staff reporting of 
abuse 
Through increased communication and emphasis on reporting 
responsibilities for patient abuse, IHS leadership has begun efforts to 
instill a culture of transparency across the agency.  This is a positive shift 
from the past, but culture change in any organization takes time and will 
need continued support to overcome deep-rooted challenges.  OIG 
previously found that IHSs structure and organizational culture did not 
always provide IHS HQ with awareness and insight about problems that 
emerged at Area Offices and facilities and did not encourage candid 
discussion of problems, which sometimes inhibited the agency from 
making needed improvements.  To address organizational challeges 
previously raised by OIG and in this report, IHS should examine its 
organizational culture and continue to promote a culture of openness and 
transparency that encourages staff to elevate concerns.   
IHS should also develop and implement strategies to address barriers to 
staff reporting of abuse identified in this report, including issues of 
anonymity of reporters, fear of retaliation, power dynamics in facilities, 
and confusion about jurisdictional boundaries of law enforcement entities.  
IHS should also conduct outreach to the various law enforcement 
agencies with jurisdictions that cover IHS healthcare facilities and clarify 
IHSs role and responsibilities related to patient abuse, to ensure that 
abuse allegations receive immediate attention and are forwarded to the 
appropriate agencies (including IHS and OIG) in a timely manner. 
Conduct additional outreach to Tribal communities to inform 
them of patient rights, solicit community concerns, and address 
barriers to reporting of patient abuse 
IHS has communicated the new policies and related reporting 
requirements to Tribal communities, but IHS should do more to address 
barriers that may deter patients and their families from reporting abuse.  
To prevent any future patient abuse incidents to go unreported, IHS 
should conduct additional outreach to Tribes and other stakeholders and 
solicit community concerns to address stigma surrounding abuse, 
language barriers, and perceptions of power imbalance between 
providers and patients.  IHS could collaborate with Tribal health 
organizations, CPS, schools, and other entities to educate Tribes on abuse 
and inform them of their rights.  IHS should also assess whether there are 
sufficient means for patients to report abuse and consider whether to 
expand on such reporting avenues. 
 
 
IHS Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into Practice and Organizational Culture  27 
OEI-06-19-00330   
This evaluation also provides additional support and urgency to a prior 
OIG recommendation that IHS has not yet implemented.   
 
Existing OIG recommendation that addresses these findings: 
 
As a management priority, IHS should develop and implement a 
staffing program for recruiting, retaining, and transitioning staff 
and leadership to remote hospitals   
In July 2019, OIG recommended in our case study of the closure and 
reopening of the Rosebud Hospital emergency department that IHS, as a 
management priority, develop and implement a staffing program for 
recruiting, retaining, and transitioning staff and leadership to remote 
hospitals.  As noted by several officials in this report, IHS continues to 
struggle with maintaining an adequate workforce and consistent 
leadership in some facilities, which can affect all aspects of hospital 
operations, including policy implementation, adherence to policy 
requirements, and sustainability of improvements.  It is important that IHS 
implement this recommendation, as well as the recommendations listed 
above, to ensure timely and effective response to patient abuse reports 
and to enhance strategies to prevent such incidents.     
   
IHS Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into Practice and Organizational Culture  28 
OEI-06-19-00330   
AGENCY COMMENTS AND OIG RESPONSE 
IHS concurred with our recommendations, and reported actions taken and 
planned to implement the recommendations, as of December 2019.  
In response to our first recommendation to extend policies to address 
more types of perpetrators, victims, and abuse, IHS reported that it is 
expanding IHM policies to include more types of potential perpetrators.  
IHS expects to issue these policy revisions in May 2020. 
In response to our second recommendation to ensure that the new 
incident reporting system is effective and addresses the risks identified in 
the current system, IHS reported that it is testing the new system and has 
convened an implementation workgroup.  IHS outlined a number of goals 
for the system, including strengthening management of incidents and 
ease of use.  IHS also noted that it is developing performance metrics for 
the new system that will assist the agency with monitoring and system 
oversight.  IHS reported that it expects to begin agency-wide training and 
deployment of the new incident reporting system in January 2020. 
In response to our third recommendation to designate a central owner in 
IHS HQ to ensure clear roles and responsibilities for shared ownership in 
implementing patient protection policies, and managing and responding 
to abuse reports, IHS stated that its newly established Office of Quality is 
tasked to oversee patient safety activities and quality assurance, and 
provide shared leadership with the IHS Office of Clinical and Preventive 
Services in implementing patient protection policies.  IHS also stated that 
it finalized a charter, in November 2019, for the Quality Assurance Risk 
Management Committee to provide senior-level oversight and 
management of high-risk clinical and administrative issues.   
In response to our fourth recommendation to continue to actively 
promote an organizational culture of transparency and work to resolve 
barriers to staff reporting of abuse, IHS reported that it has provided 
training to promote and sustain a culture shift that supports staff who 
identify and appropriately report errors in IHS care.  IHS also stated that 
the agency has provided training for all staff, including contractors, on the 
new policy guidelines for protecting children from sexual abuse by 
healthcare providers, and is developing guidance that will require all new 
employees to complete the training within 60 days of hire and on an 
annual basis for existing employees.  The IHS Office of Human Resources 
is also developing an onboarding checklist for managers and new 
employees to ensure compliance with annual training requirements.  IHS 
expects to complete the training guidance and onboarding checklist in 
January 2020. 
IHS Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into Practice and Organizational Culture  29 
OEI-06-19-00330   
In response to our fifth recommendation to conduct additional outreach 
to Tribal communities to inform them of patient rights, solicit community 
concerns, and address barriers to reporting of patient abuse, IHS reported 
that it will include information about reporting sexual abuse as a point of 
emphasis in all IHS leadership updates to Tribes.  IHS also stated that it 
will launch a national information campaign in 2020 to educate Tribal 
communities on preventing and reporting sexual abuse of children.  IHS 
will develop a website dedicated to this topic, as well as brochures and 
signage for facilities to use, that will include information about available 
resources and guidance on how to report allegations of sexual abuse.  IHS 
also stated that it will solicit community concerns through various forums, 
including information sessions and town hall meetings, and will issue 
letters to Tribal and Urban Indian leaders in 2020 to provide updates on 
IHS activities, including the national information campaign. 
In addition, IHS reported that it is on track to complete actions reported 
in the agencys response to OIGs prior recommendation to develop and 
implement a staffing program for recruiting, retaining, and transitioning 
staff and leadership to remote hospitals.  IHS reported that these actions 
include assembling a multidisciplinary, senior-level workgroup to develop 
a comprehensive workforce plan.  The workforce plan, due for completion 
in mid-2020, will address recruitment, training, and placement of staff into 
leadership positions, particularly in remote locations, and succession 
planning. 
OIG values the steps that IHS has taken, and will continue to assess 
progress updates from IHS in implementing these recommendations.  
 
   
IHS Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into Practice and Organizational Culture  30 
OEI-06-19-00330   
APPENDIX: Agency Comments 
 
IHS Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into Practice and Organizational Culture  31 
OEI-06-19-00330   
 
 
 
 
 
IHS Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into Practice and Organizational Culture  32 
OEI-06-19-00330   
 
 
IHS Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into Practice and Organizational Culture  33 
OEI-06-19-00330   
 
 
 
IHS Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into Practice and Organizational Culture  34 
OEI-06-19-00330   
 
    
IHS Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into Practice and Organizational Culture  35 
OEI-06-19-00330   
ACKNOWLEDGMENTS 
Petra Nealy served as the team leader for this study, and Kristen Calille 
and John Van Der Schans served as the lead analysts.  Others in the Office 
of Evaluation and Inspections who conducted the study include Demetri 
Martinez and Savanna Thielbar.  Office of Evaluation and Inspections staff 
who provided support include Joe Chiarenzelli and Kevin Farber. 
This report was prepared under the direction of Ruth Ann Dorrill, Regional 
Inspector General for Evaluation and Inspections in the Dallas regional 
office, and Petra Nealy, Deputy Regional Inspector General.  
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
To obtain additional information concerning this report or to obtain 
copies, contact the Office of Public Affairs at Public.Affairs@oig.hhs.gov.  
IHS Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into Practice and Organizational Culture  36 
OEI-06-19-00330   
ABOUT THE OFFICE OF INSPECTOR GENERAL 
The mission of the Office of Inspector General (OIG), as mandated by 
Public Law 95-452, as amended, is to protect the integrity of the 
Department of Health and Human Services (HHS) programs, as well as the 
health and welfare of beneficiaries served by those programs.  This 
statutory mission is carried out through a nationwide network of audits, 
investigations, and inspections conducted by the operating components: 
Office of Audit  The Office of Audit Services (OAS) provides auditing services for HHS, 
either by conducting audits with its own audit resources or by overseeing 
Services 
audit work done by others.  Audits examine the performance of HHS 
programs and/or its grantees and contractors in carrying out their 
respective responsibilities and are intended to provide independent 
assessments of HHS programs and operations.  These assessments help 
reduce waste, abuse, and mismanagement and promote economy and 
efficiency throughout HHS. 
Office of Evaluation  The Office of Evaluation and Inspections (OEI) conducts national 
evaluations to provide HHS, Congress, and the public with timely, useful, 
and Inspections 
and reliable information on significant issues.  These evaluations focus on 
preventing fraud, waste, or abuse and promoting economy, efficiency, and 
effectiveness of departmental programs.  To promote impact, OEI reports 
also present practical recommendations for improving program 
operations.   
Office of  The Office of Investigations (OI) conducts criminal, civil, and 
administrative investigations of fraud and misconduct related to HHS 
Investigations 
programs, operations, and beneficiaries.  With investigators working in all 
50 States and the District of Columbia, OI utilizes its resources by actively 
coordinating with the Department of Justice and other Federal, State, and 
local law enforcement authorities.  The investigative efforts of OI often 
lead to criminal convictions, administrative sanctions, and/or civil 
monetary penalties. 
Office of Counsel to  The Office of Counsel to the Inspector General (OCIG) provides general 
legal services to OIG, rendering advice and opinions on HHS programs 
the Inspector General 
and operations and providing all legal support for OIGs internal 
operations.  OCIG represents OIG in all civil and administrative fraud and 
abuse cases involving HHS programs, including False Claims Act, program 
exclusion, and civil monetary penalty cases.  In connection with these 
cases, OCIG also negotiates and monitors corporate integrity agreements.  
OCIG renders advisory opinions, issues compliance program guidance, 
publishes fraud alerts, and provides other guidance to the healthcare 
industry concerning the anti-kickback statute and other OIG enforcement 
authorities. 
IHS Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into Practice and Organizational Culture  37 
OEI-06-19-00330   
ENDNOTES 
1 IHS, Justification of Estimates for Appropriations Committees, Fiscal Year 2020, p. CJ-2, 7.  Accessed at 
https://www.ihs.gov/sites/budgetformulation/themes/responsive2017/display_objects/documents/FY2020CongressionalJustific
ation.pdf on August 21, 2019.  
2 Ibid. 
3 IHS, Agency Overview.  Accessed at https://www.ihs.gov/aboutihs/overview/ on May 29, 2019. 
4 Christopher Weaver and Dan Frosch, A Pedophile Doctor Drew Suspicions for 21 Years. No One Stopped Him, PBS Frontline 
in partnership with The Wall Street Journal, February 9, 2019.  Accessed at https://www.pbs.org/wgbh/frontline/article/patrick-
stanley-weber-sexual-abuse-pine-ridge-blackfeet-reservation/ on September 19, 2019.  
5 Christopher Weaver, Former U.S. Indian Health Service Doctor Is Found Guilty of Abusing Boys, The Wall Street Journal, 
September 27, 2019.  Accessed at https://www.wsj.com/articles/former-u-s-indian-health-service-doctor-is-found-guilty-of-
abusing-boys-11569624911 on October 1, 2019. 
6 Testimony of Rear Admiral Michael Weahkee, Principal Deputy Director for IHS, before the House Committee on 
Appropriations, Subcommittee on Interior, Environment, and Related Agencies, April 9, 2019.  Accessed at 
https://appropriations.house.gov/events/hearings/indian-health-service-budget-request-for-fy2020 on May 3, 2019. 
7 Testimony of RADM Michael Weahkee, Principal Deputy Director for IHS, before Senate Committee on Appropriations, 
Subcommittee on Interior, Environment, and Related Agencies, May 1, 2019.  Accessed at 
https://www.appropriations.senate.gov/hearings/review-of-the-fy2020-budget-request-for-the-indian-health-service on 
September 12, 2019. 
8 IHS, Fact Sheet: Credentialing Software and Policy Update, October 2017.  Accessed at 
https://www.ihs.gov/newsroom/factsheets/credentialing/ on August 28, 2019.   
9 Jackie Gilbert, HHS Indian Health Service awards 5-year contract for Adverse Event Reporting System, FedHealthIT, 
December 13, 2018.  Accessed at https://www.fedhealthit.com/2018/12/hhs-indian-health-service-awards-5-year-contract-for-
adverse-event-reporting-system/ on May 13, 2019. 
10 IHS, Strategic Plan FY 20192023, p. 1, February 27, 2019.  Accessed at 
https://www.ihs.gov/sites/strategicplan/themes/responsive2017/display_objects/documents/IHS_Strategic_Plan_FY%202019-
2023.pdf on August 21, 2019. 
11 IHS, IHM, pt. 1; Ch. 1; section 1-1.2 (Indian Health Manual). 
12 Pursuant to the Indian Self-Determination and Education Assistance Act, P.L. No. 93-638 (enacted January 4, 1975), IHS 
contracts or compacts (or both) with Tribes or Tribal organizations to deliver services.  IHS, Fact Sheets: A Quick Look.  Accessed 
at https://www.ihs.gov/sites/newsroom/themes/responsive2017/display_objects/documents/factsheets/QuickLook.pdf on 
August 21, 2019.   
13 IHS, Justification of Estimates for Appropriations Committees, op. cit., p. CJ-5657.   
14 In 2019, the number of IHS-operated hospitals decreased from 25 to 24 hospitals after IHS converted Rapid City Hospital to 
a health center.  OIG email correspondence with IHS official on July 1, 2019.  
15 IHS, Circular No. 9701.  Accessed at https://www.ihs.gov/ihm/circulars/1997/accreditation-certification-of-hospitals-and-
health-centers/ on November 13, 2019.   
16 Social Security Act  1880(a) and 1865(a)(1). 
17 42 CFR  482.1, 482.12, 482.13, and 482.22. 
18 CMS, State Operations Manual (SOM), Ch. 1  1018A. 
19 CMS, SOM, Appendix QGuidelines for Determining Immediate Jeopardy. 
20 Christopher Weaver and Dan Frosch, A Pedophile Doctor Drew Suspicions for 21 Years. No One Stopped Him, loc. cit. 
 
IHS Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into Practice and Organizational Culture  38 
OEI-06-19-00330   
 
21 Traci Rosenbaum, Verdict: Browning pediatrician guilty of sexually assaulting boys over 20 years ago, Great Falls Tribune, 
September 6, 2018.  Accessed at https://www.greatfallstribune.com/story/news/2018/09/06/browning-montana-blackfeet-
reservation-sexual-assault-crime-verdict-molestation/1216866002/ on October 24, 2019. 
22 Christopher Weaver, Former U.S. Indian Health Service Doctor Is Found Guilty of Abusing Boys, loc. cit. 
23 Christopher Weaver and Dan Frosch, A Pedophile Doctor Drew Suspicions for 21 Years. No One Stopped Him, loc. cit. 
24 Carson Walker, IHS Doctor Accused of Sexual Contact with Patient, Rapid City Journal, September. 19, 2005.  Accessed at 
https://rapidcityjournal.com/news/state-and-regional/ihs-doctor-accused-of-sexual-contact-with-patient/article_8695af2a-
0217-52d4-ab43-9f990c97ca4e.html on June 17, 2019; Judgment of Dismissal, Star Comes Out v. Ahsan, Civ. No. 05-5075-KES 
(D. S.D. June 17, 2008), ECF No. 117.   
25 Joe Flood, Long-Time Pine Ridge Reservation Pediatrician Investigated for Child Sexual Abuse, The Medium, December 
2016.  Accessed at http://4patientsafety.org/documents/Weber,%20Stanley%20Patrick%202016-12-08%20Article.pdf on 
October 27, 2019.   
26 Benavidez v. United States, 177 F.3d 927 (10th Cir. 1999).  Accessed at https://www.ca10.uscourts.gov/opinions/97/97-
2313.pdf on June 17, 2019.     
27 Christopher Weaver, A Suicide Attempt, an Order to Keep Silent: A U.S. Agency Mishandled Sex-Abuse Claims, PBS 
Frontline in partnership with The Wall Street Journal, June 7, 2019.  Accessed at 
https://www.pbs.org/wgbh/frontline/article/indian-health-service-suicide-sex-abuse-investigation/ on September 9, 2019. 
28 IHS, Internal document, Rollout Plan: Dr. Stanley Patrick Weber trial, September 10, 2018.  
29 IHS, Internal email correspondence regarding zero tolerance policy for sexual abuse or exploitation of children by healthcare 
providers, March 28, 2018. 
30 IHS, Fact Sheet: Credentialing Software and Policy Update, October 2017, loc. cit.  
31 IHS, IHM, pt. 3; Ch. 20; section 3-20.2 (Responsibilities).  
32 IHS, IHM, pt. 3; Ch. 20; section 3-20.1 (Introduction).  
33 IHS, Transmittal Notice 19-03, February 6, 2019.  Accessed at https://www.ihs.gov/ihm/tn/2019/transmittal-notice-19-03/ on 
November 14, 2019. 
34 IHS, IHM, pt. 3; Ch. 20; section 3-20.2 (Responsibilities). 
35 IHS, IHM, pt. 3; Ch. 20; sections 3-20.3 (Chaperones) and 3-20.4 (Staff Rights). 
36 IHS, Transmittal Notice 10-09, July 2, 2010.  Accessed at https://www.ihs.gov/ihm/tn/2010/transmittal-notice-10-09/ on 
November 14, 2019. 
37 IHS, IHM, pt. 3; Ch. 3; section 3-3.13 (Consents to Medical and Surgical Procedures). 
38 IHS, IHM, pt. 3; Ch. 3; section 3-3.14 (Minors). 
39 IHS, Department of Health and Human Services  Indian Health Service: Organizations, Functions, and Delegations of 
Authority.  Accessed at https://www.ihs.gov/IHM/funct-state/oms-reorg/ on May 16, 2019. 
40 Federal law requires healthcare professionals, while engaged in a professional capacity on Federal land, to report suspected 
child abuse.  Section 226 of the Crime Control Act of 1990, P. L. No. 101-647 (enacted November 29, 1990) (codified at           
34 U.S.C.  20341).  This statute covers most medical professionals, social workers, teachers, child-care workers, law-
enforcement personnel, foster parents, and commercial film and photo processors.  Section 404 of the Indian Child Protection 
and Family Violence Prevention Act (enacted Nov. 28, 1990) (codified at 18 U.S.C.  1169) also requires most medical 
professionals, educators, school officials, human service professionals, and law enforcement officers to report suspected child 
abuse that occurred in Indian Country. 
41 IHS, IHM, pt. 3; Ch. 23; section 3-23.1 (Introduction).  
42 IHS, Transmittal Notice 04-05, August 5, 2004.  Accessed at https://www.ihs.gov/IHM/tn/2004/transmittal-notice-04-05/ on 
September 19, 2019. 
43 IHS, IHM, pt. 3; Ch. 23; section 3-23.1 (Introduction).   
44 Ibid.  
 
IHS Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into Practice and Organizational Culture  39 
OEI-06-19-00330   
 
45 IHS, IHM, pt. 3; Ch. 20; section 3-20.2 (Responsibilities). 
46 IHS, IHM, pt. 3; Ch. 20; section 3-20.1 (Introduction). 
47 IHS, IHM, pt. 3; Ch. 20; section 3-20.2 (Responsibilities). 
48 Testimony of RADM Michael Weahkee, Principal Deputy Director for IHS, before the House Committee on Appropriations, 
Subcommittee on Interior, Environment, and Related Agencies, April 9, 2019, loc. cit. 
49 Jackie Gilbert, HHS Indian Health Service awards 5-year contract for Adverse Event Reporting System, FedHealthIT, 
December 13, 2018, loc. cit.  
50 IHS, Justification of Estimates for Appropriations Committees, op. cit., p. CJ-59. 
51 Ibid. 
52 IHS, Report Fraud, Waste, Abuse and Mismanagement.  Accessed at https://www.ihs.gov/reportfraud/ on April 25, 2019. 
53 IHS, Report Form.  Accessed at https://www.ihs.gov/reportfraud/reportform/ on September 17, 2019. 
54 OIG, Report Fraud  Submit a Hotline Complaint.  Accessed at https://oig.hhs.gov/fraud/report-fraud/ on September 17, 
2019. 
55 IHS, IHM, pt. 3; Ch. 20; section 3-20.1 (Introduction) and 3-20.4 (Staff Rights). 
56 Whistleblower Protection Act of 1989, P.L. No. 101-12 (enacted April 10, 1989) (codified at 5 U.S.C.  2302). 
57 Food and Drug Administration Safety and Innovation Act,  1129, P.L. 112-144 (enacted July 9, 2012) (codified at 42 U.S.C. 
 213a and incorporating the protections of the Military Whistleblower Protection act, which is codified 10 U.S.C.  1034, for 
Commissioned Officers of the U.S. Public Health Service). 
58 National Defense Authorization Act, P.L. 112-239,  828 (enacted Jan. 2, 2013) (providing employees of Federal contractors 
and grantee whistleblower protection for four years); An Act to Enhance Whistleblower Protection for Contractor and Grantee 
Employees, P.L. No. 114-261 (enacted December 14, 2016) (making whistleblower protections permanent) (both codified at 41 
U.S.C.  4712). 
59 Whistleblower Protection Enhancement Act of 2012, P.L. No. 112-199 (enacted November 27, 2012) (amending the 
Whistleblower Protection Act of 1989) (codified at 5 U.S.C.  2302). 
60 HHS, 2016 HHS Open Government Plan, section 3.5 (Whistleblower Protection).  Accessed at 
https://www.hhs.gov/open/2016-plan/whistleblower-protection.html on May 14, 2019. 
61 AAP, About the AAP.  Accessed at https://www.aap.org/en-us/about-the-aap/Pages/About-the-AAP.aspx on June 3, 2019. 
62 AAP, Protecting Children from Sexual Abuse by Health Care Providers, Pediatrics, Vol. 128, No. 2, August 2011.  Accessed at 
https://pediatrics.aappublications.org/content/128/2/407 on June 3, 2019. 
63 AMA, Code of Medical Ethics Overview.  Accessed at https://www.ama-assn.org/delivering-care/ethics/code-medical-ethics-
overview on August 27, 2019. 
64 NCSBN, About NCSBN.  Accessed at https://www.ncsbn.org/about.htm on August 27, 2019. 
65 NCSBN, About NCSBN - History.  Accessed at https://www.ncsbn.org/history.htm on August 27, 2019. 
66 IHS, Press Release, IHS Principal Deputy Director Michael Weahkee statement on announcement of contract for medical quality 
assurance review, May 13, 2019.  Accessed at 
https://www.ihs.gov/sites/newsroom/themes/responsive2017/display_objects/documents/Statement_MedicalQualityAssurance
Review_05132019.pdf on August 28, 2019. 
67 Testimony of RADM Michael Weahkee, Principal Deputy Director for IHS, before the House Committee on Appropriations, 
Subcommittee on Interior, Environment, and Related Agencies, April 9, 2019, loc. cit.  
68 IHS Solicitation Number 19-236-SOL-00002, Additional Terms and Conditions  Internal Medical Quality Assurance Review.  
Accessed at 
https://www.fbo.gov/index.php?s=opportunity&mode=form&tab=core&id=c16a85de36e4f9b656a5ca1bd14e64a4&_cview=0 
on August 28, 2019. 
 
IHS Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into Practice and Organizational Culture  40 
OEI-06-19-00330   
 
69 Letter from the Senate Committee on Indian Affairs to the Comptroller General for GAO, May 16, 2019.  Accessed at 
https://www.tomudall.senate.gov/imo/media/doc/LETTER%20GAO%20Request%20IHS%20Employee%20Transfer%20Misuse%
20(signed).pdf on May 23, 2019. 
70 OIG informational meeting with GAO on July 15, 2019.   
71 The White House, Statements & Releases, White House Announces the Presidential Task Force on Protecting Native American 
Children in the Indian Health Service System, March 26, 2019.  Accessed at https://www.whitehouse.gov/briefings-
statements/white-house-announces-presidential-task-force-protecting-native-american-children-indian-health-service-
system/ on April 15, 2019. 
72 OIG, Indian Health Service Hospitals: More Monitoring Needed to Ensure Quality Care, OEI-06-14-00010, October 2016.   
73 OIG, Indian Health Service Hospitals: Longstanding Challenges Warrant Focused Attention to Support Quality Care, OEI-06-14-
00011, October 2016. 
74 OIG, Case Study: Indian Health Service Management of Rosebud Hospital Emergency Department Closure and Reopening, OEI-
06-17-00270, July 2019. 
75 OIG, Organizational Challenges to Improving Quality of Care in Indian Health Service Hospitals, OEI-06-16-00390, August 
2019. 
76 AAP, Committee on Native American Child Health.  Accessed at https://www.aap.org/en-us/advocacy-and-policy/aap-health-
initiatives/NACH/Pages/Committee-on-Native-American-Child-Health.aspx on October 2, 2019. 
77 IHS, Special General Memorandum 19-03, September 27, 2019. Accessed at https://www.ihs.gov/IHM/sgm/2019/informed-
consent/ on October 24, 2019. 
78 OIG, Organizational Challenges to Improving Quality of Care in Indian Health Service Hospitals, loc. cit. 
79 OIG, Case Study: Indian Health Service Management of Rosebud Hospital Emergency Department Closure and Reopening, loc. 
cit. 
80 Ibid.  
81 OIG, Organizational Challenges to Improving Quality of Care in Indian Health Service Hospitals, loc. cit. 
82 Ibid. 
83 OIG, Hospital Incident Reporting Systems Do Not Capture Most Harm, OEI-06-09-00091, January 2012. 
IHS Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into Practice and Organizational Culture  41 
OEI-06-19-00330