Indian Health Service: IHS Mismanagement Led to Millions of Dollars in Lost or Stolen Property
Published: 2008-06-18T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: In June 2007, GAO received information from a whistleblower through GAO's FraudNET hotline alleging millions of dollars in lost and stolen property and gross mismanagement of property at Indian Health Service (IHS), an operating division of the Department of Health and Human Services (HHS). GAO was asked to conduct a forensic audit and related investigations to (1) determine whether GAO could substantiate the allegation of lost and stolen property at IHS and identify examples of wasteful purchases and (2) identify the key causes of any loss, theft, or waste. GAO analyzed IHS property records from fiscal years 2004- 2007, conducted a full physical inventory at IHS headquarters, and statistically tested inventory of information technology (IT) equipment at 7 IHS field locations in 2007 and 2008. GAO also examined IHS policies, conducted interviews with IHS officials, and assessed the security of property.
section_title: What GAO Found
paragraphs: Millions of dollars worth of IHS property has been lost or stolen over the past several years. Specifically, (1) IHS identified over 5,000 lost or stolen property items, worth about $15.8 million, from fiscal years 2004 through 2007. These missing items included all-terrain vehicles and tractors; Jaws of Life equipment; and a computer containing sensitive data, including social security numbers. (2) GAO's physical inventory identified that over 1,100 IT items, worth about $2 million, were missing from IHS headquarters. These items represented about 36 percent of all IT equipment on the books at headquarters in 2007 and included laptops and digital cameras. Further, IHS staff attempted to obstruct GAO's investigation by fabricating hundreds of documents. (3) GAO also estimates that IHS had about 1,200 missing IT equipment items at seven field office locations worth approximately $2.6 million. This represented about 17 percent of all IT equipment at these locations. However, the dollar value of lost or stolen items and the extent of compromised data are unknown because IHS does not consistently document lost or stolen property and GAO only tested a limited number of IHS locations. Information related to cases where GAO identified fabrication of documents and potential release of sensitive data is being referred to the HHS Inspector General for further investigation. GAO also found evidence of wasteful spending, including identifying that there are about 10 pieces of IT equipment for every one employee at headquarters. GAO's investigation also found computers and other IT equipment were often assigned to vacant offices. GAO identified that the loss, theft, and waste can be attributed to IHS's weak internal control environment. IHS management has failed to establish a strong "tone at the top," allowing property management problems to continue for more than a decade with little or no improvement or accountability for lost and stolen property and compromise of sensitive personal data. In addition, IHS has not effectively implemented numerous property policies, including the proper safeguards for its expensive IT equipment. For example, IHS disposed over $700,000 worth of equipment because it was "infested with bat dung."

section_title: Letter
paragraphs: In June 2007, we received information from a whistleblower through  GAO’s FraudNET hotline alleging gross mismanagement of property and  wasteful spending at the Indian Health Service (IHS). Specifically, the  whistleblower, who was a cognizant property official, alleged that IHS  headquarters could not locate 1,180 pieces of accountable personal  property, including computers and other potentially sensitive information  technology (IT) equipment, valued at over $1.8 million. The whistleblower  also claimed that officials at IHS headquarters wrote off millions of dollars  worth of missing inventory without holding anyone financially liable.  Based on the significance of these claims, you asked us to (1) determine  whether we could substantiate the allegation of lost or stolen property at  IHS and identify examples of wasteful purchases and (2) identify the key  causes of any loss, theft, or waste we detect.
To do this, we analyzed IHS property documents that identified lost or  stolen property from fiscal year 2004 through fiscal year 2007. We  conducted a full physical inventory of property at IHS headquarters and  performed random sample testing of IT equipment inventory at seven IHS  field locations that we selected based on book value of inventory and  geographic proximity. We limited the scope of our work to testing IT  equipment because it is highly pilferable, can be easily converted to  personal use, and potentially contains sensitive information that may be  used for identity fraud or other malicious purposes. We did not attempt to  quantify the level of waste at IHS, but we identified instances of waste  through observations during our equipment inventories at headquarters  and random sample testing at the selected field locations. Although we did  not perform a systematic review of IHS internal controls, we identified the  key causes of lost and stolen property and waste by examining IHS  policies and procedures, conducting interviews with IHS officials, and  assessing the physical security of property through our inventory testing.
We conducted this forensic audit and related investigations from  September 2007 to June 2008 in accordance with generally accepted  government auditing standards. Those standards require that we plan and  perform the audit to obtain sufficient, appropriate evidence to provide a  reasonable basis for our findings and conclusions based on our audit  objectives. Despite IHS efforts to obstruct our audit by making  misrepresentations and fabricating hundreds of documents, we were still  able to accomplish our objectives. We believe that the evidence obtained  provides a reasonable basis for our findings and conclusions based on our  audit objectives. We performed our investigative work in accordance with  standards prescribed by the President’s Council on Integrity and  Efficiency. A detailed discussion of our scope and methodology is  presented in appendix I.
subsections: section_title: Background
paragraphs: IHS, an operating division of HHS, is responsible for providing health  services to federally recognized tribes of American Indians and Alaska  natives. In 2007, IHS provided health services to approximately 1.9 million  American Indians and Alaska natives from more than 562 federally  recognized tribes. As an operating division of HHS, IHS is included in the  agency’s consolidated financial statement and has not been audited  independently since 2002.
IHS is divided into 12 regions and operates 163 service units throughout  the country. Service units may contain one or more health facilities,  including hospitals, health centers, village clinics, health stations, and  school health centers. There are 114 IHS-operated health facilities and 565  tribally operated health facilities. The IHS budget appropriation in 2007  was $3.2 billion, approximately 54 percent of which was administered by  tribes through various contracts and compacts with the federal  government.
section_title: IHS Has Had Millions of Dollars in Property Lost or Stolen and Has Made Wasteful Purchases
paragraphs: We substantiated the allegation of gross mismanagement of property at  IHS. Specifically, we found that thousands of computers and other  property, worth millions of dollars, have been lost or stolen. We analyzed  IHS reports for headquarters and the 12 regions from the last 4 fiscal years  which identified over 5,000 property items, worth about $15.8 million, that  were lost or stolen from IHS headquarters and field offices throughout the  country. The number and dollar value of this missing property is likely  much higher because IHS did not conduct full inventories of accountable  property for all of its locations and did not provide us with all inventory  documents as requested. Despite IHS attempts to obstruct our  investigation, our full physical inventory at headquarters and our random  sample of property at seven field locations identified millions of dollars of  missing property. We also found that IHS has made wasteful purchases  over the past few years. For example, IHS has bought computer equipment  that is currently unused in its original box and has issued IT equipment to  its employees that duplicate the equipment already provided to them.
subsections: section_title: IHS Records Indicate at Least $15.8 Million of Property Has Been Lost or Stolen
paragraphs: Our analysis of Report of Survey records from IHS headquarters and field  offices shows that from fiscal year 2004 through fiscal year 2007, IHS  property managers identified over 5,000 lost or stolen property items  worth about $15.8 million. Although we did receive some documentation  from IHS, the number and dollar value of items that have been lost or  stolen since 2004 is likely much higher for the following reasons. First, IHS  does not consistently document lost or stolen property items. For  example, 9 of the 12 IHS regional offices did not even perform a physical  inventory in fiscal year 2007. Second, for each year since fiscal year 2004,  an average of 5 of the 12 regions did not provide us with all of the reports  used to document missing property since fiscal year 2004, as we requested.
The following cases provide information on five of the egregious examples  of lost and stolen property we identified. In each case, IHS has not held  any staff accountable for the missing items. In some of the cases, IHS did  not even perform an investigation to try and locate the missing items or  determine what actions should be taken.
IHS staff held a “yard sale” of 17 computers and other property worth  $16,660 in Schurz, Nevada, between June and July 2005. According to an  IHS property manager, the equipment was advertised to the public via  fliers indicating that excess federal property was to be given away for free.  To date, IHS has not completed the investigation or held any IHS  personnel responsible and, according to a 2006 report, intends to writeoff  the missing equipment. According to the Phoenix area property manager,  the 17 computers identified as missing were transferred from a youth  patient center and could contain sensitive youth patient information  because the computers were never “cleaned” before being transferred to  the Schurz service unit. We are referring this potential release of patient  data to the HHS OIG for further investigation.
From 1999 through 2005, IHS did not follow required procedures to  document the transfer of property from IHS to the Alaska Native Tribal  Health Consortium, resulting in an unsuccessful 5-year attempt by IHS to  reconcile the inventory. Our analysis of IHS documentation revealed that  about $6 million of this property—including all-terrain vehicles,  generators, van trailers, tractors, and other heavy equipment—was lost or  stolen.
In April 2007, a desktop computer containing a database of uranium miner  names, social security numbers, and medical histories was stolen from an  IHS hospital in New Mexico. According to an HHS report, IHS attempted  to notify the 849 miners whose personal information was compromised,  but IHS did not issue a press release to inform the public of the  compromised data. In addition to this incident, the IHS Finance  department recently reported a missing Personal Digital Assistant (PDA)  in March 2008 when they requested a replacement. The PDA contained  medical information and names of patients at a Tucson Area Hospital.  According to the IHS IT official, the device contained no password or data  encryption. This was in violation of federal policy and increased the risk  that sensitive information could be disclosed to unauthorized individuals.  Both of these cases have already been reported to HHS by the IHS Office  of Information Technology.
In September 2006, IHS property staff in Tucson attempted to write off  over $275,000 worth of property, including Jaws of Life equipment valued  at $21,000. The acting area director in Tucson refused to approve the  write-off because of the egregious nature of the property loss. However,  no investigation has been conducted to date.
According to an IHS June 2006 report, a $4,000 Apple Powerbook laptop  was stolen from an employee’s vehicle in the Navajo area. Despite the lack  of authorization, the employee took the laptop for use during off-duty  hours—in violation of IHS policy. Because the employee violated IHS  policy, IHS’s initial determination, with which the employee agreed, was  that the employee was responsible for the loss and therefore should  reimburse the federal government for the value of the stolen computer.  However, the IHS approving official reversed the initial determination  decision stating that the employee had since resigned and the loss was due  to theft.
section_title: GAO Inventory Testing Reveals Lost or Stolen IT Equipment at IHS Headquarters
paragraphs: To substantiate the whistleblower’s allegation of missing IT equipment, we  performed our own full inventory of IT equipment at IHS headquarters.  Our results were consistent with what the whistleblower claimed.  Specifically, of the 3,155 pieces of IT equipment recorded in the records  for IHS headquarters, we determined that about 1,140 items (or about 36  percent) were lost, stolen, or unaccounted for. These items, valued at  around $2 million, included computers, computer servers, video  projectors, and digital cameras. According to IHS records, 64 of the items  we identified as missing during our physical inventory were “new” in April  2007. Furthermore, we found that some of the missing computers were  assigned to the IHS human resources division. These computers likely  contained sensitive employee data including names and Social Security  numbers protected under the Privacy Act of 1974. We are referring these  cases where there was a potential release of sensitive data including  employee social security numbers to the HHS OIG for further  investigation.
During our investigation of the whistleblower’s complaint, IHS made a  concerted effort to obstruct our work. IHS officials made  misrepresentations and fabricated documents to impede our work.  Specifically,    The IHS Director responsible for property claimed that IHS was able to  find about 800 of the missing items from the whistleblower’s complaint.  However, based on our physical inventory testing at headquarters, we  found that this statement was a misrepresentation and that only some of  these items have been found.
An IHS property specialist attempted to provide documentation  confirming that 571 missing items were properly disposed of by IHS.  However, we found that the documentation he provided was not dated and  contained no signatures. When we questioned the official about these  discrepancies, he admitted that he fabricated the documents. We are  referring this individual to the HHS OIG for further investigation.
According to IHS policy, receiving reports are always signed by an  authorized employee. As part of our inventory, we requested receiving  reports for three recent purchase orders. For one purchase order, IHS was  not able to provide us with any receiving reports. For the other two  purchase orders, IHS provided us with receiving reports that were not  properly completed; e.g., the reports were not signed by the person who  received the property and did not contain the date that the property was  received. When we questioned these discrepancies, IHS sent us “new”  receiving reports for the three purchase orders, but all of them contained  questionable dates and signatures. For example, figure 1 shows the  fabricated receiving report for a shipment of new scanners delivered to  IHS. ?
As shown in figure 1, there is almost a 3-month gap between the date the  equipment was received in September and the date that the receiving  report was completed and signed in December—-even though the  document should have been signed upon receipt. In fact, the new receiving  report IHS provided was signed on the same date we requested it, strongly  suggesting that IHS fabricated these documents in order to obstruct our  investigation. Further, after testing one of the other two fabricated  receiving reports, we found that 10 brand new desktop computers worth  almost $12,000 could not be located even though the receiving report  indicated that they were “received” in July 2007.
section_title: GAO Testing Identifies Lost or Stolen IT Equipment at Seven IHS Field Locations
paragraphs: We selected a random sample of IT equipment inventory at seven IHS field  offices to determine whether the lack of accountability for inventory was  confined to headquarters or occurred elsewhere within the agency.  Similar to our finding at IHS headquarters, our sample results also indicate  that a substantial number of pieces of IT equipment were lost, stolen, or  unaccounted for. Specifically, we estimate that for the seven locations,  about 1,200 equipment items, with a value of $2.6 million were lost or  stolen. As shown in table 1, our estimates are based on a statistical  sample of 250 items from a population of 7,211 IT equipment items worth  over $19 million recorded in property records for IT equipment at the  seven field office locations. Of the 250 items that we sampled, IHS could  not locate or substantiate the disposal of 42 items, or about 17 percent of  the sample population.
Furthermore, some of the missing equipment from the seven field  locations could have contained sensitive information. Although personal  health information requires additional protections from unauthorized  release under the Health Information Portability and Accountability Act of  1996 (HIPAA) and implementing regulations, we found that many of the  missing laptops were assigned to IHS hospitals and, therefore, could have  contained patient information, social security numbers, and other personal  information. We are referring these cases where there was a potential  release of sensitive data including patient information to the HHS OIG for  further investigation.
section_title: Wasteful Purchases Identified During Inventory Tests
paragraphs: IHS has also exhibited ineffective management over the procurement of IT  equipment, which has led to wasteful spending of taxpayer funds. IHS  purchased excessive amounts of IT equipment for its staff, most notably at  the headquarters office. An IHS official stated that IHS purchased new  computers using “end of the year dollars.” Some examples of wasteful  spending that we observed during our audit of headquarters and field  offices include the following:    Approximately 10 pieces of IT equipment, on average, are issued for every  one employee at IHS headquarters. Although some of these may be older  items that were not properly disposed, we did find that many employees,  including administrative assistants, were assigned two computer monitors,  a printer and scanner, a blackberry, subwoofer speakers, and multiple  computer laptops in addition to their computer desktop. Many of these  employees said they rarely used all of this equipment and some could not  even remember the passwords for some of their multiple laptops.
IHS purchased computers for headquarters staff in excess of expected  need. For example, IHS purchased 134 new computer desktops and  monitors for $161,700 in the summer of 2007. As shown in figure 2, as of  February 2008 25 of these computers and monitors—valued at about  $30,000—were in storage at IHS headquarters. An IT specialist stated that  the computers and monitors were “extras.” In addition, we identified 7  new laptops that were stored in an unlocked cabinet at headquarters and  never used.
Computers and other IT equipment were often assigned to vacant offices.  For example, many of the computer desktops and monitors purchased in  the summer of 2007 for IHS headquarters were assigned to vacant offices.  In addition, as shown in figure 3, we found two computers, two monitors,  and three printers in an employee’s office at the Albuquerque field location  we visited. The IHS area property manager stated that this equipment was  issued to an employee who spends a majority of his time on travel to  training and treatment centers.
An official for the IHS National Program stated that IHS purchased new  computers using “end of the year dollars.” For example, as shown in figure  4, one field office employee in Gallup, New Mexico had an unwrapped, 23- inch, widescreen monitor worth almost $1,700 in her office. The employee  stated that she did not know why IT sent her the monitor and she claimed  that it has never been used.
section_title: Weak Tone at the Top and Other Control Weaknesses Leave IHS Highly Vulnerable to Loss, Theft, and Waste
paragraphs: The lost or stolen property and waste we detected at IHS can be attributed  to the agency’s weak internal control environment and its ineffective  implementation of numerous property policies. In particular, IHS  management has failed to establish a strong “tone at the top” by allowing  inadequate accountability over property to persist for years and by  neglecting to fully investigate cases related to lost and stolen items.  Furthermore, IHS management has not properly updated its personal  property management policies, which IHS has not revised since 1992.  Moreover, IHS did not (1) conduct annual inventories of accountable  property; (2) use receiving agents for acquired property at each location  and designate property custodial officers in writing to be responsible for  the proper use, maintenance, and protection of property; (3) place bar  codes on accountable property to identify it as government property; (4)  maintain proper individual user-level accountability, including custody  receipts, for issued property; (5) safeguard IT equipment; or (6) record  certain property in its property management information system (PMIS).
Weak tone at the top: The importance of the “tone at the top” or the role  of management in establishing a positive internal control environment  cannot be overstated. GAO’s internal control standards state that  “management plays a key role in demonstrating and maintaining an  organization’s integrity and ethical values, especially in setting and  maintaining the organization’s ethical tone, providing guidance for proper  behavior, removing temptations for unethical behavior, and providing  discipline when appropriate.” However, IHS management has failed to  establish and maintain these ethical values. As far back as 1997, an IHS  memo by the then Acting Director stated that the agency had problems  with lost and stolen property at IHS headquarters. The memo also stated  that unused equipment was not safeguarded against loss or theft.  However, we found little corrective action was taken by IHS. For example,  management failed to update IHS personal property management policies,  which have not been revised since 1992. In addition, IHS has historically  shown little motivation to hold its employees liable for missing property.  Instead of investigating the circumstances surrounding missing property,  IHS writes off the losses without holding anyone accountable. As a result,  an IHS property official admitted to us that there is no accountability over  IHS property. For example, figure 5 shows a report used to write off  almost $900,000 worth of missing IT equipment in 2004, including laptop  and desktop computers, servers, cameras, routers, and fax machines. This  is just one of four reports that IHS used in 2004 to write off a combined  total of $1.8 million dollars worth of IT equipment.
As shown in the figure, the report does not hold anyone responsible for  the missing inventory, but it does call for the improvement of controls  over property management. However, as shown by our audit and related  investigations, IHS has made minimal efforts to improve property  management and oversight. Despite this fact, IHS rewarded the individuals  responsible for these functions in its property group with about $40,000 in  merit awards from 2003 through 2007.
No annual inventories: HHS and IHS policies require IHS personnel to  conduct annual inventories of accountable personal property, including  property at headquarters and in field offices. However, IHS headquarters  did not conduct any annual inventories from fiscal years 2004 through  2006. In addition, property managers were not able to accurately  document the findings of their fiscal year 2007 inventory nearly a year  after it was conducted. Moreover, in fiscal year 2007, only 3 out of 12  regions conducted a full physical inventory. Consequently, the extent of  missing property at IHS is unknown.
Failure to use receiving agents and to designate property custodial  officers: IHS policy requires that each accountable area designate at  least one receiving agent to receive purchased property. The receiving  agent is responsible for documenting the receipt of the property (i.e.,  receiving report) and then distributing the property to its intended user.  However, we found that acquired property is often sent directly to the  user, bypassing the receiving agent. For example, the IT department  sometimes receives new computers and IT equipment directly instead of  utilizing the receiving agent. In addition, HHS requires the designation of  property custodial officers in writing to be responsible for the proper use,  maintenance, and protection of property. However, an IHS official said  that property custodial officers have not formally been designated for  headquarters because of high staff turnover.
Lack of property bar codes: HHS and IHS policy mandate that all  accountable property have a bar code identifying it as government  property. However, in our audit of IHS headquarters inventory, we  identified over 100 pieces of IT equipment, including blackberries and  digital cameras, that were not properly bar coded. Much of this equipment  likely did not receive a bar code because, as discussed earlier, IHS does  not receive property in a central location.
Lack of personal custody property records: HHS requires the use of  hand receipts, known as HHS Form 439, any time property is issued to an  employee. This form should be retained by a property official so that  property can be tracked at the time of transfer, separation, change in  duties, or when requested by the proper authority. By signing this form, an  IHS employee takes responsibility for the government-issued equipment.  According to an IHS property official, IHS headquarters does not use the  HHS Form 439, nor do they use any other type of hand receipt. Officials  from several IHS regions stated that they use the form only in limited  cases. Without the issuance of this form, there is no documentation as to  where the equipment is located and no mechanism to hold the user  accountable for the equipment.
Lack of user-level accountability: HHS requires IHS to document  information on the user of equipment, including building and room  number, so that property can be tracked and located. However, IHS did  not properly maintain this information. Property personnel instead relied  on their personal recollection to locate property items. For example, on  several occasions during our headquarters inventory, IHS property staff  could not identify the property user. As a result, the property staff had to  make inquiries with other staff to obtain information on the user of the  equipment. Further, IHS personnel in the field offices stated that it took  them several days to locate items that were included in our sampled  inventory.
Furthermore, according to the IHS policy manual, when equipment is no  longer needed by the user, a request for property action should be  submitted in writing to the Property Accountable Officer (PAO). The PAO  then determines if the item can be transferred to another user within IHS.  However, in many cases, equipment is redistributed by the IT department  or sent to another user without PAO approval. In our audit of IHS  headquarters inventory, we found some items that were issued to an  unspecified user or to employees who had retired or left the agency. To  locate these items, IHS Headquarters staff had to inquire with the  employee’s colleagues to determine the location of the equipment. In  several cases, IHS was not able to locate the equipment assigned to  separated employees, raising the possibility that the equipment was stolen.  For example, one IHS employee stated that equipment had “disappeared”  from an office vacated by a former employee.
Weaknesses in physical security of IT equipment: According to the  Indian Health Manual, property is to be adequately protected “against the  hazards of fire, theft, vandalism, and weather commensurate with the  condition and value” of the property. However, during our inventory  review at both IHS headquarters and field office locations, we found that  IHS did not follow this policy. Specifically, we found that IHS did not  properly secure expensive IT equipment leaving them vulnerable to loss  and theft. For example we found that:    Surplus IT equipment that should have been disposed of was stored in  unlocked employees’ offices, suite areas, conference rooms, and storage  rooms. For example, figure 6 shows computer equipment stored in an  unlocked multipurpose storage room at IHS headquarters. In addition, an  IHS headquarters employee had newly purchased unsecured equipment,  including a large flat screen TV, dual monitors, a printer, a scanner, a  desktop, a subwoofer, a video camera, and a back-up power supply.
IHS did not establish proper safeguards for storing IT equipment in IHS  facilities or employees’ offices. For example, at one of the IHS hospitals  we visited, the IT department did not lock its storage area, leaving several  computers unsecured.
Because equipment was not protected against damage or destruction, IHS  had to dispose over $700,000 worth of equipment because it was “infested  with bat dung.”
Failure to use accountable property management system: HHS  policy requires that all accountable property with a value of $5,000 or  greater and all sensitive items with a value of $500 or greater be tracked  by the PMIS property management system. The PMIS system is intended  to improve accountability and standardize property records across HHS.  Equipment that is not recorded in PMIS is not inventoried or otherwise  controlled, placing it at increased risk of loss or theft. Although IHS had 2  years to migrate from legacy systems to the new inventory system, it has  not yet fully converted to the PMIS system. Furthermore, officials from  two field locations stated that they are not adding new equipment to the  system because IHS headquarters told them not to use the system until  further notice.
Because it has not entered all property information into PMIS, IHS does  not have reliable inventory records related to expensive, sensitive, and  pilferable property. Specifically, IHS has failed to enter over 18,000 items,  worth approximately $48 million, from headquarters and the sites we  reviewed. Furthermore, we found that over half of the items we selected  while performing our random sample testing of the seven field locations  were not recorded in PMIS. The types of equipment that were not entered  into PMIS include a $145,000 ultrasound unit, a $140,000 X-ray unit, and a  $61,000 anesthesia machine. In addition, although items such as  blackberries, cell phones, and digital cameras do not meet the criteria for  inclusion in PMIS, these items are highly sensitive and should be  accounted for by IHS. Furthermore, the magnitude of equipment that was  not entered into the system is likely much higher because we did not  analyze data from IHS locations not included in our statistical sample.
section_title: Conclusions
paragraphs: Our audit confirmed the whisteblower’s allegation of gross  mismanagement of property at IHS. IHS has exhibited a weak control  environment and disregard for basic accountability over its inventory. As a  result, IHS cannot account for its physical property and is vulnerable to  the loss and theft of IT equipment and sensitive personal data. Further,  IHS’ wasteful spending of IT equipment and lack of discipline or personal  accountability for lost and stolen property and personal data has set a  negative tone at the top that the status quo is acceptable. Moreover,  intentional attempts of some IHS employees to thwart our investigation  lead us to question the integrity and transparency of certain functions  within the agency’s property management group and call for stronger  leadership to strengthen tone at the top as well as throughout property  management functions.
section_title: Recommendations for Executive Action
paragraphs: We recommend that the Director of IHS strengthen IHS’s overall control  environment and “tone at the top” by updating and enforcing its policies  and procedures for property management. As part of this effort, the  Director of IHS should direct IHS property officials to take the following  10 actions:    Update IHS personal property management policies to reflect any policy  changes that have occurred since the last update in 1992.
Investigate circumstances surrounding missing or stolen property instead  of writing off losses without holding anyone accountable.
Enforce policy to conduct annual inventories of accountable personal  property at headquarters and all field locations.
Enforce policy to use receiving agents to document the receipt of property  and distribute the property to its intended user and to designate property  custodial officers in writing to be responsible for the proper use,  maintenance, and protection of property.
Enforce policy to place bar codes on all accountable property.
Enforce policy to document the issuance of property using hand receipts  and make sure that employees account for property at the time of transfer,  separation, change in duties, or on demand by the proper authority.
Maintain information on users of all accountable property, including their  buildings and room numbers, so that property can easily be located.
Physically secure and protect property to guard against loss and theft of  equipment.
Enforce the use of the PMIS property management database to create  reliable inventory records.
Establish procedures to track all sensitive equipment such as blackberries  and cell phones even if they fall under the accountable dollar threshold  criteria.
section_title: Agency Comments and Our Evaluation
paragraphs: We received written comments on a draft of this report from the Assistant  Secretary for Legislation of the Department of Health and Human Services  (HHS). HHS agreed with 9 of our 10 recommendations. However, HHS  stated that our report contained inaccuracies and misinterpretations that it  believes seriously weaken our conclusions. In its response to our draft  report HHS cited three limitations. First, HHS stated that our report did  not appreciate the fact that IHS property management is a unique system  in its collaboration with Indian Tribes and that it operates its service units  throughout the country. Second, HHS said that unaccountable property  may be lower than what our report identified because the ongoing process  of reconciling the prior system to the new system makes it more likely that  the number of currently unaccounted for property items will be reduced  rather than increase as the reconciliation progresses. Further, they state  that the implementation process for the new system made it more difficult  for IHS to provide GAO with the necessary documentation for audit. Third,  HHS also stated that we overstated the net worth of unaccounted for items  by not taking into account the depreciated value of those items. In  addition, HHS response also cited six specific cases that they believe were  misrepresented in our case studies.
In response to HHS’s first limitation, we do not believe that we  mischaracterized the uniqueness of IHS’s collaboration with Indian Tribes  and the fact that it has service units throughout the country. In the report,  we state that over half of IHS’s budget is administered by the tribes  through various contracts and compacts with the federal government. We  also state that IHS operates 163 service units that include one or more  health facilities, such as hospitals, health centers, village clinics, health  stations, and school health centers. Furthermore, the scope of our audit  only included testing IHS property, which does not include the Tribal  communities. However, we believe that because IHS operates in this type  of control environment, IHS should have strong internal controls over its  property and not the weak controls that were apparent in our audit.
HHS also contends that the unaccountable property will be reduced from  the reconciliation of the prior property system to the new system.  However, we disagree—the lost or stolen property that was identified in  our report came from IHS’s Report of Surveys, our full physical inventory  of all equipment at IHS headquarters, and random sample testing of IT  equipment at 7 field locations. Reports of Survey only identify specific  property items that were written off IHS’s inventory books from physical  inventories or other circumstances. Our physical inventory testing at IHS  headquarters and random sample testing of IT equipment at the 7 field  locations verify that there were additional missing property items to those  identified in Reports of Survey. Furthermore, as stated in our report and  HHS’s response, IHS did not perform complete physical inventories of  equipment for most of its regional offices. Specifically we identified that 9  of the 12 regions did not perform a physical inventory in 2007. In addition,  we reported that IHS did not complete the investigations of about $11  million of inventory shortages where a physical inventory was performed.  As such, our estimate does not include lost or stolen property where  physical inventories were not performed or where IHS did not complete its  investigation of inventory shortages. Further, we do not believe that IHS’s  conversion to a new system should impact IHS’s ability to maintain basic  inventory documentation that is subject to audit. Without such  documentation, IHS has no accountability of equipment that the American  taxpayers entrusted to the agency. Thus, we believe that we likely  underestimated, not overestimated, the amount of lost or stolen property.
Finally, in its written response to our draft report HHS states its belief that  our report overstates the net worth of unaccounted for items by not taking  into consideration the depreciation value of these items. While we agree  that the actual “loss” is less because of depreciation, we consider  acquisition cost very relevant because, if property that IHS has lost or is  stolen was necessary, IHS will need to buy new replacement property. It is  likely that replacement costs are as much, or more, than acquisition costs  in this scenario. Furthermore, in our use of acquisition costs for property,  IHS generally provided us the acquisition cost of equipment. IHS provided  us little data that contained depreciation or fair market value of the  equipment. Therefore, we modified our report to state that the value of  lost or stolen property was represented as the acquisition cost.
We disagree with HHS’s portrayal of the six specific cases cited in their  response to our draft report. Specifically:    Report of survey for Alaska tribal self-determination award: In its  response, HHS stated that most of the $6 million that was written off in the  Report of Survey was transferred from IHS to local Tribal communities,  the U.S. Air Force, or abandoned on an IHS construction site. As stated in  our report, none of these transfers or disposals were properly  documented. Without proper documentation, it is impossible to determine  what happened with the property, which is why we consider it to be lost or  stolen. Although HHS’s comments state that these items were old and had  little remaining useful value, IHS continues to purchase new property to  replace old, necessary items—in which case it is likely that replacement  costs are as much (or more) than acquisition cost. Furthermore, analysis  of IHS’s response raises concerns about the nature of disposal for these  items, including vehicles and machinery, which could cause environmental  hazards as a result of abandonment.
Tucson Report of Survey and “jaws of life”: HHS stated that 45 items,  including the “jaws of life” equipment that we reported as lost or stolen in  our draft report, have been recently found. We identified that these items  were lost or stolen because they were documented in a September 2006  Report of Survey. We followed up on the status of these property items on  our site visits to Tucson on two occasions in late 2007 and early 2008. On  both occasions, IHS confirmed that these items had not been found and  that an investigation into their loss had not been performed. Based on this  timeline, these items were lost for almost 2 years. IHS has not provided us  any documentation to substantiate the location of the jaws of life or any  other property identified in the Tucson Report of Survey. Therefore, we  cannot validate that these items were found.
Allegation of misrepresentation by IHS property staff: HHS stated  that the majority of the 1,180 items that were not accounted for in the  April 2007 inventory had been located and reconciled by January 2008.  Additionally in our report, we state that the IHS Director responsible for  property claimed that IHS was able to find about 800 of these missing  items. However, based on our physical inventory testing at headquarters,  which included verifying IHS’s reconciled items in January 2008, we found  that only some of these items have been found. We also identified items  missing from IHS’s April 2007 inventory in addition to the 1,180 shortage  identified by IHS. Specifically, of the 3,155 pieces of IT equipment  recorded in the records for IHS headquarters, we determined that about  1,140 items (or about 36 percent) were lost, stolen, or unaccounted for.  Part of the discrepancy can be attributed to the fact that we did not accept  fabricated documents that the IHS property management specialist  provided us as discussed below. We continue to believe that the IHS  Director responsible for property attempted to thwart our investigation  through misrepresentations.
Allegation of fabricated documents: HHS stated that IHS generated  disposal records in January 2008 to “establish an audit trail” showing that  571 items missing during our inventory work were disposed of properly.  However, when these documents were presented to us, they were  identified as the actual supporting documents, not an “audit trail.”  Additionally, HHS fails to acknowledge that the disposal records were not  dated and contained no signatures approving of the disposal. Because  these records clearly did not meet evidence standards, we asked the IHS  property employee who gave us the documents about their origin. He  admitted to fabricating them in order to satisfy our request for the  disposition of the property. By focusing on the January 2008 date of our  request, HHS is missing the point of our finding—that an IHS employee  tried to make the missing property properly accounted for by generating  documents and representing them as authentic disposal records. We have  referred the matter to the HHS Office of Inspector General for further  investigation.
Allegation of wasteful purchases: HHS stated that it initiated a  procurement strategy to increase the cost efficiency of replacing computer  technology for its employees by buying in bulk so it can take advantage of  pricing discounts and reduce the critical down time for IT tools. It also  stated that the 25 on-hand “spare computers” noted in the report were an  acceptable level of inventory. We agree that outdated technology should  be replaced by taking advantage of bulk purchases. We also agree that  there should be some inventory held in reserve for emergency needs that  arise during the year. However, as stated in the report, we found that there  were 3 computers for every person at IHS headquarters—a ratio that bulk  ordering policies do not adequately explain. In addition to the 25 new and  unused computers cited by HHS in its response, we identified several  other examples of waste at IHS headquarters including computer  equipment items issued to vacant offices and 7 new and unused laptops  stored in an unlocked cabinet. We also noted examples of waste at the  field locations, such as an unwrapped, 23-inch, widescreen monitor worth  almost $1,700. The employee in possession of the monitor stated she did  not know why IT sent her the monitor and claimed that it had never been  used. We believe that such examples exemplify wasteful purchases of  equipment rather than a prudent procurement strategy.
Yard Sale: HHS stated that IHS headquarters staff have no knowledge of a  “yard sale” of computers and other property in Nevada. We reported on  this “yard sale” based on the confirmation of eight IHS property officials,  including the Phoenix Area executive officer. In its response, HHS claimed  that the 17 computers sold at this “yard sale” were used for educational  purposes and thus likely did not contain sensitive information. The  computers were located at a Youth Wellness Center and, according to the  Phoenix area property manager, were never “cleaned” before transfer  outside of the center. Hence, we continue to believe that the potential  release of patient data and the obvious impropriety of holding a “yard sale”  for government equipment make it prudent for the HHS OIG to investigate  the matter.
Finally, HHS disagreed with our recommendation to establish procedures  to track all sensitive equipment such as blackberries and cell phones even  if they fall under the accountable dollar threshold criteria. We made this  recommendation because we identified examples of lost or stolen  equipment that contained sensitive data, such as a PDA containing medical  data for patients at a Tucson, Arizona area hospital. According to an IHS  official, the device contained no password or data encryption, meaning  that anyone who found (or stole) the PDA could have accessed the  sensitive medical data. While we recognize that IHS may have taken steps  to prevent the unauthorized release of sensitive data and acknowledge  that it is not required to track devices under a certain dollar threshold, we  are concerned about the potential harm to the public caused by the loss or  theft of this type of equipment. Therefore, we continue to believe that such  equipment should be tracked and that our recommendation remains valid.
As agreed with your office, unless you publicly release its contents earlier  we plan no further distribution of this report until 30 days from the date of  this letter. At that time, we will send copies of this report to the Secretary  of the Department of Health and Human Services, the Director of IHS, and  other interested parties.
The report is also available at no charge on the GAO Web site at  http://www.gao.gov. If you have any questions concerning this report,  please contact either Gregory D. Kutz at (202) 512-6722 or kutzg@gao.gov.  Contact points for our Offices of Congressional Relations and Public  Affairs may be found on the last page of this report. GAO staff who made  major contributions to this report are listed in appendix III.
section_title: Appendix I: Scope and Methodology
paragraphs: To substantiate the allegation of lost or stolen property and wasteful  spending at the Indian Health Service (IHS), we analyzed IHS documents  of lost or stolen property from fiscal year 2004 through fiscal year 2007.  We also conducted a full physical inventory of property at IHS  headquarters and statistically tested information technology (IT)  equipment inventory at seven selected IHS field locations. To identify  specific cases of lost or stolen property and wasteful spending, we  analyzed IHS documents and made observations during our physical  inventory and statistical tests.
We performed a full physical inventory at IHS headquarters because the  whistleblower specifically identified problems at that location.  Specifically, we tested all 3,155 headquarters property items which were  largely comprised of IT equipment that IHS had recorded in its property  records as of April 2007. We physically observed each item and its related  IHS-issued bar code and verified that the serial number related to the bar  code was consistent with IHS’s property records.
Although IHS property in the field locations includes inventory items such  as medical equipment and heavy machinery, we performed a statistical  test of only IT equipment inventory at seven IHS field locations to  determine whether the lack of accountability for inventory was pervasive  at other locations in the agency. We limited our scope to testing only IT  equipment items which are highly pilferable and can be easily converted to  personal use such as laptops, desktop computers, and digital cameras. We  selected the seven field locations based on book value of inventory and  geographic proximity. We selected five field office locations because they  had the highest dollar amount of IT equipment according to IHS’s property  records. We selected the two additional sites based on their geographic  proximity to the other field locations being tested. Our findings at these  seven locations cannot be generalized to IHS’s other locations.
To estimate the extent of lost or stolen property at these seven locations,  we selected a probability sample of 250 items from a population of 7,211 IT  items that had a book value of over $19 million. Because we followed a  probability procedure based on random selections with each item having  an equal chance of being selected, our sample is only one of a large  number of samples that we might have drawn. Since each sample could  have provided different estimates, we express our confidence in the  precision of our particular sample’s results as a 95 percent confidence  interval. This is the interval that would contain the actual population value  for 95 percent of the samples we could have drawn. As a result, we are 95  percent confident that each of the confidence intervals in this report will  include the true values in the study population. Based on this sample, we  estimate the number, the percent, and the dollar amount of lost or stolen  property at IHS. The 95 percent confidence intervals for each of these  estimates is summarized below:  We considered equipment to be lost or stolen if (1) we could not physically  observe the item during the inventory; (2) IHS could not provide us with a  picture of the item, with a visible bar code and serial number, within 2  weeks of our initial request; or (3) IHS could not provide us with adequate  documentation to support the disposal of the equipment.
We performed appropriate data reliability procedures for our physical  inventory testing at IHS Headquarters and sample testing at the seven case  study locations including (1) testing the existence of items in the database  by observing the physical existence of all items at IHS headquarters and IT  equipment selected in our sample, and (2) testing the completeness of the  database by performing a 100 percent floor-to-book inventory at IHS  headquarters and judgmentally selecting inventory items in our sample to  determine if these items were maintained in IHS inventory records.  Although our testing of the existence and completeness of IHS property  records determined that IHS inventory records are neither accurate nor  complete, we determined that the data were sufficient to perform these  tests and project our results to the population of IT equipment. In addition,  we interviewed IHS agency officials, property management staff, and other  IHS employees. We also interviewed Department of Health and Human  Services (HHS) officials concerning the migration of the Property  Management Information System (PMIS) and officials at the Program  Support Center (PSC).
Although we did not perform a systematic review of IHS internal controls,  we identified key causes of lost and stolen property and wasteful spending  at IHS by examining IHS and HHS policies and procedures, conducting  interviews with IHS officials, and our observations of property through our  inventory testing.
We conducted our forensic audit and related investigations from June 2007  to May 2008 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. Despite IHS  efforts to obstruct our review, we were still able to accomplish our  objectives. We believe that the evidence obtained provides a reasonable  basis for our findings and conclusions based on our audit objectives. We  performed our investigative work in accordance with standards prescribed  by the President’s Council on Integrity and Efficiency.
section_title: Appendix II: Comments from the Department of Health & Human Services
section_title: Appendix III: GAO Contacts and Acknowledgments
subsections: section_title: GAO Contact
paragraphs: For further information about this report, please contact Gregory D. Kutz  at (202) 512-6722 or kutzg@gao.gov.
section_title: Acknowledgments
paragraphs: In addition to the individual named above, the following made  contributions to this report: Verginie Amirkhanian, Erika Axelson, Joonho  Choi, Jennifer Costello, Jessica Gray, Richard Guthrie, John Kelly, Bret  Kressin, Richard Kusman, Barbara Lewis, Megan Maisel, Andrew  McIntosh, Shawn Mongin, Sandra Moore, James Murphy, Andy O’Connell,  George Ogilvie, Chevalier Strong, Quan Thai, Matt Valenta, and David  Yoder.