We substantiated the allegation of gross mismanagement of property at IHS. Specifically, we found that thousands of computers and other property, worth millions of dollars, have been lost or stolen over the past several years. We analyzed IHS reports for headquarters and the 12 regions from the last 4 fiscal years. These reports identified over 5,000 property items, worth about $15.8 million, that were lost or stolen from IHS headquarters and field offices throughout the country. The number and dollar value of this missing property is likely much higher because IHS did not conduct full inventories of accountable property for all of its locations and did not provide us with all inventory documents as requested. Despite IHS attempts to obstruct our investigation, our full physical inventory at headquarters and our random sample of property at 7 field locations, identified millions of dollars of missing property. Our analysis of Report of Survey records from IHS headquarters and field offices show that from fiscal year 2004 through fiscal year 2007, IHS property managers identified over 5,000 lost or stolen property items worth about $15.8 million. Although we did receive some documentation from IHS, the number and dollar value of items that have been lost or stolen since 2004 is likely much higher for the following reasons. First, IHS does not consistently document lost or stolen property items. For example, 9 of the 12 IHS regional offices did not perform a full physical inventory in fiscal year 2007. Second, an average of 5 of the 12 regions did not provide us with all of the reports used to document missing property for each year since fiscal year 2004, as we requested. Third, we found about $11 million in additional inventory shortages from our analysis of inventory reports provided to us by IHS, but we did not include this amount in our estimate of lost or stolen property because IHS has not made a final determination on this missing property. Some of the egregious examples of lost or stolen property include: In April 2007, a desktop computer containing a database of uranium miners’ names, social security numbers, and medical histories was stolen from an IHS hospital in New Mexico. According to an HHS report, IHS attempted to notify the 849 miners whose personal information was compromised, but IHS did not issue a press release to inform the public of the compromised data. From 1999 through 2005, IHS did not follow required procedures to document the transfer of property from IHS to the Alaska Native Tribal Health Consortium, resulting in a 5-year unsuccessful attempt by IHS to reconcile the inventory. Our analysis of IHS documentation revealed that about $6 million of this property—including all-terrain vehicles, generators, van trailers, pickup trucks, tractors, and other heavy equipment—was lost or stolen. In September 2006, IHS property staff in Tucson attempted to write off over $275,000 worth of property, including Jaws of Life equipment valued at $21,000. The acting area director in Tucson refused to approve the write-off because of the egregious nature of the property loss. To substantiate the whistleblower’s allegation of missing IT equipment, we performed our own full inventory of IT equipment at IHS headquarters. Our results were consistent with what the whistleblower claimed. Specifically, of the 3,155 pieces of IT equipment recorded in the records for IHS headquarters, we determined that about 1,140 items (or about 36 percent) were lost, stolen, or unaccounted for. These items, valued at around $2 million, included computers, computer servers, video projectors, and digital cameras. According to IHS records, 64 of the items we identified as missing during our physical inventory were “new” in April 2007. During our investigation of the whistleblower’s complaint, IHS made a concerted effort to obstruct our work. For example, the IHS Director over property misrepresented to us that IHS was able to find about 800 of the missing items from the whistleblower’s complaint. In addition, an IHS property specialist attempted to provide documentation confirming that 571 missing items were properly disposed of by IHS. However, we found that the documentation he provided was not dated and contained no signatures. Finally, IHS provided us fabricated receiving reports after we questioned them that the original reports provided to us were missing key information on them. Figure 1 shows the fabricated receiving report for a shipment of new scanners delivered to IHS. ? As shown in figure 1, there is almost a 3-month gap between the date the equipment was received in September and the date that the receiving report was completed and signed in December—even though the document should have been signed upon receipt. In fact, the new receiving report IHS provided was signed on the same date we requested it, strongly suggesting that IHS fabricated these documents in order to obstruct our investigation. We selected a random sample of IT equipment inventory at seven IHS field offices to determine whether the lack of accountability for inventory was confined to headquarters or occurred elsewhere within the agency. Similar to our finding at IHS headquarters, our sample results also indicate that a substantial number of pieces of IT equipment were lost, stolen, or unaccounted for. Specifically, we estimate that for the 7 locations, about 1,200 equipment items or 17 percent, with a value of $2.6 million were lost, stolen or unaccounted for. Furthermore, some of the missing equipment from the seven field locations could have contained sensitive information. We found that many of the missing laptops were assigned to IHS hospitals and, therefore, could have contained patient information and social security numbers and other personal information. IHS has also exhibited ineffective management over the procurement of IT equipment, which has led to wasteful spending of taxpayer funds. Some examples of wasteful spending that we observed during our audit of headquarters and field offices include: Approximately 10 pieces of IT equipment, on average, are issued for every one employee at IHS headquarters. Although some of these may be older items that were not properly disposed, we did find that many employees, including administrative assistants, were assigned two computer monitors, a printer and scanner, a blackberry, subwoofer speakers, and multiple computer laptops in addition to their computer desktop. Many of these employees said they rarely used all of this equipment, and some could not even remember the passwords for some of their multiple laptops. IHS purchased numerous computers for headquarters staff in excess of expected need. For example, IHS purchased 134 new computer desktops and monitors for $161,700 in the summer of 2007. As of February 2008, 25 of these computers and monitors—valued at about $30,000—were in storage at IHS headquarters. In addition, many of the computer desktops and monitors purchased in the summer of 2007 for IHS headquarters were assigned to vacant offices. The lost or stolen property and waste we detected at IHS can be attributed to the agency’s weak internal control environment and its ineffective implementation of numerous property policies. In particular, IHS management has failed to establish a strong “tone at the top” by allowing inadequate accountability over property to persist for years and by neglecting to fully investigate cases related to lost and stolen items. Furthermore, IHS management has not properly updated its personal property management policies, which IHS has not revised since 1992. Moreover, IHS did not (1) conduct annual inventories of accountable property; (2) use receiving agents for acquired property at each location and designate property custodial officers in writing to be responsible for the proper use, maintenance, and protection of property; (3) place barcodes on accountable property to identify it as government property; (4) maintain proper individual user-level accountability, including custody receipts, for issued property; (5) safeguard IT equipment; or (6) record certain property in its new property management information system. To strengthen IHS’s overall control environment and “tone at the top”, we made 10 recommendations to IHS to update its policy and enforce property management policies of both the HHS and IHS. Specifically, we recommended that the Director of IHS should direct IHS property officials to take the following 10 actions: Update IHS personal property management policies to reflect any policy changes that have occurred since the last update in 1992. Investigate circumstances surrounding missing or stolen property instead of writing off losses without holding anyone accountable. Enforce policy to conduct annual inventories of accountable personal property at headquarters and all field locations. Enforce policy to use receiving agents to document the receipt of property and distribute the property to its intended user and to designate property custodial officers in writing to be responsible for the proper use, maintenance, and protection of property. Enforce policy to place bar codes on all accountable property. Enforce policy to document the issuance of property using hand receipts and make sure that employees account for property at the time of transfer, separation, change in duties, or on demand by the proper authority. Maintain information on users of all accountable property, including their buildings and room numbers, so that property can easily be located. Physically secure and protect property to guard against loss and theft of equipment. Enforce the use of the property management information system database to create reliable inventory records. Establish procedures to track all sensitive equipment such as blackberries and cell phones even if they fall under the accountable dollar threshold criteria. HHS agreed with 9 of the 10 recommendations. HHS disagreed with our recommendation to establish procedures to track all sensitive equipment such as blackberries and cell phones even if they fall under the accountable dollar threshold criteria. We made this recommendation because we identified examples of lost or stolen equipment that contained sensitive data, such as a PDA containing medical data for patients at a Tucson, Arizona area hospital. According to an IHS official, the device contained no password or data encryption, meaning that anyone who found (or stole) the PDA could have accessed the sensitive medical data. While we recognize that IHS may have taken steps to prevent the unauthorized release of sensitive data and acknowledge that it is not required to track devices under a certain threshold, we are concerned about the potential harm to the public caused by the loss or theft of this type of equipment. Therefore, we continue to believe that such equipment should be tracked and that our recommendation remains valid. Mr. Chairman and Members of the Committee, this concludes our statement. We would be pleased to answer any questions that you or other members of the committee may have at this time. For further information about this testimony, please contact Gregory D. Kutz at (202) 512-6722 or kutzg@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this testimony. In addition to the individual named above, the individuals who made major contributions to this testimony were Verginie Amirkhanian, Erika Axelson, Joonho Choi, Jennifer Costello, Jane Ervin, Jessica Gray, Richard Guthrie, John Kelly, Bret Kressin, Richard Kusman, Barbara Lewis, Megan Maisel, Andrew McIntosh, Shawn Mongin, Sandra Moore, James Murphy, Andy O’Connell, George Ogilvie, Chevalier Strong, Quan Thai, Matt Valenta, and David Yoder. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: In June 2007, GAO received information from a whistleblower through GAO's FraudNET hotline alleging millions of dollars in lost and stolen property and gross mismanagement of property at Indian Health Service (IHS), an operating division of the Department of Health and Human Services (HHS). GAO was asked to conduct a forensic audit and related investigations to (1) determine whether GAO could substantiate the allegation of lost and stolen property at IHS and identify examples of wasteful purchases and (2) identify the key causes of any loss, theft, or waste. GAO analyzed IHS property records from fiscal years 2004 to 2007, conducted a full physical inventory at IHS headquarters, and statistically tested inventory of information technology (IT) equipment at seven IHS field locations in 2007 and 2008. GAO also examined IHS policies, conducted interviews with IHS officials, and assessed the security of property. Millions of dollars worth of IHS property has been lost or stolen over the past several years. Specifically: IHS identified over 5,000 lost or stolen property items, worth about $15.8 million, from fiscal years 2004 through 2007. These missing items included all-terrain vehicles and tractors; Jaws of Life equipment; and a computer containing sensitive data, including social security numbers. GAO's physical inventory identified that over 1,100 IT items, worth about $2 million, were missing from IHS headquarters. These items represented about 36 percent of all IT equipment on the books at headquarters in 2007 and included laptops and digital cameras. Further, IHS staff attempted to obstruct GAO's investigation by fabricating hundreds of documents. GAO also estimates that IHS had about 1,200 missing IT equipment items at seven field office locations worth approximately $2.6 million. This represented about 17 percent of all IT equipment at these locations. However, the dollar value of lost or stolen items and the extent of compromised data are unknown because IHS does not consistently document lost or stolen property, and GAO only tested a limited number of IHS locations. Information related to cases where GAO identified fabrication of documents and potential release of sensitive data was referred to the HHS Inspector General for further investigation. GAO identified that the loss, theft, and waste can be attributed to IHS's weak internal control environment. IHS management has failed to establish a strong "tone at the top," allowing property management problems to continue for more than a decade with little or no improvement or accountability for lost and stolen property and compromise of sensitive personal data. In addition, IHS has not effectively implemented numerous property policies, including the proper safeguards for its expensive IT equipment. For example, IHS disposed of over $700,000 worth of equipment because it was "infested with bat dung."