IHS, an operating division of HHS, is responsible for providing health services to federally recognized tribes of American Indians and Alaska natives. In 2007, IHS provided health services to approximately 1.9 million American Indians and Alaska natives from more than 562 federally recognized tribes. As an operating division of HHS, IHS is included in the agency’s consolidated financial statement and has not been audited independently since 2002. IHS is divided into 12 regions and operates 163 service units throughout the country. Service units may contain one or more health facilities, including hospitals, health centers, village clinics, health stations, and school health centers. There are 114 IHS-operated health facilities and 565 tribally operated health facilities. The IHS budget appropriation in 2007 was $3.2 billion, approximately 54 percent of which was administered by tribes through various contracts and compacts with the federal government. We substantiated the allegation of gross mismanagement of property at IHS. Specifically, we found that thousands of computers and other property, worth millions of dollars, have been lost or stolen. We analyzed IHS reports for headquarters and the 12 regions from the last 4 fiscal years which identified over 5,000 property items, worth about $15.8 million, that were lost or stolen from IHS headquarters and field offices throughout the country. The number and dollar value of this missing property is likely much higher because IHS did not conduct full inventories of accountable property for all of its locations and did not provide us with all inventory documents as requested. Despite IHS attempts to obstruct our investigation, our full physical inventory at headquarters and our random sample of property at seven field locations identified millions of dollars of missing property. We also found that IHS has made wasteful purchases over the past few years. For example, IHS has bought computer equipment that is currently unused in its original box and has issued IT equipment to its employees that duplicate the equipment already provided to them. Our analysis of Report of Survey records from IHS headquarters and field offices shows that from fiscal year 2004 through fiscal year 2007, IHS property managers identified over 5,000 lost or stolen property items worth about $15.8 million. Although we did receive some documentation from IHS, the number and dollar value of items that have been lost or stolen since 2004 is likely much higher for the following reasons. First, IHS does not consistently document lost or stolen property items. For example, 9 of the 12 IHS regional offices did not even perform a physical inventory in fiscal year 2007. Second, for each year since fiscal year 2004, an average of 5 of the 12 regions did not provide us with all of the reports used to document missing property since fiscal year 2004, as we requested. The following cases provide information on five of the egregious examples of lost and stolen property we identified. In each case, IHS has not held any staff accountable for the missing items. In some of the cases, IHS did not even perform an investigation to try and locate the missing items or determine what actions should be taken. IHS staff held a “yard sale” of 17 computers and other property worth $16,660 in Schurz, Nevada, between June and July 2005. According to an IHS property manager, the equipment was advertised to the public via fliers indicating that excess federal property was to be given away for free. To date, IHS has not completed the investigation or held any IHS personnel responsible and, according to a 2006 report, intends to writeoff the missing equipment. According to the Phoenix area property manager, the 17 computers identified as missing were transferred from a youth patient center and could contain sensitive youth patient information because the computers were never “cleaned” before being transferred to the Schurz service unit. We are referring this potential release of patient data to the HHS OIG for further investigation. From 1999 through 2005, IHS did not follow required procedures to document the transfer of property from IHS to the Alaska Native Tribal Health Consortium, resulting in an unsuccessful 5-year attempt by IHS to reconcile the inventory. Our analysis of IHS documentation revealed that about $6 million of this property—including all-terrain vehicles, generators, van trailers, tractors, and other heavy equipment—was lost or stolen. In April 2007, a desktop computer containing a database of uranium miner names, social security numbers, and medical histories was stolen from an IHS hospital in New Mexico. According to an HHS report, IHS attempted to notify the 849 miners whose personal information was compromised, but IHS did not issue a press release to inform the public of the compromised data. In addition to this incident, the IHS Finance department recently reported a missing Personal Digital Assistant (PDA) in March 2008 when they requested a replacement. The PDA contained medical information and names of patients at a Tucson Area Hospital. According to the IHS IT official, the device contained no password or data encryption. This was in violation of federal policy and increased the risk that sensitive information could be disclosed to unauthorized individuals. Both of these cases have already been reported to HHS by the IHS Office of Information Technology. In September 2006, IHS property staff in Tucson attempted to write off over $275,000 worth of property, including Jaws of Life equipment valued at $21,000. The acting area director in Tucson refused to approve the write-off because of the egregious nature of the property loss. However, no investigation has been conducted to date. According to an IHS June 2006 report, a $4,000 Apple Powerbook laptop was stolen from an employee’s vehicle in the Navajo area. Despite the lack of authorization, the employee took the laptop for use during off-duty hours—in violation of IHS policy. Because the employee violated IHS policy, IHS’s initial determination, with which the employee agreed, was that the employee was responsible for the loss and therefore should reimburse the federal government for the value of the stolen computer. However, the IHS approving official reversed the initial determination decision stating that the employee had since resigned and the loss was due to theft. To substantiate the whistleblower’s allegation of missing IT equipment, we performed our own full inventory of IT equipment at IHS headquarters. Our results were consistent with what the whistleblower claimed. Specifically, of the 3,155 pieces of IT equipment recorded in the records for IHS headquarters, we determined that about 1,140 items (or about 36 percent) were lost, stolen, or unaccounted for. These items, valued at around $2 million, included computers, computer servers, video projectors, and digital cameras. According to IHS records, 64 of the items we identified as missing during our physical inventory were “new” in April 2007. Furthermore, we found that some of the missing computers were assigned to the IHS human resources division. These computers likely contained sensitive employee data including names and Social Security numbers protected under the Privacy Act of 1974. We are referring these cases where there was a potential release of sensitive data including employee social security numbers to the HHS OIG for further investigation. During our investigation of the whistleblower’s complaint, IHS made a concerted effort to obstruct our work. IHS officials made misrepresentations and fabricated documents to impede our work. Specifically, The IHS Director responsible for property claimed that IHS was able to find about 800 of the missing items from the whistleblower’s complaint. However, based on our physical inventory testing at headquarters, we found that this statement was a misrepresentation and that only some of these items have been found. An IHS property specialist attempted to provide documentation confirming that 571 missing items were properly disposed of by IHS. However, we found that the documentation he provided was not dated and contained no signatures. When we questioned the official about these discrepancies, he admitted that he fabricated the documents. We are referring this individual to the HHS OIG for further investigation. According to IHS policy, receiving reports are always signed by an authorized employee. As part of our inventory, we requested receiving reports for three recent purchase orders. For one purchase order, IHS was not able to provide us with any receiving reports. For the other two purchase orders, IHS provided us with receiving reports that were not properly completed; e.g., the reports were not signed by the person who received the property and did not contain the date that the property was received. When we questioned these discrepancies, IHS sent us “new” receiving reports for the three purchase orders, but all of them contained questionable dates and signatures. For example, figure 1 shows the fabricated receiving report for a shipment of new scanners delivered to IHS. ? As shown in figure 1, there is almost a 3-month gap between the date the equipment was received in September and the date that the receiving report was completed and signed in December—-even though the document should have been signed upon receipt. In fact, the new receiving report IHS provided was signed on the same date we requested it, strongly suggesting that IHS fabricated these documents in order to obstruct our investigation. Further, after testing one of the other two fabricated receiving reports, we found that 10 brand new desktop computers worth almost $12,000 could not be located even though the receiving report indicated that they were “received” in July 2007. We selected a random sample of IT equipment inventory at seven IHS field offices to determine whether the lack of accountability for inventory was confined to headquarters or occurred elsewhere within the agency. Similar to our finding at IHS headquarters, our sample results also indicate that a substantial number of pieces of IT equipment were lost, stolen, or unaccounted for. Specifically, we estimate that for the seven locations, about 1,200 equipment items, with a value of $2.6 million were lost or stolen. As shown in table 1, our estimates are based on a statistical sample of 250 items from a population of 7,211 IT equipment items worth over $19 million recorded in property records for IT equipment at the seven field office locations. Of the 250 items that we sampled, IHS could not locate or substantiate the disposal of 42 items, or about 17 percent of the sample population. Furthermore, some of the missing equipment from the seven field locations could have contained sensitive information. Although personal health information requires additional protections from unauthorized release under the Health Information Portability and Accountability Act of 1996 (HIPAA) and implementing regulations, we found that many of the missing laptops were assigned to IHS hospitals and, therefore, could have contained patient information, social security numbers, and other personal information. We are referring these cases where there was a potential release of sensitive data including patient information to the HHS OIG for further investigation. IHS has also exhibited ineffective management over the procurement of IT equipment, which has led to wasteful spending of taxpayer funds. IHS purchased excessive amounts of IT equipment for its staff, most notably at the headquarters office. An IHS official stated that IHS purchased new computers using “end of the year dollars.” Some examples of wasteful spending that we observed during our audit of headquarters and field offices include the following: Approximately 10 pieces of IT equipment, on average, are issued for every one employee at IHS headquarters. Although some of these may be older items that were not properly disposed, we did find that many employees, including administrative assistants, were assigned two computer monitors, a printer and scanner, a blackberry, subwoofer speakers, and multiple computer laptops in addition to their computer desktop. Many of these employees said they rarely used all of this equipment and some could not even remember the passwords for some of their multiple laptops. IHS purchased computers for headquarters staff in excess of expected need. For example, IHS purchased 134 new computer desktops and monitors for $161,700 in the summer of 2007. As shown in figure 2, as of February 2008 25 of these computers and monitors—valued at about $30,000—were in storage at IHS headquarters. An IT specialist stated that the computers and monitors were “extras.” In addition, we identified 7 new laptops that were stored in an unlocked cabinet at headquarters and never used. Computers and other IT equipment were often assigned to vacant offices. For example, many of the computer desktops and monitors purchased in the summer of 2007 for IHS headquarters were assigned to vacant offices. In addition, as shown in figure 3, we found two computers, two monitors, and three printers in an employee’s office at the Albuquerque field location we visited. The IHS area property manager stated that this equipment was issued to an employee who spends a majority of his time on travel to training and treatment centers. An official for the IHS National Program stated that IHS purchased new computers using “end of the year dollars.” For example, as shown in figure 4, one field office employee in Gallup, New Mexico had an unwrapped, 23- inch, widescreen monitor worth almost $1,700 in her office. The employee stated that she did not know why IT sent her the monitor and she claimed that it has never been used. The lost or stolen property and waste we detected at IHS can be attributed to the agency’s weak internal control environment and its ineffective implementation of numerous property policies. In particular, IHS management has failed to establish a strong “tone at the top” by allowing inadequate accountability over property to persist for years and by neglecting to fully investigate cases related to lost and stolen items. Furthermore, IHS management has not properly updated its personal property management policies, which IHS has not revised since 1992. Moreover, IHS did not (1) conduct annual inventories of accountable property; (2) use receiving agents for acquired property at each location and designate property custodial officers in writing to be responsible for the proper use, maintenance, and protection of property; (3) place bar codes on accountable property to identify it as government property; (4) maintain proper individual user-level accountability, including custody receipts, for issued property; (5) safeguard IT equipment; or (6) record certain property in its property management information system (PMIS). Weak tone at the top: The importance of the “tone at the top” or the role of management in establishing a positive internal control environment cannot be overstated. GAO’s internal control standards state that “management plays a key role in demonstrating and maintaining an organization’s integrity and ethical values, especially in setting and maintaining the organization’s ethical tone, providing guidance for proper behavior, removing temptations for unethical behavior, and providing discipline when appropriate.” However, IHS management has failed to establish and maintain these ethical values. As far back as 1997, an IHS memo by the then Acting Director stated that the agency had problems with lost and stolen property at IHS headquarters. The memo also stated that unused equipment was not safeguarded against loss or theft. However, we found little corrective action was taken by IHS. For example, management failed to update IHS personal property management policies, which have not been revised since 1992. In addition, IHS has historically shown little motivation to hold its employees liable for missing property. Instead of investigating the circumstances surrounding missing property, IHS writes off the losses without holding anyone accountable. As a result, an IHS property official admitted to us that there is no accountability over IHS property. For example, figure 5 shows a report used to write off almost $900,000 worth of missing IT equipment in 2004, including laptop and desktop computers, servers, cameras, routers, and fax machines. This is just one of four reports that IHS used in 2004 to write off a combined total of $1.8 million dollars worth of IT equipment. As shown in the figure, the report does not hold anyone responsible for the missing inventory, but it does call for the improvement of controls over property management. However, as shown by our audit and related investigations, IHS has made minimal efforts to improve property management and oversight. Despite this fact, IHS rewarded the individuals responsible for these functions in its property group with about $40,000 in merit awards from 2003 through 2007. No annual inventories: HHS and IHS policies require IHS personnel to conduct annual inventories of accountable personal property, including property at headquarters and in field offices. However, IHS headquarters did not conduct any annual inventories from fiscal years 2004 through 2006. In addition, property managers were not able to accurately document the findings of their fiscal year 2007 inventory nearly a year after it was conducted. Moreover, in fiscal year 2007, only 3 out of 12 regions conducted a full physical inventory. Consequently, the extent of missing property at IHS is unknown. Failure to use receiving agents and to designate property custodial officers: IHS policy requires that each accountable area designate at least one receiving agent to receive purchased property. The receiving agent is responsible for documenting the receipt of the property (i.e., receiving report) and then distributing the property to its intended user. However, we found that acquired property is often sent directly to the user, bypassing the receiving agent. For example, the IT department sometimes receives new computers and IT equipment directly instead of utilizing the receiving agent. In addition, HHS requires the designation of property custodial officers in writing to be responsible for the proper use, maintenance, and protection of property. However, an IHS official said that property custodial officers have not formally been designated for headquarters because of high staff turnover. Lack of property bar codes: HHS and IHS policy mandate that all accountable property have a bar code identifying it as government property. However, in our audit of IHS headquarters inventory, we identified over 100 pieces of IT equipment, including blackberries and digital cameras, that were not properly bar coded. Much of this equipment likely did not receive a bar code because, as discussed earlier, IHS does not receive property in a central location. Lack of personal custody property records: HHS requires the use of hand receipts, known as HHS Form 439, any time property is issued to an employee. This form should be retained by a property official so that property can be tracked at the time of transfer, separation, change in duties, or when requested by the proper authority. By signing this form, an IHS employee takes responsibility for the government-issued equipment. According to an IHS property official, IHS headquarters does not use the HHS Form 439, nor do they use any other type of hand receipt. Officials from several IHS regions stated that they use the form only in limited cases. Without the issuance of this form, there is no documentation as to where the equipment is located and no mechanism to hold the user accountable for the equipment. Lack of user-level accountability: HHS requires IHS to document information on the user of equipment, including building and room number, so that property can be tracked and located. However, IHS did not properly maintain this information. Property personnel instead relied on their personal recollection to locate property items. For example, on several occasions during our headquarters inventory, IHS property staff could not identify the property user. As a result, the property staff had to make inquiries with other staff to obtain information on the user of the equipment. Further, IHS personnel in the field offices stated that it took them several days to locate items that were included in our sampled inventory. Furthermore, according to the IHS policy manual, when equipment is no longer needed by the user, a request for property action should be submitted in writing to the Property Accountable Officer (PAO). The PAO then determines if the item can be transferred to another user within IHS. However, in many cases, equipment is redistributed by the IT department or sent to another user without PAO approval. In our audit of IHS headquarters inventory, we found some items that were issued to an unspecified user or to employees who had retired or left the agency. To locate these items, IHS Headquarters staff had to inquire with the employee’s colleagues to determine the location of the equipment. In several cases, IHS was not able to locate the equipment assigned to separated employees, raising the possibility that the equipment was stolen. For example, one IHS employee stated that equipment had “disappeared” from an office vacated by a former employee. Weaknesses in physical security of IT equipment: According to the Indian Health Manual, property is to be adequately protected “against the hazards of fire, theft, vandalism, and weather commensurate with the condition and value” of the property. However, during our inventory review at both IHS headquarters and field office locations, we found that IHS did not follow this policy. Specifically, we found that IHS did not properly secure expensive IT equipment leaving them vulnerable to loss and theft. For example we found that: Surplus IT equipment that should have been disposed of was stored in unlocked employees’ offices, suite areas, conference rooms, and storage rooms. For example, figure 6 shows computer equipment stored in an unlocked multipurpose storage room at IHS headquarters. In addition, an IHS headquarters employee had newly purchased unsecured equipment, including a large flat screen TV, dual monitors, a printer, a scanner, a desktop, a subwoofer, a video camera, and a back-up power supply. IHS did not establish proper safeguards for storing IT equipment in IHS facilities or employees’ offices. For example, at one of the IHS hospitals we visited, the IT department did not lock its storage area, leaving several computers unsecured. Because equipment was not protected against damage or destruction, IHS had to dispose over $700,000 worth of equipment because it was “infested with bat dung.” Failure to use accountable property management system: HHS policy requires that all accountable property with a value of $5,000 or greater and all sensitive items with a value of $500 or greater be tracked by the PMIS property management system. The PMIS system is intended to improve accountability and standardize property records across HHS. Equipment that is not recorded in PMIS is not inventoried or otherwise controlled, placing it at increased risk of loss or theft. Although IHS had 2 years to migrate from legacy systems to the new inventory system, it has not yet fully converted to the PMIS system. Furthermore, officials from two field locations stated that they are not adding new equipment to the system because IHS headquarters told them not to use the system until further notice. Because it has not entered all property information into PMIS, IHS does not have reliable inventory records related to expensive, sensitive, and pilferable property. Specifically, IHS has failed to enter over 18,000 items, worth approximately $48 million, from headquarters and the sites we reviewed. Furthermore, we found that over half of the items we selected while performing our random sample testing of the seven field locations were not recorded in PMIS. The types of equipment that were not entered into PMIS include a $145,000 ultrasound unit, a $140,000 X-ray unit, and a $61,000 anesthesia machine. In addition, although items such as blackberries, cell phones, and digital cameras do not meet the criteria for inclusion in PMIS, these items are highly sensitive and should be accounted for by IHS. Furthermore, the magnitude of equipment that was not entered into the system is likely much higher because we did not analyze data from IHS locations not included in our statistical sample. Our audit confirmed the whisteblower’s allegation of gross mismanagement of property at IHS. IHS has exhibited a weak control environment and disregard for basic accountability over its inventory. As a result, IHS cannot account for its physical property and is vulnerable to the loss and theft of IT equipment and sensitive personal data. Further, IHS’ wasteful spending of IT equipment and lack of discipline or personal accountability for lost and stolen property and personal data has set a negative tone at the top that the status quo is acceptable. Moreover, intentional attempts of some IHS employees to thwart our investigation lead us to question the integrity and transparency of certain functions within the agency’s property management group and call for stronger leadership to strengthen tone at the top as well as throughout property management functions. We recommend that the Director of IHS strengthen IHS’s overall control environment and “tone at the top” by updating and enforcing its policies and procedures for property management. As part of this effort, the Director of IHS should direct IHS property officials to take the following 10 actions: Update IHS personal property management policies to reflect any policy changes that have occurred since the last update in 1992. Investigate circumstances surrounding missing or stolen property instead of writing off losses without holding anyone accountable. Enforce policy to conduct annual inventories of accountable personal property at headquarters and all field locations. Enforce policy to use receiving agents to document the receipt of property and distribute the property to its intended user and to designate property custodial officers in writing to be responsible for the proper use, maintenance, and protection of property. Enforce policy to place bar codes on all accountable property. Enforce policy to document the issuance of property using hand receipts and make sure that employees account for property at the time of transfer, separation, change in duties, or on demand by the proper authority. Maintain information on users of all accountable property, including their buildings and room numbers, so that property can easily be located. Physically secure and protect property to guard against loss and theft of equipment. Enforce the use of the PMIS property management database to create reliable inventory records. Establish procedures to track all sensitive equipment such as blackberries and cell phones even if they fall under the accountable dollar threshold criteria. We received written comments on a draft of this report from the Assistant Secretary for Legislation of the Department of Health and Human Services (HHS). HHS agreed with 9 of our 10 recommendations. However, HHS stated that our report contained inaccuracies and misinterpretations that it believes seriously weaken our conclusions. In its response to our draft report HHS cited three limitations. First, HHS stated that our report did not appreciate the fact that IHS property management is a unique system in its collaboration with Indian Tribes and that it operates its service units throughout the country. Second, HHS said that unaccountable property may be lower than what our report identified because the ongoing process of reconciling the prior system to the new system makes it more likely that the number of currently unaccounted for property items will be reduced rather than increase as the reconciliation progresses. Further, they state that the implementation process for the new system made it more difficult for IHS to provide GAO with the necessary documentation for audit. Third, HHS also stated that we overstated the net worth of unaccounted for items by not taking into account the depreciated value of those items. In addition, HHS response also cited six specific cases that they believe were misrepresented in our case studies. In response to HHS’s first limitation, we do not believe that we mischaracterized the uniqueness of IHS’s collaboration with Indian Tribes and the fact that it has service units throughout the country. In the report, we state that over half of IHS’s budget is administered by the tribes through various contracts and compacts with the federal government. We also state that IHS operates 163 service units that include one or more health facilities, such as hospitals, health centers, village clinics, health stations, and school health centers. Furthermore, the scope of our audit only included testing IHS property, which does not include the Tribal communities. However, we believe that because IHS operates in this type of control environment, IHS should have strong internal controls over its property and not the weak controls that were apparent in our audit. HHS also contends that the unaccountable property will be reduced from the reconciliation of the prior property system to the new system. However, we disagree—the lost or stolen property that was identified in our report came from IHS’s Report of Surveys, our full physical inventory of all equipment at IHS headquarters, and random sample testing of IT equipment at 7 field locations. Reports of Survey only identify specific property items that were written off IHS’s inventory books from physical inventories or other circumstances. Our physical inventory testing at IHS headquarters and random sample testing of IT equipment at the 7 field locations verify that there were additional missing property items to those identified in Reports of Survey. Furthermore, as stated in our report and HHS’s response, IHS did not perform complete physical inventories of equipment for most of its regional offices. Specifically we identified that 9 of the 12 regions did not perform a physical inventory in 2007. In addition, we reported that IHS did not complete the investigations of about $11 million of inventory shortages where a physical inventory was performed. As such, our estimate does not include lost or stolen property where physical inventories were not performed or where IHS did not complete its investigation of inventory shortages. Further, we do not believe that IHS’s conversion to a new system should impact IHS’s ability to maintain basic inventory documentation that is subject to audit. Without such documentation, IHS has no accountability of equipment that the American taxpayers entrusted to the agency. Thus, we believe that we likely underestimated, not overestimated, the amount of lost or stolen property. Finally, in its written response to our draft report HHS states its belief that our report overstates the net worth of unaccounted for items by not taking into consideration the depreciation value of these items. While we agree that the actual “loss” is less because of depreciation, we consider acquisition cost very relevant because, if property that IHS has lost or is stolen was necessary, IHS will need to buy new replacement property. It is likely that replacement costs are as much, or more, than acquisition costs in this scenario. Furthermore, in our use of acquisition costs for property, IHS generally provided us the acquisition cost of equipment. IHS provided us little data that contained depreciation or fair market value of the equipment. Therefore, we modified our report to state that the value of lost or stolen property was represented as the acquisition cost. We disagree with HHS’s portrayal of the six specific cases cited in their response to our draft report. Specifically: Report of survey for Alaska tribal self-determination award: In its response, HHS stated that most of the $6 million that was written off in the Report of Survey was transferred from IHS to local Tribal communities, the U.S. Air Force, or abandoned on an IHS construction site. As stated in our report, none of these transfers or disposals were properly documented. Without proper documentation, it is impossible to determine what happened with the property, which is why we consider it to be lost or stolen. Although HHS’s comments state that these items were old and had little remaining useful value, IHS continues to purchase new property to replace old, necessary items—in which case it is likely that replacement costs are as much (or more) than acquisition cost. Furthermore, analysis of IHS’s response raises concerns about the nature of disposal for these items, including vehicles and machinery, which could cause environmental hazards as a result of abandonment. Tucson Report of Survey and “jaws of life”: HHS stated that 45 items, including the “jaws of life” equipment that we reported as lost or stolen in our draft report, have been recently found. We identified that these items were lost or stolen because they were documented in a September 2006 Report of Survey. We followed up on the status of these property items on our site visits to Tucson on two occasions in late 2007 and early 2008. On both occasions, IHS confirmed that these items had not been found and that an investigation into their loss had not been performed. Based on this timeline, these items were lost for almost 2 years. IHS has not provided us any documentation to substantiate the location of the jaws of life or any other property identified in the Tucson Report of Survey. Therefore, we cannot validate that these items were found. Allegation of misrepresentation by IHS property staff: HHS stated that the majority of the 1,180 items that were not accounted for in the April 2007 inventory had been located and reconciled by January 2008. Additionally in our report, we state that the IHS Director responsible for property claimed that IHS was able to find about 800 of these missing items. However, based on our physical inventory testing at headquarters, which included verifying IHS’s reconciled items in January 2008, we found that only some of these items have been found. We also identified items missing from IHS’s April 2007 inventory in addition to the 1,180 shortage identified by IHS. Specifically, of the 3,155 pieces of IT equipment recorded in the records for IHS headquarters, we determined that about 1,140 items (or about 36 percent) were lost, stolen, or unaccounted for. Part of the discrepancy can be attributed to the fact that we did not accept fabricated documents that the IHS property management specialist provided us as discussed below. We continue to believe that the IHS Director responsible for property attempted to thwart our investigation through misrepresentations. Allegation of fabricated documents: HHS stated that IHS generated disposal records in January 2008 to “establish an audit trail” showing that 571 items missing during our inventory work were disposed of properly. However, when these documents were presented to us, they were identified as the actual supporting documents, not an “audit trail.” Additionally, HHS fails to acknowledge that the disposal records were not dated and contained no signatures approving of the disposal. Because these records clearly did not meet evidence standards, we asked the IHS property employee who gave us the documents about their origin. He admitted to fabricating them in order to satisfy our request for the disposition of the property. By focusing on the January 2008 date of our request, HHS is missing the point of our finding—that an IHS employee tried to make the missing property properly accounted for by generating documents and representing them as authentic disposal records. We have referred the matter to the HHS Office of Inspector General for further investigation. Allegation of wasteful purchases: HHS stated that it initiated a procurement strategy to increase the cost efficiency of replacing computer technology for its employees by buying in bulk so it can take advantage of pricing discounts and reduce the critical down time for IT tools. It also stated that the 25 on-hand “spare computers” noted in the report were an acceptable level of inventory. We agree that outdated technology should be replaced by taking advantage of bulk purchases. We also agree that there should be some inventory held in reserve for emergency needs that arise during the year. However, as stated in the report, we found that there were 3 computers for every person at IHS headquarters—a ratio that bulk ordering policies do not adequately explain. In addition to the 25 new and unused computers cited by HHS in its response, we identified several other examples of waste at IHS headquarters including computer equipment items issued to vacant offices and 7 new and unused laptops stored in an unlocked cabinet. We also noted examples of waste at the field locations, such as an unwrapped, 23-inch, widescreen monitor worth almost $1,700. The employee in possession of the monitor stated she did not know why IT sent her the monitor and claimed that it had never been used. We believe that such examples exemplify wasteful purchases of equipment rather than a prudent procurement strategy. Yard Sale: HHS stated that IHS headquarters staff have no knowledge of a “yard sale” of computers and other property in Nevada. We reported on this “yard sale” based on the confirmation of eight IHS property officials, including the Phoenix Area executive officer. In its response, HHS claimed that the 17 computers sold at this “yard sale” were used for educational purposes and thus likely did not contain sensitive information. The computers were located at a Youth Wellness Center and, according to the Phoenix area property manager, were never “cleaned” before transfer outside of the center. Hence, we continue to believe that the potential release of patient data and the obvious impropriety of holding a “yard sale” for government equipment make it prudent for the HHS OIG to investigate the matter. Finally, HHS disagreed with our recommendation to establish procedures to track all sensitive equipment such as blackberries and cell phones even if they fall under the accountable dollar threshold criteria. We made this recommendation because we identified examples of lost or stolen equipment that contained sensitive data, such as a PDA containing medical data for patients at a Tucson, Arizona area hospital. According to an IHS official, the device contained no password or data encryption, meaning that anyone who found (or stole) the PDA could have accessed the sensitive medical data. While we recognize that IHS may have taken steps to prevent the unauthorized release of sensitive data and acknowledge that it is not required to track devices under a certain dollar threshold, we are concerned about the potential harm to the public caused by the loss or theft of this type of equipment. Therefore, we continue to believe that such equipment should be tracked and that our recommendation remains valid. As agreed with your office, unless you publicly release its contents earlier we plan no further distribution of this report until 30 days from the date of this letter. At that time, we will send copies of this report to the Secretary of the Department of Health and Human Services, the Director of IHS, and other interested parties. The report is also available at no charge on the GAO Web site at http://www.gao.gov. If you have any questions concerning this report, please contact either Gregory D. Kutz at (202) 512-6722 or kutzg@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix III. To substantiate the allegation of lost or stolen property and wasteful spending at the Indian Health Service (IHS), we analyzed IHS documents of lost or stolen property from fiscal year 2004 through fiscal year 2007. We also conducted a full physical inventory of property at IHS headquarters and statistically tested information technology (IT) equipment inventory at seven selected IHS field locations. To identify specific cases of lost or stolen property and wasteful spending, we analyzed IHS documents and made observations during our physical inventory and statistical tests. We performed a full physical inventory at IHS headquarters because the whistleblower specifically identified problems at that location. Specifically, we tested all 3,155 headquarters property items which were largely comprised of IT equipment that IHS had recorded in its property records as of April 2007. We physically observed each item and its related IHS-issued bar code and verified that the serial number related to the bar code was consistent with IHS’s property records. Although IHS property in the field locations includes inventory items such as medical equipment and heavy machinery, we performed a statistical test of only IT equipment inventory at seven IHS field locations to determine whether the lack of accountability for inventory was pervasive at other locations in the agency. We limited our scope to testing only IT equipment items which are highly pilferable and can be easily converted to personal use such as laptops, desktop computers, and digital cameras. We selected the seven field locations based on book value of inventory and geographic proximity. We selected five field office locations because they had the highest dollar amount of IT equipment according to IHS’s property records. We selected the two additional sites based on their geographic proximity to the other field locations being tested. Our findings at these seven locations cannot be generalized to IHS’s other locations. To estimate the extent of lost or stolen property at these seven locations, we selected a probability sample of 250 items from a population of 7,211 IT items that had a book value of over $19 million. Because we followed a probability procedure based on random selections with each item having an equal chance of being selected, our sample is only one of a large number of samples that we might have drawn. Since each sample could have provided different estimates, we express our confidence in the precision of our particular sample’s results as a 95 percent confidence interval. This is the interval that would contain the actual population value for 95 percent of the samples we could have drawn. As a result, we are 95 percent confident that each of the confidence intervals in this report will include the true values in the study population. Based on this sample, we estimate the number, the percent, and the dollar amount of lost or stolen property at IHS. The 95 percent confidence intervals for each of these estimates is summarized below: We considered equipment to be lost or stolen if (1) we could not physically observe the item during the inventory; (2) IHS could not provide us with a picture of the item, with a visible bar code and serial number, within 2 weeks of our initial request; or (3) IHS could not provide us with adequate documentation to support the disposal of the equipment. We performed appropriate data reliability procedures for our physical inventory testing at IHS Headquarters and sample testing at the seven case study locations including (1) testing the existence of items in the database by observing the physical existence of all items at IHS headquarters and IT equipment selected in our sample, and (2) testing the completeness of the database by performing a 100 percent floor-to-book inventory at IHS headquarters and judgmentally selecting inventory items in our sample to determine if these items were maintained in IHS inventory records. Although our testing of the existence and completeness of IHS property records determined that IHS inventory records are neither accurate nor complete, we determined that the data were sufficient to perform these tests and project our results to the population of IT equipment. In addition, we interviewed IHS agency officials, property management staff, and other IHS employees. We also interviewed Department of Health and Human Services (HHS) officials concerning the migration of the Property Management Information System (PMIS) and officials at the Program Support Center (PSC). Although we did not perform a systematic review of IHS internal controls, we identified key causes of lost and stolen property and wasteful spending at IHS by examining IHS and HHS policies and procedures, conducting interviews with IHS officials, and our observations of property through our inventory testing. We conducted our forensic audit and related investigations from June 2007 to May 2008 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. Despite IHS efforts to obstruct our review, we were still able to accomplish our objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. We performed our investigative work in accordance with standards prescribed by the President’s Council on Integrity and Efficiency. For further information about this report, please contact Gregory D. Kutz at (202) 512-6722 or kutzg@gao.gov. In addition to the individual named above, the following made contributions to this report: Verginie Amirkhanian, Erika Axelson, Joonho Choi, Jennifer Costello, Jessica Gray, Richard Guthrie, John Kelly, Bret Kressin, Richard Kusman, Barbara Lewis, Megan Maisel, Andrew McIntosh, Shawn Mongin, Sandra Moore, James Murphy, Andy O’Connell, George Ogilvie, Chevalier Strong, Quan Thai, Matt Valenta, and David Yoder.

Summary: In June 2007, GAO received information from a whistleblower through GAO's FraudNET hotline alleging millions of dollars in lost and stolen property and gross mismanagement of property at Indian Health Service (IHS), an operating division of the Department of Health and Human Services (HHS). GAO was asked to conduct a forensic audit and related investigations to (1) determine whether GAO could substantiate the allegation of lost and stolen property at IHS and identify examples of wasteful purchases and (2) identify the key causes of any loss, theft, or waste. GAO analyzed IHS property records from fiscal years 2004- 2007, conducted a full physical inventory at IHS headquarters, and statistically tested inventory of information technology (IT) equipment at 7 IHS field locations in 2007 and 2008. GAO also examined IHS policies, conducted interviews with IHS officials, and assessed the security of property. Millions of dollars worth of IHS property has been lost or stolen over the past several years. Specifically, (1) IHS identified over 5,000 lost or stolen property items, worth about $15.8 million, from fiscal years 2004 through 2007. These missing items included all-terrain vehicles and tractors; Jaws of Life equipment; and a computer containing sensitive data, including social security numbers. (2) GAO's physical inventory identified that over 1,100 IT items, worth about $2 million, were missing from IHS headquarters. These items represented about 36 percent of all IT equipment on the books at headquarters in 2007 and included laptops and digital cameras. Further, IHS staff attempted to obstruct GAO's investigation by fabricating hundreds of documents. (3) GAO also estimates that IHS had about 1,200 missing IT equipment items at seven field office locations worth approximately $2.6 million. This represented about 17 percent of all IT equipment at these locations. However, the dollar value of lost or stolen items and the extent of compromised data are unknown because IHS does not consistently document lost or stolen property and GAO only tested a limited number of IHS locations. Information related to cases where GAO identified fabrication of documents and potential release of sensitive data is being referred to the HHS Inspector General for further investigation. GAO also found evidence of wasteful spending, including identifying that there are about 10 pieces of IT equipment for every one employee at headquarters. GAO's investigation also found computers and other IT equipment were often assigned to vacant offices. GAO identified that the loss, theft, and waste can be attributed to IHS's weak internal control environment. IHS management has failed to establish a strong "tone at the top," allowing property management problems to continue for more than a decade with little or no improvement or accountability for lost and stolen property and compromise of sensitive personal data. In addition, IHS has not effectively implemented numerous property policies, including the proper safeguards for its expensive IT equipment. For example, IHS disposed over $700,000 worth of equipment because it was "infested with bat dung."