We substantiated the allegation of gross mismanagement of property at IHS. Specifically, we found that thousands of computers and other property, worth millions of dollars, have been lost or stolen over the past several years. We analyzed IHS reports for headquarters and the 12 regions from the last 4 fiscal years. These reports identified over 5,000 property items, worth about $15.8 million, that were lost or stolen from IHS headquarters and field offices throughout the country. The number and dollar value of this missing property is likely much higher because IHS did not conduct full inventories of accountable property for all of its locations and did not provide us with all inventory documents as requested. Despite IHS attempts to obstruct our investigation, our full physical inventory at headquarters and our random sample of property at 7 field locations, identified millions of dollars of missing property. Our analysis of Report of Survey records from IHS headquarters and field offices show that from fiscal year 2004 through fiscal year 2007, IHS property managers identified over 5,000 lost or stolen property items worth about $15.8 million. Although we did receive some documentation from IHS, the number and dollar value of items that have been lost or stolen since 2004 is likely much higher for the following reasons. First, IHS does not consistently document lost or stolen property items. For example, 9 of the 12 IHS regional offices did not perform a full physical inventory in fiscal year 2007. Second, an average of 5 of the 12 regions did not provide us with all of the reports used to document missing property for each year since fiscal year 2004, as we requested. Third, we found about $11 million in additional inventory shortages from our analysis of inventory reports provided to us by IHS, but we did not include this amount in our estimate of lost or stolen property because IHS has not made a final determination on this missing property. Some of the egregious examples of lost or stolen property include: In April 2007, a desktop computer containing a database of uranium miners’ names, social security numbers, and medical histories was stolen from an IHS hospital in New Mexico. According to an HHS report, IHS attempted to notify the 849 miners whose personal information was compromised, but IHS did not issue a press release to inform the public of the compromised data. From 1999 through 2005, IHS did not follow required procedures to document the transfer of property from IHS to the Alaska Native Tribal Health Consortium, resulting in a 5-year unsuccessful attempt by IHS to reconcile the inventory. Our analysis of IHS documentation revealed that about $6 million of this property—including all-terrain vehicles, generators, van trailers, pickup trucks, tractors, and other heavy equipment—was lost or stolen. In September 2006, IHS property staff in Tucson attempted to write off over $275,000 worth of property, including Jaws of Life equipment valued at $21,000. The acting area director in Tucson refused to approve the write-off because of the egregious nature of the property loss. To substantiate the whistleblower’s allegation of missing IT equipment, we performed our own full inventory of IT equipment at IHS headquarters. Our results were consistent with what the whistleblower claimed. Specifically, of the 3,155 pieces of IT equipment recorded in the records for IHS headquarters, we determined that about 1,140 items (or about 36 percent) were lost, stolen, or unaccounted for. These items, valued at around $2 million, included computers, computer servers, video projectors, and digital cameras. According to IHS records, 64 of the items we identified as missing during our physical inventory were “new” in April 2007. During our investigation of the whistleblower’s complaint, IHS made a concerted effort to obstruct our work. For example, the IHS Director over property misrepresented to us that IHS was able to find about 800 of the missing items from the whistleblower’s complaint. In addition, an IHS property specialist attempted to provide documentation confirming that 571 missing items were properly disposed of by IHS. However, we found that the documentation he provided was not dated and contained no signatures. Finally, IHS provided us fabricated receiving reports after we questioned them that the original reports provided to us were missing key information on them. Figure 1 shows the fabricated receiving report for a shipment of new scanners delivered to IHS. ? As shown in figure 1, there is almost a 3-month gap between the date the equipment was received in September and the date that the receiving report was completed and signed in December—even though the document should have been signed upon receipt. In fact, the new receiving report IHS provided was signed on the same date we requested it, strongly suggesting that IHS fabricated these documents in order to obstruct our investigation. We selected a random sample of IT equipment inventory at seven IHS field offices to determine whether the lack of accountability for inventory was confined to headquarters or occurred elsewhere within the agency. Similar to our finding at IHS headquarters, our sample results also indicate that a substantial number of pieces of IT equipment were lost, stolen, or unaccounted for. Specifically, we estimate that for the 7 locations, about 1,200 equipment items or 17 percent, with a value of $2.6 million were lost, stolen or unaccounted for. Furthermore, some of the missing equipment from the seven field locations could have contained sensitive information. We found that many of the missing laptops were assigned to IHS hospitals and, therefore, could have contained patient information and social security numbers and other personal information. IHS has also exhibited ineffective management over the procurement of IT equipment, which has led to wasteful spending of taxpayer funds. Some examples of wasteful spending that we observed during our audit of headquarters and field offices include: Approximately 10 pieces of IT equipment, on average, are issued for every one employee at IHS headquarters. Although some of these may be older items that were not properly disposed, we did find that many employees, including administrative assistants, were assigned two computer monitors, a printer and scanner, a blackberry, subwoofer speakers, and multiple computer laptops in addition to their computer desktop. Many of these employees said they rarely used all of this equipment, and some could not even remember the passwords for some of their multiple laptops. IHS purchased numerous computers for headquarters staff in excess of expected need. For example, IHS purchased 134 new computer desktops and monitors for $161,700 in the summer of 2007. As of February 2008, 25 of these computers and monitors—valued at about $30,000—were in storage at IHS headquarters. In addition, many of the computer desktops and monitors purchased in the summer of 2007 for IHS headquarters were assigned to vacant offices. The lost or stolen property and waste we detected at IHS can be attributed to the agency’s weak internal control environment and its ineffective implementation of numerous property policies. In particular, IHS management has failed to establish a strong “tone at the top” by allowing inadequate accountability over property to persist for years and by neglecting to fully investigate cases related to lost and stolen items. Furthermore, IHS management has not properly updated its personal property management policies, which IHS has not revised since 1992. Moreover, IHS did not (1) conduct annual inventories of accountable property; (2) use receiving agents for acquired property at each location and designate property custodial officers in writing to be responsible for the proper use, maintenance, and protection of property; (3) place barcodes on accountable property to identify it as government property; (4) maintain proper individual user-level accountability, including custody receipts, for issued property; (5) safeguard IT equipment; or (6) record certain property in its new property management information system. To strengthen IHS’s overall control environment and “tone at the top”, we made 10 recommendations to IHS to update its policy and enforce property management policies of both the HHS and IHS. Specifically, we recommended that the Director of IHS should direct IHS property officials to take the following 10 actions: Update IHS personal property management policies to reflect any policy changes that have occurred since the last update in 1992. Investigate circumstances surrounding missing or stolen property instead of writing off losses without holding anyone accountable. Enforce policy to conduct annual inventories of accountable personal property at headquarters and all field locations. Enforce policy to use receiving agents to document the receipt of property and distribute the property to its intended user and to designate property custodial officers in writing to be responsible for the proper use, maintenance, and protection of property. Enforce policy to place bar codes on all accountable property. Enforce policy to document the issuance of property using hand receipts and make sure that employees account for property at the time of transfer, separation, change in duties, or on demand by the proper authority. Maintain information on users of all accountable property, including their buildings and room numbers, so that property can easily be located. Physically secure and protect property to guard against loss and theft of equipment. Enforce the use of the property management information system database to create reliable inventory records. Establish procedures to track all sensitive equipment such as blackberries and cell phones even if they fall under the accountable dollar threshold criteria. HHS agreed with 9 of the 10 recommendations. HHS disagreed with our recommendation to establish procedures to track all sensitive equipment such as blackberries and cell phones even if they fall under the accountable dollar threshold criteria. We made this recommendation because we identified examples of lost or stolen equipment that contained sensitive data, such as a PDA containing medical data for patients at a Tucson, Arizona area hospital. According to an IHS official, the device contained no password or data encryption, meaning that anyone who found (or stole) the PDA could have accessed the sensitive medical data.