This is the accessible text file for GAO report number GAO-08-727 entitled 'Indian Health Service: IHS Mismanagement Led to Millions of Dollars in Lost or Stolen Property' which was released on July 21, 2008. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Report to Congressional Requesters: United States Government Accountability Office: GAO: June 2008: Indian Health Service: IHS Mismanagement Led to Millions of Dollars in Lost or Stolen Property: GAO-08-727: GAO Highlights: Highlights of GAO-08-727, a report to congressional requesters. Why GAO Did This Study: In June 2007, GAO received information from a whistleblower through GAO’s FraudNET hotline alleging millions of dollars in lost and stolen property and gross mismanagement of property at Indian Health Service (IHS), an operating division of the Department of Health and Human Services (HHS). GAO was asked to conduct a forensic audit and related investigations to (1) determine whether GAO could substantiate the allegation of lost and stolen property at IHS and identify examples of wasteful purchases and (2) identify the key causes of any loss, theft, or waste. GAO analyzed IHS property records from fiscal years 2004-2007, conducted a full physical inventory at IHS headquarters, and statistically tested inventory of information technology (IT) equipment at 7 IHS field locations in 2007 and 2008. GAO also examined IHS policies, conducted interviews with IHS officials, and assessed the security of property. What GAO Found: Millions of dollars worth of IHS property has been lost or stolen over the past several years. Specifically: * IHS identified over 5,000 lost or stolen property items, worth about $15.8 million, from fiscal years 2004 through 2007. These missing items included all-terrain vehicles and tractors; Jaws of Life equipment; and a computer containing sensitive data, including social security numbers. * GAO’s physical inventory identified that over 1,100 IT items, worth about $2 million, were missing from IHS headquarters. These items represented about 36 percent of all IT equipment on the books at headquarters in 2007 and included laptops and digital cameras. Further, IHS staff attempted to obstruct GAO’s investigation by fabricating hundreds of documents. * GAO also estimates that IHS had about 1,200 missing IT equipment items at seven field office locations worth approximately $2.6 million. This represented about 17 percent of all IT equipment at these locations. However, the dollar value of lost or stolen items and the extent of compromised data are unknown because IHS does not consistently document lost or stolen property and GAO only tested a limited number of IHS locations. Information related to cases where GAO identified fabrication of documents and potential release of sensitive data is being referred to the HHS Inspector General for further investigation. The figure shows examples of the lost and stolen property GAO identified during the audit. Figure: Examples of Lost and Stolen Property Identified at IHS: Illustrations of the following: Caterpillar tractor; All-terrain vehicle; Pickup truck; Jaws of life; Laptop; Digital camera. Source: GAO; Art Explosion. [End of figure] GAO also found evidence of wasteful spending, including identifying that there are about 10 pieces of IT equipment for every one employee at headquarters. GAO’s investigation also found computers and other IT equipment were often assigned to vacant offices. GAO identified that the loss, theft, and waste can be attributed to IHS’s weak internal control environment. IHS management has failed to establish a strong “tone at the top,” allowing property management problems to continue for more than a decade with little or no improvement or accountability for lost and stolen property and compromise of sensitive personal data. In addition, IHS has not effectively implemented numerous property policies, including the proper safeguards for its expensive IT equipment. For example, IHS disposed over $700,000 worth of equipment because it was “infested with bat dung.” What GAO Recommends: GAO makes 10 recommendations to the IHS to update IHS policy, and enforce management policies such as conducting physical inventories, properly tracking inventory, and safeguarding assets. Although HHS agreed to 9 recommendations, HHS stated that the report contained inaccuracies and misinterpretations that they believe seriously weaken the conclusions. GAO disagrees with their assessment and reiterates support for all recommendations. To view the full product, including the scope and methodology, click on GAO-08-727. For more information, contact Gregory Kutz at (202) 512- 6722 or kutzg@gao.gov. [End of section] Contents: Letter: Results in Brief: Background: IHS Has Had Millions of Dollars in Property Lost or Stolen and Has Made Wasteful Purchases: Weak Tone at the Top and Other Control Weaknesses Leave IHS Highly Vulnerable to Loss, Theft, and Waste: Conclusions: Recommendations for Executive Action: Agency Comments and Our Evaluation: Appendix I: Scope and Methodology: Appendix II: Comments from the Department of Health & Human Services: Appendix III: GAO Contacts and Acknowledgments: Tables: Table 1: Sample Results of Seven IHS Field Locations: Table 2: 95 Percent Confidence Intervals for Statistical Sample Estimates: Figures: Figure 1: Example of Questionable Receiving Report: Figure 2: Storage of Excess Recent-Model Computers and Monitors: Figure 3: Excess Computers at Albuquerque, New Mexico Field Location: Figure 4: Unused 23-Inch Widescreen Monitor at Gallup, New Mexico Field Location: Figure 5: IHS Report Writing Off Thousands of Dollars in IT Equipment Inventory Without Holding Anyone Accountable: Figure 6: Pictures of Unsecured IT Equipment at IHS Headquarters: Abbreviations: HHS: Department of Health and Human Services: HIPAA: Health Information Portability and Accountability Act of 1996: IHS: Indian Health Service: IT: information technology: OIG: Office of Inspector General: PAO: Property Accountable Officer: PDA: Personal Digital Assistant: PMIS: Property Management Information System: PSC: Program Support Center: [End of section] United States Government Accountability Office: Washington, DC 20548: June 18, 2008: The Honorable Henry A. Waxman: Chairman: Committee on Oversight and Government Reform: House of Representatives: The Honorable Nick J. Rahall, II: Chairman: Committee on Natural Resources: House of Representatives: In June 2007, we received information from a whistleblower through GAO's FraudNET hotline alleging gross mismanagement of property and wasteful spending at the Indian Health Service (IHS). Specifically, the whistleblower, who was a cognizant property official, alleged that IHS headquarters could not locate 1,180 pieces of accountable personal property, including computers and other potentially sensitive information technology (IT) equipment, valued at over $1.8 million. The whistleblower also claimed that officials at IHS headquarters wrote off millions of dollars worth of missing inventory without holding anyone financially liable. Based on the significance of these claims, you asked us to (1) determine whether we could substantiate the allegation of lost or stolen property at IHS and identify examples of wasteful purchases and (2) identify the key causes of any loss, theft, or waste we detect. To do this, we analyzed IHS property documents that identified lost or stolen property from fiscal year 2004 through fiscal year 2007. We conducted a full physical inventory of property at IHS headquarters [Footnote 1] and performed random sample testing of IT equipment inventory at seven IHS field locations[Footnote 2] that we selected based on book value of inventory and geographic proximity.[Footnote 3] We limited the scope of our work to testing IT equipment because it is highly pilferable, can be easily converted to personal use, and potentially contains sensitive information that may be used for identity fraud or other malicious purposes. We did not attempt to quantify the level of waste at IHS, but we identified instances of waste through observations during our equipment inventories at headquarters and random sample testing at the selected field locations. Although we did not perform a systematic review of IHS internal controls, we identified the key causes of lost and stolen property and waste by examining IHS policies and procedures, conducting interviews with IHS officials, and assessing the physical security of property through our inventory testing. We conducted this forensic audit and related investigations from September 2007 to June 2008 in accordance with generally accepted government auditing standards.[Footnote 4] Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. Despite IHS efforts to obstruct our audit by making misrepresentations and fabricating hundreds of documents, we were still able to accomplish our objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. We performed our investigative work in accordance with standards prescribed by the President's Council on Integrity and Efficiency. A detailed discussion of our scope and methodology is presented in appendix I. Results in Brief: We confirmed the whistleblower's allegation of gross mismanagement of property at IHS. Specifically, we found that thousands of computers and other property, worth millions of dollars,[Footnote 5] have been lost or stolen at IHS over the past several years. The number and dollar value of items that have been lost or stolen since 2004 is likely much higher because IHS did not consistently document lost or stolen property items and did not provide us all the reports that IHS field offices used to document lost or stolen property since fiscal year 2004 as requested. Specifically, we found the following: * We analyzed IHS reports from fiscal year 2004 through fiscal year 2007 and identified over 5,000 lost or stolen property items, worth approximately $15.8 million. These items included all-terrain vehicles, tractors, and pick-up trucks worth around $6 million; and "Jaws of Life" equipment worth over $20,000. In addition, a desktop computer that contained sensitive information (e.g., social security numbers and medical information) on 849 uranium miners was reported stolen in April 2007 and to date has not been found. In addition to these reports, the IHS Finance department recently reported a missing Personal Digital Assistant (PDA) in March 2008 when they requested a replacement. The PDA contained medical information and names of patients at a Tucson, Arizona area hospital. According to the IHS IT official, the device contained no password or data encryption. This was in violation of federal policy and increased the risk that sensitive information could be disclosed to unauthorized individuals.[Footnote 6] Both of these cases have already been reported to the Department of Health and Human Services (HHS) by the IHS Office of Information Technology. The total dollar value of lost or stolen items and extent of compromised data are unknown because IHS does not consistently document lost or stolen property. * Of the 3,155 pieces of IT equipment that were on the books at IHS headquarters in 2007, 1,140 items, or about 36 percent, were lost, stolen, or unaccounted for. These missing items, valued at about $2 million, include computers, computer servers, video projectors, and digital cameras. According to IHS records, 64 of the items we identified as lost or stolen during our physical inventory were "new" in April 2007. Further, IHS officials attempted to obstruct our investigation by making misrepresentations and fabricating documents to conceal this lost or stolen property. * Based on our random sample of IT equipment at the 7 selected IHS field locations, we estimate that about 1,200 items worth approximately $2.6 million were lost, stolen, or unaccounted for at these locations. [Footnote 7] This represents about 17 percent of all IT equipment at the 7 field locations we visited. Because we only looked at 7 of the 163 IHS locations, the number and value of lost or stolen equipment is likely much higher. The missing equipment we identified included IHS hospital laptops, which may contain patients' social security numbers and medical histories. In order to avoid duplicating missing property items and dollar amounts, we did not combine the total amount of missing items and dollar values from our review of IHS documentation, physical inventory at IHS headquarters, and sample testing at the 7 field locations. IHS's ineffective management over IT equipment has also led to wasteful spending. Our analysis of IHS records indicates that there are approximately 10 pieces of IT equipment for every one employee at IHS headquarters.[Footnote 8] We also found numerous pieces of recent-model equipment at IHS headquarters, including 25 brand new computers--with a combined value of about $30,000--that were not issued to any employees and were collecting dust in a store room. The lost or stolen property and waste we detected at IHS can be attributed to the agency's weak internal control environment and its ineffective implementation of numerous property policies. IHS management has failed to establish a strong "tone at the top" by allowing inadequate accountability over property to persist for years and by neglecting to fully investigate cases related to lost and stolen items. Furthermore, IHS management has not revised its personal property management policies since 1992[Footnote 9]. Moreover, we found that IHS did not (1) conduct annual inventories of accountable property; (2) use receiving agents for acquired property at each location and designate property custodial officers in writing to be responsible for the proper use, maintenance, and protection of property; (3) place bar codes on accountable property to identify it as government property; and (4) maintain proper user-level accountability, including custody receipts, for issued property. IHS personnel also did not implement proper physical security controls to safeguard property. For example, we observed computers worth thousands of dollars set aside in unsecured storage areas and hallways. Furthermore, IHS failed to migrate data to the new inventory management system by not properly recording certain property in its Property Management Information System (PMIS),[Footnote 10] leaving about $48 million in inventory outside of this database and at an increased risk of loss or theft. [Footnote 11] Some examples of property that we identified as not being recorded in PMIS included a $145,000 ultrasound unit, a $140,000 X-ray unit, and a $61,000 anesthesia machine. We are recommending that the Director of IHS update IHS policy, and enforce property management policies such as conducting physical inventories, enforcing user-level accountability, properly tracking inventory, and safeguarding assets. In the case where we identified that an individual fabricated hundreds of documents and cases where there was a potential release of sensitive data--including employee social security numbers and patient information regarding missing computers from the human resource department and from IHS hospitals--we are making referrals to the HHS Office of Inspector General (OIG) for further investigation. We provided a draft copy of our report to HHS for review and comment. While they believe that our report contains inaccuracies and misrepresentations, they agreed with 9 of our 10 recommendations. HHS did not agree with our recommendation to establish procedures to track all sensitive equipment such as blackberries and cell phones even when they fall under HHS's accountable dollar threshold criteria. Additionally, HHS commented that our report contained inaccuracies and misinterpretations by not considering IHS's unique property management system due to its collaboration with Indian Tribes; the implementation and reconciliation of IHS's new inventory tracking system; and depreciation value of lost and stolen items. Additionally, HHS cited six cases that they believe were misrepresented in our case studies. We believe that we fairly characterized and conservatively estimated our findings and reiterate support for all recommendations. See the Agency Comments and Our Evaluation section of this report for a more detailed discussion of the agency comments. We have reprinted HHS's written comments in appendix II. Background: IHS, an operating division of HHS, is responsible for providing health services to federally recognized tribes of American Indians and Alaska natives. In 2007, IHS provided health services to approximately 1.9 million American Indians and Alaska natives from more than 562 federally recognized tribes. As an operating division of HHS, IHS is included in the agency's consolidated financial statement and has not been audited independently since 2002. IHS is divided into 12 regions and operates 163 service units throughout the country.[Footnote 12] Service units may contain one or more health facilities, including hospitals, health centers, village clinics, health stations, and school health centers. There are 114 IHS- operated health facilities and 565 tribally operated health facilities. The IHS budget appropriation in 2007 was $3.2 billion, approximately 54 percent of which was administered by tribes through various contracts and compacts with the federal government.[Footnote 13] IHS Has Had Millions of Dollars in Property Lost or Stolen and Has Made Wasteful Purchases: We substantiated the allegation of gross mismanagement of property at IHS. Specifically, we found that thousands of computers and other property, worth millions of dollars, have been lost or stolen. We analyzed IHS reports for headquarters and the 12 regions from the last 4 fiscal years which identified over 5,000 property items, worth about $15.8 million, that were lost or stolen from IHS headquarters and field offices throughout the country. The number and dollar value of this missing property is likely much higher because IHS did not conduct full inventories of accountable property[Footnote 14] for all of its locations and did not provide us with all inventory documents as requested. Despite IHS attempts to obstruct our investigation, our full physical inventory at headquarters and our random sample of property at seven field locations identified millions of dollars of missing property. We also found that IHS has made wasteful purchases over the past few years. For example, IHS has bought computer equipment that is currently unused in its original box and has issued IT equipment to its employees that duplicate the equipment already provided to them. IHS Records Indicate at Least $15.8 Million of Property Has Been Lost or Stolen: Our analysis of Report of Survey[Footnote 15] records from IHS headquarters and field offices shows that from fiscal year 2004 through fiscal year 2007, IHS property managers identified over 5,000 lost or stolen property items worth about $15.8 million.[Footnote 16] Although we did receive some documentation from IHS, the number and dollar value of items that have been lost or stolen since 2004 is likely much higher for the following reasons. First, IHS does not consistently document lost or stolen property items. For example, 9 of the 12 IHS regional offices did not even perform a physical inventory in fiscal year 2007. Second, for each year since fiscal year 2004, an average of 5 of the 12 regions did not provide us with all of the reports used to document missing property since fiscal year 2004, as we requested. The following cases provide information on five of the egregious examples of lost and stolen property we identified. In each case, IHS has not held any staff accountable for the missing items. In some of the cases, IHS did not even perform an investigation to try and locate the missing items or determine what actions should be taken. * IHS staff held a "yard sale" of 17 computers and other property worth $16,660 in Schurz, Nevada, between June and July 2005. According to an IHS property manager, the equipment was advertised to the public via fliers indicating that excess federal property was to be given away for free. To date, IHS has not completed the investigation or held any IHS personnel responsible and, according to a 2006 report, intends to writeoff the missing equipment. According to the Phoenix area property manager, the 17 computers identified as missing were transferred from a youth patient center and could contain sensitive youth patient information because the computers were never "cleaned" before being transferred to the Schurz service unit. We are referring this potential release of patient data to the HHS OIG for further investigation. * From 1999 through 2005, IHS did not follow required procedures to document the transfer of property from IHS to the Alaska Native Tribal Health Consortium, resulting in an unsuccessful 5-year attempt by IHS to reconcile the inventory. Our analysis of IHS documentation revealed that about $6 million of this property--including all-terrain vehicles, generators, van trailers, tractors, and other heavy equipment--was lost or stolen. * In April 2007, a desktop computer containing a database of uranium miner names, social security numbers, and medical histories was stolen from an IHS hospital in New Mexico. According to an HHS report, IHS attempted to notify the 849 miners whose personal information was compromised, but IHS did not issue a press release to inform the public of the compromised data. In addition to this incident, the IHS Finance department recently reported a missing Personal Digital Assistant (PDA) in March 2008 when they requested a replacement. The PDA contained medical information and names of patients at a Tucson Area Hospital. According to the IHS IT official, the device contained no password or data encryption. This was in violation of federal policy and increased the risk that sensitive information could be disclosed to unauthorized individuals. Both of these cases have already been reported to HHS by the IHS Office of Information Technology. * In September 2006, IHS property staff in Tucson attempted to write off over $275,000 worth of property, including Jaws of Life equipment valued at $21,000. The acting area director in Tucson refused to approve the write-off because of the egregious nature of the property loss. However, no investigation has been conducted to date. * According to an IHS June 2006 report, a $4,000 Apple Powerbook laptop was stolen from an employee's vehicle in the Navajo area. Despite the lack of authorization, the employee took the laptop for use during off- duty hours--in violation of IHS policy. Because the employee violated IHS policy, IHS's initial determination, with which the employee agreed, was that the employee was responsible for the loss and therefore should reimburse the federal government for the value of the stolen computer. However, the IHS approving official reversed the initial determination decision stating that the employee had since resigned and the loss was due to theft. GAO Inventory Testing Reveals Lost or Stolen IT Equipment at IHS Headquarters: To substantiate the whistleblower's allegation of missing IT equipment, we performed our own full inventory of IT equipment at IHS headquarters. Our results were consistent with what the whistleblower claimed. Specifically, of the 3,155 pieces of IT equipment recorded in the records for IHS headquarters, we determined that about 1,140 items (or about 36 percent) were lost, stolen, or unaccounted for. These items, valued at around $2 million, included computers, computer servers, video projectors, and digital cameras. According to IHS records, 64 of the items we identified as missing during our physical inventory were "new" in April 2007. Furthermore, we found that some of the missing computers were assigned to the IHS human resources division. These computers likely contained sensitive employee data including names and Social Security numbers protected under the Privacy Act of 1974.[Footnote 17] We are referring these cases where there was a potential release of sensitive data including employee social security numbers to the HHS OIG for further investigation. During our investigation of the whistleblower's complaint, IHS made a concerted effort to obstruct our work. IHS officials made misrepresentations and fabricated documents to impede our work. Specifically, * The IHS Director responsible for property claimed that IHS was able to find about 800 of the missing items from the whistleblower's complaint. However, based on our physical inventory testing at headquarters, we found that this statement was a misrepresentation and that only some of these items have been found. * An IHS property specialist attempted to provide documentation confirming that 571 missing items were properly disposed of by IHS. However, we found that the documentation he provided was not dated and contained no signatures. When we questioned the official about these discrepancies, he admitted that he fabricated the documents. We are referring this individual to the HHS OIG for further investigation. * According to IHS policy, receiving reports are always signed by an authorized employee. As part of our inventory, we requested receiving reports for three recent purchase orders. For one purchase order, IHS was not able to provide us with any receiving reports. For the other two purchase orders, IHS provided us with receiving reports that were not properly completed; e.g., the reports were not signed by the person who received the property and did not contain the date that the property was received. When we questioned these discrepancies, IHS sent us "new" receiving reports for the three purchase orders, but all of them contained questionable dates and signatures. For example, figure 1 shows the fabricated receiving report for a shipment of new scanners delivered to IHS. Figure 1: Example of Questionable Receiving Report: [See PDF for image] This figure is an illustration of a questionable receiving report, and includes the following information: Receiving report chronology: * October 2007: IHS provides incomplete information packet including blank receiving report; * December 4, 2007: GAO questions blank receiving report; * December 4, 2007: IHS completes fabricated receiving report (see below) on the same day as the GAO request. Fabricated receiving report: Date received: Indicated as September 16, 2007; Signature date: Indicated as December 4, 2007. Source: GAO analysis of IHS data. [End of figure] As shown in figure 1, there is almost a 3-month gap between the date the equipment was received in September and the date that the receiving report was completed and signed in December---even though the document should have been signed upon receipt. In fact, the new receiving report IHS provided was signed on the same date we requested it, strongly suggesting that IHS fabricated these documents in order to obstruct our investigation. Further, after testing one of the other two fabricated receiving reports, we found that 10 brand new desktop computers worth almost $12,000 could not be located even though the receiving report indicated that they were "received" in July 2007. GAO Testing Identifies Lost or Stolen IT Equipment at Seven IHS Field Locations: We selected a random sample of IT equipment inventory at seven IHS field offices to determine whether the lack of accountability for inventory was confined to headquarters or occurred elsewhere within the agency.[Footnote 18] Similar to our finding at IHS headquarters, our sample results also indicate that a substantial number of pieces of IT equipment were lost, stolen, or unaccounted for. Specifically, we estimate that for the seven locations, about 1,200 equipment items, with a value of $2.6 million were lost or stolen.[Footnote 19] As shown in table 1, our estimates are based on a statistical sample of 250 items from a population of 7,211 IT equipment items worth over $19 million recorded in property records for IT equipment at the seven field office locations. Of the 250 items that we sampled, IHS could not locate or substantiate the disposal of 42 items, or about 17 percent of the sample population. Table 1: Sample Results of Seven IHS Field Locations: Total IT items selected in sample: 250; Items physically observed during inventory: 166; Items observed via picture with bar code and serial number: 25; Items with documentation to support disposal: 17; Total lost or stolen items: 42. Source: GAO. [End of table] Furthermore, some of the missing equipment from the seven field locations could have contained sensitive information. Although personal health information requires additional protections from unauthorized release under the Health Information Portability and Accountability Act of 1996 (HIPAA) and implementing regulations,[Footnote 20] we found that many of the missing laptops were assigned to IHS hospitals and, therefore, could have contained patient information, social security numbers, and other personal information. We are referring these cases where there was a potential release of sensitive data including patient information to the HHS OIG for further investigation. Wasteful Purchases Identified During Inventory Tests: IHS has also exhibited ineffective management over the procurement of IT equipment, which has led to wasteful spending of taxpayer funds. IHS purchased excessive amounts of IT equipment for its staff, most notably at the headquarters office. An IHS official stated that IHS purchased new computers using "end of the year dollars." Some examples of wasteful spending that we observed during our audit of headquarters and field offices include the following: * Approximately 10 pieces of IT equipment, on average, are issued for every one employee at IHS headquarters.[Footnote 21] Although some of these may be older items that were not properly disposed, we did find that many employees, including administrative assistants, were assigned two computer monitors, a printer and scanner, a blackberry, subwoofer speakers, and multiple computer laptops in addition to their computer desktop. Many of these employees said they rarely used all of this equipment and some could not even remember the passwords for some of their multiple laptops. * IHS purchased computers for headquarters staff in excess of expected need. For example, IHS purchased 134 new computer desktops and monitors for $161,700 in the summer of 2007. As shown in figure 2, as of February 2008 25 of these computers and monitors--valued at about $30,000--were in storage at IHS headquarters. An IT specialist stated that the computers and monitors were "extras." In addition, we identified 7 new laptops that were stored in an unlocked cabinet at headquarters and never used. Figure 2: Storage of Excess Recent-Model Computers and Monitors: [See PDF for image] This figure contains two photographs depicting the storage of excess recent-model computers and monitors. Source: GAO. [End of figure] * Computers and other IT equipment were often assigned to vacant offices. For example, many of the computer desktops and monitors purchased in the summer of 2007 for IHS headquarters were assigned to vacant offices. In addition, as shown in figure 3, we found two computers, two monitors, and three printers in an employee's office at the Albuquerque field location we visited. The IHS area property manager stated that this equipment was issued to an employee who spends a majority of his time on travel to training and treatment centers. Figure 3: Excess Computers at Albuquerque, New Mexico Field Location: [See PDF for image] This figure contains a photograph of excess computers at the Albuquerque, New Mexico field location. Source: GAO. [End of figure] * An official for the IHS National Program stated that IHS purchased new computers using "end of the year dollars." For example, as shown in figure 4, one field office employee in Gallup, New Mexico had an unwrapped, 23-inch, widescreen monitor worth almost $1,700 in her office. The employee stated that she did not know why IT sent her the monitor and she claimed that it has never been used. Figure 4: Unused 23-Inch Widescreen Monitor at Gallup, New Mexico Field Location: [See PDF for image] Photograph of an unused 23-inch widescreen monitor at the Gallup, New Mexico field location. Source: GAO. [End of figure] Weak Tone at the Top and Other Control Weaknesses Leave IHS Highly Vulnerable to Loss, Theft, and Waste: The lost or stolen property and waste we detected at IHS can be attributed to the agency's weak internal control environment and its ineffective implementation of numerous property policies. In particular, IHS management has failed to establish a strong "tone at the top" by allowing inadequate accountability over property to persist for years and by neglecting to fully investigate cases related to lost and stolen items. Furthermore, IHS management has not properly updated its personal property management policies, which IHS has not revised since 1992. Moreover, IHS did not (1) conduct annual inventories of accountable property; (2) use receiving agents for acquired property at each location and designate property custodial officers in writing to be responsible for the proper use, maintenance, and protection of property; (3) place bar codes on accountable property to identify it as government property; (4) maintain proper individual user-level accountability, including custody receipts, for issued property; (5) safeguard IT equipment; or (6) record certain property in its property management information system (PMIS). Weak tone at the top: The importance of the "tone at the top" or the role of management in establishing a positive internal control environment cannot be overstated. GAO's internal control standards state that "management plays a key role in demonstrating and maintaining an organization's integrity and ethical values, especially in setting and maintaining the organization's ethical tone, providing guidance for proper behavior, removing temptations for unethical behavior, and providing discipline when appropriate." However, IHS management has failed to establish and maintain these ethical values. As far back as 1997, an IHS memo by the then Acting Director stated that the agency had problems with lost and stolen property at IHS headquarters. The memo also stated that unused equipment was not safeguarded against loss or theft. However, we found little corrective action was taken by IHS. For example, management failed to update IHS personal property management policies, which have not been revised since 1992. In addition, IHS has historically shown little motivation to hold its employees liable for missing property. Instead of investigating the circumstances surrounding missing property, IHS writes off the losses without holding anyone accountable. As a result, an IHS property official admitted to us that there is no accountability over IHS property. For example, figure 5 shows a report used to write off almost $900,000 worth of missing IT equipment in 2004, including laptop and desktop computers, servers, cameras, routers, and fax machines. This is just one of four reports that IHS used in 2004 to write off a combined total of $1.8 million dollars worth of IT equipment. Figure 5: IHS Report Writing Off Thousands of Dollars in IT Equipment Inventory Without Holding Anyone Accountable: [See PDF for image] This figure is an illustration of an IHS report writing off thousands of dollars in IT equipment inventory without holding anyone accountable. An excerpt from page two of the report reads: “No one individual or group of individuals should be held responsible for the loss, however, a concentrated effort should be undertaken to prevent the turn in, transfer, donation of equipment without the proper property documentations being completed.” The amount written of is $899,592.00. Source: IHS. [End of figure] As shown in the figure, the report does not hold anyone responsible for the missing inventory, but it does call for the improvement of controls over property management. However, as shown by our audit and related investigations, IHS has made minimal efforts to improve property management and oversight. Despite this fact, IHS rewarded the individuals responsible for these functions in its property group with about $40,000 in merit awards from 2003 through 2007. No annual inventories: HHS and IHS policies require IHS personnel to conduct annual inventories of accountable personal property, including property at headquarters and in field offices. However, IHS headquarters did not conduct any annual inventories from fiscal years 2004 through 2006. In addition, property managers were not able to accurately document the findings of their fiscal year 2007 inventory nearly a year after it was conducted. Moreover, in fiscal year 2007, only 3 out of 12 regions conducted a full physical inventory.[Footnote 22] Consequently, the extent of missing property at IHS is unknown. Failure to use receiving agents and to designate property custodial officers: IHS policy requires that each accountable area[Footnote 23] designate at least one receiving agent to receive purchased property. The receiving agent is responsible for documenting the receipt of the property (i.e., receiving report) and then distributing the property to its intended user. However, we found that acquired property is often sent directly to the user, bypassing the receiving agent. For example, the IT department sometimes receives new computers and IT equipment directly instead of utilizing the receiving agent. In addition, HHS requires the designation of property custodial officers in writing to be responsible for the proper use, maintenance, and protection of property. However, an IHS official said that property custodial officers have not formally been designated for headquarters because of high staff turnover. Lack of property bar codes: HHS and IHS policy mandate that all accountable property have a bar code identifying it as government property. However, in our audit of IHS headquarters inventory, we identified over 100 pieces of IT equipment, including blackberries and digital cameras, that were not properly bar coded. Much of this equipment likely did not receive a bar code because, as discussed earlier, IHS does not receive property in a central location. Lack of personal custody property records: HHS requires the use of hand receipts, known as HHS Form 439, any time property is issued to an employee. This form should be retained by a property official so that property can be tracked at the time of transfer, separation, change in duties, or when requested by the proper authority. By signing this form, an IHS employee takes responsibility for the government-issued equipment. According to an IHS property official, IHS headquarters does not use the HHS Form 439, nor do they use any other type of hand receipt. Officials from several IHS regions stated that they use the form only in limited cases. Without the issuance of this form, there is no documentation as to where the equipment is located and no mechanism to hold the user accountable for the equipment. Lack of user-level accountability: HHS requires IHS to document information on the user of equipment, including building and room number, so that property can be tracked and located. However, IHS did not properly maintain this information. Property personnel instead relied on their personal recollection to locate property items. For example, on several occasions during our headquarters inventory, IHS property staff could not identify the property user. As a result, the property staff had to make inquiries with other staff to obtain information on the user of the equipment. Further, IHS personnel in the field offices stated that it took them several days to locate items that were included in our sampled inventory. Furthermore, according to the IHS policy manual, when equipment is no longer needed by the user, a request for property action should be submitted in writing to the Property Accountable Officer (PAO). The PAO then determines if the item can be transferred to another user within IHS. However, in many cases, equipment is redistributed by the IT department or sent to another user without PAO approval. In our audit of IHS headquarters inventory, we found some items that were issued to an unspecified user or to employees who had retired or left the agency. To locate these items, IHS Headquarters staff had to inquire with the employee's colleagues to determine the location of the equipment. In several cases, IHS was not able to locate the equipment assigned to separated employees, raising the possibility that the equipment was stolen. For example, one IHS employee stated that equipment had "disappeared" from an office vacated by a former employee. Weaknesses in physical security of IT equipment: According to the Indian Health Manual, property is to be adequately protected "against the hazards of fire, theft, vandalism, and weather commensurate with the condition and value" of the property. However, during our inventory review at both IHS headquarters and field office locations, we found that IHS did not follow this policy. Specifically, we found that IHS did not properly secure expensive IT equipment leaving them vulnerable to loss and theft. For example we found that: * Surplus IT equipment that should have been disposed of was stored in unlocked employees' offices, suite areas, conference rooms, and storage rooms. For example, figure 6 shows computer equipment stored in an unlocked multipurpose storage room at IHS headquarters. In addition, an IHS headquarters employee had newly purchased unsecured equipment, including a large flat screen TV, dual monitors, a printer, a scanner, a desktop, a subwoofer, a video camera, and a back-up power supply. Figure 6: Pictures of Unsecured IT Equipment at IHS Headquarters: [See PDF for image] This figure contains three photographs of unsecured IT equipment at IHS Headquarters. Source: GAO. [End of figure] * IHS did not establish proper safeguards for storing IT equipment in IHS facilities or employees' offices. For example, at one of the IHS hospitals we visited, the IT department did not lock its storage area, leaving several computers unsecured. * Because equipment was not protected against damage or destruction, IHS had to dispose over $700,000 worth of equipment because it was "infested with bat dung." Failure to use accountable property management system: HHS policy requires that all accountable property with a value of $5,000 or greater and all sensitive items[Footnote 24] with a value of $500 or greater be tracked by the PMIS property management system. [Footnote 25] The PMIS system is intended to improve accountability and standardize property records across HHS. Equipment that is not recorded in PMIS is not inventoried or otherwise controlled, placing it at increased risk of loss or theft. Although IHS had 2 years to migrate from legacy systems to the new inventory system, it has not yet fully converted to the PMIS system.[Footnote 26] Furthermore, officials from two field locations stated that they are not adding new equipment to the system because IHS headquarters told them not to use the system until further notice. Because it has not entered all property information into PMIS, IHS does not have reliable inventory records related to expensive, sensitive, and pilferable property. Specifically, IHS has failed to enter over 18,000 items, worth approximately $48 million, from headquarters and the sites we reviewed. Furthermore, we found that over half of the items we selected while performing our random sample testing of the seven field locations were not recorded in PMIS. The types of equipment that were not entered into PMIS include a $145,000 ultrasound unit, a $140,000 X-ray unit, and a $61,000 anesthesia machine. In addition, although items such as blackberries, cell phones, and digital cameras do not meet the criteria for inclusion in PMIS, these items are highly sensitive and should be accounted for by IHS. Furthermore, the magnitude of equipment that was not entered into the system is likely much higher because we did not analyze data from IHS locations not included in our statistical sample. Conclusions: Our audit confirmed the whisteblower's allegation of gross mismanagement of property at IHS. IHS has exhibited a weak control environment and disregard for basic accountability over its inventory. As a result, IHS cannot account for its physical property and is vulnerable to the loss and theft of IT equipment and sensitive personal data. Further, IHS' wasteful spending of IT equipment and lack of discipline or personal accountability for lost and stolen property and personal data has set a negative tone at the top that the status quo is acceptable. Moreover, intentional attempts of some IHS employees to thwart our investigation lead us to question the integrity and transparency of certain functions within the agency's property management group and call for stronger leadership to strengthen tone at the top as well as throughout property management functions. Recommendations for Executive Action: We recommend that the Director of IHS strengthen IHS's overall control environment and "tone at the top" by updating and enforcing its policies and procedures for property management. As part of this effort, the Director of IHS should direct IHS property officials to take the following 10 actions: * Update IHS personal property management policies to reflect any policy changes that have occurred since the last update in 1992. * Investigate circumstances surrounding missing or stolen property instead of writing off losses without holding anyone accountable. * Enforce policy to conduct annual inventories of accountable personal property at headquarters and all field locations. * Enforce policy to use receiving agents to document the receipt of property and distribute the property to its intended user and to designate property custodial officers in writing to be responsible for the proper use, maintenance, and protection of property. * Enforce policy to place bar codes on all accountable property. * Enforce policy to document the issuance of property using hand receipts and make sure that employees account for property at the time of transfer, separation, change in duties, or on demand by the proper authority. * Maintain information on users of all accountable property, including their buildings and room numbers, so that property can easily be located. * Physically secure and protect property to guard against loss and theft of equipment. * Enforce the use of the PMIS property management database to create reliable inventory records. * Establish procedures to track all sensitive equipment such as blackberries and cell phones even if they fall under the accountable dollar threshold criteria. Agency Comments and Our Evaluation: We received written comments on a draft of this report from the Assistant Secretary for Legislation of the Department of Health and Human Services (HHS). HHS agreed with 9 of our 10 recommendations. However, HHS stated that our report contained inaccuracies and misinterpretations that it believes seriously weaken our conclusions. In its response to our draft report HHS cited three limitations. First, HHS stated that our report did not appreciate the fact that IHS property management is a unique system in its collaboration with Indian Tribes and that it operates its service units throughout the country. Second, HHS said that unaccountable property may be lower than what our report identified because the ongoing process of reconciling the prior system to the new system makes it more likely that the number of currently unaccounted for property items will be reduced rather than increase as the reconciliation progresses. Further, they state that the implementation process for the new system made it more difficult for IHS to provide GAO with the necessary documentation for audit. Third, HHS also stated that we overstated the net worth of unaccounted for items by not taking into account the depreciated value of those items. In addition, HHS response also cited six specific cases that they believe were misrepresented in our case studies. In response to HHS's first limitation, we do not believe that we mischaracterized the uniqueness of IHS's collaboration with Indian Tribes and the fact that it has service units throughout the country. In the report, we state that over half of IHS's budget is administered by the tribes through various contracts and compacts with the federal government. We also state that IHS operates 163 service units that include one or more health facilities, such as hospitals, health centers, village clinics, health stations, and school health centers. Furthermore, the scope of our audit only included testing IHS property, which does not include the Tribal communities. However, we believe that because IHS operates in this type of control environment, IHS should have strong internal controls over its property and not the weak controls that were apparent in our audit. HHS also contends that the unaccountable property will be reduced from the reconciliation of the prior property system to the new system. However, we disagree--the lost or stolen property that was identified in our report came from IHS's Report of Surveys, our full physical inventory of all equipment at IHS headquarters, and random sample testing of IT equipment at 7 field locations. Reports of Survey only identify specific property items that were written off IHS's inventory books from physical inventories or other circumstances. Our physical inventory testing at IHS headquarters and random sample testing of IT equipment at the 7 field locations verify that there were additional missing property items to those identified in Reports of Survey. Furthermore, as stated in our report and HHS's response, IHS did not perform complete physical inventories of equipment for most of its regional offices. Specifically we identified that 9 of the 12 regions did not perform a physical inventory in 2007. In addition, we reported that IHS did not complete the investigations of about $11 million of inventory shortages where a physical inventory was performed. As such, our estimate does not include lost or stolen property where physical inventories were not performed or where IHS did not complete its investigation of inventory shortages. Further, we do not believe that IHS's conversion to a new system should impact IHS's ability to maintain basic inventory documentation that is subject to audit. Without such documentation, IHS has no accountability of equipment that the American taxpayers entrusted to the agency. Thus, we believe that we likely underestimated, not overestimated, the amount of lost or stolen property. Finally, in its written response to our draft report HHS states its belief that our report overstates the net worth of unaccounted for items by not taking into consideration the depreciation value of these items. While we agree that the actual "loss" is less because of depreciation, we consider acquisition cost very relevant because, if property that IHS has lost or is stolen was necessary, IHS will need to buy new replacement property. It is likely that replacement costs are as much, or more, than acquisition costs in this scenario. Furthermore, in our use of acquisition costs for property, IHS generally provided us the acquisition cost of equipment. IHS provided us little data that contained depreciation or fair market value of the equipment. Therefore, we modified our report to state that the value of lost or stolen property was represented as the acquisition cost. We disagree with HHS's portrayal of the six specific cases cited in their response to our draft report. Specifically: * Report of survey for Alaska tribal self-determination award: In its response, HHS stated that most of the $6 million that was written off in the Report of Survey was transferred from IHS to local Tribal communities, the U.S. Air Force, or abandoned on an IHS construction site. As stated in our report, none of these transfers or disposals were properly documented. Without proper documentation, it is impossible to determine what happened with the property, which is why we consider it to be lost or stolen. Although HHS's comments state that these items were old and had little remaining useful value, IHS continues to purchase new property to replace old, necessary items--in which case it is likely that replacement costs are as much (or more) than acquisition cost. Furthermore, analysis of IHS's response raises concerns about the nature of disposal for these items, including vehicles and machinery, which could cause environmental hazards as a result of abandonment. * Tucson Report of Survey and jaws of life: HHS stated that 45 items, including the "jaws of life" equipment that we reported as lost or stolen in our draft report, have been recently found. We identified that these items were lost or stolen because they were documented in a September 2006 Report of Survey. We followed up on the status of these property items on our site visits to Tucson on two occasions in late 2007 and early 2008. On both occasions, IHS confirmed that these items had not been found and that an investigation into their loss had not been performed. Based on this timeline, these items were lost for almost 2 years. IHS has not provided us any documentation to substantiate the location of the jaws of life or any other property identified in the Tucson Report of Survey. Therefore, we cannot validate that these items were found. * Allegation of misrepresentation by IHS property staff: HHS stated that the majority of the 1,180 items that were not accounted for in the April 2007 inventory had been located and reconciled by January 2008. Additionally in our report, we state that the IHS Director responsible for property claimed that IHS was able to find about 800 of these missing items. However, based on our physical inventory testing at headquarters, which included verifying IHS's reconciled items in January 2008, we found that only some of these items have been found. We also identified items missing from IHS's April 2007 inventory in addition to the 1,180 shortage identified by IHS. Specifically, of the 3,155 pieces of IT equipment recorded in the records for IHS headquarters, we determined that about 1,140 items (or about 36 percent) were lost, stolen, or unaccounted for. Part of the discrepancy can be attributed to the fact that we did not accept fabricated documents that the IHS property management specialist provided us as discussed below. We continue to believe that the IHS Director responsible for property attempted to thwart our investigation through misrepresentations. * Allegation of fabricated documents: HHS stated that IHS generated disposal records in January 2008 to "establish an audit trail" showing that 571 items missing during our inventory work were disposed of properly. However, when these documents were presented to us, they were identified as the actual supporting documents, not an "audit trail." Additionally, HHS fails to acknowledge that the disposal records were not dated and contained no signatures approving of the disposal. Because these records clearly did not meet evidence standards, we asked the IHS property employee who gave us the documents about their origin. He admitted to fabricating them in order to satisfy our request for the disposition of the property. By focusing on the January 2008 date of our request, HHS is missing the point of our finding--that an IHS employee tried to make the missing property properly accounted for by generating documents and representing them as authentic disposal records. We have referred the matter to the HHS Office of Inspector General for further investigation. * Allegation of wasteful purchases: HHS stated that it initiated a procurement strategy to increase the cost efficiency of replacing computer technology for its employees by buying in bulk so it can take advantage of pricing discounts and reduce the critical down time for IT tools. It also stated that the 25 on-hand "spare computers" noted in the report were an acceptable level of inventory. We agree that outdated technology should be replaced by taking advantage of bulk purchases. We also agree that there should be some inventory held in reserve for emergency needs that arise during the year. However, as stated in the report, we found that there were 3 computers for every person at IHS headquarters--a ratio that bulk ordering policies do not adequately explain. In addition to the 25 new and unused computers cited by HHS in its response, we identified several other examples of waste at IHS headquarters including computer equipment items issued to vacant offices and 7 new and unused laptops stored in an unlocked cabinet. We also noted examples of waste at the field locations, such as an unwrapped, 23-inch, widescreen monitor worth almost $1,700. The employee in possession of the monitor stated she did not know why IT sent her the monitor and claimed that it had never been used. We believe that such examples exemplify wasteful purchases of equipment rather than a prudent procurement strategy. * Yard Sale: HHS stated that IHS headquarters staff have no knowledge of a "yard sale" of computers and other property in Nevada. We reported on this "yard sale" based on the confirmation of eight IHS property officials, including the Phoenix Area executive officer. In its response, HHS claimed that the 17 computers sold at this "yard sale" were used for educational purposes and thus likely did not contain sensitive information. The computers were located at a Youth Wellness Center and, according to the Phoenix area property manager, were never "cleaned" before transfer outside of the center. Hence, we continue to believe that the potential release of patient data and the obvious impropriety of holding a "yard sale" for government equipment make it prudent for the HHS OIG to investigate the matter. Finally, HHS disagreed with our recommendation to establish procedures to track all sensitive equipment such as blackberries and cell phones even if they fall under the accountable dollar threshold criteria. We made this recommendation because we identified examples of lost or stolen equipment that contained sensitive data, such as a PDA containing medical data for patients at a Tucson, Arizona area hospital. According to an IHS official, the device contained no password or data encryption, meaning that anyone who found (or stole) the PDA could have accessed the sensitive medical data. While we recognize that IHS may have taken steps to prevent the unauthorized release of sensitive data and acknowledge that it is not required to track devices under a certain dollar threshold, we are concerned about the potential harm to the public caused by the loss or theft of this type of equipment. Therefore, we continue to believe that such equipment should be tracked and that our recommendation remains valid. As agreed with your office, unless you publicly release its contents earlier we plan no further distribution of this report until 30 days from the date of this letter. At that time, we will send copies of this report to the Secretary of the Department of Health and Human Services, the Director of IHS, and other interested parties. The report is also available at no charge on the GAO Web site at [hyperlink, http://www.gao.gov]. If you have any questions concerning this report, please contact either Gregory D. Kutz at (202) 512-6722 or kutzg@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix III. Signed by: Gregory D. Kutz: Managing Director: Forensic Audits and Special Investigations: [End of section] Appendix I: Scope and Methodology: To substantiate the allegation of lost or stolen property and wasteful spending at the Indian Health Service (IHS),[Footnote 27] we analyzed IHS documents of lost or stolen property from fiscal year 2004 through fiscal year 2007.[Footnote 28] We also conducted a full physical inventory of property at IHS headquarters and statistically tested information technology (IT) equipment inventory at seven selected IHS field locations. To identify specific cases of lost or stolen property and wasteful spending, we analyzed IHS documents and made observations during our physical inventory and statistical tests. We performed a full physical inventory at IHS headquarters because the whistleblower specifically identified problems at that location. Specifically, we tested all 3,155 headquarters property items which were largely comprised of IT equipment that IHS had recorded in its property records as of April 2007. We physically observed each item and its related IHS-issued bar code and verified that the serial number related to the bar code was consistent with IHS's property records. Although IHS property in the field locations includes inventory items such as medical equipment and heavy machinery, we performed a statistical test of only IT equipment inventory at seven IHS field locations to determine whether the lack of accountability for inventory was pervasive at other locations in the agency. We limited our scope to testing only IT equipment items which are highly pilferable and can be easily converted to personal use such as laptops, desktop computers, and digital cameras. We selected the seven field locations based on book value of inventory and geographic proximity.[Footnote 29] We selected five field office locations because they had the highest dollar amount of IT equipment according to IHS's property records. We selected the two additional sites based on their geographic proximity to the other field locations being tested. Our findings at these seven locations cannot be generalized to IHS's other locations. To estimate the extent of lost or stolen property at these seven locations, we selected a probability sample of 250 items from a population of 7,211 IT items that had a book value of over $19 million. Because we followed a probability procedure based on random selections with each item having an equal chance of being selected, our sample is only one of a large number of samples that we might have drawn. Since each sample could have provided different estimates, we express our confidence in the precision of our particular sample's results as a 95 percent confidence interval. This is the interval that would contain the actual population value for 95 percent of the samples we could have drawn. As a result, we are 95 percent confident that each of the confidence intervals in this report will include the true values in the study population. Based on this sample, we estimate the number, the percent, and the dollar amount of lost or stolen property at IHS. The 95 percent confidence intervals for each of these estimates is summarized below: Table 2: 95 Percent Confidence Intervals for Statistical Sample Estimates: Description: Estimated lost items; Estimate: 1,211; Lower endpoint of 95 percent confidence interval: 893; Upper endpoint of 95 percent confidence interval: 1,588. Description: Estimated percentage items lost; Estimate: 17; Lower endpoint of 95 percent confidence interval: 12.4; Upper endpoint of 95 percent confidence interval: 22.0. Description: Estimated dollar amount of lost or stolen; Estimate: $2,598,613; Lower endpoint of 95 percent confidence interval: $1,389,012; Upper endpoint of 95 percent confidence interval: $4,531,133. Source: GAO. [End of table] We considered equipment to be lost or stolen if (1) we could not physically observe the item during the inventory; (2) IHS could not provide us with a picture of the item, with a visible bar code and serial number, within 2 weeks of our initial request; or (3) IHS could not provide us with adequate documentation to support the disposal of the equipment.[Footnote 30] We performed appropriate data reliability procedures for our physical inventory testing at IHS Headquarters and sample testing at the seven case study locations including (1) testing the existence of items in the database by observing the physical existence of all items at IHS headquarters and IT equipment selected in our sample, and (2) testing the completeness of the database by performing a 100 percent floor-to- book inventory at IHS headquarters and judgmentally selecting inventory items in our sample to determine if these items were maintained in IHS inventory records. Although our testing of the existence and completeness of IHS property records determined that IHS inventory records are neither accurate nor complete, we determined that the data were sufficient to perform these tests and project our results to the population of IT equipment. In addition, we interviewed IHS agency officials, property management staff, and other IHS employees. We also interviewed Department of Health and Human Services (HHS) officials concerning the migration of the Property Management Information System (PMIS) and officials at the Program Support Center (PSC).[Footnote 31] Although we did not perform a systematic review of IHS internal controls, we identified key causes of lost and stolen property and wasteful spending at IHS by examining IHS and HHS policies and procedures, conducting interviews with IHS officials, and our observations of property through our inventory testing. We conducted our forensic audit and related investigations from June 2007 to May 2008 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. Despite IHS efforts to obstruct our review, we were still able to accomplish our objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. We performed our investigative work in accordance with standards prescribed by the President's Council on Integrity and Efficiency. [End of section] Appendix II: Comments from the Department of Health & Human Services: The Secretary Of Health And Human Services: Washington, DC 20201: May 23, 2008: Gregory D. Kutz: Managing Director: Forensic Audits and Special Investigations: U.S. Government Accountability Office: Washington, DC 20548: Dear Mr. Kutz: Enclosed are the Department's comments on the U.S. Government Accountability Office's (GAO) draft report entitled, "IHS Management Led to Millions of Lost or Stolen Property" (GAO-08-727). The Department appreciates the opportunity to review and comment on this draft before its publication. Sincerely, Signed by: Jennifer R. Luong, for: Vincent Ventimiglia, Jr. Assistant Secretary for Legislation: Attachment: Comments Of The Department Of Health And Human Services (HHS) On The U.S. Government Accountability Office's (GAO) Draft Report Entitled: "IHS Mismanagement Led To Millions Of Lost Or Stolen Property" (GAO 08- 727): IHS appreciates the opportunity to respond to GAO's report on IHS property management. IHS has been and remains committed to proper and accountable property management. To this end, IHS Headquarters and Area Offices have fully cooperated with GAO in the audit and investigation by providing detailed records, performing extensive data reconciliations upon request of the GAO, and participating in multiple and extended staff interviews. Overview of the IHS inventory system: IHS is responsible for a national, comprehensive health care delivery system serving American Indians and Alaska Natives. The Agency structure is a decentralized organization, with a central Headquarters office located in Rockville, Maryland and 12 regions (Areas) throughout the United States. Each of the 12 regions is overseen by a senior Area Director, who reports to the IHS Director. IHS employs approximately 15,000 employees and the budget is approximately $4 billion annually. IHS currently uses the HHS Property Management Information System (PMIS) to inventory personal Federal property. The PMIS was first implemented in FY 2005, and continues to improve accountability of property at IHS. Indian Tribes are authorized by Public Law 93-638, "Indian Self- Determination and Education Assistance Act," to assume control of programs administered by the IHS, including administrative support functions. The statute also permits IHS to transfer title to both real and personal Federal property associated with the operation of the contracted program. Also, Public Law 86-121, "Indians, Sanitation Facilities," authorizes IHS to transfer property to Indian Tribes in order to maintain sanitation facilities. Additional authority for providing equipment to Tribes is found in the Public Law 94-437, "Indian Health Care Improvement Act," as amended, at 25 U.S.C. 1632, regarding safe water and sanitary waste disposal facilities, where the Secretary, acting through the Service, is authorized to provide under section 2004a of Title 42 P.L. 86-121], financial and technical assistance to Indian Tribes and communities in the establishment, training, and equipping of utility organizations to operate and maintain Indian sanitation facilities. In early FY 2005, HHS made a decision to utilize PMIS, a global system to be used by HHS Operating Divisions, including IHS. At that time, the IHS was focused on migrating then-current property data into the new PMIS. At implementation, the IHS-wide inventory was comprised of approximately 121,000 items with an original acquisition cost of $302 million prior to assigning new and higher HHS accountability thresholds and assessing value of depreciation. At the time, IHS believed that the migration process would only take a few months to complete. Once migrated to the new PMIS, a physical inventory could be taken using the new system. IHS Property Managers in all 12 Areas were advised by HHS that our efforts should focus on preparing the property data for migration, and the conduct of physical inventories should be the second priority after data migration. Unfortunately, the migration of property data took nearly two years to complete, and there were several problems with the data that prevented approximately 20,000 records from being migrated. Some of these problems included lack of information for required data fields and the, need to update their catalog of item descriptions to accommodate the IHS inventory by the HHS Program Support Center, which administers the new PMIS. The implementation of the new HHS consolidated PMIS, including staff training, took an extensive amount of time and resources. Training is still ongoing and is a continuous process. Conducting physical inventories using the new system therefore lagged and many IHS Areas reverted to some legacy systems that had not been decommissioned. The process for conducting wall-to-wall physical inventories became more challenging due to turnover of IHS staff and depletion of experienced property management personnel, along with remaining property personnel being required to perform additional duties with multiple collateral responsibilities. Using and maintaining legacy property systems became too difficult to manage a large number of assets. As a result, some IHS Areas did not have the resources to conduct a wall-to-wall inventory on an annual basis. The new HHS logistics management policy mandates that all "accountable" and "sensitive" property (not all Government equipment) be tagged with a Government decal. Accountable property is any item with an acquisition cost of $5,000 or more. Sensitive property is an item identified to be tracked with an acquisition cost between $500 and S4,999 that requires stricter inventory control. If a property item meets the new, higher dollar threshold or the sensitive items criteria, then a barcode tag is affixed to the property item and entered into the PMIS. After applying the new HHS accountability thresholds, the IHS inventory is comprised of approximately 49,000 items with a total original acquisition cost of $205 million. The PMIS includes a depreciation expense feature which will adjust the book value of the IHS inventory when it has been fully implemented, a feature which was unavailable in the legacy property system. In 2007, a physical inventory was completed for 100% of accountable/sensitive property in 5 of the 14 accountable areas throughout the MIS, including IHS HQ. An additional 5 accountable areas completed partial inventories (50-90% of accountable/sensitive property) and the remaining 4 accountable areas examined 15% or less of their accountable/sensitive property in 2007. Response to GAO Report: IHS believes that GAO's report continues to include many inaccuracies and misinterpretations. GAO itself acknowledges various limitations to its audit and investigation, some of which are listed below. These limitations seriously undercut GAO's conclusions. * The report fails to appreciate that IHS property management is a unique system compared to most other Federal agencies where interaction involves collaboration with sovereign nations which grew out of the special Government-to-Government relationship between the Federal Government and Indian Tribes. IHS operates service units comprised of health facilities, such as hospitals, health centers, village clinics, health stations, and school health centers throughout the country. More than half of the IHS budget is administered by Tribes through various contracts and compacts with the Agency. * The report repeatedly notes that IHS did not consistently document "lost or stolen" property items and concludes that the number of currently unaccounted for items might actually be higher than GAO has identified. This fails to recognize the impact on IHS property management of the implementation of a new inventory tracking system in 2005. In fact, the ongoing process of reconciling the prior system to the new system makes it far more likely that the number of currently unaccounted for items will be reduced rather than increase as the reconciliation progresses. En addition, the implementation and reconciliation process has made it more difficult to provide GAO with the necessary documentation for the audit. * The report also overstates the net worth of currently unaccounted for items by not taking into consideration the depreciation value of these items. Some items referenced in the report are 15 to 35 years old, and yet are assigned their original acquisition cost. For example, some of the large, non-IT items of inventory, such as all terrain vehicles (ATVs) are valued at the original acquisition cost despite the fact that the actual equipment was acquired between 1974 and 1999, well past their useful life expectancy of 8 years. While GAO and IHS have met on multiple occasions to discuss specific situations addressed in the report, we believe that GAO continues to inaccurately describe some of the situations described below. Alaska Tribal Self-Determination Award: At the time of the transfer of IHS property to the Alaska Tribal compact in 2000, personal property in use in Alaska reflected a non- depreciated value of approximately $13 million, of which approximately $7 million was transferred to the Alaska Tribal compact under the new agreement/award. The remaining $6 million of this original amount (representing l,197 items) was written off the IHS inventory on a single Report of Survey in 2006, after several years of intensive on- site research and reconciliation performed by IHS and Tribal health officials on site in Alaska. On this Report of Survey, it clearly states that of the $6 million written off; most of the items were disposed of either by (I) transfer to local Tribal communities; (2) transfer to a local Air Force Base; or (3) "abandoned" on an IHS construction site due to the extraordinary expense associated with the removal of the equipment, leaving $177,000 (68 items) that were identified as missing. The ATVs and tractors referred to in the report as "lost or stolen," were not among the 68 items that IHS identified as missing. Rather, they were identified on the 2006 Alaska Report of Survey as "transferred" or "abandoned in place". Some of the large construction equipment in the extremely isolated locations in Alaska has to be flown in, or shipped by barge. The acquisition dates of these 1,197 items span 15-35 years. The useful life and actual "value" of the items to be written-off were considered by the Board of Survey and the Determining Authority in the final decision to write-off the inventory. Tucson Report of Survey and Jaws of Life: The 2006 Report of Survey for the entire Tucson Area reflected 114 items unaccounted for, or 3.5% of the total items in the Tucson Area inventory. The original acquisition cost of' these items was $275,757. which represents 4.2% of the total original acquisition cost of the Area-wide inventory. The Tucson Area property staff is in the final stages of completing the 2008 physical inventory which includes reconciling any differences between the physical inventory and the property records. The initial work on the 2008 reconciliation process has resulted in locating and accounting for 45 items representing $114,601 that were listed on the 2006 Report of Survey, however, the report does not reflect this. Included in the items located are all of the Jaws of Life extrication equipment which the report characterizes as "lost or stolen." The Jaws of Life equipment is used in ambulances that are an integral part of an emergency medical services program operated by IHS in the Tucson Area. At the completion of the 2008 physical inventory and reconciliation process, the Tucson Area will prepare a final Report of Survey to list all items not accounted for. Allegation of misrepresentations made by IHS property staff: When the GAO investigation commenced in August 2007, IHS property staff were starting to make progress on the reconciliation of the April 2007 physical inventory of IHS HQ. The initial results in April 2007 indicated that l,180 items were still listed on the inventory, but were not located on site, and over 500 items were found on site, but were not listed on the HQ inventory. The inventory reconciliation process was delayed by several months, but by July 2007 IHS staff started to make significant progress on their research of inventory differences. The basic research included reviewing alternate records to determine if, perhaps, the unaccounted for items were in fact proper disposals that had not been documented, or if the items might have been missed in the initial physical inventory. After the basic research was completed IHS was able to account for the majority of the l,180 items originally identified as unaccounted for. More specifically, at the time GAO arrived on site in August 2007, efforts were already well underway by IHS staff to obtain verification from the Director of the HHS Federal warehouse where IHS turns in its surplus equipment. Independent verification with the Federal warehouse provided evidence in 2007 that 498 items had in fact been properly disposed of as turn-ins to the warehouse. Additionally, in a subsequent inspection by IHS staff in late 2007, 222 items were found on site in IHS HQ that had been missed in the initial physical inventory taken in April 2007. The entire reconciliation process was completed in January 2008 and updated information was provided at that time to the GAO. Nevertheless, the report continues to categorize these items as "lost or stolen." GAO's Allegation of Fabricated Documents: In January 2008, an IHS property staff member, in his effort to ensure that GAO received the needed information in a form he believed they would accept, generated blank disposal records and recorded the disposal information that was provided from the HHS Federal warehouse onto the HHS 22 forms. When these "HHS 22s" were provided to GAO, they reflected a current date of January 2008 and were clearly represented as having been created for purposes of establishing an audit trail using the independent warehouse verification. Although they were not backdated or otherwise falsified, GAO accused the property staff person of "fabricating disposal records" No one in IHS conveyed to GAO that these documents were anything but newly generated documents. IHS does not condone the actions of the staff person who generated the HHS-22s well after the fact, for the purpose of recording otherwise verified information for the review of the GAO, but we do not believe there was intent to deceive or mislead the investigators. Allegation of "wasteful" purchases: In 2007, IHS Headquarters initiated a procurement strategy to increase the cost efficiency of the replacement of computer technology used by all its employees. The useful life of many desktop computers and smaller portable devices is 3-5 years. By buying in bulk to meet needs in advance, IHS can take advantage of bulk price discounts, and reduce critical down time of vital IT tools. The 25 on-hand "spare computers" noted in the report as "excess" and examples of "wasteful" purchases, represents roughly 6% of the total number of desktops deployed at IHS Headquarters. In the opinion of the IHS Chief Information Officer, this is an acceptable level of inventory. IHS makes only one bulk purchase of desktops each year in order to take advantage of bulk price discounts. Only the numbers of desktops that have exceeded their useful life are replaced in the annual bulk purchase. A very few additional computers must be purchased for emergent needs that arise during the year, such as new employees or to replace faulty equipment. IHS also uses those few additional computers, pending deployment to individual staff, for IT training purposes of all staff at both the Albuquerque and Rockville Headquarters locations. Yard Sale: We have requested, but have not received, a copy of the "flier" that GAO references in the report. To date, staff at IHS Headquarters have not seen this flier and have no knowledge of the alleged yard sale. However, information regarding the property that is discussed in this section of the GAO report is described below. We have a written statement from the employee in the Phoenix Area property office that transferred the computers at issue from the Desert Vision Youth Wellness Center to the Schurz Service Unit in 2005. He has verified that these computers were used for educational purposes at the Wellness Center, and were not used in a clinical setting in which the computers would more likely be used to store sensitive data. HHS Response to GAO Recommendations: We concur with nine of the ten GAO recommendations addressed in the report to the Director of IHS to strengthen overall control environment for property management. We address individual recommendations below: * Update IHS personal property management policies to reflect any policy changes that have occurred since the last update in 1992. - Concur. We have initiated this process. The revision process was started in 2002, however, was put "on hold" pending the implementation of a new property system that would inevitably change some of the business processes that would need to be addressed in the new policy. Additionally, recent revisions of the HHS Logistics Management Manual must be considered when revising the IHS policy. * Investigate circumstances surrounding missing or stolen property instead of writing off losses without holding anyone accountable. - Concur. IHS will continue to accomplish the needed investigations regarding property that is unaccounted for, prior to write-off, and will hold employees accountable as deemed appropriate throughout the Report of Survey process. * Enforce policy to conduct annual inventories of accountable personal property at headquarters and all field locations. - Concur. instructions for conducting the 2008 physical inventory utilizing the PMIS have been distributed to the Area Property Management Officers. A personal property certification statement was included in the instructions that require the Property Custodial Offlcer/Asset Center Representative and the Area Property Management Officer to sign and date, certifying the physical inventory was conducted. * Enforce policy to use receiving agents to document the receipt of property and distribute the property to its intended user and to designate property custodial officers in writing to be responsible for the proper use, maintenance, and protection of property. - Concur. Receiving agents and Property Custodial Officers will be assigned, trained and held accountable. * Enforce policy to place barcodes on all accountable property. - Concur. IHS will continue to utilize the HHS policy to tag and control all accountable and sensitive property. * Enforce policy to document the issuance of property using hand receipts and make sure that employees account for property at the time of transfer, separation, change in duties, or on demand by the proper authority. - Concur. IHS uses a clearance form for separating employees. This policy and the use of this form will be enforced prior to an employee's last day of work. * Maintain information on the user of all accountable property, including building and room number, so that property can easily be located. - Concur. This information will be reviewed as the 2008 physical inventory is conducted and any updates to the PMIS will be made to reflect the current location of all accountable and sensitive property. * Physically secure and protect property to guard against loss and theft of equipment. - Concur. IHS will continue to safeguard all property and plans to send a Special General Memorandum to all IHS employees reminding them of their personal responsibilities to safeguard property. * Enforce the use of the PMIS property management database to create reliable inventory records. - Concur. Training and system implementation is nearly completed. As stated above, instructions for conducting the 2008 physical inventory utilizing the PMIS have been distributed to the Area Property Management Officers. * Establish procedures to track all sensitive equipment such as blackberries and cell phones even if they fall under the accountable dollar threshold criteria. - Do Not Concur. IHS will continue to follow the HHS Policy for Sensitive Equipment and track only sensitive equipment that meets the criteria established by HHS for property accountability. Currently this policy requires sensitive items such as blackberries and cell phones to be tracked only if the purchase price is $500 or more, however, we agree it is important to protect all data that is considered sensitive. The following information describes security measures that are in place for sensitive IT equipment, and those planned for the future. IHS employs a number of management and technical measures to ensure a high degree of security for IT equipment. This includes: 1) All IHS laptops are equipped with hard-drive encryption software; and 2) IHS policy prohibits the use or storage of sensitive information on mobile devices (e.g., blackberries) and portable media (e.g., CD/DVD). If a waiver is required, the mobile device or portable media must be encrypted. Plans are currently being developed to deploy software on all desktops for the encryption of portable media. Additionally, plans are currently under development for the encryption of hard-drives for IHS desktop computers that could contain sensitive information. [End of section] Appendix III: GAO Contacts and Acknowledgments: GAO Contact: For further information about this report, please contact Gregory D. Kutz at (202) 512-6722 or kutzg@gao.gov. Acknowledgments: In addition to the individual named above, the following made contributions to this report: Verginie Amirkhanian, Erika Axelson, Joonho Choi, Jennifer Costello, Jessica Gray, Richard Guthrie, John Kelly, Bret Kressin, Richard Kusman, Barbara Lewis, Megan Maisel, Andrew McIntosh, Shawn Mongin, Sandra Moore, James Murphy, Andy O'Connell, George Ogilvie, Chevalier Strong, Quan Thai, Matt Valenta, and David Yoder. [End of section] Footnotes: [1] IHS headquarters property consists mostly of IT equipment. [2] We considered equipment to be lost or stolen in our physical inventory testing and random sample testing of seven field locations if we could not observe the item to confirm bar code and serial number, or if IHS could not provide us with adequate documentation to support the disposal of the equipment. [3] The seven sites we selected account for 35 percent of the IT equipment items or 40 percent of the value of IT equipment. The seven locations we tested included both IHS area offices and service units such as hospitals and supply centers. [4] A forensic audit is a systematic evaluation of the effectiveness of internal controls over a program, process, and/or policies and procedures. Forensic audits identify ineffective controls and vulnerabilities and use data mining and investigations to expose areas of fraud, waste, abuse, and security vulnerabilities to show the effect of inadequate controls. [5] The amount of lost or stolen property stated throughout the report was valued at acquisition cost, which is how IHS typically values the property in its records. [6] OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information (May 22, 2007). [7] Because these estimates are based on a probability sample, they are subject to sampling error. For example, we are 95 percent confident that missing IT equipment is valued between $1.39 million and $4.53 million. Likewise, we are 95 percent confident that between 12 and 22 percent of the IT equipment items were lost or stolen. Additional information on our sample and estimates is presented in appendix I. [8] More specifically, IHS has issued approximately three computers per employee. [9] Indian Health Manual, Part 5, Chapter 12, "Personal Property Management" (Apr. 29, 1992). [10] HHS mandated the property management information system, PMIS, which was implemented over a 2-year process effective October 18, 2007, and contains IHS personal property, including inventory that is capitalized and sensitive. [11] While performing our random sample testing of the seven field locations, we also found that over half of the items we selected were not in PMIS. [12] IHS area offices are located in Aberdeen, South Dakota; Anchorage, Alaska; Albuquerque, New Mexico; Bemidji, Minnesota; Billings, Montana; Nashville, Tennessee; Oklahoma City, Oklahoma; Phoenix, Arizona; Portland, Oregon; Sacramento, California; Tucson, Arizona; and Window Rock, Arizona. [13] Additionally, IHS reported about $ 800 million in third-party collections. [14] Accountable personal property is personal property with an acquisition value of $5,000 or greater and all sensitive items with a value of $500 or greater. [15] A Report of Survey is the document used to record and present findings and recommendations concerning the loss, theft, damage, or destruction of government property; to approve corrective actions, including financial recovery efforts; and to approve the resulting adjustments to property accountability records. [16] In addition to the $15.8 million in lost or stolen property items that we identified in the Report of Surveys, we also found about $11 million in additional inventory shortages in the regional offices from our analysis of Inventory Status Reports provided to us by IHS. However, we did not include this amount in our estimate of lost or stolen property because IHS has not made a final determination on this missing property. [17] Privacy Act of 1974, Pub. L. No. 93-579, § 3, codified, as amended, at 5 U.S.C. § 552a. [18] We selected the seven field locations based on book value of inventory and geographic proximity. Five field office locations were selected because they had the highest dollar amount of IT equipment. We selected two additional sites because of their geographic proximity to the other field offices being tested. [19] Because these estimates are based on a probability sample, they are subject to sampling error. For example, we are 95 percent confident that missing IT equipment is valued between $1.39 million and $4.53 million. Likewise, we are 95 percent confident that between 12 and 22 percent (or between 893 and 1588) of the IT equipment items were lost or stolen. Additional information on our sample and estimates is presented in appendix I. [20] HIPAA, Pub. L. No. 104-191, § 264, The Secretary of Health and Human Services has prescribed standards for safeguarding medical information in the HIPAA Medical Privacy Rule. See 45 C.F.R. pt. 164. [21] More specifically, IHS has issued approximately three computers per employee. [22] In addition, one region did conduct a partial inventory of its property. [23] An accountable area is an area specifically defined by organizational or geographic limits throughout which property accountability is assigned to a designated accountable official. [24] Sensitive items are property items that are especially vulnerable to loss, theft, or misuse. [25] Prior to the implementation of the PMIS system, each of the 12 IHS regions and IHS headquarters maintained separate property databases using different software programs. [26] The official scheduled date that IHS was supposed to decommission the legacy systems and start using PMIS exclusively was October 18, 2007. [27] The scope of our audit only included testing IHS property, which does not include the Tribal communities. [28] We analyzed Report of Survey documents identifying property as lost, stolen, missing, or shortages. [29] The seven sites we selected account for 35 percent of the IT equipment items or 40 percent of the value of IT equipment. The seven locations we tested included both IHS area offices and service units such as hospitals and supply centers. [30] To be conservative, we accepted properly documented disposed items, even though it is considered a poor property management practice. [31] PSC is the support center within HHS that maintains PMIS. [End of section] GAO's Mission: The Government Accountability Office, the audit, evaluation and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO's commitment to good government is reflected in its core values of accountability, integrity, and reliability. Obtaining Copies of GAO Reports and Testimony: The fastest and easiest way to obtain copies of GAO documents at no cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each weekday, GAO posts newly released reports, testimony, and correspondence on its Web site. To have GAO e-mail you a list of newly posted products every afternoon, go to [hyperlink, http://www.gao.gov] and select "E-mail Updates." Order by Mail or Phone: The first copy of each printed report is free. Additional copies are $2 each. A check or money order should be made out to the Superintendent of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or more copies mailed to a single address are discounted 25 percent. Orders should be sent to: U.S. Government Accountability Office: 441 G Street NW, Room LM: Washington, D.C. 20548: To order by Phone: Voice: (202) 512-6000: TDD: (202) 512-2537: Fax: (202) 512-6061: To Report Fraud, Waste, and Abuse in Federal Programs: Contact: Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: E-mail: fraudnet@gao.gov: Automated answering system: (800) 424-5454 or (202) 512-7470: Congressional Relations: Ralph Dawn, Managing Director, dawnr@gao.gov: (202) 512-4400: U.S. Government Accountability Office: 441 G Street NW, Room 7125: Washington, D.C. 20548: Public Affairs: Chuck Young, Managing Director, youngc1@gao.gov: (202) 512-4800: U.S. Government Accountability Office: 441 G Street NW, Room 7149: Washington, D.C. 20548: