Following today’s release of a report from the Iowa State Auditor office regarding the alleged theft of $327,000 in computer equipment and lapses in financial oversight in the Department of Orthopaedics, University of Iowa Health Care leaders outlined corrective actions they initiated to address those issues, as well as a concern about documentation procedures.

Details of the unrelated incidents were shared with the Board of Regents, State of Iowa, Wednesday afternoon during its meeting in Iowa City. UI Health Care officials also scheduled a news conference about the cases after the board meeting.

“All of us are disappointed by and concerned about both of these incidents,” Jean Robillard, M.D., UI vice president for medical affairs, said. “We are convinced that the vast majority of our faculty and staff respect and comply with all rules, policies and regulations.”

He added that UI Health Care leaders took immediate action to conduct reviews, including retaining external third parties, and moved to re-educate faculty and staff about proper procedures.

“These matters were reported to appropriate oversight agencies and we are continuing our practice of being transparent by holding these difficult conversations today,” Robillard said.

He also praised employees who brought the situations to the university’s attention, which allowed for immediate reviews of the issues.

“We are reminding everyone who works here about exactly what expectations we have and how to ensure that they are following all the rules,” he said. “We also continue to encourage all faculty and staff to report any concerns they have, and to emphasize that they can do so anonymously if they prefer.”

A staff member reported the suspected theft of computer equipment late in 2011. UI Health Care leaders immediately requested an internal audit of the Department of Orthopaedics and took a number of actions to prevent a recurrence of such a loss, including:

• Clear procedures for financial fraud prevention and detection have been discussed with management and widely distributed to the campus.
• Each university department must have a methodology satisfactory to the University Controller for tracking computer purchases from the point it is requisitioned to the point the equipment is deployed to a university faculty or staff member.
• UI Hospitals and Clinics implemented significant internal control procedures including additional segregation of responsibility requirements specific to the department of Orthopedics.
• The University Purchasing Department developed additional management reports designed to highlight department and individual spending patterns. The reports are being shared with departmental management.
• The University Accounts Payable Department is requiring an explicit, written business justification for all instances where multiple computers are not processed through university vendor contracts, even when there is departmental authorization.
• The University Purchasing Department has assessed the limit on all university procurement cards and reduced the card limit to an amount that only covers historical spending patterns.
• The Department of Orthopedics reduced the number of individuals with procurement card privileges from 47 to 13 and established additional oversight of uses.
• In addition, the auditors made recommendations about financial controls and oversight in the Department of Orthopaedics.

The employee at the center of the investigation has left the university, which is pursuing legal action.

In the other incident, another staff member voiced concern to UI Health Care officials on Oct. 4 about possible problems with documentation procedures in the Department of Orthopaedics. The Compliance Office initiated an immediate internal investigation.

Based upon in initial findings, the university reported the concern one week later to the Center for Medicare/Medicaid Services (CMS) and the Iowa Department of Inspections and Appeals (IDIA). In addition, UI Health Care leaders took the following actions to help prevent a recurrence of the concerns:

• Required all users with access to the electronic medical records system to change their passwords
• Re-educated all faculty and staff about policies and regulations governing the security of computer identification and passwords
• Encouraged faculty and staff to report concerns about billing compliance or any other issues to the 24/7 Compliance Helpline

“We will continue our review until we determine there are no other issues,” Robillard said. “We will also provide due process to individuals who did not follow the rules.”