Navajo families' personal data at risk in IHS theft

The 2007 theft of an IHS computer resulted in federal officials contacting some 849 Navajo families whose personal information was stored in the computer.

The theft of the computer, which still has not been located, was made public for the first time last week when the U.S. Government Accountability Office - the federal counterpart to the Navajo Nation's Office of Auditor General - released a report saying that more than 5,000 pieces of IHS equipment throughout the country were reported stolen or missing between 2004 and 2007.

The value of the missing items is more than $16 million.

In addition to careless management, the GAO said IHS officials obstructed, misrepresented, and otherwise took actions to thwart auditors' attempts to get a true picture of the situation.

The GAO report blamed top management within the IHS for not taking the problem seriously and allowing property management problems to continue for more than a decade with "little or no improvement or accountability for lost or stolen property and the compromise of sensitive personal data."

Jennie Notah, a spokeswoman for the Navajo Area IHS, said the theft of the computer occurred in the IHS office that worked with families of uranium miners who were eligible for federal benefits. When it occurred, the agency immediately called tribal officials to report the incident.

The IHS also contacted the families whose personal information - Social Security numbers, medical history, etc. - was stored in the computer and told them that the federal government would pay to enroll them in a program that would issue an alert if anyone tried to use the information.

Stolen personal information can be used to steal someone's identity, acquire credit cards, or other actions that could cause harm such as damaging a person's credit rating.

"Some agreed to sign up and some didn't," said Notah, adding that the federal government was willing to pay for the families to stay on the program for up to a year to prevent harm or loss.

The IHS has continued to monitor the families and said there were no incidents of identity theft using the information stored in the computer.

Report not made public

Notah said IHS officials decided not to make the computer theft public because of a fear that doing so would hinder the investigation. A report was made to the Navajo tribal police and they conducted an investigation, as did federal officials.

She said the uranium office has since been transferred from a tribal building with little security to a federal building with more security.

The GAO report also noted another incident where a $4,000 Apple Powerbook laptop computer was stolen from an employee's vehicle in the Navajo Area.

"Despite the lack of authorization - in violation of IHS policy - the employee took the laptop for use during off-duty hours," the report stated.

"Because the employee violated IHS policy, the initial determination - which the employee agreed to - was that the employee was responsible for the loss and therefore should reimburse the federal government for the value of the stolen computer," the report stated.

However, IHS ultimately reversed the determination, stating that the employee has since resigned.

GAO officials said that they investigated a total of 12 regional field offices as well as the main headquarters and came up with the $16 million figure, identifying more than 5,000 items that were lost or stolen.

The actual extent of the loss is likely much higher, however, because IHS did not conduct full inventories of its property and did not provide the GAO with all the documents requested.

IHS obstructs investigation

The GAO also said there were times when IHS officials tried to obstruct the investigation. Notah said Navajo Area officials cooperated fully when GAO auditors and provided them with any documents they requested.

The auditors said IHS officials at times lied or misrepresented the facts. For example, one director responsible for property claimed that IHS was able to find about 800 of the items that were reported missing in the report, but a check of this revealed that it was not true.

In another case, an IHS official turned in documents confirming that some of these items were located, but later admitted under questioning that he had fabricated the documents. GAO has asked for an investigation to determine whether the individual should be disciplined or charged for his behavior.

"We also found," the GAO report stated, "that IHS has made wasteful purchases over the past few years. For example, IHS has bought computer equipment that is currently unused and is still in its original box and has issued equipment to its employees that duplicate the equipment already provided to them."

The report said that a field employee stationed in Gallup had an unwrapped 23-inch, widescreen monitor worth almost $1,700 in her office. The employee said she did not know why she was given the monitor and that it has never been used.

Other instances in the GAO report include:

• In 2005, IHS staff in Schurz, Nev., held a "yard sale" of 17 computers and other property worth $16,600. The equipment was advertised to the public via fliers indicating that the federal property was to be given away free. To date, IHS has not investigated these claims and instead intends to write off the loss. The audit also revealed that the computers, which contained sensitive patient information, were not erased before being released to new owners.
• In September 2006, IHS property staff in Tucson attempted to write off more than $275,000 worth of lost property, including Jaws of Life equipment. The acting area director refused to allow it because of the "egregious nature of the loss." However, no investigation has ever been done to determine what happened to the equipment.

Whistleblower

The GAO audit began with a call from a whistleblower inside the IHS property office who reported gross mismanagement and lack of accountability to the GAO's FraudNet hotline.

In a response to the allegations in the report, officials for the U.S. Department of Health and Human Services, the IHS parent agency, said that while they agree that some changes need to be made, the report contained a number of inaccuracies.

For example, HHS officials contend that the $16 million figure is inflated because the GAO auditors did not take into consideration the depreciated value of the missing items.

The auditors agreed with this but pointed out that if the items were to be replaced, it is likely that the replacement cost will be as much, if not more, than the original cost.

HHS officials also argued that the items reported missing in Tucson were recently found. GAO officials said they could not validate the claim and even if the items have now been located, they were missing for more than two years.

As for the allegation of wasteful purchases, HHS officials said that in order to save money, the agency had begun buying in bulk and at times when there were price discounts for volume purchases. They attribute the excess and duplicative equipment to this factor.

The outcome of the audit is that the GAO has made several recommendations on how the IHS can better keep track of its resources and HHS personnel indicated that some of these recommendations will be implemented.

Back to top »