Overall, we identified most state agencies maintain computer systems which hold a variety of sensitive data or process payments that must be protected. Although the state is responsible for these sensitive data or payment systems, it lacks an enterprise-level approach to IT security. We also found that 17 of 45 agencies (38%) that process payments or maintain large amounts of highly sensitive data have not had an independent evaluation of their security measures in the past three years. In addition, we learned the state lacks a complete set of three-year IT Plans as required by law, and that agencies’ submitted plans have been made public despite containing sensitive security information.
We also reviewed IT security resources at 10 selected agencies. As part of that review, we found the reporting structures at seven agencies created a risk that important security issues may not be communicated to top management. Additionally, three agencies’ lead IT security positions were not filled with sufficiently qualified staff, and two agencies lacked enough staff to perform necessary IT security tasks. Lastly, IT security software products agencies reported using in five security categories appeared to be adequate except for one agency, which lacked software to back up its system databases and electronic files stored on its network since November 2013.
Business Procurement Cards: Expanding Their Use To Increase Cash Rebates to the State
For fiscal year 2008, we estimated that $27 million of the non-procurement-card purchases agencies made from the 37 highest-volume vendors potentially could have been charged to a procurement card. Charging all those purchases would have generated more than $380,000 in cash-back rebates. Agencies also made $327 million of similar non-procurement-card purchases from the thousands of other vendors we didn’t analyze. If just 20% of these purchases could have been charged, agencies would have generated $940,000 in additional cash-back rebates, for a total of $1.3 million. Among other things, agency officials told us they didn’t always use their procurement cards when they could because of concerns about the complexity of tracking such purchases, and the perceived lack of thorough controls over procurement card purchases.
The KU Medical Center and KU Hospital: Reviewing Selected Operational Issues
Since 2001, research spending from all sources has grown from 23% of total spending in 2001 to 32% in 2007. The amount of the State operating grant spent for research accounts for only $3.6 million, and represents an unchanged 3% of State grant expenditures. However, more of the State grant now is being spent on other costs, and less on education. The Kansas City campus received almost all the $13.3 million increase in State grant moneys since 2001. Among other things, it uses State funds to pay for the Medical Center’s Kansas City-based administrative operations, and some residency program costs, an expense covered by different funding sources in Wichita. The big increase in research spending has come from other sources—primarily federal research grants generated by faculty on the Kansas City campus. The differences in the amounts spent on research between Kansas City and Wichita have raised concerns in Wichita, which has received accreditation citations for not having research opportunities. The Legislature created the University of Kansas Hospital Authority in 1998 to improve the financial viability of the KU Hospital. The current organizational relationship between the Hospital and Medical Center follows State law, and is similar to how teaching hospitals and medical schools are organized in many other states. However, the financial relationship between the Medical Center and Hospital isn’t defined in State law, and is a source of contention between the two. Although comparisons of financial support with other states have significant limitations, the amount of financial support the Medical Center has received in the past from all affiliated hospitals does appear to be relatively low. The value of the care provided to medically indigent patients may be recorded as either charity care or bad debt, and is referred to as uncompensated care. When reporting the value of charity care or bad debt in its financial statements, the KU Hospital follows generally accepted accounting principles. Those principles require public teaching hospitals to report the value of that care based on their established charges for the services provided. However, reporting the value of uncompensated care (charity care plus bad debt) on that basis results in much higher dollar figures than if the care is valued based either discounted rates for paying patients or the cost of the care.
The KU Medical Center and KU Hospital: Reviewing Selected Financial Issues
We saw no evidence to indicate the Medical Center was having trouble covering its ongoing operations. From 2004-2006, its current assets for ongoing operations increased by about 31%, its current liabilities for ongoing operations increased by 13%, and its cash balances and ratios looked healthy. The School of Medicine has made multi-year commitments totaling $79 million to department chairs since 1999. The Medical Center has paid about 61% of the commitments made since 2003, mostly with KU Endowment and Research Institute funds. Over the next five years, the Medical Center has committed nearly $250 million to capital expenditures, which have been approved by the Board of Regents and the Legislature, and have identified funding sources. Finally, officials recently unveiled plans to spend $800 million over 10 years to expand research. Funding sources haven’t been fully identified; possible sources include moneys from an affiliation with St. Luke’s Hospital as well as contributions from the Kansas City area. The Legislature appropriated $5 million to the KU Cancer Center for both fiscal years 2007 and 2008 to help it reach a designation from the National Institutes of Health as a Cancer Center and Comprehensive Cancer Center. In 2006, Center officials indicated that State funding would be used for research, drug discovery, outreach, and administration. In fiscal year 2007, about $2.2 million of the $5 million appropriation (45%) was used for research. Center officials indicated State funds are used to fill the gaps that other funding sources don’t cover. This year, the Hospital Authority executed a $1.8 million separation agreement with its former CEO. Nothing in law or regulation prohibited the Hospital from giving a separation package of that size, which was equal to three years of the CEO’s annual base salary. The agreement included both ongoing responsibilities and concessions from the CEO. Board members told us they thought the separation package was in the Hospital’s best interest. We tried to determine if similar packages had been granted in other states where the hospital CEO had left, but were unable to make a determination because information of this nature was limited. In April 2006, the Hospital contracted for a new medical-records system projected to cost about $50 million over five years. The cost difference between the two vendors was calculated at between about $1 million and about $12 million– much smaller than the $30 million some thought. The range of costs resulted from uncertainty about the amount of work the Hospital would have to supply to implement the software. The Board’s decision appeared to be based on the fact that Epic did the best in all the Hospital’s evaluations, and that physicians and staff preferred it to Cerner. Board members told us cost was a secondary consideration.
Examining Problems with the University of Kansas Medical Center’s Heart Transplant Program
Four hearts were turned down because of inadequate nurse staffing in May and June 1994, partly because of a shortage of nurses, and partly because the cardiothoracic surgeon had a fundamental disagreement with the nurse manager about the types of nurses who should care for his patients. Between July 1994 and March 1995, 17 hearts were turned down because of a lack of surgeons. Patients who were on, or added to, the waiting list were not informed that hearts were being rejected for non-medical reasons. Top officials of the Medical Center were aware of problems with the heart transplant program, and several knew that donor hearts were being rejected for non-medical reasons. However, these officials failed to recognize how serious the problems were and failed to take appropriate action to deal with them. A total of 14 people were on the waiting list during the period when no heart transplants were being performed. Four were removed from the list, three received transplants at other hospitals, three died, and four are on waiting lists at other hospitals.Similar problems could happen in other departments at the Medical Center because individuals who knew about problems failed to take appropriate steps to ensure the problems were effectively resolved. In addition, the lines of authority and responsibility have not been clearly communicated to Medical Center staff.Finally, heart transplants still would be available at St. Luke's Hospital in Kansas City, Missouri, if the Medical Center permanently closed its heart transplant program, although there would be some financial and other impacts on the Medical Center.
Reviewing Certain Financial Management Practices at the University of Kansas Medical Center
The process Medical Center officials used to identify overhead activities that benefit both the hospital and the university was reasonable. Officials generally did a good job of determining each side’s “share” of overhead costs, but we had questions about the way they calculated a few of the costs. The Medical Center decided to use its $600,000 fiscal year 1995 appropriation to hire seven additional primary care faculty. Although this expenditure will not help address the financial viability of the primary care foundations in the short term, it may help in the long run as off-site clinics are developed and more managed-care contracts are obtained. Considerably less than half the appropriation has been obligated for primary care initiatives during fiscal year 1995; during the audit, Medical Center staff told us the remaining moneys would be used to fund part of its shrinkage requirements, which is not consistent with spending the money on primary care. The Medical Center has not received all the benefits it hoped to receive from the contractual relationship with the for-profit Salick Cancer Center: profits have not materialized, a permanent facility has not yet been built because of financing problems, and the number of patients has not increased as projected. Also, the contract does not include provisions that would help ensure the Medical Center receives all the expected benefits.
Reviewing State-Funded Medical Scholarships in Kansas
Since the inception of the Kansas Medical Scholarship Program, requirements have become more restrictive regarding designated areas of practice, types of medical specialties, and repayment provisions. In 1986, the emphasis of the Program changed from distributing physicians to underserved areas to placing primary-care physicians into rural areas. Since 1978, more than $36 million in medical scholarships has been awarded to 1,476 students. Approximately 46 percent of those recipients have fulfilled their service obligations. Many graduates are fulfilling their obligations under provisions of the law that allow them to practice in urban areas. The Program appears to be achieving the goals of retaining more Medical Center graduates in Kansas and distributing more doctors to underserved areas. In future years, because fewer than 35 new scholarships are being awarded annually, significantly fewer doctors will be distributed to underserved or rural areas as a result of the Program.
Reviewing the Way State Agencies Collect Delinquent Accounts
Statewide requirements for collecting, reporting, and writing off amounts owed to the State have improved somewhat in the past 11 years, but complete information about agencies’ accounts receivable is just beginning to be collected. Most of the six agency programs reviewed are required to follow additional collection procedures that go beyond the State’s minimum requirements, and all of them use the State’s set-off program as part of their collection procedures. Statewide procedures for the management of delinquent accounts and specific agencies’ collection procedures can both be improved.
Kansas provides loans and scholarships to medical, osteopathic, and optometry students. The Medical Scholarship program does not appear to have had an impact on overall retention rates, but does appear to be encouraging a larger proportion of graduates to practice in underserved areas. About 37 percent of Osteopathic Scholarship recipients stayed in Kansas. The Optometry program is too new to determine any impact it has had on retention rates.
Entry Into Retirement Annuity Plans at the Regents’ Institutions
Most employees who were signed up immediately for a retirement annuity plan either had a valid contract or the required experience when they started work. But many of those employees got their contract just before they started; they had not been enrolled in a valid plan at another school. The State incurs a cost of about $250,000 a year to pick up these employee’ retirement contributions. The Legislature will need to determine if it intended for these contibutions to be picked up.
Physicians’ Corporations at the University of Kansas Medical Center
The audit examined the effectiveness of the relationship between the University of Kansas and the 15 physicians’ corporations operating at the University’s Medical Center. The current relationship has several advantages. Under the current structure, physicians at the Medical Center provide more money for operating the School of Medicine and have greater incentive to earn higher revenues by working more hours without reducing the time spent on teaching and research. The audit found, however, that a number of issues within the relationship that revolve around a common conclusion: contracting with 15 different corporations poses difficulties for the effective management of the Medical Center. These difficulties range from procedural matters to larger issues as the Medical Center’s ability to shift funds to help meet its goal of supplying more primary care physicians for the State.The audit proposes two major alternatives for improving the relationships: adjusting all 15 contracts with the corporations to make the desired changes when contracts are renegotiated in 1980, or negotiating a single contract with all physicians and departments--in essence, creating a single physicians’ corporation.
Management of Selected Support Services at the University of Kansas Medical Center
This audit found substantial need for better management practices in the areas of: dietetics, physical plant, housekeeping, laundry, and purchasing. These five areas had accounted for more than $7 million of the Medical Center’s budge in fiscal year 1975. The audit point out particular examples in each area where current problems can be corrected. The audit also calls to attention problems the Medical Center will face in the future.
Unclassified Personnel Positions at the University of Kansas Medical Center
This audit comes as a direct request from the Legislative Coordinating Council. The request directed Legislative Post Audit to study why there are 2,200 unclassified positions at the University of Kansas Medical Center. Based on the initial study it was decided to concentrate detailed analysis on research associates and assistant positions.