Return to Nicholas Johnson's Main Web Site

Return to Nicholas Johnson's Iowa Rain Forest ("Earthpark") Web Site

Return to Nicholas Johnson's Blog, FromDC2Iowa

Auditor to look into UI breach

Brian Morelli

Iowa City Press-Citizen

January 30, 2007

[Note: This material is copyright by the Press-Citizen, and is reproduced here as a matter of "fair use" for non-commercial, educational purposes only. Any other use may require the prior approval of the Iowa City Press-Citizen.]

State Auditor Dave Vaudt will examine the security of University Hospitals' information technology systems.

University of Iowa Interim President Gary Fethke announced Monday that he requested the audit after someone accessed information on a hospital computer they should not have.

"We are constantly auditing and reviewing how we control access in our information technology systems to ensure that those processes are up-to-date and as effective as possible in protecting electronic records and documents," Fethke said in a statement. "However, we recently had an incident at (University Hospitals), which leads me to believe that an objective, external review of our processes is well advised."

The Iowa state Board of Regents office had been directed to investigate the matter, which regents called a "security breach of a computer," Jan. 11. UI identified it as a personnel matter and would not elaborate other than to say it did not involve patient information or a hacker.

Some regents confirmed it was related to documents obtained from the files of University Hospitals Director Emeritus John Colloton.

The UI General Counsel's office started an internal investigation in December and said the investigation concluded the week of Jan. 15.

"Our own investigation indicates that this was a case in which a university employee violated our policy on the acceptable use of information," Fethke said in the statement.

UI spokesman Steve Parrott said an external perspective will help determine if there is a problem.

"That is one reason to get an outside view, to get someone objective to see how serious they think it is," Parrott said.

Vaudt said he hoped to start this week, but it was too early to set a timetable for how long it would last.

"The first thing we will have to do is wrap our arms around this," Vaudt said referring to the scope of the audit.

Vaudt said this would be the first audit he has done at UI in his four years as auditor.

Todd Stewart, director of Internal Audit for the Board of Regents, will assist.