Report 2008-501 Summary - January 2009

California Prison Health Care Services

:

It Lacks Accurate Data and Does Not Always Comply With State and Court-Ordered Requirements When Acquiring Information Technology Goods and Services

HIGHLIGHTS

Our review of California Prison Health Care Services' (Prison Health Services) contracts for IT goods and services revealed the following:

RESULTS IN BRIEF

The Department of Corrections and Rehabilitation (Corrections) is responsible for providing health care to inmates in its custody. However, in 2001 a U.S. district court found that the State of California (State) failed to provide constitutionally adequate medical care to adult inmates. Following unsuccessful attempts by the State to improve patient care, the court appointed a receiver in 2006 to take control of the delivery of medical services to state prisoners and to bring prison health care up to federal constitutional standards. The receiver recently began using the name California Prison Health Care Services (Prison Health Services) to better encompass the roles of both the Plata Support Division—a subdivision of Corrections—and the nonprofit organization the receiver established.1 The federal judge ordered that the receiver must work within the bounds of state laws and administrative policies unless he finds that these legal requirements prevent him from carrying out his duties. In April 2007 the receiver requested a waiver from state contracting laws and regulations for specified projects because, as he stated, they were hampering his ability to carry out his responsibilities in a timely manner. The court approved the request to expedite institutional and medical reform but required that when not following state contracting rules, the receiver must follow specific alternative methods for soliciting, assessing, and entering into health care contracts, including information technology (IT) contracts, which were the subject of our review.

As requested by the current court-appointed receiver, the Bureau of State Audits (bureau) conducted an audit of contracts for IT goods and services initiated by Prison Health Services for the improvement of prison medical health care services. We found that Prison Health Services does not have sufficiently reliable data to allow it to identify all IT contracts it initiates. While Corrections maintains two databases that contain various information related to contracts, including those initiated by Prison Health Services and approved through the state contracting process, these databases often contain inaccurate and incomplete data. Prison Health Services noted that its staff use reports generated from these databases to identify the number of contracts it initiated and to assess appropriate future staffing levels to support its operational efforts internally instead of relying on Corrections. Its chief information officer stated that Prison Health Services is in the process of implementing a new enterprise-wide business information system that will house future contract information and will have appropriate controls to limit inaccurate data. Corrections noted that data related to some existing contracts has been migrated to the new system from the existing contracts database. Therefore, even though Prison Health Services intends to limit inaccurate data, the new system may already contain inaccurate or incomplete data.

In reviewing 21 contracts related to IT goods and services executed between January 1, 2007, and June 30, 2008, we found that Prison Health Services did not always comply with state requirements and its own policies. Eight of the 21 contracts—valued at more than $3.6 million—lacked required certifications stating that the purchases were necessary to Prison Health Services' operations and were compatible with its current IT systems. Further, for one IT service contract valued at $190,400, Prison Health Services used the wrong form. As a result, it failed to ensure that the vendor agreed to all of the terms and conditions required for that specific type of contract, such as how the payments are to be made for services rendered. Prison Health Services also could not provide evidence that it complied with all bidding and contract award requirements for four service contracts we tested.

Prison Health Services' failure to comply with the basic requirements of the state contracting process may be attributed to a lack of adequate internal controls to ensure that appropriate individuals review contract agreements. According to its chief information officer, in March 2008 Prison Health Services implemented a policy requiring each individual responsible for reviewing contracts to initial a routing slip to indicate he or she had reviewed the contract for such things as accuracy, completeness, technical specifications, and budget availability. Of the 21 contracts we reviewed, 11 were approved prior to implementation of this policy, and nine of the 11 did not have any evidence that appropriate staff reviewed the contracts for compliance. For two of the remaining 10 contracts that were approved after the new policy was implemented, Prison Health Services was still unable to provide any evidence to indicate that all appropriate individuals had reviewed them.

In addition, Prison Health Services has not fully complied with all provisions of the federal court's order when using the three alternative contracting methods the court authorized: expedited formal bid, urgent informal bid, and sole source. It has not developed formal policies to implement any of these alternative contracting methods. For two contracts, totaling over $27 million, that were executed using the expedited formal bid method, we found no evidence that specific criteria were considered to justify the use of this alternative contracting method. Similarly, Prison Health Services has not always followed prudent business practices in retaining documents to demonstrate that it complied with all requirements of the federal court. For example, for one contract valued at $141,000, it could not provide evidence to support that it made a reasonable effort to solicit three bidders, nor did it specify what criteria it used to evaluate the two bids it received. In addition, Prison Health Services does not always clearly identify the total value of contracts it executes through alternative contracting methods, which places it at risk for paying contractors more than the agreed-upon contract amount. Further, although it appointed committees to evaluate two contracts executed through the expedited formal bid method in compliance with the court order, Prison Health Services could not demonstrate how it had ensured that committee members did not have any impermissible affiliations or conflicts, as required.

Although Prison Health Services informed us that it reported to the court all contracts it executed using alternative methods as required, it could not provide sufficient documentation to support this assertion. Moreover, it cannot demonstrate that it reported all vendors who submitted bids on contracts executed using alternative contracting methods. Failing to retain proposals from all bidders decreases the transparency of Prison Health Services' operations and contract evaluation process, and does not provide assurance that its reports to the court are complete and accurate.

RECOMMENDATIONS

To ensure that it has complete and accurate information related to its contracts, Prison Health Services should ascertain that the internal controls over the data entered into the new enterprise-wide business information system work as intended. For contract-related data that has already been migrated from old databases to the new system, Prison Health Services needs to ensure the accuracy of key fields such as the ones for contract amount, service type, and the data fields that identify contracts initiated by Prison Health Services by comparing the data stored in its new database to existing hard-copy files.

To make certain that its contracts for IT goods and services comply with state contracting requirements and applicable policies and procedures, Prison Health Services should ensure that all responsible staff are aware of and follow processing and documentation requirements, including evidencing the review and approval of contracts.

To ensure that it complies with the terms of the court-approved waiver of state contracting requirements, Prison Health Services should develop policies to support its use of alternative contracting methods. These policies should include a requirement that Prison Health Services develop clear and specific criteria and guidelines for determining when the waiver authority should be used and how the requirements of the waiver are to be met and documented. Further, Prison Health Services should clearly identify the value of all contracts it executes and ensure that all contracting documents are maintained in a central location.

To better support that it has reported all contracts and bidders to the court, Prison Health Services should develop a system of tracking all contracts executed under alternative contracting methods and retain all bids it receives for each contract. To better track its contracts, Prison Health Services should assign a sequential contract number or other unique identifier to each contract executed using alternative contracting methods.

AGENCY COMMENTS

Prison Health Services agreed with our recommendations and indicated that it has taken or will take steps to implement them.

1 Our report focuses only on the activities undertaken by Prison Health Services to administer, control, manage, and operate the California prison medical health care system. We did not review activities undertaken by the receivership unrelated to performing these state functions.