After it was revealed that University of Michigan Health System officials waited six months to report to University Police that an employee was in possession of child pornography, the U.S. Department of Education and the Joint Commission — a national health care accreditation organization — are both reviewing the incident.
In an interview Friday afternoon, Joint Commission Spokesman Bret Coons confirmed that UMHS is under examination for its delayed response to the case, but could not release information regarding how the organization was made aware of the incident. An official with the DOE noted that the department is “looking into” the incident, but declined to comment further.
In May, a female resident found a flash drive in a hospital computer belonging to former medical resident Stephen Jenson containing explicit material. After leaving and discovering the flash drive missing the next day, she notified her supervisors, who notified hospital security. UMHS did not notify University Police until November.
When Joint Commission standards are found to be out of compliance at an accredited organization, Coons said the commission may conduct an unscheduled or unannounced on-site evaluation of the facility, ask for a written response to the complaint or the complaint may be filed into a database of industry trends.
If an organization is scheduled for accreditation or certification in the future, he said the commission may consider the complaint and the organization’s compliance with related standards in making their decision. Coons said the commission has not yet found that UMHS has failed to comply with any of its standards.
University spokesman Rick Fitzgerald confirmed Friday afternoon that the Joint Commission has asked for information regarding the incident but said a formal complaint against UMHS had not been filed.
Fitzgerald said hospital accreditation is not presently at risk because the Joint Commission has only asked for information about the incident, adding that UMHS officials are cooperating with the Commission.
However, Fitzgerald said the University had not received any direct communication from the DOE regarding the incident as of Friday afternoon.
University President Mary Sue Coleman responded to the delay in reporting by calling for an internal investigation, which Fitzgerald said is still in progress.
“An internal review is still underway, and we are confident that the interval review will answer a lot of the questions that people are asking and that we’re asking ourselves,” Fitzgerald said. “We hope to find answers soon.”
Preliminary recommendations from the internal review obtained by The Michigan Daily note there was “not a clear line of responsibility for investigating the case,” adding that the hospital’s general counsel had initially reviewed the case and decided not to pursue it due to lack of sufficient evidence.
The report also noted that hospital security did not log the incident into the database it shares with the Department of Public Safety. If it had, DPS would have been made aware of the incident.
DPS declined to comment on the incident and referred all inquiries to the University’s Office of Public Affairs.
The preliminary document also states that UMHS Medical Center Information Technology staff reviewed the computer’s internal log, but it notes that MCIT staff members don’t have the proper equipment to conduct a forensic investigation of a computer. And therefore they weren’t able to retrieve “other relevant information.”
The preliminary review offered four recommendations that are currently being considered, including creation of a common protocol for reporting breaches of security that arise on campus, regular logging of potential crimes in the database shared by hospital security and DPS, development of joint training exercises between DPS and Hospital Security and the referring of all future computer forensic cases to DPS.
Ora Pescovitz, the University’s executive vice president for medical affairs, wrote a blog post on Jan. 30 about the issue and wrote that she is a proponent for collaboration in thorough examination of the case.
“It is our collective responsibility to be diligent in reporting behaviors and actions that are inappropriate, and that we applaud and support those who have the courage to do so,” Pescovitz wrote. “It isn’t always easy to speak up, but it is always the right thing to do. And it is my and all leadership’s responsibility to thoroughly and timely investigate reported concerns.”