Summary

California Prison Health Care Services: It Lacks Accurate Data and Does Not Always Comply With State and Court-Ordered Requirements When Acquiring Information Technology Goods and Services January 2009 Report 2008-501 C A L I F O R N I A S T A T E A U D I T O R The first five copies of each California State Auditor report are free. Additional copies are $3 each, payable by check or money order. You can obtain reports by contacting the Bureau of State Audits at the following address: California State Auditor Bureau of State Audits 555 Capitol Mall, Suite 300 Sacramento, California 95814 916.445.0255 or TTY 916.445.0033 OR This report is also available on the World Wide Web http://www.bsa.ca.gov The California State Auditor is pleased to announce the availability of an on-line subscription service. For information on how to subscribe, please contact the Information Technology Unit at 916.445.0255, ext. 456, or visit our Web site at www.bsa.ca.gov. Alternate format reports available upon request. Permission is granted to reproduce reports. For questions regarding the contents of this report, please contact Margarita Fernández, Chief of Public Affairs, at 916.445.0255. CALIFORNIA STATE AUDITOR Elaine M. Howle State Auditor Doug Cordiner B u r e a u o f S t a t e A u d i t s Chief Deputy 555 Capitol Mall, Suite 300 Sacramento, CA 95814 916.445.0255 916.327.0019 fax www.bsa.ca.gov January 29, 2009 2008-501 The Governor of California President pro Tempore of the Senate Speaker of the Assembly State Capitol Sacramento, California 95814 Dear Governor and Legislative Leaders: As requested by the current court-appointed receiver, the Bureau of State Audits presents its audit report concerning contracts, including purchase orders, for information technology (IT) goods and services entered into by the California Prison Health Care Services (Prison Health Services). This report concludes that Prison Health Services does not have reliable data to allow it to identify all IT contracts it initiates. Further, eight of the 21 contracts we reviewed—valued at more than $3.6 million—lacked required certifications stating that the purchases were necessary to Prison Health Services’ operations and were compatible with its current IT systems. Prison Health Services also could not provide evidence that it complied with all bidding and contract award requirements for four service contracts we tested. Prison Health Services’ failure to comply with the basic requirements of the state contracting process may be attributed to a lack of adequate internal controls to ensure that appropriate individuals review contract agreements. In addition, Prison Health Services has not developed formal policies to implement alternative contracting methods approved by the federal court. Similarly, Prison Health Services has not always followed prudent business practices in retaining documents to demonstrate that it complied with all requirements of the federal court. Moreover, Prison Health Services does not always clearly identify the total value of contracts it executes through alternative contracting methods, which places it at risk for paying contractors more than the agreed-upon contract amount. Finally, Prison Health Services’ failure to retain proposals from all bidders decreases the transparency of Prison Health Services’ operations and contract evaluation process, and does not provide assurance that its reports to the court are complete and accurate. Respectfully submitted, ELAINE M. HOWLE, CPA State Auditor California State Auditor Report 2008-501 vii January 2009 Contents Summary 1 Introduction 5 Audit Results California Prison Health Care Services Does Not Have Accurate Data for Contracts It Initiates 13 Prison Health Services Does Not Consistently Follow State Contracting Requirements to Purchase Information Technology Goods and Services 14 Prison Health Services Cannot Be Assured That It Met All Court‑Ordered Provisions Related to Alternative Contracting Methods 17 Recommendations 22 Appendix The Federal Court Granted the Receiver a Waiver From State Contracting Requirements for Specific Projects 25 Response to the Audit California Prison Health Care Receivership Corp. 27 California State Auditor Report 2008-501 1 January 2009 Summary Results in Brief Audit Highlights . . . The Department of Corrections and Rehabilitation (Corrections) Our review of California Prison Health is responsible for providing health care to inmates in its custody. Care Services’ (Prison Health Services) However, in 2001 a U.S. district court found that the State of contracts for IT goods and services revealed California (State) failed to provide constitutionally adequate the following: medical care to adult inmates. Following unsuccessful attempts by the State to improve patient care, the court appointed a » Prison Health Services does not have receiver in 2006 to take control of the delivery of medical services reliable data to identify all IT contracts to state prisoners and to bring prison health care up to federal it initiates—current databases contain constitutional standards. The receiver recently began using the inaccurate and incomplete data. name California Prison Health Care Services (Prison Health Services) to better encompass the roles of both the Plata Support » The new enterprise-wide business Division—a subdivision of Corrections—and the nonprofit information system may already contain organization the receiver established.1 The federal judge ordered inaccurate or incomplete data, migrated that the receiver must work within the bounds of state laws and from the old databases. administrative policies unless he finds that these legal requirements prevent him from carrying out his duties. In April 2007 the receiver » Eight of 21 contracts we reviewed lacked requested a waiver from state contracting laws and regulations for required certifications justifying the specified projects because, as he stated, they were hampering his purchase and four service contracts ability to carry out his responsibilities in a timely manner. The court did not have evidence of compliance approved the request to expedite institutional and medical reform with all bidding and contract but required that when not following state contracting rules, the award requirements. receiver must follow specific alternative methods for soliciting, assessing, and entering into health care contracts, including » Prison Health Services has not complied information technology (IT) contracts, which were the subject of with all provisions of the federal court’s our review. order when using alternative contracting methods—two contracts did not contain As requested by the current court-appointed receiver, the Bureau justification for an expedited formal of State Audits (bureau) conducted an audit of contracts for IT bid method. goods and services initiated by Prison Health Services for the improvement of prison medical health care services. We found that Prison Health Services does not have sufficiently reliable data to allow it to identify all IT contracts it initiates. While Corrections maintains two databases that contain various information related to contracts, including those initiated by Prison Health Services and approved through the state contracting process, these databases often contain inaccurate and incomplete data. Prison Health Services noted that its staff use reports generated from these databases to identify the number of contracts it initiated and to assess appropriate future staffing levels to support its operational efforts internally instead of relying on Corrections. Its chief information officer stated that Prison Health Services is 1 Our report focuses only on the activities undertaken by Prison Health Services to administer, control, manage, and operate the California prison medical health care system. We did not review activities undertaken by the receivership unrelated to performing these state functions. 2 California State Auditor Report 2008-501 January 2009 in the process of implementing a new enterprise-wide business information system that will house future contract information and will have appropriate controls to limit inaccurate data. Corrections noted that data related to some existing contracts has been migrated to the new system from the existing contracts database. Therefore, even though Prison Health Services intends to limit inaccurate data, the new system may already contain inaccurate or incomplete data. In reviewing 21 contracts related to IT goods and services executed between January 1, 2007, and June 30, 2008, we found that Prison Health Services did not always comply with state requirements and its own policies. Eight of the 21 contracts—valued at more than $3.6 million—lacked required certifications stating that the purchases were necessary to Prison Health Services’ operations and were compatible with its current IT systems. Further, for one IT service contract valued at $190,400, Prison Health Services used the wrong form. As a result, it failed to ensure that the vendor agreed to all of the terms and conditions required for that specific type of contract, such as how the payments are to be made for services rendered. Prison Health Services also could not provide evidence that it complied with all bidding and contract award requirements for four service contracts we tested. Prison Health Services’ failure to comply with the basic requirements of the state contracting process may be attributed to a lack of adequate internal controls to ensure that appropriate individuals review contract agreements. According to its chief information officer, in March 2008 Prison Health Services implemented a policy requiring each individual responsible for reviewing contracts to initial a routing slip to indicate he or she had reviewed the contract for such things as accuracy, completeness, technical specifications, and budget availability. Of the 21 contracts we reviewed, 11 were approved prior to implementation of this policy, and nine of the 11 did not have any evidence that appropriate staff reviewed the contracts for compliance. For two of the remaining 10 contracts that were approved after the new policy was implemented, Prison Health Services was still unable to provide any evidence to indicate that all appropriate individuals had reviewed them. In addition, Prison Health Services has not fully complied with all provisions of the federal court’s order when using the three alternative contracting methods the court authorized: expedited formal bid, urgent informal bid, and sole source. It has not developed formal policies to implement any of these alternative contracting methods. For two contracts, totaling over $27 million, that were executed using the expedited formal bid method, we found no evidence that specific criteria were considered to justify the use of this alternative contracting method. Similarly, Prison California State Auditor Report 2008-501 3 January 2009 Health Services has not always followed prudent business practices in retaining documents to demonstrate that it complied with all requirements of the federal court. For example, for one contract valued at $141,000, it could not provide evidence to support that it made a reasonable effort to solicit three bidders, nor did it specify what criteria it used to evaluate the two bids it received. In addition, Prison Health Services does not always clearly identify the total value of contracts it executes through alternative contracting methods, which places it at risk for paying contractors more than the agreed-upon contract amount. Further, although it appointed committees to evaluate two contracts executed through the expedited formal bid method in compliance with the court order, Prison Health Services could not demonstrate how it had ensured that committee members did not have any impermissible affiliations or conflicts, as required. Although Prison Health Services informed us that it reported to the court all contracts it executed using alternative methods as required, it could not provide sufficient documentation to support this assertion. Moreover, it cannot demonstrate that it reported all vendors who submitted bids on contracts executed using alternative contracting methods. Failing to retain proposals from all bidders decreases the transparency of Prison Health Services’ operations and contract evaluation process, and does not provide assurance that its reports to the court are complete and accurate. Recommendations To ensure that it has complete and accurate information related to its contracts, Prison Health Services should ascertain that the internal controls over the data entered into the new enterprise-wide business information system work as intended. For contract-related data that has already been migrated from old databases to the new system, Prison Health Services needs to ensure the accuracy of key fields such as the ones for contract amount, service type, and the data fields that identify contracts initiated by Prison Health Services by comparing the data stored in its new database to existing hard-copy files. To make certain that its contracts for IT goods and services comply with state contracting requirements and applicable policies and procedures, Prison Health Services should ensure that all responsible staff are aware of and follow processing and documentation requirements, including evidencing the review and approval of contracts. 4 California State Auditor Report 2008-501 January 2009 To ensure that it complies with the terms of the court-approved waiver of state contracting requirements, Prison Health Services should develop policies to support its use of alternative contracting methods. These policies should include a requirement that Prison Health Services develop clear and specific criteria and guidelines for determining when the waiver authority should be used and how the requirements of the waiver are to be met and documented. Further, Prison Health Services should clearly identify the value of all contracts it executes and ensure that all contracting documents are maintained in a central location. To better support that it has reported all contracts and bidders to the court, Prison Health Services should develop a system of tracking all contracts executed under alternative contracting methods and retain all bids it receives for each contract. To better track its contracts, Prison Health Services should assign a sequential contract number or other unique identifier to each contract executed using alternative contracting methods. Agency Comments Prison Health Services agreed with our recommendations and indicated that it has taken or will take steps to implement them. California State Auditor Report 2008-501 5 January 2009 Introduction Background The Department of Corrections and Rehabilitation (Corrections) operates 33 adult penal institutions that housed more than 165,000 inmates as of October 2008. Corrections is required to provide medically necessary health care to these inmates. In 1992 Corrections established the Health Care Services Division that oversaw the delivery of medical, dental, and psychiatric services at the institutions. However, as a result of a 2001 class-action lawsuit filed on behalf of inmates in Corrections’ custody, a U.S. district court found that the State of California (State) failed to provide constitutionally adequate medical care to adult inmates. Following unsuccessful attempts by the State to improve patient care, the court established a receivership in 2005 and appointed a receiver in 2006 to provide leadership and executive management over the prison medical health care system with the goals of restructuring day-to-day operations and developing, implementing, and validating a new sustainable system that provides constitutionally adequate medical care to all inmates. The court transferred the authority to administer the State’s prison health care system from the secretary of Corrections to the court-appointed receiver, and the Plata Support Division was established as a subdivision of Corrections to provide administrative support for the reform initiatives spearheaded by the receiver. In 2006 the receiver established a nonprofit corporation—the California Prison Health Care Receivership Corporation (Corporation)—as a distinct and separate legal entity to help carry out the responsibilities assigned to the receiver. The Plata Support Division and other offices supporting the receiver’s reform efforts are managed by a combination of Corporation executives and state employees under the direction of the receiver. The receiver recently began using the name California Prison Health Care Services (Prison Health Services) to better describe the receivership and the other organizations he oversees.2 According to the federal receiver’s plan of action, Prison Health Services’ goals include ensuring timely access to health care services; establishing a prison medical program addressing the full continuum of health care services; recruiting, training, and retaining a quality professional medical workforce; implementing a quality assurance and continuous improvement program; establishing medical support infrastructure; and providing necessary clinical, administrative, and 2 Our report focuses only on the activities undertaken by Prison Health Services to administer, control, manage, and operate the California prison medical health care system. We did not review activities undertaken by the receivership unrelated to performing these state functions. 6 California State Auditor Report 2008-501 January 2009 housing facilities. Prison Health Services enters into various contracts for goods and services necessary to achieve its goals and meet its responsibilities. Despite the fact that the receiver is the federal court’s officer appointed to correct a federal constitutional deficiency, the receiver acts in place of the secretary of Corrections and, therefore, must ensure that Prison Health Services adheres to state laws and regulations when entering into contracts unless those requirements are waived by the federal court. The Federal Court Granted a Waiver From Information Technology Defined State Contracting Laws and Regulations Under Certain Circumstances Information Technology (IT) means all computerized and auxiliary automated information handling, including The federal judge ordered that the receiver systems design and analysis; conversion of data; computer must work within the bounds of state laws and programming; information storage and retrieval; voice, regulations unless these legal requirements are video, and data communications; requisite systems controls; preventing him from carrying out his duties, in and simulation. Examples of IT goods and services include the following: which case the receiver must request a waiver from the federal court. The Public Contract Code • Personal computers generally governs state departments’ contracting • Printers activities. The Department of General Services (General Services) is statutorily responsible for • Modems all contracts for the acquisition of information • System maintenance technology (IT) goods and services. See the • Technical consulting text box for the definition of IT. General Services maintains the State Contracting Manual, which Sources: State Administrative Manual and State Contracting Manual. sets forth policies and procedures for the acquisition of IT goods and services. State contracting practices include three approaches for IT acquisition: competitive bid, noncompetitive bid, and leveraged procurement agreements (leveraged agreements). The competitive bid process requires departments to conduct procurement activities in an open and fair environment that promotes competition among prospective suppliers, such as the solicitation of a minimum number of bidders. Under the noncompetitive bid process, departments may enter into a contract with a vendor without soliciting bids from others if no known competition exists. However, in such cases, departments must demonstrate that proposed acquisitions are the only goods and services that meet the State’s needs or that an immediate acquisition is necessary for the protection of public health, welfare, or safety. Leveraged agreements, on the other hand, allow departments to obtain goods and services under pricing structures previously negotiated by General Services with vendors after it has competitively assessed them. This method includes four categories: California Multiple Award Schedule, Software License Program, California State Auditor Report 2008-501 7 January 2009 Statewide Contract, and Master Agreements. Some leveraged agreement prices are set at the maximum the vendor may charge, and departments may negotiate for lower prices, while others are fixed prices. Requirements for using the different leveraged agreement categories are slightly different. For example, while the use of the California Multiple Award Schedule generally requires that the agency solicit at least three offers from the list of approved vendors, some statewide contracts allow agencies to choose a single vendor from the list without obtaining any bids. Although General Services has the statutory authority for IT acquisitions, it may grant delegated purchasing authority to agencies and departments that demonstrate the ability to conduct value-effective IT acquisitions and the capability to execute IT contracts while adhering to state requirements and policies. General Services has granted Corrections such delegated purchasing authority for IT-related acquisitions that range from less than $5,000 for noncompetitively bid contracts up to $2 million for Software License Program orders. General Services may also grant unlimited authority when agencies purchase very specific goods or services through certain leveraged agreements. For example, it has delegated to Corrections the authority to enter into contracts, without limit on the dollar amount, with vendors with whom General Services has contracted as part of a statewide contract. Prison Health Services uses statewide contracts to procure goods such as desktop computers, monitors, printers, and scanners. Prison Health Services’ staff informed us that it often uses various leveraged agreements because of their efficiency and streamlined competitive process. In addition to the requirements outlined in state laws and the State Contracting Manual, Corrections also has internal policies and procedures that guide its contracting process and ensure compliance with state requirements. Because Prison Health Services uses Corrections’ delegated purchasing authority and routes many of its IT-related acquisitions through that contracting office, it adheres to Corrections’ internal acquisition policies and procedures. In April 2007, after about a year of operations, the receiver requested a waiver from state contracting laws and regulations for specified projects because, according to the request, they were hampering his ability to carry out his responsibilities in a timely manner. The court agreed and approved the request to expedite institutional and medical reform. The federal court allowed the receiver to forgo state contracting requirements provided that he follows specific alternative methods for soliciting and evaluating bids and entering into health care contracts in support of the specified projects. Since the original waiver for 13 projects granted 8 California State Auditor Report 2008-501 January 2009 by the federal court, the receiver has applied for and the court has approved 13 additional projects. As the Appendix shows, as of September 30, 2008, the court has approved a total of 26 projects for which the receiver can use the alternative contracting methods in lieu of following state contracting requirements. The waiver allows the receiver to enter into contracts using any of three streamlined alternative methods: expedited formal bid, urgent informal bid, and sole source. The expedited formal bid and the urgent informal bid methods require a competitive bid procedure, while the sole source method allows the receiver to select a single vendor that can meet its needs without seeking additional bids. The waiver specifies that the receiver must use the expedited formal bid method for contracts valued at or above $750,000. The waiver allows the receiver to use the urgent informal bid method for contracts valued between $75,000 and $750,000 if the receiver determines that urgent circumstances do not permit sufficient time to use the expedited formal bid method. For all contracts valued below $75,000, the waiver allows the receiver to use the urgent informal method. The receiver may use a vendor selected by the sole source method when he has determined, after reasonable effort under the circumstances, that there is no other reasonably available source. In order to maintain accountability, the court requires the receiver to report on a quarterly basis the contracts entered into by Prison Health Services using any of the alternative methods. The court also requires the receiver to report all bidders for these contracts. Regardless of the contracting method used, once a need for goods or services has been identified, a contract agreement is generally developed and executed in five phases, as Figure 1 shows. The phases usually include choosing an acquisition approach (such as a leveraged agreement for the state contracting process or an urgent informal bid under the alternative contracting method), developing supporting documentation, routing for internal review, executing the contract, and paying invoices. Depending on the type of contracting method and acquisition approach used, specific nuances may exist. For IT-related issues, Prison Health Services identifies its needs and typically performs all work necessary to identify its preferred vendor. However, according to Prison Health Services’ officials, because Corrections’ contracting office has greater personnel resources to manage the workload associated with the volume of acquisitions, its contracting office generally executes Prison Health Services’ contracts entered into under state contracting procedures. California State Auditor Report 2008-501 9 January 2009 Corrections’ contracting office is generally not involved when Prison Health Services enters into contracts using one of the three court-approved alternative methods. Rather, such contracts are segregated from the state process and are developed, executed, and maintained solely by Prison Health Services. Figure 1 California Prison Health Care Services Information Technology Contracting Methods Initiation Initiation 1. Identify the need to acquire goods and/or services. California Prison Health Care Services (Prison Health 2. Prison Health Services executives (including legal Services) identifies the need to acquire goods counsel) determine if the acquisition should be and/or services. Its executives (including legal conducted using: counsel) determine if the state contracting process A) state contracting process, or or an alternative contracting method should be used for each acquisition. B) alternative contracting method. State Contracting Process* Alternative Contracting Method† State contracting process* Alternative contracting methods† Development Development 1. Acquisition approach is chosen (competitive bidding, 1. Depending on the acquisition approach (expedited Preparation/Development Preparation/Development noncompetitive bid, leveraged procurement agreement). formal bid, urgent informal bid, or sole source), project managers solicit bids from vendors and make 2. Supporting contract documentation is developed, 1. Acquisition approach is chosen (Competitive Bidding, 1. Depending on the acquisition approach (urgent informal, recommendations, as necessary. acquired, and assembled, including the solicitation for Non-Competitive Bid, Leveraged Procurement Agreement). expedited formal, sole source), project managers solicit bids bids and the evaluation process. 2. Receiver, or his delegate, selects the vendor. from vendors and make recommendations, as necessary. 2. Supporting contract documentation is developed, acquired and assembled, including the solicitation for 2. Receiver, or his delegate, selects the vendor. bids and the evaluation process. Process Process 3. Contract documentation routed for internal and, if 3. Project managers and legal counsel negotiate contract applicable, external reviews; stakeholders may include with vendor; legal counsel reviews contract for legality Process Process Department of General Services. and whether alternative contracting method requirements were followed. 3. Contract documentation routed for internal and, if 3. Project managers and legal counsel negotiate contract with applicable, external, reviews; stakeholders may include vendor; contract reviewed for legality and alternative General Services. method requirements by legal counsel. Execution Execution 4. Final review, encumbrance, and signature(s) by delegated authority and, when appropriate, vendor. 4. Contract signed by receiver and vendor. 5. Department of Corrections and Rehabilitation’s 5. Executed contract sent to the accounting office within Execution/Payment Execution/Payment (Corrections) accounting office receives and pays the receiver’s nonprofit organization—California invoices, once approved by Prison Health Services. Prison Health Care Receivership Corporation— for receipt and payment of invoices for alternative contracts. 4. Contract executed, which entails final review, 4. Contract signed by Receiver and vendor. encumbrance and signatures by delegated authority, and 5. Executed contract sent to Corporation’s accounting for vendor when appropriate. receipt and payment of invoices. 5. Corrections’ accounting offices receive and pay invoices, Steps performed by Prison Health Services once approved by Prison Health Services. Step performed by Prison Health Services or Corrections Steps performed by Corrections Steps performed by Prison Health Services Sources: Prison Health Services and Corrections. Step performed by Prison Health Services or Corrections * Prison Health Services’ acquisitions through the state contracting process are broken down into three phases: development, processing, and Step performed by Corrections execution. Steps 1 through 3 are considered the development and processing stages and are generally completed by individuals within Prison Health Services, including program officials, technical reviewers, and fiscal management staff. Steps 4 and 5 are considered the execution stage and are completed by Corrections’ contracting and accounting offices. † If a project area has not been approved for a waiver from state contracting processes, the receiver may petition the court for additional waiver authority for new projects before proceeding. Corrections is generally not involved when Prison Health Services enters into contracts under the alternative contracting methods. 10 California State Auditor Report 2008-501 January 2009 According to data obtained from Corrections’ two contracting databases, Prison Health Services’ IT-related acquisitions account for a relatively small proportion of its total acquisition expenditures. As we discuss later in this report, the data in the contracting databases were not sufficiently reliable for our purposes; however, because they were the only data available, we chose to use them to provide context, as shown in Table 1. Table 1 California Prison Health Care Services’ Information Technology Acquisitions January 2007 Through June 2008 number of ConTraCT Types of ConTraCTs ConTraCTs vaLue Contracts Approved Through State Contracting Process Contracts for goods 40 $5,755,439* Contracts for services 12 4,329,796 Contracts Approved Through Alternative Contracting Methods† Contracts (goods and services) 9 28,879,582 Totals 61 $38,964,817 Sources: Department of Corrections and Rehabilitation’s (Corrections) contracting databases, California Prison Health Care Services, and the receiver’s quarterly reports submitted to the federal court. Note: Although we deemed Corrections’ contracting databases not sufficiently reliable for our purposes, we present this data to provide context. * This includes two amendments to contracts. † Quarterly reports submitted to the federal court do not distinguish between the purchase of goods versus services. Scope and Methodology State law gives the Bureau of State Audits (bureau) the authority to audit contracts involving the expenditure of public funds in excess of $10,000 entered into by public entities at the request of the public entity. The current court-appointed receiver requested that the bureau conduct an audit of contracts for IT goods and services initiated by Prison Health Services for the improvement of prison medical health care services. To obtain an understanding of the state contracting requirements for obtaining IT goods and services, we reviewed the relevant laws, regulations, and policies and identified those that were applicable and significant to the audit. In addition, we reviewed Corrections’ policies and procedures related to contracting. Finally, we interviewed Prison Health Services’ and Corrections’ staff to assess their roles and responsibilities with regard to the acquisition of IT goods and services on behalf of Prison Health Services and to California State Auditor Report 2008-501 11 January 2009 identify what pertinent policies, procedures, and internal controls are in place for developing and executing IT acquisitions under the state contracting process. To identify all contracts for IT goods and services and related dollar amounts executed between January 1, 2007, and June 30, 2008, we obtained two of Corrections’ databases that track contracts for goods and services, including those executed on behalf of Prison Health Services. Using criteria identified by Corrections, we attempted to determine IT contracts executed on behalf of Prison Health Services during the audit period. The U.S. Government Accountability Office, whose standards we follow, requires us to assess the reliability of computer-processed data. To determine whether the databases contained accurate and complete information for our purpose, we reviewed key data fields for a sample of contracts from both databases. We found inaccurate data in some of these fields, such as those that would identify whether purchases were for IT-related goods and services, the amount of the purchase, and the date a contract agreement was approved. In addition, we identified a non-IT contract incorrectly listed as one for IT goods. Therefore, we determined that Corrections’ databases were not sufficiently reliable for identifying all IT contracts and related information initiated by Prison Health Services between January 1, 2007, and June 30, 2008. Despite data reliability issues found with Corrections’ databases, we did, however, use the data to help identify the population of contracts for goods and services executed through the state contracting process because these were the only data available. We then performed an initial review of the population of contracts to confirm that documentation supporting the acquisition was initiated and developed by Prison Health Services. Through this initial review process, we discovered and tested an additional contract for IT services that was initiated by Prison Health Services and miscoded. In total, we selected and reviewed a sample of 21 contract agreements. We did not evaluate amendments and limited our review to contracts valued at $100,000 or more. We did not assess whether Corrections complied with laws, regulations, and policies and procedures when executing contracts requested by Prison Health Services. Further, we did not audit IT contracts that Corrections may have entered into to carry out activities unrelated to Prison Health Services. For each selected contract, we reviewed the contract file to determine whether Prison Health Services executed it in accordance with state laws, regulations, and policies, including Corrections’ internal policies and procedures for contracting, when applicable. 12 California State Auditor Report 2008-501 January 2009 To obtain an understanding of the alternative contracting methods used by Prison Health Services for acquiring IT goods and services, we reviewed its master contract waiver application, the court’s approval, subsequent waiver applications and court orders, and other relevant court documents that were applicable and significant to the audit. In addition, we interviewed officials from Prison Health Services to identify pertinent policies and procedures for developing and executing IT-related contracts under this process. Because Prison Health Services does not have any other mechanism for tracking the contracts processed through its alternative contracting methods, we identified all contracts the receiver reported to the court in the six quarterly reports filed between January 2007 and June 2008. Using the description of the contracts included in the quarterly reports, we identified nine IT-related contracts. We also reviewed Prison Health Services’ lists of contracted vendors to identify other potentially relevant IT contracts. We removed from our sample one contract valued at less than $50,000 and two others that appeared to support a larger contract. For the remaining six contracts, we reviewed available documentation to assess Prison Health Services’ compliance with court-ordered requirements. California State Auditor Report 2008-501 13 January 2009 Audit Results California Prison Health Care Services Does Not Have Accurate Data for Contracts It Initiates California Prison Health Care Services (Prison Health Services) does not have sufficiently reliable data to allow it to identify all contract agreements it initiates, including information technology (IT) contracts, and related information. As we describe in the Introduction, when entering into contracts through the state contracting process, Prison Health Services typically performs all necessary work to identify the preferred vendor for its IT contracts. The contracting office of the Department of Corrections and Rehabilitation (Corrections) executes the contract with the preferred vendor, and its accounting office is responsible for making payments on these contracts. Corrections maintains databases to track information related to all contracts for goods and services that it executes using state contracting processes, including the ones for IT initiated by Prison Health Services. However, the databases contain inaccurate or incomplete data related to IT contracts initiated by Prison Health Services. Without complete and accurate information on its contracts, Prison Health Services may not be able to make informed management decisions. Corrections maintains a database for contracts for goods and another database for contracts for services. Corrections’ staff enter information such as the contract number, contract amount, contractor name, and the type of goods or services procured in the respective fields of the databases. On a limited basis, Prison Health Services’ staff have also entered into Corrections’ database information for a small number of IT contracts approved during the month of June 2008. As we discuss in the Scope and Methodology of this report, Corrections’ contracting databases are not sufficiently reliable for identifying the dollar amount and number of all IT contracts initiated by Prison Health Services during the period we sampled. For example, we found that the dollar amount for one IT service contract was underreported in the database by $425,000 and the dollar amount for another IT contract for goods was entered as a negative number. Further, we observed contract approval dates that were inaccurate by as many as 13 days, which decreases our confidence that we could accurately identify all IT contracts approved during the period we sampled. Finally, the contract requestor, contract processing unit designation, and organization code fields, which identify whether Prison Health Services initiated the contract, were used inconsistently or could not be validated. Moreover, we identified two IT contracts that together had a total value of $735,000 and were initiated by Prison Health Services that were incorrectly entered into Corrections’ databases as contracts for non-IT services. 14 California State Auditor Report 2008-501 January 2009 Effective October 2008, the Department of General Services (General Services) granted Prison Health Services delegated purchasing authority, allowing it to develop and execute its own contracts internally without having to go through Corrections. According to its managers, Prison Health Services uses reports generated from Corrections’ contract databases, for example, to identify all contracts it initiated to assess the appropriate staffing levels needed to support its efforts to develop and execute all IT contracts internally rather than using Corrections’ contracting resources. However, without reliable data, Corrections’ databases have limited usefulness to Prison Health Services as a management tool. The chief information officer of Prison Health Services informed us that it and Corrections are in the process of implementing a new enterprise-wide business information system. According to Prison Health Services, staff will enter all data into the new system, which includes specific controls to ensure accurate and complete data input regarding its contracts, as well as use the system to create and maintain contract documentation. The chief information officer noted that appropriate staff have been trained to use the new system. Nevertheless, according to Corrections, data related to some existing contracts has been migrated to the new system from the existing contract databases. As a result, the new system may already contain inaccurate or incomplete data. Prison Health Services Does Not Consistently Follow State Contracting Requirements to Purchase Information Technology Goods and Services Prison Health Services failed to consistently adhere to state contracting requirements, including Corrections’ and its own internal policies, when entering into contracts for IT goods and services. State laws and regulations outline the process that Corrections must follow when making such purchases. Because the receiver acts in place of the secretary of Corrections for all matters related to providing medical care to adult inmates, Prison Health Services must adhere to the same contracting requirements as Corrections, except to the extent that the federal court has waived those requirements. Our review of 21 contract agreements related to IT goods and services executed between January 1, 2007, and June 30, 2008, found that Prison Health Services did not have required documentation to justify the purchases for eight contracts, failed to ensure the contractor agreed to the various required provisions for one contract, and could not demonstrate it complied with appropriate bidding and bid evaluation requirements for four contracts. Prison Health Services’ failure to comply with these requirements could be attributed to its lack of adequate controls to ensure that appropriate individuals reviewed these contracts. California State Auditor Report 2008-501 15 January 2009 As described in the Introduction, General Services is responsible for all state acquisitions and maintains the State Contracting Manual, which sets forth policies and procedures for IT acquisitions. As permitted by state law, General Services has delegated purchasing authority to Corrections. Corrections’ contracting office is responsible for carrying out this authority through the proper administration of purchases. General Services may revoke authority to process and approve acquisitions if it finds that requirements have not been met, such as ensuring the necessity of products and services acquired and executing purchase documents that are in the State’s best interest. To provide additional guidance in adhering to state laws and regulations, agencies or departments often develop complementary policies and procedures to implement requirements set forth by General Services. According to its officials, Prison Health Services relies on Corrections’ greater number of personnel to deal with the workload associated with its high volume of acquisitions and it conforms to internal contracting policies and procedures, as communicated in Corrections’ policy manuals. However, as Table 2 on the following page shows, Prison Health Services did not consistently comply with specific documentation and forms requirements, or with Corrections’ and its own internal policies and procedures. For example, to ensure it maintains its delegated purchasing authority, Corrections requires that Prison Health Services certify that all purchases are necessary to its operations, conform to policy, and are consistent with departmental standards. We found that eight of the 21 IT contracts we reviewed, valued at more than $3.6 million and representing almost 39 percent of the 21 contracts valued at $9.3 million, lacked these certifications. Without the necessary certifications, Prison Health Services cannot readily assure Corrections and General Services that these purchases of IT goods and services were necessary and in the State’s best interest. Further, General Services requires that specific forms be used when obtaining services using the various leveraged agreement categories to ensure that contracts contain all necessary stipulations. For example, it requires that master agreement contracts for IT consulting services be signed by the vendor and include, by reference, the scope of work, payment provisions, and general and any special terms and conditions and additional provisions as necessary. However, for one IT service contract valued at $190,400, Prison Health Services used the form designed for another type of leveraged agreement contract that does not include the vendor’s signature, a specified effective date, or the special terms and conditions for the IT services contract. As a result, Prison Health Services failed to ensure that the vendor agreed to all of the terms and conditions that applied and were required for a master 16 California State Auditor Report 2008-501 January 2009 agreement contract for IT consulting services, as this was, and failed to include important provisions such as a clause allowing for the extension of the contract on a month-to-month basis at Prison Health Services’ discretion and one describing how the payments are to be made for services rendered. Table 2 Results of Key Attributes We Reviewed for a Sample of California Prison Health Care Services’ Information Technology Acquisitions Approved Through the State Contracting Process number of ConTraCTs LaCking required LaCking CompLianCe LaCking review by amounT of number of exCeeding essenTiaL serviCes wiTh appLiCabLe designaTed CaLifornia ConTraCTs ConTraCTs deLegaTed and/or JusTifiCaTion using bidding and evaLuaTion prison heaLTh Care Types of ConTraCTs reviewed reviewed auThoriTy CerTifiCaTions wrong form requiremenTs serviCes’ sTaff Contracts for Services California Multiple Award Schedule $1,463,150 5 0 0 0 4 4 Interagency 1,000,000 1 0 0 0 0 1 Master Agreement 1,767,446 4 0 0 1 0 1 Subtotals $4,230,596 10 0 0 1 4 6 Contracts for Goods Statewide contract 3,381,580 9 0 7 0 NA 3 Software agreements 1,718,277 2 0 1 0 0 2 Subtotals $5,099,857 11 0 8 0 0 5 Totals $9,330,453 21* 0 8 1 4 11 Source: Bureau of State Audits’ review of 21 contract files approved between January 1, 2007, and June 30, 2008. NA = Not applicable. These were strategically sourced statewide contracts, which are competitively established by the Department of General Services and provide the best contractor to offer the specific goods and services on a statewide basis, thus making this category not applicable. * For 16 of the 21 contracts we reviewed, we identified a total of 24 instances of noncompliance. Six of the instances were related to five contracts approved after March 2008 when, according to its chief information officer, California Prison Health Care Services implemented a policy change requiring the use of routing slips to evidence contract review. Prison Health Services also could not always provide evidence that it complied with all requirements related to bidding and evaluating the bids it received. General Services requires that when using the California Multiple Award Schedule, departments solicit at least three offers, and if at least three vendors do not submit offers, the departments must contact the vendors to determine why they did not respond. Further, General Services requires that departments document the criteria used to determine best value when awarding a contract. However, for two of the five IT contracts awarded using the California Multiple Award Schedule and valued at $764,600, Prison Health Services could not demonstrate that it contacted vendors who did not reply to its request for bids. For two other IT contracts similarly awarded and valued at $490,000, Prison Health California State Auditor Report 2008-501 17 January 2009 Services could not provide any documentation of the criteria it used to award these contracts. As a result, Prison Health Services cannot be assured that it obtained the best value for these contracts. Prison Health Services’ failure to comply with some of the basic requirements of the state contracting process may be attributed to its lack of adequate internal controls to ensure that appropriate individuals reviewed its contract agreements for compliance with applicable laws, policies, and procedures. According to its chief information officer, prior to March 2008, Prison Health Services lacked explicit policy regarding who must review contracts or a method to verify that contracts were reviewed. Prison Health Services approved 11 of the 21 IT contracts we reviewed prior to March 2008, and it could not provide any evidence that nine of these 11 contracts were reviewed. According to the chief information officer, in March 2008 Prison Health Services implemented a policy requiring the use of routing slips to evidence contract reviews take place. The chief information officer told us that different individuals now review the contracts for areas such as accuracy, completeness, technical specifications, and budget availability before they are approved. As the last person listed on the routing slip, the chief information officer ensures that appropriate individuals have reviewed the contract agreements. Although the chief information officer stated that such reviews were completed, for two of the 10 IT contracts approved after it implemented the new policy, Prison Health Services did not have the routing slips or other evidence to indicate that all appropriate individuals reviewed them. Prison Health Services Cannot Be Assured That It Met All Court‑Ordered Provisions Related to Alternative Contracting Methods Although Prison Health Services uses the alternative contracting methods authorized by the federal court, it has not fully complied with all provisions of the court’s order for using such methods. To better fulfill Prison Health Services’ mission to raise the quality of inmate medical care, the court approved the receiver’s request to use streamlined alternative contracting methods in lieu of the state contracting process. The court outlined specific requirements that are to be met when applying the alternative methods and affirmed that the underlying principles of accountability and transparency called for in state contracting law should be maintained. However, Prison Prison Health Services did Health Services has not developed internal policies and procedures not comply with the explicit to ensure the appropriate implementation of the court‑approved court‑imposed requirements in alternative contracting methods. We found that Prison Health executing five of six IT‑related Services did not comply with the explicit requirements imposed contracts approved using an by the court in executing five of six IT‑related contracts approved alternative contracting method. 18 California State Auditor Report 2008-501 January 2009 since January 1, 2007, that used alternative contracting methods. In addition, Prison Health Services cannot support that it reported all required information to the court because of weak internal controls and poor record retention practices. Prison Health Services Does Not Maintain Appropriate Documentation to Demonstrate It Complies With All Requirements of the Federal Court Waiver As discussed in the Introduction, the federal court approved the receiver’s request for a waiver from state contracting requirements for specified projects because, according to the request, these requirements directly hampered the receiver’s mission to expeditiously address shortcomings in the State’s prison health care system. In granting its waiver, the court noted that the fundamental purposes underlying state contracting law should be preserved to the extent possible. The court ultimately approved the use of three alternative contracting methods: expedited formal bid, urgent informal bid, and sole source. The expedited formal bid method requires that Prison Health Services develop and issue a request for proposal, develop criteria for selecting a successful bidder, and appoint a three-person selection committee consisting of persons with relevant experience, none of whom are affiliated with or otherwise have any conflict with any bidder or the receiver. The urgent informal bid method does not require a selection panel; however, it requires Prison Health Services to make reasonable good-faith efforts to identify and solicit at least three proposals and develop specific criteria to select the successful bidder. Finally, the sole source method permits Prison Health Services to use a single source only if it is unable to reasonably identify another available source. Prison Health Services has not developed formal policies to aid it in implementing the alternative contracting methods. For example, according to its chief information officer and chief counsel, decisions to use alternative contracting methods in lieu of the state contracting process are generally reached in person or through telephone consultation with the chief counsel, and no records are kept. According to its chief counsel, Prison Health Services generally uses alternative contracting methods when it is necessary Prison Health Services has no to obtain the services faster than is usually possible under the formal written policies surrounding state contracting process; however, the chief information officer the rationale to use alternative confirmed Prison Health Services has no formal written policies contracting methods. surrounding the rationale to use alternative contracting methods. As Table 3 shows, of the six IT contracts we reviewed, having a total value of $28 million, that were executed using alternative contracting methods, Prison Health Services justified in its California State Auditor Report 2008-501 19 January 2009 quarterly reports to the court its use of the urgent informal bid and sole source methods for four contracts. However, we found no evidence that Prison Health Services considered specific criteria to justify the use of the expedited formal bid contracting method for the remaining two contracts. While documenting the rationale for using the expedited formal bid method is not explicitly required in the waiver order, we believe it is reasonable to expect Prison Health Services to document its decisions and the rationale for using the waiver authority because without such documentation Prison Health Services cannot assure the court that its use of the waiver authority is necessary. Table 3 Results of Key Requirements We Tested for California Prison Health Care Services’ Information Technology Acquisitions Approved Through Alternative Contracting Methods doCumenTed CriTeria and deveLoped doCumenTed reporTed reporTed raTionaLe and CommiTTee To The awardee JusTifying use deveLoped appLied members CourT The and aLL aLTernaTive of aLTernaTive a requesT soLiCiTed ConTraCT appoinTed were free raTionaLe bidders, if ConTraCTing ConTraCT ConTraCTing for Three award a seLeCTion from for soLe appLiCabLe, meThod used vendor name vaLue meThod* proposaLs proposaLs CriTeria CommiTTee ConfLiCTs sourCe To CourT Expedited University of Texas formal bid Medical Branch $181,636 No Yes Yes No† Yes No NA Yes Expedited formal bid IBM 26,915,053‡ No Yes Yes Yes Yes No NA Yes Urgent informal bid Stanfield Systems 141,000 Yes NA No§ No NA NA NA No Urgent informal bid Just Associates 90,000 Yes Yesll Yes No† NA NA NA Yes Urgent informal bid Credential Smart 183,600 Yes Yesll Yes No† NA NA NA Yes Sole source Enterprise Networking Solutions 489,600 Yes NA NA NA NA NA Yes NA Sources: Federal court order and the Bureau of State Audits’ review of various documentation provided by California Prison Health Care Services (Prison Health Services) for selected contracts. NA = Not applicable. * Although not an explicit requirement, because the court granted the waiver to meet a specific need, we believe it is a reasonable expectation that Prison Health Services document its decisions and rationale to use the waiver authority. In fact, it met this requirement for four of the six information technology contracts we tested. † Based on some correspondence provided, it appears that Prison Health Services considered criteria, but it could not provide any evidence demonstrating it used the criteria in selecting the winning proposals for these contracts. ‡ Prison Health Services identified the value of this contract. We could not verify $357,848 in taxes that Prison Health Services noted were included as part of this contract. § Although the quarterly report to the court claimed that Prison Health Services solicited three proposals, we found no evidence of its solicitation. ll Although not required to develop a request for proposals when using the urgent informal bid method, Prison Health Services did so for two of the three contracts we reviewed. 20 California State Auditor Report 2008-501 January 2009 Similarly, Prison Health Services has not always followed fundamental best business practices because it failed to retain documents in a central file that would demonstrate that it complied with all requirements of the federal court. According to the chief information officer, it does not have any policies governing the retention of key contracting documents in a centralized location. Instead, according to the chief information officer, program managers retain contracting documentation, which sometimes is incomplete because the documents required for retention are not specified by policy and may be kept in various locations. For example, for one IT contract shown in Table 3, valued at $141,000 and approved through the urgent informal bid method, Prison Health Services could not provide evidence to support that it made reasonable efforts to solicit three bidders and could not demonstrate how it evaluated the two bids it did receive, as required by the court. Because solicitation and selection criteria documentation were not available, we could not determine whether the receiver executed this contract in accordance with court-ordered requirements and in a manner consistent with its other contracting decisions and received the best value for the State. Further, although Prison Health Services provided some documents that indicate it considered certain criteria when awarding two other contracts through the urgent informal bid method and one contract through the expedited formal bid method, it could not provide evidence of its assessments of the various proposals it received using the criteria it established to select the winning proposals for these IT contracts. Further, Prison Health Services does not always clearly identify the value of a contract it executes through alternative contracting methods. Unlike contracts approved through the state contracting process, which include a standard form that identifies the total value of the contract, Prison Health Services does not include such forms for the contracts it approves using alternative contracting methods. For example, Prison Health Services stipulated the value of one of the IT contracts we reviewed to be roughly $26.9 million. Although we were able to verify the Prison Health Services does not amount for most of the components of the contract, we were always clearly state contract unable to verify that the approximately $358,000 identified by values and thus, risks paying Prison Health Services as taxes was part of this contract. Without contractors more than the clearly stated contract values, Prison Health Services risks paying agreed‑upon amount. contractors more than the agreed-upon contract amount. In addition, the court requires that Prison Health Services ensure the members on its selection committee for contracts executed through the expedited formal bid method are not affiliated with, or otherwise have any conflict with, any bidder or the receiver. However, our review found that although Prison Health Services appointed committees to evaluate two of the contracts we reviewed, California State Auditor Report 2008-501 21 January 2009 it could not provide documentation regarding how it determined committee members did not have any such affiliations or conflicts. Moreover, although Prison Health Services has an annual conflict-of-interest reporting process, it could not provide us with signed copies of conflict-of-interest documents for all members of these two selection committees. In fact, some individuals on the selection committees were not Prison Health Services’ employees and were not subject to its economic interest disclosure policy, and an alternative process for assessing those individuals’ impartiality was not documented. Thus, although the chief information officer asserts that Prison Health Services ensured that committee evaluators did not have impermissible affiliations or conflicts, it has no way to verify that it met this court requirement. Prison Health Services Cannot Demonstrate That It Reported All Required Information Related to Alternative Contracting Procedures On a quarterly basis, the court requires the receiver to report all contracts executed using alternative contracting methods, including all bidders and the chosen vendor or provider. Although Prison Health Services’ quarterly reports include such information, the court cannot be assured that the reported information is complete. For example, its chief information officer stated that Prison Health Services does not assign unique identifying numbers or otherwise track contracts executed using alternative contracting methods. Without a tracking mechanism, it is difficult to identify all such contracts. Although Prison Health Services informed us that it reported to the court all contracts it executed using alternative methods, it could not provide sufficient documentation to support this assertion. In addition, Prison Health Services cannot demonstrate that it reported all vendors who bid on contracts executed using alternative contracting methods. Five of the six IT contracts we reviewed were competitively bid and were processed using either the expedited formal or urgent informal bidding methods. Because it did not retain all the proposals it received, Prison Health Prison Health Services did not retain Services could not provide adequate support that it reported all all the proposals it received using bidders for one contract. For a competitively bid IT contract that the urgent informal bid method, used the urgent informal bid method and was valued at $141,000, including the winning vendor, for Prison Health Services could provide documentation of vendors one of five IT contracts we reviewed it intended to solicit, but it could not provide documentation of requiring competition. all bidders it ultimately solicited. In fact, the bidders listed in the quarterly report for this contract, including the winning vendor, do not correspond with the vendors Prison Health Services proposed to solicit. Further, it could not provide us with the proposals that the bidders submitted for this contract, including that of the vendor to whom Prison Health Services ultimately awarded the contract. 22 California State Auditor Report 2008-501 January 2009 Without the proposals received from all bidders, we cannot definitively say that Prison Health Services reported all bidders for this contract. The lack of proposals from all bidders decreases the transparency of Prison Health Services’ operations and contract evaluation process, and it does not provide assurance that Prison Health Services’ reports to the court are complete and accurate. Recommendations To ensure that it has complete and accurate information related to its contracts, Prison Health Services should ascertain that the internal controls over the data entered into the new enterprise-wide business information system work as intended. For contract-related data that has already been migrated from old contract databases to the new system, it needs to ensure the accuracy of key fields such as the ones for contract amount, service type, and the data fields that identify contracts initiated by Prison Health Services by comparing the data stored in its new database to existing hard-copy files. To make certain that its contracts for IT goods and services comply with state contracting requirements and applicable policies and procedures, Prison Health Services should ensure that all responsible staff are aware of and follow contract processing and documentation requirements, including evidencing the review and approval of contracts. To ensure that it complies with the terms of the court-approved waiver of state contracting requirements, Prison Health Services should develop policies to support its use of alternative contracting methods. These policies should include a requirement that Prison Health Services develop clear and specific criteria and guidelines for determining when the waiver authority should be used and how the requirements of the waiver are to be met and documented. Further, Prison Health Services should clearly identify the value of all contracts it executes and ensure that all contracting documents are maintained in a central location. To better support that it has reported all contracts and bidders to the court, Prison Health Services should develop a system of tracking all contracts executed under alternative contracting methods and retain all bids it receives for each contract. To better track its contracts, Prison Health Services should assign a sequential contract number or other unique identifier to each contract executed using alternative contracting methods. California State Auditor Report 2008-501 23 January 2009 We conducted this review under the authority vested in the California State Auditor by Section 8543 et seq. of the California Government Code and according to generally accepted government auditing standards. We limited our review to those areas specified in the audit scope section of the report. Respectfully submitted, ELAINE M. HOWLE, CPA State Auditor Date: January 29, 2009 Staff: Kris D. Patel, Project Manager Melissa Arzaga Roye, MPP Kim Buchanan, MBA Richard W. Fry, MPA Stephanie Gogulski, MPP, MA Lori A. Olsen, MPA Benjamin W. Wolfgram Legal Counsel: Steven Benito Russo, JD For questions regarding the contents of this report, please contact Margarita Fernández, Chief of Public Affairs, at 916.445.0255. 24 California State Auditor Report 2008-501 January 2009 Blank page inserted for reproduction purposes only. California State Auditor Report 2008-501 25 January 2009 Appendix THe FedeRAl CouRT GRAnTed THe ReCeIveR A WAIveR FRom STATe ConTRACTInG RequIRemenTS FoR SPeCIFIC PRoJeCTS In April 2007 the receiver appealed to the U.S. District Court for the Northern District of California for a waiver from complying with state contracting requirements. The court approved the receiver’s request in June 2007 and specified alternative contracting methods that the receiver must follow in lieu of state contracting requirements. In granting the waiver the court noted that it could only be used for 13 specific projects, but should the receiver request that additional projects be covered, the court would consider expanding the approved project list. The receiver subsequently requested and the court approved 13 additional projects to be covered by the waiver. Table A on the following page lists the projects approved by the court as of September 30, 2008. 26 California State Auditor Report 2008-501 January 2009 Table A Projects the Federal Court Approved to Use Alternative Contracting Methods as of September 30, 2008 proJeCT desCripTion approvaL daTe sTCeJorp Lanigiro 1 Information technology technical and operational infrastructure June 4, 2007 2 Health information management 3 Clinical data warehouse 4 Telemedicine 5 5,000 multi-purpose medical bed construction: project management and preliminary planning 6 San Quentin State Prison project: medical facility construction 7 Temporary medical facility (modular building) 8 Recruitment and hiring 9 Peer review 10 Emergency response 11 Fiscal control 12 Contracting 13 Pharmacy *sTCeJorp Tneuqesbus 14 Radiology services August 13, 2007 15 Clinical laboratory services 16 Nursing leadership development 17 Physician credentialing 18 Medical specialty services 19 Avenal State Prison: clinical space renovation and construction December 20, 2007 20 Asthma initiative January 25, 2008 21 Strategic offender management system April 23, 2008 22 Improvement of health care facilities at Correctional Training July 1, 2008 Facility, Soledad 23 Improvement of health care facilities at Mule Creek State Prison 24 Improvement of health care facilities at California Rehabilitation Facility, Norco 25 10,000 bed program July 2, 2008 26 Quality measurement technical assistance September 18, 2008 Source: Waiver applications submitted by the receiver and approved by the federal court. * When approving the alternative contracting methods in June 2007, the court noted that they could only be used for 13 specific projects. The receiver subsequently requested and the court approved the use of alternative contracting methods for 13 additional projects. California State Auditor Report 2008-501 27 January 2009 (Agency response provided as text only.) California Prison Health Care Receivership Corp. 501 J Street P.O. Box 4038 Sacramento, CA 95812-4038 January 15, 2009 Elaine M. Howle, CPA California State Auditor Bureau of State Audits 555 Capitol Mall, Suite 300 Re: January 2009 Audit Report No. 2008-501 Regarding California Prison Health Care Services Dear Ms. Howle: I want to thank you and your staff for your evident professionalism in investigating and documenting the IT contracting concerns which I brought to your attention shortly after my appointment in late January, 2008. As you know, back in 2002, Governor Gray Davis called on me to assume the State CIO role in the aftermath of the Oracle contracting problem. Within a few months of my appointment back then, it was clear that the problems with IT contracting were broader than just Oracle. Among other things, I discovered that the e-government project, which was responsible for establishing a state “portal” early in the Davis Administration, had been implemented through a series of utterly inappropriate, serial short-term sole source contracts that had been strung together over a period of years with a single vendor at an overall cost to the State in the millions. Working with key executives in the Davis Administration, we shut down those contractual relationships and put IT procurement and project management back on sound footing. After several years of effort, we were even able to junk the old, improperly-procured portal in favor of a portal implemented entirely by a small team of state employees, proving that we don’t always need expensive consultants to make significant progress in state IT matters. That new portal is garnering national attention, as noted by the Little Hoover Commission in a recent report: “Due in large part to the efforts of the state’s previous chief information officer [i.e., the current Receiver], who created a strategic plan for California information technology, the state’s reputation for technological sophistication has improved. In a few years, California has gone from the back of the pack to near the front. The Center for Digital Government placed California in the No. 5 position in its most recent ranking of tech-savvy states. The state’s Web site also has improved dramatically, earning recognition and awards for its customer-service features.” Little Hoover Commission, “A New Legacy System: Using Technology to Drive Performance,” p. ii (November 2008). My experience as State CIO made me quite sensitive to process issues in IT procurement. That is why, when it came to my attention, shortly after my appointment, that some of the IT contracts executed during my predecessor’s tenure may not have followed appropriate state laws and policies, I immediately contacted your office to conduct an audit. At about the same time, I was able to replace the Receivership’s former CIO – who had no prior state government experience – with a CIO, Jamie Mangrum, who had decades of state IT experience, and I directed Mr. Mangrum to immediately begin reviewing our processes to ensure 28 California State Auditor Report 2008-501 January 2009 Letter to Elaine Howle Re: Audit Report No. 2008-501 January 15, 2009 Page 2 of 2 compliance with state law. As previously found by the federal court in Plata v. Schwarzenegger, not only was the clinical side of the prison medical system broken prior the Receivership, but the administration of the contracting system was also in shambles. See generally March 30, 2006 Order re State Contracts and Contract Payment Relating to Service Providers for CDCR Inmates. While progress has been made in this regard, for better or for worse, the greater balance of the resources of the Receivership under my predecessor were applied to addressing the abhorrent clinical conditions on the ground in the prisons. This, as found by Mr. Mangrum and made clear by your report, may have been at the expense of the need to focus a greater degree of effort on much needed administrative controls. Mr. Mangrum, for example, discovered that policies and procedures had simply not been implemented. Subsequently, we began to establish those polices as soon as possible. The results of your audit confirm my fears that the one bad IT contract I had seen was but the tip of an iceberg. Your audit also confirms that Mr. Mangrum’s quick actions to establish policies resulted in immediate improvements. Recent actions since the completion of your audit, for example, the adoption of a formal policy governing use of the federal court’s waiver of state contracting laws, will also lead to further improvements. Achieving perfection in processing IT contracts remains a challenge under the state’s overly complex IT procurement rules, but I am heartened at our improvements and confident that, with the information provided to us by your audit, we can do even better. Sincerely, (Signed by: John Hagar for) J. Clark Kelso California State Auditor Report 2008-501 29 January 2009 cc: Members of the Legislature Office of the Lieutenant Governor Milton Marks Commission on California State Government Organization and Economy Department of Finance Attorney General State Controller State Treasurer Legislative Analyst Senate Office of Research California Research Bureau Capitol Press