Audit finds security shortcomings across new UIHC downtown campus, clinics

IOWA CITY — In the year since taking over Iowa City’s bankrupt Mercy Hospital and transitioning the 78-year-old facility into its new downtown campus, University of Iowa Health Care has not completed a comprehensive review of staff badge access, “increasing the risk of unauthorized entry,” according to an internal audit made public this week.

UIHC’s Medical Center Downtown also has an “inadequate” key management process and no way of verifying whether the 290 vendors and contractors with electronic entry badges are active “since a log of active vendors and contractors is not maintained.”

“Management should review badge access assigned to vendors and contractors for appropriateness and de-provision badges that cannot be identified or are no longer needed,” according to the February audit going before the Board of Regents next week. “Moving forward, (the downtown campus) should complete regular reviews of vendor and contractor access.”

To their nine findings of security and access related to UIHC’s new downtown campus and community clinics acquired in the $28 million bankruptcy sale, auditors said the university was responsive and — in some cases — took immediate action.

“In an effort to better secure the (Medical Center Downtown) hospital, the exterior door cores were recently re-keyed,” according to a UIHC response to one audit finding that keys are tracked on an outdated spreadsheet that is “not actively maintained.”

“A review of (Medical Center Downtown’s) universal key assignments identified that six of the 15 universal keys are assigned to staff who are terminated or no longer have a business need,” according to the audit, explaining that a universal key provides access to multiple doors — as opposed to just one. “Additionally, there is no record of these keys being returned … after termination.”

In a statement to The Gazette, UIHC spokeswoman Laura Shoemaker said a “large portion of the audit’s recommendations are already in progress,” including some that involve facility upgrades.

“UI Health Care is committed to providing a safe and secure environment for patients, visitors, and staff,” Shoemaker said, noting protocols in place across all UIHC campuses include:

‘Could not be verified’

UIHC officially took over the 234-bed former Mercy Iowa City on Jan. 31, 2024 — transitioning 1,000 former Mercy employees into the UIHC workforce, including 45 physicians, 33 advanced practitioners and other nurses and staff.

Over the last year, UIHC reported seeing more than 72,000 patients at the downtown campus and the 11 associated community clinics it acquired from Mercy across Iowa City and in Muscatine, Solon, Tipton, West Branch, West Liberty and Williamsburg.

For reference, the full UIHC enterprise in the 2024 budget year — so largely excluding the downtown campus — reported over 1.3 million clinic visits, 34,000 inpatient admissions, 54,000 emergency room visits, 38,000 major surgeries and 202,000 minor operations.

For security, the main UIHC campus uses a badge access system that differs from the one maintained on the former Mercy site, which auditors reported has “limited functionality.” Unlike the UIHC system, the one downtown doesn’t interface with human resources systems, “so badge access must be manually assigned to or removed for each person.”

When Mercy made the transition to UIHC last year, all retained employees were told to swap their old Mercy badges for new UIHC ones.

The audit’s review of 2,165 people with standard-access badges found 575 whose appointment status, affiliation or identity could not be determined; 149 miscellaneous accounts not tied to a person; and 102 for people who had been terminated.

An additional review of 265 people with badge access to the downtown campus’ medication rooms found 66 with unknown status or affiliation; nine who had been terminated; five who had guest accounts; and another 52 whose badge access appropriateness “could not be verified.”

In response to those badge concerns, UIHC officials said they’ll consider transitioning the downtown campus to the main campus’ badge system and will complete a “full badge access review.”

UIHC also committed to creating and implementing “termination checklists” after auditors found the downtown campus doesn’t consistently ensure termination processes are followed — including removing system and badge access and collecting physical keys.

Auditors found similar concerns across the Mercy-acquired clinics, along with concerns about the condition of clinic doors.

“One clinic does not keep its employee entrance door locked during business hours, and another clinic's employee entrance door does not always operate properly, causing the door not to close,” according to the audit. “Additionally, the interior doors connecting the waiting room with the clinical areas are not locked, despite their ability to be locked at several locations. Other locations do not have the ability to lock the connecting doors.”

“Management will conduct a security risk assessment and identify any security concerns related to each (clinic) location,” UIHC officials committed.

Security assessment

In late January, UIHC issued a request for qualifications for a “comprehensive security assessment” for all of its Johnson County locations “to ensure security operations are, and continue to be, the best in class when compared to institutions that are similar in size, operations and services.”

UIHC, according to the request, has 41 Johnson County locations — including its new North Liberty campus about to come online and its downtown campus.

The university expects any security assessment supplier to produce recommendations and guidance on patient screening processes, weapons detection, duress alarms, video cameras and staffing.

“Supplier shall provide recommendations for inpatient behavioral units and other high risk services including emergency departments,” according to the notice, which also seeks security recommendations for designers working on a new UIHC inpatient tower “that is scheduled to begin construction next year.”

Vanessa Miller covers higher education for The Gazette.

Comments: (319) 339-3158; vanessa.miller@thegazette.com