Return to Nicholas Johnson's Iowa Rain Forest ("Earthpark") Web Site

Return to Nicholas Johnson's Blog, FromDC2Iowa
 
 

Erin Jordan, "U of I Examines Security Breach of Colloton Files"

Diane Heldt, "Hospital: Employee Misused Computer"

[Note: This material is copyright by the Press-Citizen, and is reproduced here as a matter of "fair use" for non-commercial, educational purposes only. Any other use may require the prior approval of the Iowa City Press-Citizen.]

"I don't think we have any business in it at this point," Iowa City Regent Bob Downer said Thursday. "If there are appeals because of disciplinary action, that is the point when regents should be involved."

Downer said he was surprised when Regent President Michael Gartner, during a regent meeting Thursday in Urbandale, directed board office staff to investigate an undisclosed security breach of a computer at University Hospitals.

"I asked other people what this was. Someone, I can't remember who it was, said it was a matter involving (University Hospital Director Emeritus John) Colloton's e-mail and the like, and I said it was pretty old news. I was advised during the course of this that there have been internal university investigations on this and that is where it belongs," Downer said.

Colloton did not return phone messages or e-mails.

All questions to UI on Thursday were referred to Marcus Mills, vice president for legal services and general counsel.

The breach is a personnel matter in which someone accessed material they shouldn't have, Mills said. UI has been investigating it for five or six weeks, he said.

Mills would not say what action might be taken against the person if he or she was caught. He also would not confirm whether the breach was related to Colloton.

Mills said the most important thing to remember is that the breach did not involve an external hacker and did not expose any patient information.

On Nov. 26, the Press-Citizen received the first in a series of anonymous e-mails that included documents apparently authored by Colloton. Those documents appeared to be correspondence with top officials, such as Gartner and former University of Iowa president David Skorton, involving topics ranging from the UI presidential search, the Wellmark contract controversy of 2004 and 2005, and UI and University Hospitals' organizational structure.

The Press-Citizen filed an open records request Nov. 29 seeking correspondence from Colloton to Gartner and Skorton, among others, to authenticate the documents. On the advice of the Iowa Attorney General's office, UI refused the request on Dec. 28, stating that Colloton is not paid by the university and does not have official duties. On Jan. 5, UI refused to provide documents prepared by Colloton's secretary, Nancy Kirkpatrick, who is a paid University Hospitals' employee.

Colloton, for whom the John Colloton Pavilion at the hospital complex was named, was University Hospitals' director and CEO from 1971 to 1993. He was named director emeritus in 2001. Colloton also has been on the Wellmark Board of Directors since 1974 and served as the board chairman from 1993 to 2000 and as the lead director since 2000.

He maintains an office on the seventh floor of the John Colloton Pavilion, has a secretary, a UI e-mail account and free parking with a "Lot 1" designation, which allows parking in any lot on campus.

Colloton has not returned several phone and e-mail messages dating back to Dec. 2, when the Press-Citizen presented him some of the documents it had received.

At the end of the regents' meeting, Gartner said, "As many of the regents know, there was a security breach of a computer over at the hospital, and there seems to be more rumor than fact going around at the moment, both in Des Moines downtown and up at the Legislature and in Iowa City. I just ask that the regent office find out exactly what is going on and report back."

No discussion followed.

Regent Executive Director Gary Steinke said he didn't think regents were getting involved in a UI matter. He said he didn't know anything about the breach, which is why regents were seeking information.

"Several regents and several legislators are asking about the details of an apparent security breach. No one knows anything about it," Steinke said. "That is why this is so significant to the regents."

[Note: This material is copyright by the Des Moines Register, and is reproduced here as a matter of "fair use" for non-commercial, educational purposes only. Any other use may require the prior approval of the Des Moines Register.]
_______________
The University of Iowa is investigating how an employee of University Hospitals accessed private information through the hospital's computer system.

Iowa Board of Regents President Michael Gartner asked the U of I during a board meeting Thursday to report back about the "security breach." Gartner said he had been asked by three regents and two legislators about the breach, but provided few details.

Gartner told a legislator the breach involved access to information belonging to John Colloton, former long-time director of University Hospitals.

"We were talking about general things and he mentioned something about Colloton's computer," said Sen. Joe Bolkcom, D-Iowa City, about a conversation he had with Gartner Thursday morning at a legislative breakfast in Des Moines.

U of I General Counsel Marc Mills said the breach did not endanger patient or employee information. He would not say whether the investigation involved a leak of Colloton's correspondence, but said: "This was not an outside access by a hacker. An employee violated a university policy and gained access to information they shouldn't have."

Mills's office recently denied public information requests from The Des Moines Register and other media to obtain copies of Colloton's correspondence dealing with the hospital and the U of I's failed presidential search. Colloton retired from the U of I in 2000, but still has an office and a secretary. The requests were denied because Mills said that Colloton is no longer an employee.

Mills said he did not know when his office would report back to the regents about the investigation.

Regent Bob Downer, an Iowa City lawyer, said the board should not be delving into personnel issues at the universities because the board is responsible for hearing employee appeals.

[Note: This material is copyright by The Gazette, and is reproduced here as a matter of "fair use" for non-commercial, educational purposes only. Any other use may require the prior approval of The Gazette.]
_______________
  URBANDALE — A University Hospitals employee inappropriately used information or technology resources at the hospital, University of Iowa officials said Thursday.

  Access was not gained to protected information or patient records during the incident, said Marc Mills, vice president for legal services and general counsel.

  Mills said hospital officials are dealing with the matter internally as a personnel issue. UI officials have known about the situation for five or six weeks, he said.

  ‘‘Really it is a personnel matter that’s a violation of university policy,’’ he said.

  He declined to say what the incident was or how UI officials found out about it. ‘‘We want to reassure patients and the public that it did not involve patient records,’’ he said.

  Mills is to give information about the incident to the state Board of Regents, at the request of Regents President Michael Gartner of Des Moines. Gartner, during a regents meeting in Urbandale, said rumors were circulating about a possible computer security breach, and he asked regents staff to find out what happened.

  Gartner said he was asked about the rumors by two legislators and three other regents. ‘‘I’ve only heard rumors and half facts,’’ he said. ‘‘I thought the board should hear facts.’’

  University Hospitals Chief Executive Officer Donna Katen- Bahensky referred comment to Mills.