Having trouble viewing this email? View it in your browser.

Office of Audit, Compliance & Privacy

Case in Point:
Lessons for the proactive manager

July 2016
Vol. 8 No. 7
“There are risks and costs to action. But they are far less than the long range risks of comfortable inaction.”

-- John F. Kennedy

In June we concluded our analysis of articles we linked in Case in Point during 2015. This month we turn our attention back to the topic of compliance. As we've previously stated, the compliance category has been our largest for the past few years, and it has also experienced dramatic growth in importance for higher education institutions. Higher education is perhaps among the most regulated industries in terms of the sheer volume of regulations which apply to it, and this can be overwhelming. It is therefore important we utilize best practices to manage our compliance efforts.

While it may seem ironic, today's best practices for organizational compliance are found in the U.S. Federal Sentencing Guidelines. There are generally seven best practices recognized that can be found in these Guidelines. One of these best practices, "Response & Prevention," touches on the organization's responsibility when it becomes aware of a compliance failure, and what it does in response to that incident.

Inherent in this best practice is the need for the organization to cultivate a culture where all employees feel comfortable in reporting potential compliance problems to appropriate personnel. Awareness accompanied by inaction is a dangerous thing in today's compliance world. Within Case in Point we've linked multiple stories during the past few months where an employee (or employees) became aware of a potential compliance failure but chose inaction - leading to substantial financial, reputational, and legal risk to the institution. Inaction and failing to report potential offenses is not a viable option in today's world. Failure to act appropriately may lead to mandated oversight which is substantially more cumbersome and expensive in the long run. The best course is to always appropriately report the issue. If you aren't sure where to report you can always contact our office directly, contact one of our compliance partners, or anonymously report through EthicsPoint.

We invite you to review the news stories in higher education we link below and consider how you can best proactively manage risk.

M. Kevin Robinson, CIA, CFE
Associate Vice President
Office of Audit, Compliance & Privacy

Information Security & Technology Events

Jul 22, 2016: The University of Mississippi Medical Center agreed to a $2.75 million settlement with the federal government for alleged violations of the Health Insurance Portability and Accountability Act (HIPAA). Unsecured electronic health information on 10,000 people was breached when a laptop computer was found to be missing, according to the U.S. Department of Health and Human Services' Office for Civil Rights. (link)

Jul 13, 2016: Oregon Health & Science University has agreed to pay federal authorities $2.7 million for two data breaches in 2013 that involved more than 7,000 patients. OHSU also will enact a "rigorous three-year corrective action plan" as part of a resolution agreement with the U.S. Department of Health and Human Services Office for Civil Rights, according to a statement released Wednesday. The two breaches occurred within three months of each other. (link)

Jul 08, 2016: N.C. State University says it has notified 38,000 current and former students that some of their personal information may have been accessed by someone who hacked into the university's computer system. NCSU officials say someone accessed a university email account using a "sophisticated phishing scam" and got access to a file from 2013 that included names, mailing addresses, university ID numbers and Social Security numbers. Officials say there is no evidence yet that any of the personal data have been retrieved or misused. (link)

Fraud & Ethics Related Events

Jul 14, 2016: The Justice Department said Thursday that Columbia University has agreed to pay $9.5 million to resolve allegations that it improperly charged the National Institutes of Health for facilities and administrative costs on more than 400 federal grants. Prosecutors say the Ivy League school inflated the amount of money owed for use of facilities from July 2003 to June 2015. Universities are allowed to charge a higher rate for research conducted on campus to offset maintenance and operations expenses. Although Columbia faculty carried out federally sponsored research in buildings owned by the state of New York, entitling the school to a lower rate of reimbursement, the university applied the higher rate, according to the complaint. (link)

Jul 13, 2016: A South Carolina attorney has pleaded guilty to defrauding a University of Alabama sorority -- her alma mater -- of hundreds of thousands of dollars in a sorority house furnishing scheme. U.S. Attorney Joyce White Vance today announced 39-year-old Jennifer Elizabeth Meehan entered her plea Tuesday in federal court. Meehan, who was tasked with furnishing the University's new Gamma Phi Beta house, was arrested last year and accused of defrauding the sorority of nearly $400,000 through schemes in which Meehan submitted invoices for a sorority's furniture and equipment and received payment for them without ever actually providing the goods to the house. (link)

Jul 12, 2016: UC Berkeley Chancellor Nicholas Dirks is under university investigation for the alleged misuse of public funds for travel and the personal use of a campus athletic trainer without payment, the Los Angeles Times has learned. A whistleblower complaint alleged that Dirks had failed to pay for use of the campus Recreational Sports Facility and its professional services, and that he used public funds to pay for travel with a recreational sports employee on non-university business, according to an April 11 letter to Dirks from Rachael Nava, the University of California's chief operating officer. (link)

Jul 07, 2016: The woman formerly in charge of making "change" at University Hospital dining areas has been charged in the theft of $1.1 million. Kyejuana Avery, 34, entered into a plea agreement Thursday with the U.S. Attorney's Office to a charge of theft concerning programs receiving federal funds, according to court documents. Between 2007 and 2013 Avery was employed as a financial account representative at the University of Alabama at Birmingham's Hospital Food and Nutrition Services Department, according to the plea deal. That department sells food and beverages at locations around University Hospital. (link)

Jul 07, 2016: Two former Georgia Southern University staff members violated NCAA ethical conduct rules when they provided three football student-athletes with impermissible academic assistance, according to a decision issued by a Division I Committee on Infractions panel. A former assistant compliance director provided a student-athlete with a flash drive containing her previous work for a course in which the student-athlete was enrolled. The student-athlete later pulled an assignment from the flash drive and submitted it as his own work. When the professor discovered the work, the student-athlete and former assistant compliance director worked together to draft responses that stated the student-athlete was solely accountable. During the interview process, after initially denying the involvement of the former assistant compliance director, the student-athlete stated that the staff member provided him with the flash drive and instructed him to tell a false story. (link)

Jul 05, 2016: Three former Georgia Tech employees face fraud charges after allegedly spending $250,000 of university funds on personal items, including upgrades to a private hunting lodge. All three were employed in Georgia Tech's Advanced Concepts Laboratory, servicing clients like the Department of Defense and various intelligence agencies. As part of this job, Fraley had access to a Georgia Tech procurement card, or "PCard", for making university-related purchases. (link)

Jun 30, 2016: In a case that has raised concern about the University of South Florida's hiring practices, the school has fired a high-profile director who managed to sail through the vetting process in 2013 despite serious marks on his job record. The university announced Thursday it has removed Samuel Bradley as director of its Zimmerman School of Advertising and Mass Communications for trying to conceal an investigation into his inappropriate relations with students while in his previous job at Texas Tech University. (link)

Jun 30, 2016: The University of Missouri has agreed to pay the federal government $2.2 million to settle a claim that physicians with MU Health Care committed fraud. The health care program allegedly violated the False Claims Act by submitting claims for radiology services to federal programs such as Medicare and Medicaid and maintaining that radiology images had been reviewed by physicians. "In fact, they had not reviewed those images," Tammy Dickinson, U.S. attorney for the Western District, said in a statement Thursday. (link)

Compliance/Regulatory & Legal Events

Jul 29, 2016: A petition by a fired Baylor athletic staff member filed in Dallas County on Wednesday could provide insight into the university's sexual assault scandal. Thomas Hill, who spent 28 years at Baylor and was recently the university's associate athletic director for community relations and special projects, filed a Rule 202 petition to depose three Baylor Board of Regents members to find out why he was fired. (link)

Jul 29, 2016: The U.S. Department of Education's Office for Civil Rights has opened a new sexual assault investigation at the University of Virginia, according to a report obtained Thursday. Department's spokeswoman Dorie Turner Nolt confirmed Thursday that the office had opened a Title IX investigation at UVa on July 22. Nolt said the investigation involves facts that were not covered as part of the office's investigation into Title IX violations at UVa that was launched in 2011 and ended in September. (link)

Jul 28, 2016: Baltimore County police have charged two men in connection with an incident in March that seriously injured a Towson University student. Investigators said a 19-year-old man who is a Towson student attended an initiation event on March 31 for the Tau Kappa Epsilon fraternity. Police said the victim was made to perform strenuous workouts, recite knowledge of the fraternity and drink unknown substances. After the event, the victim became extremely ill and was hospitalized. Evan Palmer Francis, 21, of Olney, and Alexander James Cantor, 21, of Bel Air, have been charged with hazing and reckless endangerment. Francis was released on $35,000 bail, and Cantor was released on $50,000 bail. Trials are set for both men on Sept. 19. (link)

Jul 28, 2016: Four Radford University students, all members of a now-disbanded fraternity, pleaded guilty Thursday to hazing and alcohol charges related to making pledges do push-ups on bottle caps, and other painful and humiliating initiation rituals. In a Radford General District Court hearing, Theodore Eugene Anna and Andrew Morgan Piccione pleaded guilty to hazing, and Jesse Vaughn Leasure and Evan Ross Satterley pleaded guilty to hazing and also to purchasing alcohol for underaged persons. (link)

Jul 27, 2016: The University of Michigan has agreed to pay $165,000 to settle what was left of a lawsuit over a graduate student's dismissal from an engineering program in 2011. The school struck a deal with Jennifer Dibbern shortly before a June trial and after a federal judge dismissed most claims. She had accused the university of retaliating against her for union activity and efforts to change the campus anti-harassment policy. The university denied any wrongdoing and said Dibbern wasn't making enough progress toward a doctorate degree after four years, among other issues. (link)

Jul 26, 2016: The University of Utah is being investigated by the federal government after a complaint from graduate Nisha Kavalam who said the school mishandled her sexual assault investigation. Kavalam, who graduated in December with a degree in social work, says she reported to the U. a few weeks after being sexually assaulted by a fellow student in February 2015. Under Title IX, a federal law that bars sexual discrimination, schools have an obligation to swiftly investigate reports of sexual assault. The school took more than a year to find the perpetrator, she said, so in May she filed a federal complaint with the education department's Office for Civil Rights. (link)

Jul 25, 2016: A former University of Alaska Fairbanks hockey player who was charged with and then acquitted of rape says the statewide college system refuses to hand over his petroleum engineering degree. Nolan Youngmun, through his attorney William Ingaldson, filed a lawsuit Wednesday against the University of Alaska and three individuals, who he argues are unreasonably withholding his bachelor's degree. Former UAF chancellor Brian Rogers, interim chancellor Michael Powers and the university's Title IX coordinator Mae Marsh are named as co-defendants in the suit, which also seeks more than $100,000 in damages. (link)

Jul 21, 2016: In early April, shortly after his team celebrated a postseason championship, a George Washington men's basketball player visited a campus Title IX coordinator to log complaints about Coach Mike Lonergan. Lonergan, the player believed, had created an offensive, uncomfortable environment, evidenced in his mind -- and in the minds of many of his teammates -- by the spate of transfers during the coach's five-year tenure. When the player shared the complaints, which included Lonergan making repeated graphic remarks about the school's athletic director, Title IX coordinator Rory Muhammad's response surprised him. The player was told, he later recalled, that the school had looked into Lonergan's behavior previously and that the issue had been "handled." (link)

Jul 19, 2016: A student Christian organization at N.C. State University says it has dropped its lawsuit against four campus administrators because the university has changed its policies on student speech on campus. Grace Christian Life argued that requiring students to get a permit to pass out pamphlets and fliers on campus violated free speech rights and that administrators enforced the rule unfairly. (link)

Jul 18, 2016: Two former University of Oregon Counseling & Testing Center employees, who blew the whistle on a superior they said accessed an alleged rape victim's health records without her consent, settled a lawsuit with the school Sunday. In their lawsuit, Jennifer Morlok and Karen Stokes said they were retaliated against by coworkers after raising concerns about the university accessing a student's health records without her consent. School officials maintained they did nothing improper by accessing the files as they prepared for the woman's suit against the university. (link)

Jul 14, 2016: Monroe County prosecutors filed charges Thursday against a former senior lecturer at the Indiana University Jacobs School of Music. Guo Ping Wang is charged with sexual battery and criminal confinement, both felonies. A warrant was issued for his arrest. According to court documents filed Thursday, Wang approached a student after Nutcracker rehearsals at the IU Musical Arts Center in November 2015, and asked her to "stay to work on her technique." Wang attempted to kiss the student and when she got up to leave, he stood between her and the only door to the office, according to the probable cause affidavit. (link)

Jul 11, 2016: Five people charged in the sexual assault of a woman at Ramapo College appeared in Bergen County Superior Court Monday where they entered not guilty pleas and were offered plea deals by the prosecutor to consider. The charges date to a November 2014 incident in which the victim attended a fraternity party and woke up the next morning undressed in a dorm room, believing she had been sexually assaulted. She went to Hackensack University Medical Center where medical personnel found she had lacerations consistent with non-consensual sex. (link)

Jul 07, 2016: The U.S. Department of Education's Office for Civil Rights (OCR) announced today that it has entered into a resolution agreement with Minot State University, North Dakota, after finding the university in violation of Title IX of the Education Amendments of 1972. OCR found that the university failed to process a complaint brought by a former student (Student A) who reported that during her time at the school, she had been sexually assaulted for over two years by one of her professors. Despite the serious nature of the complaint, OCR determined that Minot State did not take any steps to address the effects of the hostile environment to which the student reported she had been subjected. (link)

Jul 05, 2016: A former student of Jacksonville State University has filed a federal lawsuit against the university and others alleging discrimination while he was a member of the school's Marching Southerners band. Lawyers for Jalen Green, a student who withdrew from JSU last December, filed the 38-page suit June 28 in U.S. District Court. It names as defendants the school, band director Kenneth Bodiford, vice president of student affairs Timothy King, an instructor and two students, along with any students to be named later. It alleges violations of the student's first and 14th amendment rights, saying Green was subjected to a "racially hostile educational environment, disparate treatment, and "threats of violence for speaking out against the discrimination." It seeks punitive and compensatory damages. (link)

Jul 05, 2016: Kansas State University's policy not to investigate accusations of rape in off-campus fraternity houses is "incorrect," according to federal government statements filed in court in support of two female students at the university. Their federal lawsuits, filed in Kansas in April, say the university violated Title IX, by failing to respond to their complaints of rape. Responding to the lawsuits, the university argued in court that the cases should be dismissed because it is not legally responsible for reports of student-on-student rape at "off-campus" fraternity houses or events. (link)

Jul 05, 2016: The University of Tennessee has reached a financial settlement with a group of women who sued the school in federal court for the way it handled their allegations of sexual assaults by student-athletes. According to documents obtained by ESPN, the university will pay the eight women $2.48 million. On Feb. 9, a group of six unidentified women filed a federal civil lawsuit against Tennessee, alleging that the school violated Title IX regulations and created a "hostile sexual environment" through a policy of indifference toward assaults by student-athletes. (link)

Jul 03, 2016: Already the efforts of this White House have dramatically transformed the way colleges and universities respond to allegations of sexual misconduct. The Education Department has 253 ongoing investigations at 198 postsecondary institutions into the handling of sexual violence. Hundreds of schools have taken steps to make it easier to report allegations and discipline offenders. Many schools have appointed a specific officer to receive complaints and have determined that a "preponderance of evidence" is enough to establish that misconduct occurred, a less rigorous evidentiary standard than the "beyond a reasonable doubt" that applies in most criminal cases. (link)

Jul 01, 2016: At one university, a garbage can blocked access to the paper towels, a table was placed in front of the automatic door button, students in wheelchairs couldn't access the accessible sink in a science lab because of a trash can's placement, and staff sometimes plowed snow into disabled parking spaces or access lanes. These common oversights can occur even on campuses where leaders believe they have complied with the Americans with Disabilities Act and Section 504 of the Rehabilitation Act. To avoid running afoul of the law, constant vigilance and ongoing review are essential because there are so many factors to consider -- from what the law covers to how to best put accommodations into practice. (link)

Jun 30, 2016: The University of Washington says a microbiology professor faces possible discipline for violating sexual harassment policies. As detailed in a report on BuzzFeed this week, university investigations found Dr. Michael Katze demanded and received sexual favors from an employee in his lab. Investigators found that the woman, who had little prior job experience and performed little work in the office, was paid 12 percent more than the university's average for her position, and received gifts and vacations from the professor. (link)

Campus Life & Safety Events

Jul 25, 2016: A father and son from Chicago face criminal charges after being accused of drugging and sexually assaulting a woman visiting Illinois State University. The alleged incident happened on Tuesday in a campus residence hall. Campus police said Shawn Childs Sr. volunteered to buy liquor for a group of students staying in the ISU dorm during orientation for incoming students. The victim told police she saw Shawn Childs Sr. put a pill in her drink. Childs Sr. is charged with possession of a controlled substance with intent to deliver for allegedly putting ecstasy in the woman's soda. The victim said 19-year-old Shawn Childs Jr. raped her twice after his father drugged her. Childs Jr. is charged with four counts of criminal sexual assault. (link)

Jul 13, 2016: The Auburn Police Department is urging players of the wildly popular mobile game Pokémon Go be vigilant after a man was robbed while playing the game on Wednesday. According to police, the victim reported the robbery outside of a closed building in the 900 block of S. College Street at 3 a.m. on July 13. The victim told police that he was playing Pokémon Go on his cell phone, which directed him to the building. While outside of the closed building, he was approached by four black males and robbed at gunpoint. (link)

Jul 13, 2016: Three University of Maryland students were robbed at gunpoint while playing Pokémon Go on the university's College Park campus, University of Maryland police say. Three separate robberies were reported Tuesday night between 10 p.m. and 11 p.m. outside Tydings, Tawes and Queen Anne's halls. Police say three of the victims were playing Pokémon Go when they were robbed. A fourth victim was not playing the popular game, but had a phone in their hands. The suspect, who was wearing black clothing, showed a black handgun in two of the incidents and took the victims' cell phones. (link)

Jul 12, 2016: The Pokémon Go craze is believed to be at the root of an accident on the Texas A&M campus. The popular app game uses the GPS on your mobile device and places characters on your map that you can catch by going to different locations. Tuesday, Texas A&M University Police tweeted that on Monday, an illegally-parked car was hit from behind, causing the second car's airbags to deploy. Police say the driver of the illegally-parked car had left it to catch a Pokémon. (link)

Jul 11, 2016: An African-American dishwasher lost his job after losing his cool and breaking a stained-glass panel in Yale's Calhoun residential college dining hall that depicted slaves carrying bales of cotton. City police arrested Corey Menafee, who now faces a felony charge. The university, meanwhile, has cut ties with him. Yale Vice President for Communications Eileen O'Connor: "An incident occurred at Calhoun College, a residential college on the campus of Yale University, in which a stained glass window was broken by an employee of Yale, resulting in glass falling onto the street and onto a passerby, endangering [her] safety. The employee apologized for his actions and subsequently resigned from the University. The University will not advocate that the employee be prosecuted in connection with this incident and is not seeking restitution." (link)

Jul 12, 2016: The University of Wisconsin at Madison got a call on Saturday saying a group of bicyclists on the campus had their heads buried in their smartphones, and were weaving in and out of traffic. The caller offered a theory: They were playing Pokémon Go. Since late last week, officials at colleges across the country have noticed the swift adoption of the game, which players download onto their mobile phones. Students who might appear to be aimlessly wandering have actually been exploring their campuses, desperately looking for Pokémon, as the characters in the game are known, and congregating around "Poké Stops," where they reload on supplies such as "Poké balls," an essential tool for catching "Pokémon." (link)

Jul 07, 2016: At least two of Oregon's big public universities have found lead in campus water fixtures. Portland State University found elevated lead in faucets in an academic building, and Oregon State found it in a residence hall bathroom. Portland State officials say the fixtures at Cramer Hall have been fixed, turned off or posted with signs. Cramer is home to a number of social science departments such as anthropology, economics and history. It is among PSU's oldest buildings, having been built in 1955 as the original "Portland College" classroom facility, before the college was a full-fledged university. PSU released other sampling results showing lead levels below the federal safety threshold. (link)

Jul 06, 2016: Three University of Texas at Austin professors sued their university and the state on Wednesday, claiming Texas' new campus carry law is forcing the school to impose "overly-solicitous, dangerously-experimental gun policies" that violate the First and Second Amendments. The professors -- Jennifer Lynn Glass, Lisa Moore and Mia Carter -- are asking a federal judge to grant an injunction that would block the law before it goes into effect on Aug. 1. In the suit, professors say they teach courses that touch emotional issues like gay rights and abortion. The possibility of guns on campus could stifle class discussion, which is a violation of the First Amendment, the suit says. (link)

Jul 05, 2016: From censuring students to censoring professors, officials at the University of Northern Colorado have spent the past year regulating speech on their campus in a way First Amendment advocates say should raise serious questions. Two years ago, UNC administrators created the UNC Bias Response Team with the stated intention of responding to complaints of bias-motivated behavior. During the 2015-16 academic year, UNC officials responded to dozens of complaints -- most generated by students -- regarding everything from professors' in-class assignments to students' strongly stated political opinions to cooking competitions that caused problems for students with eating disorders. (link)

Jul 04, 2016: The body of a teenage Wisconsin student who went missing shortly after he arrived for an exchange program was found in the Tiber River on Monday. John Cabot University confirmed that the body was that of 19-year-old Beau Solomon, who was last seen by his friends in the early hours of Friday morning at a pub in Rome. Solomon had just completed his first year as a personal finance major at the University of Wisconsin-Madison. (link)

Other News & Events

Jul 08, 2016: Scandals can cost universities thousands of applicants, but exactly how many interested students a school loses may depend on how widely the incident is covered in the media, according to a new working paper from Harvard Business School. The analysis discovered that a school should prepare for a steep drop in applicants if it's involved in a scandal that ends up being detailed in a lengthy magazine article or covered by The New York Times. (link)

Jul 02, 2016: One was about to enter business school. Another brought an international outlook to the halls of Berkeley. And the last, while being a U.S. citizen, claimed Dhaka as home. All three died in Dhaka during Friday's brutal terrorist attack at a popular restaurant in the Bangladeshi capital. Officials at the University of California at Berkeley and Emory University in Atlanta confirmed Saturday that they had lost students in the attack. Abinta Kabir and Faraaz Hossain were enrolled as undergraduates at Emory's Oxford College, and Tarishi Jain was studying economics at the San Francisco-area school. (link)

If you have any suggestions, questions or feedback, please e-mail me at robinmk@auburn.edu. We hope you find this information useful and would appreciate hearing your thoughts. Feel free to forward this email to your direct reports, colleagues, employees or others who might find it of value. Back issues of this newsletter are available on our web site at https://www.auburn.edu/administration/oacp.

If you have any suggestions for items to include in future newsletters, please e-mail Robert Gottesman at gotterw@auburn.edu.

Back to top

Office of Audit, Compliance & Privacy
Auburn University
304 Samford Hall
M. Kevin Robinson, Assoc. VP

© Redistribution of this newsletter, with or without modification, is permitted provided Auburn University Office of Audit, Compliance & Privacy is listed as the source.