Report of the Vermont State Auditor DOUGLAS R. HOFFER Vermont State Auditor Child Protection Registry: Agency of Human Services Room for Greater Compliance in Checking the Registry by Agency and Selected Contractors and Grantees December 16, 2019 Rpt. No. 19-05 Report of the Vermont State Auditor Mission Statement The mission of the Auditor’s Office is to hold state government accountable. This means ensuring that taxpayer funds are used effectively and efficiently, and that we encourage the prevention of waste, fraud, and abuse. DOUGLAS R. HOFFER Vermont State Auditor This report is a work of the Office of the State Auditor, State of Vermont, and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from the State of Vermont or the Office of the State Auditor. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Please contact the Office of the State Auditor if you have questions about reproducing this report December 16, 2019 Rpt. No. 19-05 DOUGLAS R. HOFFER Vermont State Auditor 132 STATE STREET • MONTPELIER, VERMONT 05633-5101 (802) 828-2281 • TOLL-FREE IN VT: (877) 290-1400 • FAX: (802) 828-2198 AUDITOR@VERMONT.GOV • WWW.AUDITOR.VERMONT.GOV Dear Colleagues, The State of Vermont along with its human services contractors and grantees rely on the Child Protection Registry (CPR) to help safeguard Vermont’s children. The CPR contains a list of people with substantiated incidents of child abuse or neglect, even if no criminal conviction resulted. It is used to screen the backgrounds of those who work with and care for children. Employers are sometimes required by law, licensing regulations, or contract/ grant terms to check whether potential new hires and, in some cases, existing employees are listed in the CPR. The Department for Children and Families (DCF) performs these checks and provides the results to authorized individuals at the requesting organization. This audit focused on whether selected groups of Agency of Human Services (AHS) departments, contractors, and grantees were checking the CPR. The objectives of this audit were to determine: 1. Whether selected entities made required checks of the CPR in calendar year 2018; and 2. What actions were taken, if any, by entities required to check the CPR when an individual was listed in the registry. In 2018, most of the AHS departments and 10 contractors and grantees obtained information, as required, on whether individuals had substantiated records for child abuse or neglect. However, a few organizations failed to check one or two of their new hires, and three organizations failed to check a substantial number of new hires. These organizations reported that they have since checked all individuals they missed who are still in their employ. By failing to check the CPR, an employer could unknowingly hire individuals who have abused or neglected children in the past. For potential AHS hires, there are two key exceptions to required CPR checks. Those exceptions are for individuals who are: (1) current classified State employees, and (2) former employees exercising their re-employment rights under the State’s collective bargaining agreement. I recommend that the Legislature adopt legislation to require CPR checks of these individuals before hiring them to provide care, custody, treatment, transportation, or supervision of children. In addition, 33 V.S.A. §4919 limits employers to requesting CPR checks only for those workers whose duties include the care, custody, treatment, transportation, or supervision of children, unless otherwise authorized. As a result, there were cases in which organizations did not check the CPR for staff performing maintenance, administrative, or other duties that did not meet these criteria. December 16, 2019 14 September 2014 Rpt. No.No. 19-05 Rpt. 13-03 DOUGLAS R. HOFFER Vermont State Auditor 132 STATE STREET • MONTPELIER, VERMONT 05633-5101 (802) 828-2281 • TOLL-FREE IN VT: (877) 290-1400 • FAX: (802) 828-2198 AUDITOR@VERMONT.GOV • WWW.AUDITOR.VERMONT.GOV We also examined the actions of the six AHS contractors and grantees with the greatest number of checks yielding a substantiated CPR record between 2016 and 2018. In the great majority of cases, the person with the substantiated CPR record was not hired or retained. In most cases when an individual was hired, a subsequent check showed that the person was no longer listed in the CPR, or DCF corrected an error. In four cases, a person listed in the CPR was hired after the employer determined that the position did not pose a danger to children. In the absence of a specific requirement controlling how to handle individuals with substantiated CPR records, organizations have discretion in hiring individuals with a substantiated record of child abuse or neglect. Furthermore, we made several recommendations to DCF, and the one aforementioned recommendation to the Legislature. DCF has agreed to implement our recommendations. We have also released a companion report on the use of the CPR in public education. In this report, we found that the Agency of Education submitted CPR checks to DCF with incorrect information (e.g., the individual’s first and last name were reversed), which could have resulted in DCF drawing an incorrect conclusion that someone was or was not listed in the CPR. Although the CPR matching process was not part of our objectives, we determined in the course of our audit that organizations submit to DCF the last four digits of the social security number for the individual being checked. However, DCF does not routinely use this information as part of its matching process, and the CPR does not contain social security numbers. In light of the Agency of Education’s erroneous checks, I became concerned about the problems posed by the limited use of social security numbers in this process. We have thus far collected limited information on this issue, and there may be technical and/or collection difficulties associated with adding social security numbers to the CPR. Nevertheless, we have sent a letter to DCF inquiring about the technical feasibility of adding social security numbers to the CPR because of the potential to enhance the CPR matching process. I would like to thank the staff at the Department for Children and Families; Department of Vermont Health Access; Department of Disabilities, Aging and Independent Living; the Vermont Department of Health; and the contractors and grantees for their cooperation during this audit. This report is available on the state auditor’s website, http://auditor.vermont.gov/. Sincerely, DOUGLAS R. HOFFER State Auditor December 16, 2019 14 September 2014 Rpt. No.No. 19-05 Rpt. 13-03 DOUGLAS R. HOFFER Vermont State Auditor ADDRESSEES 132 STATE STREET • MONTPELIER, VERMONT 05633-5101 (802) 828-2281 • TOLL-FREE IN VT: (877) 290-1400 • FAX: (802) 828-2198 AUDITOR@VERMONT.GOV • WWW.AUDITOR.VERMONT.GOV The Honorable Mitzi Johnson Speaker of the House of Representatives The Honorable Tim Ashe President Pro Tempore of the Senate Mr. Adam Greshin Commissioner, Department of Finance and Management Mr. Mike Smith Secretary, Agency of Human Services The Honorable Phil Scott Governor Mr. Ken Schatz Commissioner, Department for Children and Families Mr. Cory Gustafson Commissioner, Department of Vermont Health Access December 16, 2019 14 September 2014 Ms. Susanne Young Secretary, Agency of Administration Mr. Mark Levine, MD Commissioner, Department of Health Monica Caserta Hutt Commissioner, Department of Disabilities, Aging and Independent Living Rpt. No.No. 19-05 Rpt. 13-03 Child Protection Registry: Agency of Human Services Room for Greater Compliance in Checking the Registry by Agency and Selected Contractors and Grantees Contents Page Highlights 1 Objective 1: Selected Entities Generally Determined Whether New Hires Had a Substantiated Record of Child Abuse or Neglect but There Were Some Significant Exceptions 5 Background AHS CPR Checking Requirements Most Required Checks Were Performed but Some Were Not 4 5 8 Objective 2: Selected Entities Acted on Substantiated Results 11 Conclusions 14 Other Matters Recommendations Management’s Comments and Our Evaluation Appendix I: Scope and Methodology Appendix II: Abbreviations Appendix III: Comments from Management Appendix IV: SAO Evaluation of Management’s Comments December 16, 2019 14 September 2014 13 14 15 16 19 20 22 Rpt. No.No. 19-05 Rpt. 13-03 Child Protection Registry: Agency of Human Services Room for Greater Compliance in Checking the Registry by Agency and Selected Contractors and Grantees Highlights To help protect children, Vermont law authorizes the Agency of Human Services’ (AHS) Department for Children and Families (DCF) to disclose records from the State’s Child Protection Registry (CPR) for permitted purposes. For example, employers may request CPR checks when they are seeking to hire an individual who will provide the care, custody, treatment, transportation, or supervision of children. The CPR contains a record of child abuse and neglect investigations that have resulted in a substantiated report on or after January 1, 1992. A substantiated report is defined in statute as one that DCF has determined by investigation “is based upon accurate and reliable information that would lead a reasonable person to believe that the child has been abused or neglected.” An individual does not have to be convicted of a crime to have a substantiated record in the CPR. Because checking the CPR is intended to improve the safety of children, the State Auditor’s Office (SAO) decided to audit the usage of this system. This audit focused on AHS requirements to check the CPR. 1 Our objectives were to determine: 1. Whether selected entities made required checks of the CPR in calendar year 2018; and 2. What actions were taken, if any, by entities required to check the CPR, when an individual was listed in the registry. The entities in our scope included (1) AHS departments that employ individuals who provide care, custody, treatment, transportation, and supervision of children, (2) a contractor (ARIS Solutions) that performs payroll services for employers of personal care workers for certain AHS programs, and (3) contractors and grantees for AHS programs involving children. 2 Objective 1 Finding: Did selected entities make required checks of the CPR in calendar year 2018? 1 2 3 1 In 2018, most of the selected AHS departments, contractors, and grantees obtained information on whether individuals had substantiated records for child abuse and neglect, as required. 3 By failing to check the CPR, an employer could unknowingly A companion report, Child Protection Registry: Public Education – Agency of Education and Supervisory Unions & Districts Failed to Obtain Many Registry Results as Required (SAO report 19-06, December 16, 2019), is available on the SAO website. Appendix I details the scope and methodology of the audit. Appendix II contains a list of abbreviations used in this report. Checks for substantiated records were performed either on the CPR or on another DCF system that provides the extract of substantiated records to the CPR. December 16, 2019 14 September 2014 Rpt. No.No. 19-05 Rpt. 13-03 Child Protection Registry: Agency of Human Services Room for Greater Compliance in Checking the Registry by Agency and Selected Contractors and Grantees hire individuals who have abused or neglected children in the past. AHS requires these checks through licensing regulations, contract and grant clauses, and policy. Organizations usually submit CPR check requests through the Adult Abuse and Child Protection Registries Automated Checking System website. DCF’s Centralized Intake and Emergency Services (CIES) unit conducts the checks and posts the results on this website, which can be retrieved by authorized users. For two types of organizations in our scope—Parent Child Centers (PCC) and Woodside Juvenile Rehabilitation Center—other DCF units check a different internal system instead of the CPR to determine whether an individual has a substantiated record of child abuse or neglect. While there were a few organizations that neglected to check one or two newly hired employees against the CPR or another DCF system there were three organizations that failed to make required checks in more numerous instances. Those situations at Lund Family Center, Vermont Permanency Initiative, and Woodside Juvenile Rehabilitation Center are outlined below. • • • 2 December 16, 2019 14 September 2014 Lund Family Center: Under agreements with DCF, the Lund Family Center operates (1) a residential treatment facility for children and youth with emotional behavioral and other challenges known as a Private Non-Medical Institution and (2) a Parent Child Center, which provides prevention, early intervention, and early child development services to prospective parents and families with young children. Both agreements include requirements to ensure that Lund Family Center employees do not have a substantiated report of child abuse and neglect. In 2018, of the 49 new employees we reviewed, Lund hired 33 without checking them against the CPR. A Lund human resources official ascribed this to a process flaw that she asserted has been corrected. Vermont Permanency Initiative: The Vermont Permanency Initiative operates Private Non-Medical Institutions under agreements with DCF that require the organization to check the CPR. In 2018, of the 47 new employees reviewed, this organization hired 9 without checking them against the CPR. According to the compliance director of the Vermont Permanency Initiative, this was due to administrative mistakes and they have taken steps to ensure that such exceptions do not recur. Woodside Juvenile Rehabilitation Center: Woodside is operated by DCF and provides residential placements and medical and psychiatric treatment for youth. As a State organization, only non-state employee applicants for Woodside employment fall under the AHS’s hiring policy, which requires that the CPR be checked prior to hiring individuals to provide care, custody, treatment, transportation, and supervision of children. Of ten employees hired to such positions in 2018, six were not checked for substantiated records of child abuse or neglect. Rpt. No.No. 19-05 Rpt. 13-03 Child Protection Registry: Agency of Human Services Room for Greater Compliance in Checking the Registry by Agency and Selected Contractors and Grantees Each of these three organizations reported that they have subsequently checked the CPR for those employees whose checks were missed. Not all employees are required to be checked for substantiated records of child abuse and neglect. For example, the AHS hiring policy does not apply to candidates who are (1) current classified State employees or (2) previous employees exercising their re-employment rights under the State’s collective bargaining agreement. 4 According to the State’s director of labor relations, absent a statutory or regulatory requirement to conduct background checks of existing State classified employees, the State could only implement such a requirement through collective bargaining. In addition, absent authorization from another source (e.g., licensing regulation), 33 V.S.A. §4919 limits employers to requesting CPR checks only for those workers whose duties include the care, custody, treatment, transportation, or supervision of children. As a result, there were cases in which organizations did not check the CPR for staff performing maintenance, administrative, or other duties that did not meet these criteria. Objective 2 Finding: What actions were taken, if any, by entities required to check the CPR, when an individual was listed in the registry? Between 2016 and 2018 DCF’s CIES notified six selected contractors that 196 individuals were listed as having substantiated records on the CPR, of which 22 (11 percent) were hired or retained. In nearly all cases when the individual was hired or retained, the decision was made after DCF either (1) later determined that the individual was not actually listed in the CPR or (2) expunged the substantiated record from the CPR after an appeal by the potential new hire. In only four cases were individuals with a substantiated record of child abuse or neglect in the CPR employed or retained. In these cases, the contractors determined that the individuals would not be in positions that could cause harm to their clients because of the nature of those positions. Unless otherwise mandated by a specific requirement (e.g., a contract clause or licensing rule) organizations have discretion in the actions they can take upon learning that a person has a substantiated record for child abuse or neglect. This may include offers of employment. Recommendations We make a variety of recommendations to DCF and suggest that the legislature consider legislation to require background checks for existing State employees and previous employees exercising their re-employment rights under the State’s collective bargaining agreement who apply for positions that provide care, custody, treatment, transportation, and supervision of children. 4 3 A classified employee is an employee of the State of Vermont who is hired to fill a position in the classified service in accordance with merit principles as administered by the Department of Human Resources. December 16, 2019 14 September 2014 Rpt. No.No. 19-05 Rpt. 13-03 Child Protection Registry: Agency of Human Services Room for Greater Compliance in Checking the Registry by Agency and Selected Contractors and Grantees Background DCF’s Family Services Division investigates allegations of mistreatment of children to determine if the allegation is substantiated. 5 According to 33 V.S.A. §4912(16), a substantiated report means that the DCF commissioner or designee “has determined after investigation that a report is based upon accurate and reliable information that would lead a reasonable person to believe that the child has been abused or neglected.” In 2018, DCF investigated 3,173 allegations of child abuse or neglect, of which it substantiated 999. 6 All substantiated records of child abuse or neglect on or after January 1, 1992 are maintained in the CPR, unless they have been overturned or expunged. 7 Vermont’s statute defines a registry record as consisting of the name of the individual substantiated for child abuse or neglect, at least one other identifier to avoid possible misidentification, the date of the finding, and the nature of the finding. In addition, for individuals placed on the CPR after July 1, 2009, the record contains a child protection level related to the risk of future harm to children. An individual does not need to be convicted of a crime to have a substantiated record in the CPR. Vermont law allows DCF to disclose CPR records to various organizations for specific purposes. For example, under 33 V.S.A. §4919, DCF may disclose CPR records to employers if such information is to be used to determine whether to hire or retain an individual providing care, custody, treatment, transportation, or supervision of children or vulnerable adults. According to this statute, employers may submit requests to the CPR, after obtaining the person’s consent, for current employees, volunteers, grantees, contractors or an individual for whom the employer has given a conditional offer of a contract, volunteer position, or employment. Organizations can request checks for CPR records electronically or via a paper request form. Electronic requests for CPR checks are the most common and are submitted using an AHS website (the Adult Abuse and Child Protection Registries Automated Checking System). 8 DCF’s CIES staff members process CPR check requests and notify the applicable organization 5 6 7 8 4 DCF’s Family Services Policy 56, Substantiating Child Abuse and Neglect (https://dcf.vermont.gov/sites/dcf/files/FSD/Policies/56.pdf) contains criteria on how it makes substantiation decisions. 2018 Report on Child Protection in Vermont (DCF/Family Services Division). Under 33 V.S.A. §4916a and §4916b individuals can challenge their placement on the CPR. 33 V.S.A. §4916c, and §4916d allows eligible individuals to request an expungement of their CPR record. DCF’s Rule 3000, Child Protection Registry and Administrative Review Process (https://dcf.vermont.gov/sites/dcf/files/FSD/Rules/3000.pdf) covers reviews of substantiation decisions and expungement petitions. Organizations can use this system to submit requests for checks against both the Department of Disabilities, Aging, and Independent Living’s Adult Abuse Registry and the CPR. December 16, 2019 14 September 2014 Rpt. No.No. 19-05 Rpt. 13-03 Child Protection Registry: Agency of Human Services Room for Greater Compliance in Checking the Registry by Agency and Selected Contractors and Grantees when the result is available, and authorized users can access it from the website. Objective 1: Selected Entities Generally Determined Whether New Hires Had a Substantiated Record of Child Abuse or Neglect but There Were Some Significant Exceptions As required, in 2018 most of the selected entities generally checked the CPR or another DCF system that provides the extract of substantiated records to the CPR. Requirements to perform such checks are imposed by various sources, including internal state government policy relating to State employees, contract terms, and licensing rules. Three entities failed to check one or two 2018 hires and three others had more widespread omissions. AHS CPR Checking Requirements Applicants for AHS Employment AHS hiring policy 9 requires background checks, including checking the CPR, for applicants (exempting existing state employees) for a position in which the duties involve providing care, custody, treatment, transportation or supervision of children. The Departments of Vermont Health Access (DVHA), Health (VDH), Disabilities, Aging and Independent Living (DAIL), and DCF reported that they employ individuals in positions that provide care, custody, treatment, transportation, or supervision of children, such as DAIL’s vocational rehabilitation counselors that work with youth. In 2018, DCF appointed the largest number of individuals to such positions. For example, DCF’s Woodside Juvenile Rehabilitation Center, which provides residential placements and medical and psychiatric treatment for youth, has positions such as nurses, counselors, and teachers that have contact with children. 10 For the AHS departments in our scope, requests for CPR checks are submitted by the Department of Human Resources (DHR), except for DCF’s Woodside Juvenile Rehabilitation Center. DHR utilizes a hiring checklist that includes a 9 10 5 AHS Hiring Standards (Chapter 4.02, effective December 7, 2009). These residential placements include youth in the custody of DCF or the Department of Corrections. December 16, 2019 14 September 2014 Rpt. No.No. 19-05 Rpt. 13-03 Child Protection Registry: Agency of Human Services Room for Greater Compliance in Checking the Registry by Agency and Selected Contractors and Grantees question as to whether the position provides services that would require a CPR check. Checks for substantiated records of child abuse or neglect for applicants for positions at Woodside are performed by DCF’s Residential Licensing & Special Investigations (RLSI) unit and recorded by means of a stamp saying “Child Abuse Registry Cleared” on the person’s background check form. A RLSI official stated that their practice is not to check the CPR itself, but rather to check another DCF system, which provides the extract of substantiated records to the registry. Not all applicants to an AHS position that includes the care, custody, treatment, transportation, or supervision of children undergo a CPR check. The AHS hiring policy does not apply to candidates who are (1) current classified State employees or (2) previous employees exercising their reemployment rights under the State’s collective bargaining agreement who apply for such positions. 11 According to the State’s director of labor relations, absent a statutory or regulatory requirement to conduct background checks of existing State classified employees, the State could only implement such a requirement through collective bargaining as required by the State Employees Labor Relations Act. Thus, a person could be hired to a state position involving contact with children without being subject to CPR checks. ARIS Solutions ARIS Solutions provides payroll services for individuals authorized by the State to receive services from various AHS programs. 12 ARIS is not the employer of these workers but is required by its contract with the State to perform background checks, including a CPR check, on new workers. An example of a program that ARIS supports is the Children’s Personal Care Services program, which helps families and caregivers pay for one-on-one assistance for a child under 21 who needs help with tasks such as dressing, bathing, grooming, eating, and/or mobility. AHS Contractors and Grantees AHS uses contractors and grantees to carry out various programs for children. The scope of this audit included four types of contractors/grantees: 11 12 6 A classified employee is an employee of the State of Vermont who is hired to fill a position in the classified service in accordance with merit principles as administered by DHR. DAIL contracts with ARIS Solutions to act as the fiscal/employer agent for consumer or surrogate-directed services as well as for other programs. A key feature of consumer or surrogate-directed services is that the consumer or a surrogate serves as the employer of attendants, not the State. ARIS performs a variety of tasks in this role, including enrolling employers and attendants. December 16, 2019 14 September 2014 Rpt. No.No. 19-05 Rpt. 13-03 Child Protection Registry: Agency of Human Services Room for Greater Compliance in Checking the Registry by Agency and Selected Contractors and Grantees • • • • Designated Agencies (DA): Within their designated areas, the eleven DAs provide a range of services to adults and children and adolescents with severe emotional disturbances or developmental disabilities. Specialized Service Agencies (SSA): SSAs are organizations that provide services to persons with developmental disabilities or mental health needs. There are seven SSAs. Private Non-Medical Institutions (PNMI): PNMIs are treatment facilities for children and youth with emotional behavior and other challenges. According to licensing rules, a PNMI is required to conduct CPR checks upon hire and every three years thereafter for employees and others who may have unsupervised contact with children. 13 There are 15 PNMIs in Vermont. Parent Child Centers (PCC): A statewide network of 15 PCCs provides prevention, early intervention, and early child development services to prospective parents and families with young children. Most PCCs hold a valid child care license from DCF’s Child Development Division. 14 To hold such a license, DCF rules require that PCCs ensure that no person be left alone with children without approval from DCF’s Child Development Division. 15 The PCC is supposed to submit the name and other identifying information of applicable staff to this division. 16 The Child Development Division then performs a background check, including a review of the DCF system that provides the extract of substantiated records to the CPR. Once the background check is complete, the Child Development Division sends the PCC a letter with its approval or disapproval. In addition to other requirements pertaining to the CPR that these organizations may be subject to, each of their contracts or grants with AHS includes a provision that states: 13 14 15 16 7 “Party agrees not to employ any individual, to use any volunteer or other service provider, or to otherwise provide reimbursement to any individual who in the performance of PNMIs are a type of residential treatment program and are covered by the following rule: Licensing Regulations for Residential Treatment Programs, (DCF, January 2011). All four of the PCCs at which we did detailed testing held child care licenses. Child Care Licensing Regulations: Center Based Child Care and Preschool Programs (DCF, CVR 13-171-004 September 2016). The regulations require that staff and auxiliary staff in the Center Based Child Care and Preschool Program be submitted for approval. Staff are defined as a program director, teacher, teacher associate, teacher assistant, trainee, classroom aide, or seasonal staff. Auxiliary staff are defined as those who may have contact with children and whose responsibilities do not include care and education of children. This includes, but is not limited to, cooks, janitors, maintenance workers, and other staff not directly responsible for the supervision, care and education of children. December 16, 2019 14 September 2014 Rpt. No.No. 19-05 Rpt. 13-03 Child Protection Registry: Agency of Human Services Room for Greater Compliance in Checking the Registry by Agency and Selected Contractors and Grantees services connected with this agreement provides care, custody, treatment, transportation, or supervision to children … if there has been a substantiation of abuse or neglect or exploitation involving that individual. Party is responsible for confirming as to each individual having such contact with children … the non-existence of a substantiated allegation of abuse, neglect or exploitation by verifying that fact though [sic] … as to children, the Central Child Protection Registry (unless the Party holds a valid child care license or registration from the Division of Child Development, Department for Children and Families).” Most Required Checks Were Performed but Some Were Not As Table 1 shows, in 2018, most selected entities checked whether newly hired employees had substantiated records in the CPR or in another DCF system that provides the extract to the CPR. 17 There were three notable exceptions that neglected to check a significant number of 2018 new hires for substantiated records of child abuse or neglect. Those organizations were DCF’s Woodside Juvenile Rehabilitation Center, the Lund Family Center, and the Vermont Permanency Initiative. It is also notable that four of the ten state contractors/grantees did not check the CPR for one or more individuals. By failing to check the CPR, an employer could unknowingly hire individuals who have abused or neglected children in the past. 17 8 Our methodology may not have identified all 2018 new hires by these organizations. December 16, 2019 14 September 2014 Rpt. No.No. 19-05 Rpt. 13-03 Child Protection Registry: Agency of Human Services Room for Greater Compliance in Checking the Registry by Agency and Selected Contractors and Grantees Table 1: 2018 Checks of New Hiresa for Substantiated Records of Child Abuse or Neglectb Organization Name Type AHS/DAIL AHS/DCF (excluding Woodside) AHS/DCF/ Woodside Juvenile Rehabilitation Center State State State 10 4 6 0 AHS/DVHA AHS/VDH State State 4 22 3 8 0 2 1 12 2,826 2,826 0 0 368 49 368 16 0 33 0 0 PCC 14 12 0 2 SSA 50 48 0 ARIS Solutions Howard Center Lund Family Center Payroll provider for some AHS programs DA & PNMI PNMI & PCC Orange County Parent Child Center Rutland County Parent Child Center Specialized Community Care 9 2018 New Hires Total # With # Without # Not Hires Required Required Required Reviewed Checks Checks to Check 7 7 0 0 91 88 0 3 December 16, 2019 14 September 2014 PCC 24 19 0 Comments DCF lacked sufficient evidence that 6 Woodside new hires were checked. While in each case DCF had a form that was stamped “Child Abuse Registry Cleared,” this was contradicted by records in DCF’s system that provides the extract of substantiated records to the CPR and the CPR itself. After we notified DCF of our results, they checked the CPR for these 6 individuals and found that none had substantiated records. DHR could not find the hiring checklist for 2 new hires in positions that can have contact with children. Thus, there was no evidence that CPR checks were conducted or unneeded. After we notified DCF of our results, they checked the CPR for these 2 individuals and found that neither had substantiated records. A human resources official stated that individuals were not checked due to a since corrected procedural flaw. The official stated that the checks have now been performed and that none of the individuals had substantiated records. 5 2 Rpt. No.No. 19-05 Rpt. 13-03 Child Protection Registry: Agency of Human Services Room for Greater Compliance in Checking the Registry by Agency and Selected Contractors and Grantees Organization Name Type Springfield Area Parent Child Center PCC Upper Valley Services Vermont Permanency Initiative DA Windsor County Youth Services a b PNMI PNMI 2018 New Hires Total # With # Without # Not Hires Required Required Required Comments Reviewed Checks Checks to Check 21 19 1 1 According to the executive director, the exception occurred before she was hired, the check has now been performed, and the individual did not have a substantiated record. 38 34 0 4 47 38 9 0 16 14 1 1 According to the compliance director, 6 of the individuals not checked are no longer employed by the organization and they have now obtained CPR checks for the other three (no substantiated records). She also stated that these exceptions were due to administrative mistakes and they have taken actions to ensure that such exceptions do not recur. According to the executive director, the exception was an oversight, the check has now been completed, and the individual did not have a substantiated record AHS new hires were identified by obtaining lists of positions involving contact with children from AHS departments and obtaining a file of 2018 hires to those positions from DHR. ARIS provided a data file of 2018 hires. New hires by contractors and grantees were identified by comparing 2017 and 2018 W2 data provided by the Department of Taxes. Our methodology may not have identified all 2018 new hires by these organizations and excluded those new hires for positions that were not covered by the DA, SSA, PNMI, or PCC contracts or grants. For all organizations, we checked data from the CPR for evidence that the entity was provided the results of a check for a substantiated record of child abuse or neglect for each new hire. In addition, (1) for PCCs we checked whether the organization received confirmation from DCF’s child development division that the individual did not have a record of substantiated child abuse or neglect and (2) for the Woodside Juvenile Rehabilitation Center, we confirmed whether the organization checked another DCF system that provides the extract of substantiated records to the CPR. This table also illustrates that not all newly hired employees are required to be checked for substantiated records of child abuse and neglect. For example, absent authorization by another requirement (e.g., PNMI regulations), 33 V.S.A. §4919 limits employers to requesting that DCF check the CPR only for those workers whose duties include the care, custody, treatment, transportation, or supervision of children. As a result, there were cases in which organizations did not check the CPR for new hires performing maintenance, administrative, or other duties that did not meet these criteria. In contrast, 16 V.S.A. §255 requires school superintendents to request and obtain information from the CPR for individuals she or he is prepared to recommend for any full-time, part-time, or temporary employment. 10 December 16, 2019 14 September 2014 Rpt. No.No. 19-05 Rpt. 13-03 Child Protection Registry: Agency of Human Services Room for Greater Compliance in Checking the Registry by Agency and Selected Contractors and Grantees Objective 2: Selected Entities Acted on Substantiated Results Between 2016 and 2018, in the great majority of cases in which a selected entity was informed that an individual had a substantiated record of abuse or neglect of a child, the person was not hired or allowed to participate in a program. 18 Further, in almost all of the cases in which such individuals were hired or retained, DCF had later informed the organization that the individual was not actually listed in the CPR or the individual’s CPR record was expunged. 33 V.S.A. §4911(5) recognizes the importance of balancing the need to protect children with the potential employment consequences of a registry record for persons who are substantiated for child abuse and neglect. Moreover, unless mandated by a specific requirement (e.g., a contract clause or licensing rule) there is no single action that organizations must take upon learning that a person has a substantiated record for child abuse or neglect. For example, PNMI licensing rules allow the program administrator to evaluate the results of background checks that include the CPR. AHS’s customary contract and grant terms, in contrast, forbid employing a person to provide care, custody, treatment, transportation, or supervision to children or to vulnerable adults if there has been a substantiation of abuse or neglect or exploitation involving that person. 18 19 20 21 11 If DCF finds a substantiated record in the CPR, authorized users at the requesting entity are provided with the person’s name, substantiation date, and abuse type. 19 As shown in Table 2, selected organizations did not hire (or, in the case of ARIS, allow to be hired) or allow to participate in a program almost 90 percent of individuals in which they were notified of such a record. 20 In almost all other cases, an individual was hired or retained after the employer repeated the check and obtained a negative result, either because DCF later informed the organization that the result of the original CPR check was incorrect, and the individual was not listed in the registry or because the candidate had their name expunged from the CPR. 21 Two organizations hired or retained individuals with a substantiated record, after deciding they would not pose a danger to clients due to the nature of their Organizations sometimes checked the CPR for purposes other than employment, such as a person applying to reside in a shared living program. Abuse types include sexual abuse, physical abuse, neglect, risk of physical harm, risk of sexual abuse, abandonment, and emotional maltreatment. ARIS Solutions provides payroll services enabling recipients of various AHS programs to employ workers funded by these programs. ARIS is not the employer of these workers. According to DCF Rule 3000, expungement means the removal of a person's name from the CPR, following consideration of the facts related to a person's petition to expunge or in compliance with a decision to expunge by the Human Services Board or other legal authority. December 16, 2019 14 September 2014 Rpt. No.No. 19-05 Rpt. 13-03 Child Protection Registry: Agency of Human Services Room for Greater Compliance in Checking the Registry by Agency and Selected Contractors and Grantees positions. These decisions were made independently by these organizations as this authority is delegated to employers under the AHS standard contract clause. Table 2: Summary of Actions Taken by Selected Entities When Notified of a Substantiated Report of Child Abuse or Neglect, 2016-2018 Organization Name ARIS Solutionsc Health Care & Rehabilitation Services Howard Center # of # Hired or Retained Individuals # Not Originally Hired or DCF Later Reported as Otherwise Determined Other Type Other Explanation Substantiated Acceptedb Not Listed in CPR by DCFa Payroll provider 160 145 15 0 for some AHS programs DA 6 5 1d 0 Northeast Kingdom Human Services Rutland Mental Health Services Washington County Mental Health Services Total Percent a b c d 12 DA & PNMI 7 5 0 2 DA 9 8 1 0 DA 9 7 0 2 DA 5 196 100% 4 174 89% 1 18 9% 0 4 2% This DA determined that these two individuals would not pose a danger to their clients due to the nature of their positions. This DA determined that these two individuals would not pose a danger to their clients due to the nature of their positions. In a few cases the same person was checked and found to have a substantiated record more than once. Each person is counted only once. Organizations sometimes checked the CPR for purposes other than employment, such as a contractor or a person applying to reside in a shared living program. ARIS Solutions provides payroll services enabling recipients of various AHS programs to employ workers funded by these programs. ARIS is not the employer of these workers. After a substantiated check result in February 2017, Health Care & Rehabilitation Services questioned DCF’s decision and was told that the substantiation was an error. They immediately submitted another check request and the result was negative. When we asked the CIES director about this decision in July 2019, she stated that this person does in fact have a substantiated record in the CPR. Health Care & Rehabilitation Services reported that the person no longer works at this DA. December 16, 2019 14 September 2014 Rpt. No.No. 19-05 Rpt. 13-03 Child Protection Registry: Agency of Human Services Room for Greater Compliance in Checking the Registry by Agency and Selected Contractors and Grantees Other Matters Vermont statutes pertaining to the CPR limit its permitted use and require DCF to preserve its confidentiality. During the audit, we identified internal control weaknesses relating to the implementation of these requirements. • • • 13 December 16, 2019 14 September 2014 Rules. 33 V.S.A. §4916(c) states that DCF shall adopt rules to permit use of CPR records as authorized by subchapter 2 of the title (Reporting Abuse Of Children) while preserving confidentiality of the registry and other department records related to abuse and neglect. 16 V.S.A. §254(e) and §255(h) cover disclosure of CPR records to the Agency of Education and school superintendents, respectively. These statutes also call on DCF to adopt rules governing the process for obtaining information from the CPR and for disseminating and maintaining records of that information. DCF’s rules do not explicitly address the permitted uses of the CPR covered by 33 V.S.A. Subchapter 2 §4919 and 16 V.S.A. §254(e) and §255(h). This is a concern because some of the entities we reviewed had policies requiring CPR checks of all hires, regardless of role. A rule that addresses the various permitted uses of the CPR and provides definitions that are not included in the statute may help organizations to apply the statutes correctly. For example, a rule could clarify terms used in 33 V.S.A. §4919(a)(3), which limits employers from checking individuals that provide “care, custody, treatment, transportation or supervision” of children but does not define these terms and may not cover all relevant occupations. Confidentiality. To obtain electronic access to CPR records in response to submitting a request, an individual must subscribe to the Adult Abuse and Child Protection Registries Automated Checking System. As part of the subscription process, individuals viewing CPR check results (called receivers) are supposed to sign a user confidentiality agreement. However, receivers are directed not to submit the form with their application. Instead, they are required to produce it upon AHS’s request. DCF does not have a process in place to periodically check whether these forms are being signed. DCF therefore lacks assurance that those who receive CPR information are familiar with their obligations regarding confidentiality. Access control. During the audit, we identified an information system access control weakness that could lead to unauthorized access to CPR records. We sent a separate letter to DCF’s commissioner on October 17, 2019 explaining the weakness. In an October 25, 2019 response, the commissioner provided a corrective action plan. We are not providing additional information on this weakness to the public because it has not Rpt. No.No. 19-05 Rpt. 13-03 Child Protection Registry: Agency of Human Services Room for Greater Compliance in Checking the Registry by Agency and Selected Contractors and Grantees yet been corrected and could lead to unauthorized access to CPR check results, including whether an individual has a substantiated record of child abuse or neglect. Conclusions With three substantive and three other exceptions, selected AHS departments, contractors, and grantees checked whether new employees in 2018 had substantiated records of child abuse or neglect. The three substantive exceptions were DCF’s Woodside Juvenile Rehabilitation Center, the Lund Family Center, and the Vermont Permanency Initiative. In addition, selected contractors hired or retained few individuals that they found to be listed in the CPR. Notwithstanding these results, there were weaknesses and anomalies in the implementation of the CPR and its legal framework that, if fixed, could improve the process of checking the CPR for substantiated records of child abuse or neglect. Recommendations We make recommendations to the Commissioner of the Department for Children and Families in Table 3. Table 3: Recommendations to the Commissioner of the Department for Children and Families Recommendation 1. 2. 3. 14 DCF should develop rules permitting use as authorized of CPR records while preserving confidentiality, as required by 33 V.S.A. §4916(c), 16 V.S.A. §254(e), and 16 V.S.A. §255(h). DCF should develop a process to ensure that confidentiality agreements are signed by those who receive CPR information. This could involve annual or periodic reviews of all or a sample of organizations. DCF should complete the corrective action plan developed in response to our October 17, 2019 letter on an information system access control weakness. December 16, 2019 14 September 2014 Report Issue Pages 13 DCF has not issued rules as required by statute. 13 13 DCF requires receivers to sign and retain a confidentiality agreement before being permitted to receive CPR information but has no process for checking whether these agreements have been signed. On October 17, 2019, we sent a letter to DCF’s commissioner outlining an information system access control weakness that could lead to unauthorized access to CPR records. In an October 25, 2019 response, the commissioner provided a corrective action plan. Rpt. No.No. 19-05 Rpt. 13-03 Child Protection Registry: Agency of Human Services Room for Greater Compliance in Checking the Registry by Agency and Selected Contractors and Grantees We recommend a statutory adjustment to the Legislature in Table 4. Table 4: Matter for Legislative Consideration Report Issue Pages The Legislature should consider adopting 6 The AHS hiring policy exempts candidates for positions legislation to require existing classified from undergoing a CPR check who are (1) current State employees and former employees classified State employees or (2) previous employees exercising their re-employment rights exercising their re-employment rights under the State’s under the State’s collective bargaining collective bargaining agreement who apply for such agreement to be subject to CPR checks positions. According to the State’s director of labor before appointment to positions providing relations, absent a statutory or regulatory requirement care, custody, treatment, transportation, to conduct background checks of existing State classified or supervision of children. employees, it would have to be collectively bargained as required by the State Employees Labor Relations Act. Recommendation 4. Management’s Comments and Our Evaluation On November 27, 2019, DCF’s Director of Operations provided comments on a draft of this report on behalf of the Commissioner of DCF and AHS. This letter is reprinted in Appendix III. DCF agreed to implement our recommendations but disagreed with one of our findings. Our evaluation of their comment is in Appendix IV. 15 December 16, 2019 14 September 2014 Rpt. No.No. 19-05 Rpt. 13-03 Appendix I Scope and Methodology To address our objectives, we first developed an understanding of the statutes and rules governing the CPR and how and when information from the CPR can be disclosed by reviewing: 1. State statutes, including 33 V.S.A. Chapter 49, Subchapter 2, and 16 V.S.A Chapter 5, Subchapter 4; 2. Rules, such as CVR 13-172-300 Child Protection Registry and Administrative Review Process, CVR 13-172-800 Child Protection Registry, 22 CVR 13-171-004 Child Care Licensing Regulations: Center Based Child Care and Preschool Programs, and CVR 13-172-001 Licensing Regulations for Residential Treatment Programs; 3. Policies, including AHS Hiring Standards and the DAIL Background Check Policy; and 4. Contracts and grants with the DAs, SSAs, PNMIs, PCCs, and ARIS Solutions. We gained an understanding of how CPR checks are requested and processed by reviewing guidance and training materials and by discussions with the CIES director and information technology deputy director who supports DCF. To determine our scope, we obtained from DCF, VDH, DVHA, and DAIL, lists of their state positions that provide care, custody, treatment, transportation, or supervision of children, 23 and the lists of DAs, SSAs, PNMIs, and PCCs. We also decided to include ARIS Solutions in our scope because this organization performs payroll services for employers of personal care workers for certain AHS programs, including some that involve children. We obtained from DCF, data files that contained the organization requesting the CPR check via either electronic or paper requests. These files included the name and other identifying information of the individual being checked, and the result of all CPR checks processed from 2016 to 2018. We imported these files into IDEA, our data analysis software, and assessed their reliability by reviewing the data to ensure that it was reasonable and accorded with the data requested (with appropriate entries in each field and expected ranges of values). 22 23 16 We then obtained the following data files and, after reviewing the data to ensure reasonableness in accordance with our requests, used our data analysis software to compare them to the CPR check files and generate This rule was superseded by CVR 13-172-300 effective March 1, 2019. We also asked the Department of Mental Health, who said they had no such positions. December 16, 2019 14 September 2014 Rpt. No.No. 19-05 Rpt. 13-03 Appendix I Scope and Methodology preliminary lists of employees that appeared to have been hired in 2018 that were not checked to the CPR. We received: • • • From DHR a list of appointments to those positions in 2018. From ARIS a list of employees paid through ARIS who were hired in 2018. From the Department of Taxes, partial details from 2017 and 2018 W2 forms submitted by DAs, SSAs, PNMIs, and PCCs. 24 Analysis of this data may not have identified all new hires in 2018. For example, if a person who was hired in December 2018 had previously worked for the same employer, leaving in January 2017, our analysis of tax data would not identify them as a new hire. For our first objective, we performed detailed test work on grantees and contractors that had relatively high proportions of what appeared to be unchecked hires in 2018. We included examples of all organization types, which were comprised of two DAs, one SSA, four PNMI operators, and four PCCs. Of these, one DA and one PCC also operate PNMIs. From each entity in our Objective 1 scope, we asked for an explanation and evidence as to why a check was not required. 25 An example of evidence provided is job specifications for the individuals not checked against the CPR to evaluate whether the individual was hired into a position that required a check of the CPR. In some cases, organizations provided records of whether individuals had substantiated reports of child abuse or neglect from sources other than the CPR, namely DCF’s Child Development Division (PCCs) or RLSI unit (Woodside Juvenile Rehabilitation Center). Both of these organizations used a DCF system that provides the extract of substantiated records to the CPR. For our second objective, we used CPR data from 2016 to 2018 to calculate the number of checks that resulted in a substantiation for ARIS, DAs, SSAs, PNMIs, and PCCs. For the six contractors with the greatest number of substantiation results, we asked for the reason for each check, the action taken upon receiving the result, whether the person had been hired, and, for those hired, details of their roles. We did not validate the information we received in response to this request except that we confirmed whether the 24 25 17 W2 data was not available for three PCCs. The Department of Taxes stated that this was probably due to their submitting W2 data in paper form. There were instances of contractor or grantee new hires that were not employed in programs under contract to AHS or not under PCC or PNMI contracts. We removed these new hires from our final analysis. December 16, 2019 14 September 2014 Rpt. No.No. 19-05 Rpt. 13-03 Appendix I Scope and Methodology individual was or was not employed by reviewing the W2 records of that organization. We limited our internal control work in this audit to obtaining and reviewing organizations’ policies and procedures pertaining to checking the CPR and reviewing the results. Our field work was conducted between November 2018 and October 2019, primarily at the offices of DCF in Waterbury. We conducted this performance audit in accordance with generally accepted government auditing standards, which require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. 18 December 16, 2019 14 September 2014 Rpt. No.No. 19-05 Rpt. 13-03 Appendix II Abbreviations AHS CIES CPR CVR DA DAIL DCF DHR DVHA PCC PNMI RLSI SAO SSA VDH V.S.A. 19 December 16, 2019 14 September 2014 Agency of Human Services Centralized Intake and Emergency Services Child Protection Registry Code of Vermont Rules Designated Agency Department of Disabilities, Aging and Independent Living Department for Children and Families Department of Human Resources Department of Vermont Health Access Parent Child Center Private Non-Medical Institution Residential Licensing and Special Investigations State Auditor’s Office Specialized Service Agency Vermont Department of Health Vermont Statutes Annotated Rpt. No.No. 19-05 Rpt. 13-03 Appendix III Comments from Management The following is a reprint of management’s response to a draft of this report. Our evaluation of these comments is contained in Appendix IV. Comment 1 20 December 16, 2019 14 September 2014 Rpt. No.No. 19-05 Rpt. 13-03 Appendix III Comments from Management 21 December 16, 2019 14 September 2014 Rpt. No.No. 19-05 Rpt. 13-03 Appendix IV SAO Evaluation of Management’s Comments In accordance with generally accepted government auditing standards, the following table contains our evaluation of management’s comments when they disagreed with our finding. Comment # Management’s Response 1 DCF disagrees with the conclusion that the Child Protection Registry was not checked for six new employees in 2018 at Woodside. … The report notes that DCF has a form for each of the six individuals that is stamped "Child Abuse Registry Cleared". The report concludes that this stamp was contradicted by extract records in the DCF system. During the audit exit interview, DCF explained that there is a screen in the DCF system that a person performing the Child Protection Registry check could utilize that does not leave an electronic footprint. This screen in the DCF system is known as the "590 screen". The fact that each of the six employees has a form stamped "Child Abuse Registry Cleared" in conjunction with the fact that a Registry check could have been done utilizing the 590 screen along with the fact that none of the six employees is on the Child Protection Registry provides a reasonable basis to conclude that a Registry check was performed for these six employees. 22 December 16, 2019 14 September 2014 SAO Evaluation We disagree with DCF’s conclusion. During the audit, we discussed the process used to perform checks for substantiated records of child abuse or neglect for Woodside new hires with the DCF staff member charged with performing the checks during 2018, who has since left State employment, and that person’s supervisor. Neither of these individuals stated that they used the “590 screen” referenced in DCF’s comments. In addition, we inquired about whether DCF contacted the former employee to ask whether she used the “590 screen” and they had not. Accordingly, DCF’s response is speculative and we stand by our conclusion in the report that DCF lacked sufficient evidence that six Woodside new hires were checked. Rpt. No.No. 19-05 Rpt. 13-03