The administrative offices at Central Valley Hospital were mercifully separate from the building that housed the doctors, nurses, and clinical operations. Families with sick children didn’t venture into this part of the building, where bean counters billed insurance carriers and shattered lives were reflected as numbers on a spreadsheet.
Steps from the elevator doors, a reception counter blocked access to the offices and the community of cubicles that lay beyond. John and Paula approached the unattended counter where a note taped to the surface directed people to use the phone on the reception desk to contact employees.
John grabbed the phone and scanned the employee directory for Trisha Woods. He tapped in her extension. “Miss Woods? John Penley and Paula Newberry here.”
He listened for a moment, hung up, and heard an electric lock release the short half door set within the counter. The detectives wandered through a maze of light-blue cubicle walls to a back-corner office marked with a small plaque that identified it as the office of Trisha Woods, IT manager.
Trisha sat at a desk and faced a bank of computer monitors that threatened to encircle her work space. Lines, charts, and numbers streamed enough data to overload the senses of a NASA flight controller. She swiveled around in her chair, and her expression softened when she saw John.
“How’s Tommy holding up?” she asked.
“Tommy’s asking questions a kid his age shouldn’t have to think about.”
“It will happen for him.”
“I hope so. This is my partner, Detective Paula Newberry.”
Trisha stood and shook Paula’s hand with an unexpectedly firm grip. She was a fraction of an inch over five feet tall but exuded a larger presence through her demeanor and confidence. “So, Dr. Kelly gave me a rundown on what you’re looking for. The organ-sharing network, right?”
“We’re pursuing an angle that our suspect could be using UNOS as a shopping list. He finds out who needs a transplant and goes hunting for a match,” John said.
“That’s a gruesome theory,” Trisha said.
Paula asked, “Who has access to that kind of data?”
Trisha gestured the detectives to a small sofa. “The system operates on a private network. All patient data are encrypted, and access is restricted from the outside. No remote access. The system is password protected, and only authorized users have access to the medical information and patient data.”
“How many users are there?” John asked as he moved a stack of files and parked on the sofa.
“Nationally, I’m not certain. At this transplant center, we have three categories of users, each with different levels of permissions within the system. We have users with ‘read-only’ permission, but most have full access to enter and edit data, and only a few superusers need access to all the code and software for reports or maintenance. Total, we have less than fifty people with access to the system.”
“If I have access to UNOS, and I need to move a patient up or down on the waiting list for transplant, how do I manipulate the system?” John asked.
Trisha paused before she spoke, not certain how John would take her answer. “Strictly speaking, moving patients up and down on the wait list isn’t manipulation. When the medical condition of one patient or another changes, so does the waiting list. The list doesn’t look the same from one day to the next.”
“I understand that, Trisha, believe me.”
Trisha got the unspoken reference to the detective’s son and nodded.
“What my partner and I are trying to get at is, can I move people up on the waiting list when there is no legitimate medical reason for a change?” Paula asked.
“Well, yes you could, but why would you?”
“If I have an organ to market, I’d want to get it to the person who paid me,” John said.
Trisha’s brow furrowed. “I see what you’re saying, but it’s not that simple. The transplantable organ would have to be acquired, tissue typed and cross matched, then entered into the system. Then, according to your premise, someone would change the UNOS wait list to match it to the donor.”
Paula asked, “So what you’re saying is that it can be done?”
“Well, yes, in theory,” Trisha said.
“Who can make that kind of change in the system? I gather that it would be someone with full access to edit data?”
“Right. Each transplant center has a core set of personnel who do that kind of work. For example, at this hospital, there are two superusers, me and my deputy IT director. Then the regular permissions include the transplant team and their staff. Less than two dozen people total.”
“That narrows it down a bit,” Paula said.
“Can you give us a list of that UNOS user group?” John asked.
“I will check with the hospital administrator, but I don’t see any problem getting that for you.”
“Thanks. Is there any way to show changes in the waiting list and who made the change?” John said as he got up from the sofa.
“I can prepare a report without patient data that will show all transactions, who made changes on the waiting list, when new patients were added, and when they came off the list.”
“How about just changes over the last six months?”
“No problem.”
“Okay, how about patient-specific data?” John pressed.
“Release of patient data is restricted. I can’t give that to you without a court order or consent, of course,” Trisha said.
“What if the patient is my son?”