Anonymity (Almost) Guaranteed

Ohio University is suspending its anonymous submission system for reporting ethical violations after a request for public records compelled officials to turn over information that they felt could potentially violate the privacy of people cited in unsubstantiated claims.

The system is run by a third-party vendor, EthicsPoint, which supplies similar services to other universities in Ohio and many colleges across the country. Compelled by their boards, nonprofit institutions began putting such systems into place in the wake of the Enron scandal and ensuing Sarbanes-Oxley regulations that apply to public corporations and which many colleges have adopted even though they are not covered by the law. The hope was that universities could encourage employees to come forward -- in this case, via phone or a Web interface -- with evidence of fraud, abuse or other wrongdoing, without risk of retaliation.

Ohio University, in Athens, is subject to the state's broad "Sunshine Laws" -- including the Public Records Act -- which allow for many government records, including those at public universities, to be released upon request. There are specific exceptions -- ongoing investigations, for example, or to protect the identity of children. Ethics hotlines in K-12 public schools are also protected from the laws, as are police tip lines, but not those at universities.

So when Sean Gaffney, who was the editor in chief of the summer edition of The Post, the independent student-run daily paper, filed a request in July for all the reports obtained through EthicsPoint since its inception at Ohio in February 2006, he triggered a series of discussions and evaluations at the university that led officials on Aug. 24 to put a halt to the system until they could determine if additional privacy safeguards were needed. They also contacted the subjects of the reports to warn them that public records containing their names were being released.

"I think it will have a chilling effect on the system unless we make changes to provide people the assurance that they'll be protected, but I also think that we need to do a good job about educating reporters about the type of information that they report," said Kathryn Chambers Gilmore, the university's internal auditor.

The specific problem, Gilmore said, was that the newspaper's request was so broad -- "all documents relating to the EthicsPoint [s]oftware, including case files, contracts and correspondence" -- that it encompassed reports that couldn't be substantiated. The university's counsel and the state attorney general's office concluded that the law still mandated the release of the requested material; only ongoing investigations, and certain data covered by the Family Educational Rights and Privacy Act, were exempted.

Gilmore said that "almost all of [the reports] were unsubstantiated," leading to fears that records requests could result in the dissemination of potentially false accusations against people named in the files -- all the more so because anyone can submit complaints anonymously or without fear of retribution.

But for Gaffney, that was the point. The newspaper filed the request, he said, to evaluate how the system was working for the university. "I wanted to see what the software is being used for -- are they wasting [resources] on unsubstantiated claims?" he explained. "How much of this is frivolous? How much is not? What are the benefits here?"

Gaffney said he assured the university that he wouldn't publish names from unsubstantiated reports, calling it "irresponsible." University officials met with Gaffney after receiving the records request to determine what exactly he was looking for. At that time, Gilmore said, they provided him with summaries of the reports and the printed records, then tried to determine what else he needed.

"I know that Mr. Gaffney said at that time that he understood the ethical implications of the personal types of information that we released to him," Gilmore said, adding that she had a "strong reason to believe that they'll handle that information appropriately. But we were concerned enough" to suspend the program for the time being, she added. The newspaper has a new editor for the fall and hasn't yet published a story based on the records.

For Gaffney, the response was "insulting." "They're concerned that we'll run slanderous stuff about people," he said. "That would not have been OK with me because I don't think it would have been a responsible investigation of this software."

Ohio University isn't the only EthicsPoint client in the state that's confronted a request for public records. The Columbus Dispatch made a similar request to Ohio State University earlier in the year -- although not one that asked for unsubstantiated reports -- and used the information for a story published on Aug. 6, finding that the system had led officials to uncover 19 cases of wrongdoing (out of 169 reports total).

"Certainly we'd be concerned about releasing unsubstantiated claims," said Jim Lynch, the director of media relations at Ohio State.

At Ohio University, Gilmore said, many of the unsubstantiated claims were of a nature she hadn't necessarily predicted: statements of opinion, rather than suspicions of wrongdoing, and complaints about other employees or their work environment. In that way, the ethics hotline had inadvertently become a sort of sounding board for workplace frustrations.

"Where there were problems of morale or there was something that employees didn't understand, there was a place they could go to express their concerns," she said, a development that actually could have helped management respond more effectively.

Whether that will come across in the Post's eventual story is unclear. But Gilmore said there was no question that the system, which costs $8,100 a year, has been worth it. At least two cases of fraud have been uncovered, resulting in reclamations of over $31,000 and the resignation of an associate athletics director over alleged inconsistencies in expense reports. Over 30 reports had been received until the system was suspended.

For now, the university is offering the next best alternative to EthicsPoint for employees with information about possible violations: Gilmore's telephone number. "To protect the identity of a call-in number, callers may use a calling card, call from a pay phone or dial *67 before Gilmore's number," an announcement stated. She does not keep a log of phone calls, although records of incoming calls made without first blocking the identity of the caller could also be subject to public requests, she explained.

Officials are also determining whether and how to approach lawmakers about amending Ohio's public records law to protect subjects in reports that can't be verified. Gilmore said she's also open to restricting the EthicsPoint service to telephone lines only, which might not only curb people's fears about privacy but stem the disinhibition some employees have felt in making anonymous complaints about the workplace environment.

"It's unfortunate that a request to have this information has resulted in a situation that might make people feel less compelled to come forward, because that's not the intention," said Amanda Mayhew, the general counsel at EthicsPoint.

Mayhew said that it isn't possible to separate the names of subjects from the rest of the data in report printouts, so even if universities could legally keep the information out of the public record they'd have to manually redact it.