• Related story: U-M President Mary Sue Coleman calls 6-month delay in reporting child porn 'serious failure'

Editor's note: The University of Michigan released this timeline of events Friday regarding the discovery of child pornography on a thumb drive left in a university computer. The timeline is reproduced here in its entirety.

The chronology is based on interviews the Office of University Audits conducted. Dates and events are outlined according to the best recollections of those interviewed.

5/23/11 - Monday

• Late in the evening, a female pediatric resident (Female Resident) discovers a USB thumb drive left in a computer in a medical residents’ lounge. In an attempt to identify the owner so that she can return the drive, she opens files on the USB thumb drive and sees the name of a male medicine-pediatric resident (Male Resident) on a document in one of the files. Another file contains a picture of adult pornography; a third contains a photo that she believes may be child pornography. She panics, closes the files, and leaves the residents’ lounge, leaving the USB thumb drive. She goes home for the night.

5/24/11 - Tuesday

• The Female Resident returns to work in the morning and goes back to the residents’ lounge to retrieve the USB thumb drive, but it is gone.
• The Female Resident reports what she saw to the Attending Physician on the same service. The Attending Physician consults with the Chair of the Medical School Department Compliance Officers (Compliance Chair)

University of Michigan Hospital.

University of Michigan Health System photo

• The Compliance Chair contacts the Health System Chief Compliance Officer (Chief Compliance Officer). The Chief Compliance Officer arranges for the Compliance Chair to make a report to the Office of General Counsel (Health System Legal Office), and Hospitals and Health Centers Security and Entrance Services (HHC-Security).
• The Compliance Chair speaks with an attorney from the Health System Legal Office and an HHC-Security Supervisor, and relates the Female Resident’s allegations.
• Within the Health System Legal Office, the attorney assigned to medical staff affairs assumes the lead role in the case (Lead Attorney). The attorney who took the original report continues to assist the Lead Attorney throughout the Health System Legal Office investigation (Assisting Attorney).
• The Attending Physician and the Compliance Chair arrange for the Female Resident to meet with HHC-Security. The Female Resident recounts the information described above (5/23) to the HHC-Security Supervisor and an HHC-Security Officer.
• After the meeting, the Female Resident and the HHC-Security officers go to the residents’ lounge to look at the computer in question.
• The HHC-Security Supervisor contacts a Data Security Analyst in MCIT (Medical Center Information Technology) and requests assistance in analyzing what information can be gathered from the computer hard drive.
• The HHC-Security Supervisor leaves a voicemail for a Department of Public Safety (DPS) Police Sergeant asking whether DPS could provide some forensic assistance with images viewed on a computer from a USB thumb drive. (The phone message to DPS was never returned.).
• The Assisting Attorney sends an e-mail to the Data Security Analyst and the HHC-Security Supervisor. They are advised that their work is confidential and under attorney client privilege. The text of the e-mail can be found in Addendum II.
• The attorneys follow up with a confirming call to the HHC-Security Supervisor.
• The HHC-Security Supervisor told University Audits he did not complete a report to the police because of the e-mail (Addendum II) from the Health System Legal Office that he believed meant he should stop.
• The Data Security Analyst begins providing the attorneys with the May 23/24, 2011, computer records that confirm that the Male Resident in question logged into the computer before and after the reporting Female Resident. There were no other intervening log-ins during that time frame.

5/26/11 - Thursday

• The Health System Legal Office requests a meeting with the Female Resident. Due to scheduling conflicts, the meeting is set for 5/31, and then rescheduled to 6/2.

6/2/11 - Thursday

• The Lead Attorney interviews the Female Resident; the Assisting Attorney could not be there due to scheduling conflicts. The Female Resident leaves the interview crying.
• The Lead Attorney tells the Assisting Attorney that the Female Resident was unsure of her story and what she saw.

On or about 6/2/11

• The attorneys call the Health System Chief Compliance Officer and relay that there is not sufficient evidence to move forward, that the Health System Legal Office’s assessment was that the Female Resident’s story was shaky. The Lead Attorney reports to the Associate Vice President and Deputy General Counsel (Health System Affairs) that there was no evidence and that the case would be closed. The Female Resident texts the Attending Physician to tell her the meeting did not go well. She says the attorney told her the investigation is complete and the claims are unfounded. There was no evidence of child pornography on the computer. The Attending Physician tells the Female Resident she wants to follow up with the attorney, but the Female Resident asks her not to.

6/9/11 - Thursday

• The last day of employment of the Lead Attorney. The attorney’s departure is unrelated to the case.

11/11/11 - Friday evening

• One of the original reporting physicians (Attending Physician) contacts (via phone call) the Risk Management Top Executive who is part of the Office of Clinical Affairs in the Health System. Two recent events caused the Attending Physician to come forward to raise questions about the case:

• She learned that the attorney who had investigated the case in May (Lead Attorney) had left the University.
• The Penn State incident occurred. The Attending Physician expressed concern about the treatment of the Female Resident and the outcome of the May case. The Risk Management Top Executive tells her this is the first time he had heard of the allegations.

11/12/11 - Saturday

• The Risk Management Top Executive meets with the Female Resident who originally found the USB thumb drive.
• The Risk Management Top Executive briefs the Chief Medical Officer for the Health System about the Attending Physician’s phone call and the meeting with the Female Resident.

11/14/11 - Monday

• The Risk Management Top Executive contacts the Deputy General Counsel (Health System Affairs) and shares the Female Resident’s account of the May incident and the Health System Legal Office meeting. The Chief Medical Officer confers with Chair of the Department of Pediatrics and Communicable Diseases (Pediatric Chair), and confirms that the Male Resident will be carefully supervised until appropriate action including precautionary suspension under the Medical Staff Bylaws can take place.
• Efforts were made to schedule a meeting with the Female Resident. It took several days to bring everyone together.

11/17/11 - Thursday

• The Chief Medical Officer, the Director of Pediatric Education, and a Health System Legal Office attorney meet with the Female Resident. She speaks in detail about what she saw on the drive, and they find her account convincing.

11/18/11 - Friday

• The Office of Clinical Affairs and Health System Legal Office make a report to HHC-Security, with the understanding that they will immediately make a report to the Department of Public Safety (University Police-DPS). HHC-Security reports allegations to DPS.
• DPS advises the Office of Clinical Affairs and Health System Legal Office that they will send a detective to begin investigation but then determine that no detective was available until Monday, 11/21/2011.

• DPS conducts investigation: interviewing numerous witnesses, obtaining forensic evidence, and reviewing the case with the Prosecuting Attorney (11/21 - 12/16). Clinical Affairs and others aware of the allegations are asked by DPS not to contact the Male Resident or tell others. They are told not to remove him from service as it would alert him and evidence could be destroyed.
• The Chief Medical Officer reviews the Male Resident’s files, and notes no performance issues or patient complaints. The Chief Medical Officer and department leadership continue active monitoring of the Male Resident.

12/2/11 - Friday

• A warrant to search the Male Resident’s home is issued and executed.
• Chief Medical Officer and Chair of Internal Medicine issues precautionary suspension of the Male Resident’s patient care responsibilities, pending the outcome of the investigation. (Male Resident is a clinical trainee in a joint internal medicine/pediatrics program.)
• President Coleman is notified.

12/3/11 - Saturday

• President Coleman asks the Executive Director of University Audits to conduct an internal review, to determine the underlying control failures that caused the delay, and recommend changes.
• Executive Director of University Audits notifies Regent White, Chair of the Finance, Audit, and Investment Committee of the Board of Regents.

12/16/2011 - Friday

• The Male Resident is arrested by DPS officers. The Executive Committee on Clinical Affairs unanimously voted to summarily suspend the Male Resident’s appointment as a clinical program trainee effective immediately. The University of Michigan Graduate Medical Education Office discharged the Male Resident from his Medicine-Pediatrics residency-training program effective 12/16/2011.

12/17/11 - Saturday

• The Male Resident is arraigned on charges of possession of child pornography.