Audit Report on the Development and Implementation of The Enhanced Syndromic Surveillance Data Capture System by the Department of Health and Mental Hygiene

AUDIT REPORT IN BRIEF

We performed an audit on the development and implementation of the Department of Health and Mental Hygiene’s (the Department) Enhanced Syndromic Surveillance Data Capture System (SSDCS). The system’s primary purpose was to collect data from a variety of sources for monitoring trends in non-specific symptoms of illness and enable the Department to detect disease outbreaks as quickly as possible. Our audit also covered enhancements to the initial system.

The enhanced SSDCS meets the overall goals as stated in the system justification. As developed, the enhanced SSDCS allows for future enhancements and upgrades by being capable of receiving and processing data files from up to 50 different sources. The Department’s two business objectives for the development and implementation of the enhanced SSDCS were to eliminate labor-intensive file handling and administrative tasks performed by Department staff and to provide a secure, reliable file handling and data processing environment.

In addition, the Department complied with the City Charter and §3-06 of the PPB Rules dealing with "Emergency Purchases" when it contracted with Information Builders Inc. (IBI) to develop and upgrade the system. Furthermore, our user satisfaction survey of the system’s seven primary users as of November 27, 2002, found two users were very happy with the system, while the remaining five users were somewhat happy with the system.

We found, however, that:

• data from emergency rooms are still being transmitted through non-secure e-mails,
• testing certificates confirming that system errors were corrected were not provided, and
• an independent quality assurance consultant was not hired.

To address these issues, we recommend that the Department should:

• Ensure that all data are transmitted through secure methods.
• Obtain all acceptance certificates from IBI.
• Meet with system users to assess their needs and to ensure that their concerns are addressed.
• Engage a quality assurance consultant to assist in monitoring and reviewing the development work and any system enhancements or subsequent work on SSDCS, as well as on any future systems development project.