Management Response and Action Plan (MRAP) Audit of Data Integrity - The Health Information and Claims Processing Services (HICPS) System

Help on accessing alternative formats, such as Portable Document Format (PDF), Microsoft Word and PowerPoint (PPT) files, can be obtained in the alternate format help section.

Audit of Data Integrity - The Health Information and Claims Processing Services (HICPS) System

Recommendations	Management Response: Accept Accept with conditions Reject	Planned Management Actions	Deliverables	Expected Completion Date	Accountability
The Assistant Deputy Minister, First Nations and Inuit Health Branch, should ensure that a senior NIHB officer reviews and approves all transactions where the Approved Professional Fee exceeds the maximum Dental Fee Allowed in the HICPS.	Accept The functionality that allows officers to adjust fees to be paid over the amount normally allowable is related to an operational requirement. The Non-Insured Health Benefits Directorate agrees that the controls are not sufficient around this functionality and will implement measures that allow proper oversight in instances where approved professional fees are being increased by Health Canada officers to address situations where defined NIHB allowable fees cannot cover the actual professional costs due to specific client needs.	Request Regional Program Managers to identify senior officer(s) that may approve dental fee adjustments, when required. Provide guidance to Regional Program Managers, Regional Dental Analysts and Regional Dental Officers regarding situations where allowable professional fees may be increased, and notify them of the procedures for documenting their rationale for the increase to ensure appropriate accountability. Implement new automated controls within the HICPS adjudication system to track instances where adjustments to professional fees are made and allow proper management oversight. Regular management reviews at the regional and national level of the use and application of dental fee adjustments, assuring their accordance with departmental procedures.	Prepare an e-mail requesting that Regional Program Managers identify senior officer(s) who may approve adjustments, and to send the names to the Director, Operations Services & Systems Division (OSSD)	October 30, 2008.	Director Operations Services and System Division (OSSD)
			Retain the list of senior officers approved to make fee adjustments and update as required	On-going	Director OSSD
			Prepare e-mail for Regional Program Managers, Regional Dental Analysts and Regional Dental Officers detailing new procedures	October 2008-	Director BMD
			New automated controls will be implemented within the new HICPS contract, currently under development.	Beginning December 1, 2009*	Director OSSD
			*The new HICPS will be implemented on December 1, 2009. It is expected that these automated controls will be fully operational. Regional NIHB Managers will be required to accumulate a log of events and report them quarterly to the Director OSSD to support certification under Section 34 of the FAA.	March 31, 2010.	Regional Program Managers
			After this date, OSSD will periodically request acceptance of reports from Regional NIHB Manager based on information gathered in the HICPS.	Pre-March 31, 2010	Director OSSD
The Assistant Deputy Minister, First Nations and Inuit Health Branch, should ensure that the activities of all users who have access to HICPS, including access to the database, are periodically monitored. Monitoring should include the activities of NIHB staff at the application level, and of the subcontractor's Database Administrators at the database level.	Accept The Non-Insured Health Benefits Directorate agrees with the recommendation. This issue has been previously identified by the Program and for which new requirements have been built into the Statement of Work (SOW) for the new HICPS currently under development.	During the summer 2008, OSSD will define with the contractor the requirements under the contract for the audit trail functionality.	Define the audit trail functionality with the contractor	Summer 2008.	Director OSSD
		An audit trail built into the new HICPS will allow active monitoring of the transactions and changes made into the system by authorized users.	The new audit trail will be implemented under the new HICPS contract on December 1, 2009. It is expected that these controls will be fully operational	March 31, 2010.	Director OSSD
The Assistant Deputy Minister, First Nations and Inuit Health Branch, should: (a) ensure that all Security Forms are retained at least 3 years (i.e. Policy on Information Management); (b) ensure all Security Request Forms are approved by only authorized staff; and c) ensure all Security Request Forms contain approval signatures of authorized management.	Accept The Non-Insured Health Benefit Directorate agrees with this recommendation and has already taken measures to resolve the problem. A full reconciliation of Health Canada users has been conducted in response to a Privacy Impact Assessment completed by the Program in June 2006 . The reconciliation ensures that only authorized users have access to the current HICPS.	Repatriate the user access control function from the HICPS contractor to Health Canada.	Define specific business requirements in relation to role based user access controls	Summer2008	Director OSSD
		Full re-registration of HICPS users.	All users will be required to complete a new Security Request Form and obtain approval from their Regional NIHB Managers or Headquarters Divisional Directors.	Summer 2009	Director OSSD
		Implementation of the New HICPS	New HICPS service will be implemented	December 1, 2009.	Director OSSD
		Annual reconciliation of User Accounts.	On an annual basis, user accounts will be reconciled under the new contract	On-going starting September 2010.	Director OSSD
The Assistant Deputy Minister, First Nations and Inuit Health Branch, should develop shorter agreed- upon standards with the contractor/sub-contractor required to resolve critical problems.	Accept The Non-Insured Health Benefits Directorate agrees that the timely resolution of adjudication system problems deserves continuous attention. Through negotiations, NIHB has made significant progress in reducing the problem log list and improving the management and resolution of problems under the terms of the contract. The Non-Insured Health Benefits Directorate is not in a position under the terms of the contract established in 1997 to further incent the contractor, and has decided to impose new requirements on the new contractor to implement problem resolution standards. The contractor also has an obligation under the terms of the new contract to ensure these requirements apply to any sub-contractor. To make real progress in the short-term NIHB Directorate has enhanced its efforts at the system-testing stage to reduce the occurrence of error, as well as to continually work with the contractor/prime contractor to identify effective and timely solutions and work-arounds, and to prioritize work according to risk. None of the problems currently being addressed are creating health or financial risks for the department and the log is subject to regular joint review process to prioritize according to risks. Measures have been taken to refine the incident management process and standards under the new HICPS contract and ensure these requirements will apply to any sub contractors.	Require new standards for timely problem resolution for both the prime and all sub-contractors under the new HICPS contract.	Development of the detailed requirements with the contractor related to the Incident Management System and Process	Summer 2008	Director OSSD HICPS Contractor
		Implement the new problem resolution standards.	Clarified definition of a critical problem and a new standard will come into effect upon the implementation of the New Health Information Claims Processing Service	December 2009	Director OSSD HICPS Contractor