The Comptroller of Puerto Rico issued a qualified opinion of the operations of the computerized information systems of the Medical Services Administration of Puerto Rico (ASEM) of the Department of Health. A qualified opinion is issued when the instances of noncompliance, individually or in the aggregate, are significant but not pervasive.
The Report reveals that ASEM disbursed $1,681,841 for services rendered without written contracts. These payments for support and maintenance services for the Meditech system, between March and June 2019, and between July 2020 and February 2022, were made outside the contract. The Meditech system handles the financial, clinical and administrative information of ASEM.
The five-finding audit notes that as of June 24, 2022, the implementation of the modules and interfaces that allow notifying the Department of Health of the information on the procedures that the patient received during the hospital visit continued in the process of implementation and evaluation. ASEM had already paid 90% of this contract executed on August 31, 2017, for $2,924,635. This situation could put at risk the obtaining of federal Medicare and Medicaid funds, and it is exposed to receiving fines for not complying with the full implementation of the modules.
The auditors also detected that the institutions benefited from the “Scanning and Archiving” module of the Meditech system, the Pediatric Hospital, the Adult University Hospital, and ASEM, had taken up to 15 months to use this module since it was completed in November 2020. Since then the contracted company billed the support and maintenance services. This situation had the effect of investing $88,722, which was not of use, nor did it redound in benefit of the public interest.
The Report publishes that the IT Risk Assessment Report did not include an inventory of the main equipment of the information systems, or the management's conclusion regarding the risk assessment or the evidence that it had been approved. In addition, for the audited period, the Business Continuity Strategy did not contain information required in the Guides of the Federal Information Systems Controls Audit Manual (FISCAM) issued by the Government Auditing Standards (GAO). On March 30, 2023, the Executive Director provided to the Comptroller of Puerto Rico the Contingency Plan and the Disaster Recovery Plan, both approved in March 2023. 81% of the invoices examined, from a sample of those paid more than five years after their issuance, contained incorrect dates. The Report of invoices in the “AP Accounts Payable” module of the Meditech system had a total of 78,957 invoices recorded from 2017 to 2022. This situation of incorrect dates on the invoices affects the integrity and detracts from the reliability of the data contained in the module.
Audit Report OC-24-19 can be obtained on our website: www.ocpr.gov.pr.
Some documents on this page are saved in PDF format.
To view these documents, you must have the following free program installed.
