View Audit Report

According to an audit released today by New York City Comptroller William C. Thompson, Jr., the Department of Health and Mental Hygiene has successfully enhanced its electronic Syndromic Surveillance Data Capture System (SSDCS). The SSDCS was created to collect data from a variety of sources to monitor trends in non-specific symptoms of illness and enable the agency to detect disease outbreaks as quickly as possible.

“In response to the tragic events of September 11, 2001 and the threat of anthrax transmission, the Department of Health and Mental Hygiene has prudently upgraded its ability to collect and monitor rapidly the critical data needed to detect the outbreak of disease in the City,” Comptroller Thompson said. “Unfortunately, the threat of both natural and terrorist initiated disease transmission is a reality in these uncertain times in which we live. The agency’s enhanced system makes the City a safer place to be.”

The original SSDCS system, which was developed in 1998, collected only Emergency Medical Service dispatch data. The enhanced system also receives data from the emergency rooms of 39 public and private hospitals and lab results from the New York State Department of Health. In addition, the updated system receives daily worker absenteeism data from a large City agency and daily pharmacy sales data from a large pharmacy chain.

The audit of SSDCS was conducted from September 2002 through January 2003. Auditors reviewed and analyzed the agency’s contract with IBI (the vendor) to design and develop secure data transmissions from emergency rooms to SSDCS. Additionally, reviews were made of the project plan, functional design and user acceptance plan. Interviews were also conducted with officials in the department to determine how the enhanced system is used and a user satisfaction survey was also conducted.

Although the audit found that the enhanced SSDCS meets the overall goals as stated in the system justification, some areas were in need of improvement. The Comptroller’s Office found that some data from emergency rooms are still being transmitted through non-secure e-mails and testing certificates confirming that system errors were corrected were not provided. Auditors also found that an independent quality assurance consultant was not hired as required by Comptroller’s Directive 18.

Thompson recommended that the agency: ensure that all data are transmitted through secure methods; obtain all acceptance certificates from IBI; and, meet with system users to assess their needs and to ensure that their concerns are addressed.

In response, the agency stated that it “continues to work with our partners to encourage the use of secure data transfer methods, and will require their use for confidential data exchange….DOHMH agrees that the utilization of an independent quality assurance consultant should be incorporated into project planning for certain projects, and will evaluate the benefit of using a QA consultant for future development work.” The agency agreed with the remaining recommendations.

# # #