Final Report - Audit of the Public Service Health Program

December 7, 2012

Management Response and Action Plan

Table of Contents

• Executive summary
• A - Introduction
  • 1. Background
  • 2. Audit objective
  • 3. Scope and approach
  • 4. Statement of assurance
• B - Findings, recommendations and management responses
  • 1. Governance
    • 1.1 Mandate
    • 1.2 Roles and responsibilities
  • 2. Risk management
    • 2.1 Program risks
  • 3. Internal control
    • 3.1 Business processes
    • 3.2 Information systems
    • 3.3 Resource management
    • 3.4 Privacy practices
    • 3.5 Monitoring
• C - Conclusion
• Appendix A - Audit criteria
• Appendix B - Scorecard
• Appendix C - Public Service Health Program service delivery - Description of key services

Executive summary

This audit focused on the activities of the Public Service Health Program (PSHP). Health Canada provides occupational health medical advice, guidance and services to departments listed in schedules I and IV of the Financial Administration Act. This includes over 125 departments and agencies representing over 250,000 public servants across Canada. The Program is administered by Health Canada under Occupational Safety and Health Policy delegation from Treasury Board.

The objective of the audit was to assess the management control framework and its operating effectiveness to support the PSHP. The audit was conducted in accordance with the Government of Canada's Policy on Internal Audit and examined sufficient, relevant evidence and obtained sufficient information and explanations to provide a reasonable level of assurance in support of the audit conclusion.

In 2009, Health Canada, in collaboration with the Treasury Board of Canada Secretariat, revised the mandate of the Program to meet departmental funding pressures. While the revised mandate is clear and well understood by program management and staff, the Treasury Board of Canada Secretariat has yet to update the Occupational Safety and Health Policy to reflect Health Canada's revised role.

A comprehensive governance framework is in place to deliver the Program in accordance with its mandate. The PSHP has established adequate committees and working groups to support program management and to leverage information sharing. Roles and responsibilities throughout the Program are clear, well defined and generally understood by its staff. Despite ongoing shortages of medical professionals and administrative staff, the Program succeeds in delivering services to public servants nationally. Management has taken appropriate steps to manage shortages of Occupational Health Medical Officers and administrative staff in some regions.

The Program manages risk informally, but consistently. The Program contributes to the formal branch risk profile, but has yet to implement its own risk management activities at the program level. The audit also noted that regional service delivery processes vary across regional offices and geographical locations. PSHP management is documenting its national service delivery processes and regional variations. The PSHP relies on a collection of siloed and single-purpose systems that do not adequately support the efficient delivery of services or monitoring of the Program. Additionally, some of these systems are no longer supported by their vendors, making modifications difficult and impractical. It would be beneficial for the Program to identify an integrated solution to improve its efficiency and effectiveness.

The PSHP uses external medical service providers to supplement and complement its internal staff. There were 26 vendors with over $10,000 in payments in 2011-12, and 11 vendors with over $25,000. Although formal contracts would normally be required under departmental contracting policy, only one of these vendors had a contract in place.

Regional processes for verifying invoices from external medical service providers vary by region. In two of the three regions visited, this process does not include a review to determine whether invoiced rates for medical services align with provincial rates or other pre-determined acceptable rates.

The PSHP collects extensive personal medical information about federal employees to carry out its delegated occupational health services. The Privacy Act and government privacy policy require the PSHP to meet specific requirements in the storage and handling of this information. Health Canada would benefit from conducting a Privacy Impact Assessment to better understand the Program's privacy exposures and identify appropriate mitigation measures.

The Program has developed draft performance measures however; management notes that tracking key performance measures on an ongoing basis will be difficult without improved information systems.

Overall, the management control framework of the Program is sound, but its operating effectiveness can be further strengthened. Management agrees with the seven recommendations and has provided an action plan to strengthen the management control framework for the PSHP.

A - Introduction

1. Background

Health Canada, under Occupational Safety and Health Policy delegation from Treasury Board since 1970, is tasked with theadministration of the Public Service Health Program (PSHP). Under the program, Health Canada provides occupational health medical advice, guidance and services to departments listed in schedules I and IV of the Financial Administration Act. This includes over 125 departments and agencies representing over 250,000 public servants across Canada. The program falls under the Specialized Health Services activity of Health Canada's Program Activity Architecture, which is managed by the department's Regions and Programs Bureau.

The program's key activities can be classified into three areas: service delivery; support services; and management services. A detailed description of the service delivery component is provided in Appendix C.

Key Services

Service delivery

• Health assessment - Cat I
• Health assessment - Cat II
• Health assessment - Cat III
• Posting assessment
• Return from posting
• Cross posting assessment
• Fitness to work evalutation
• Immunizations
• Travel medicine advice
• OHS and exposure advice

Support Services

• OHN and THN support
• Exposure health assesments
• Workplace/risk assessment
• Information sessions
• Ongoing training
• Communicate diseases
• Laboratory testing

Management and oversight

• HR management
• Financial
• IT Management
• Information management
• Policy/legal issues
• Material management
• Communications
• Travel
• Acquisition

Superannuation services are also provided by PSHP personnel, but these are not considered part of the PSHP. These services are not a part of the authorities granted to the program by the 1987 Cabinet Committee decision, but are provided for under the Public Service Superannuation Act, the Financial Administration Act and a separate Treasury Board submission.

The PSHP is delivered across the country, and overseas, by Occupational Health Medical Officers (doctors employed by the program) herein referred to as Medical Officer, Occupational Health Nurses (nurses employed by the program), technicians, and administrative personnel. The program is also supported by Designated Doctors under direction from PSHP, and receives information from external medical service providers (such as family physicians, medical specialists, and medical laboratories).

Regions and Programs Bureau operates from the British Columbia, Prairie, Ontario, Quebec, and Atlantic regions. PSHP services are delivered from seven regional offices located in the British Columbia/Yukon, Alberta/Northwest Territories, Manitoba/Saskatchewan, Ontario/Nunavut, National Capital Region, Quebec, and Atlantic. Each regional PSHP office is managed by a regional PSHP Manager. Regional PSHP Managers report administratively to Regional Directors General (Regions and Programs Bureau) and receive functional direction from the Director, PSHP (Specialized Health Services Directorate).

For 2012-13, the PSHP projects $14.4M in expenditures. The program is funded mainly through appropriations, with the exception of approximately $680,000 in recovered costs. These recovered costs include payments from Public Works and Government Services Canada related to superannuation services. The National Capital Region has the largest volume of service requests as it has the highest population of federal employees. Atlantic, British Columbia/Yukon and Quebec regions have higher volumes of service relative to the number of federal employees in the region. This is attributable to the number of periodic health evaluations required for region-specific occupations such as Correctional Services Canada and seagoing personnel of the Canadian Coast Guard.

Volume excludes incomplete services where patients missed appointments*

2. Audit objective

The objective of the audit was to assess the management control framework and its operating effectiveness to support the Public Service Health Program.

3. Scope and approach

The audit focused on the activities of the PSHP since April 1, 2010. This included processes related to service delivery and management practices. The audit did not assess the medical decisions of program outputs (for example, health evaluations).

This audit was originally planned in the 2012-15 Multi-Year Risk-Based Audit Plan as the Audit of the Public Service Health Program and the Employee Assistance Program. During the planning phase of the audit, it was determined that the Employee Assistance Program would be excluded from the audit scope. The Employee Assistance Program was experiencing a sharp increase in service demand due to Budget 2012 workforce adjustments in the Public Service, and was not able to devote the necessary time and resources to the audit. The Employee Assistance Program will be addressed in a future audit.

The audit examined the management control framework of the PSHP for compliance with Government of Canada Policy.

The audit criteria, outlined in Appendix A were derived from the Office of the Comptroller General Internal Audit Sector's Audit Criteria Related to the Management Accountability Framework: A Tool for Internal Auditors (March 2011) and the following Treasury Board and Health Canada policies:

• Treasury Board Occupational Safety and Health Policy (1994);
• Treasury Board Common Services Policy (2006);
• Treasury Board Policy on Government Security (2009);
• Treasury Board Privacy Policy Suite (2010); and
• Health Canada's Delegation of Financial Signing Authorities (2010).

The audit was carried out within the Regions and Programs Bureau, and included site visits of regional clinics and offices in Winnipeg, Montreal and Ottawa. Methodologies included: review of documentation, policies, standards, guidelines and frameworks; interviews; testing of controls related to information privacy and analysis.

4. Statement of assurance

In the professional judgment of the Chief Audit Executive, sufficient and appropriate procedures were performed and evidence gathered to support the accuracy of the audit conclusion. The audit findings and conclusion are based on a comparison of the conditions that existed as of the date of the audit, against established criteria that were agreed upon with management. Further, the evidence was gathered in accordance with the Internal Auditing Standards for the Government of Canada and the International Standards for the Professional Practice of Internal Auditing.

B - Findings, recommendations and management responses

1. Governance

1.1 Mandate

Audit criterion: There is an up to date mandate that comprehensively describes the Public Service Health Program.

Mandates define what an organization is formally required to accomplish by external authorities. A clear mandate allows the organization to define clear strategic outcomes and activities that align with its mandate. The alignment of strategic outcomes and activities to the mandate fosters clear expectations and minimizes scope creep within all levels of the program. The mandate of the Public Service Health Program is defined in the Treasury Board Occupational Safety and Health Policy (1994) and the Treasury Board Common Services Policy (2006).

In 2009, Health Canada, in collaboration with the Treasury Board of Canada Secretariat, revised the program to meet departmental funding pressures. The program transitioned to a medical model and eliminated its ergonomics and workplace investigations service lines. The program continued to limit its scope to serve only federal departments and agencies listed in schedules I and IV of the Financial Administration Act, as well as a small number of other organizations through Interdepartmental Letters of Agreement.

The Treasury Board Occupational Health and Safety Policy and Common Services Policy are being reviewed and updated by Treasury Board of Canada Secretariat to reflect the program's revised mandate. The outdated Treasury Board Occupational Safety and Health Policy refers to several services that are no longer delivered by Health Canada. For example the Treasury Board policy notes that Health Canada conducts environmental health investigations and surveys as well as occupational health nursing services in departments yet these are no longer delivered.

In addition to the services that are explicitly delegated to Health Canada in the Treasury Board Occupational Health and Safety Policy, Health Canada reviews medical examinations of government employees who have elected to “buy back” prior service under the Public Service Superannuation Act. As well, the PSHP also reviews medical examinations to recommend retirement on medical grounds under the Public Service Superannuation Act. PSHP articulates its revised mandate in a recently developed draft logic model. It will be important for PSHP to continue to work with the Treasury Board of Canada Secretariat to have the Government of Canada's policy better align with the mandate of the Program.

1.2 Roles and responsibilities

Audit criterion: Roles and responsibilities are understood and carried out by all stakeholders.

Roles and responsibilities of individual positions are outlined in job descriptions. Clear roles and responsibilities provide programs with a structured roadmap of key stakeholder involvement. This clarity in the participation of program stakeholders crystalizes expectations and reduces confusion. Additionally, clear roles and responsibilities are valuable in periods of transformation because they offer structure and consistency which sustains high quality levels of service delivery. Roles and responsibilities of key program committees and working groups are documented in committee terms of reference.

The PSHP has established the following committees and working groups to foster clarity in roles and responsibilities and to leverage information sharing.

The Regional Manager's Working Group meets bi-weekly via teleconference and in-person twice annually, to develop strategies and address operational issues in the delivery of the Public Service Health Program. The Working Group members include the PSHP Director, the National Medical Advisor, Regional Managers from each region, and key headquarters Program Managers.

The Medical Advisory Committee meets in person two to four times a year (depending on demand) to review contentious or difficult medical assessment cases and to provide professional advice to assist Medical Officers in making their assessment decisions. This committee is chaired by the National Medical Advisor and includes at least one PSHP Medical Officer and one contracted external occupational health expert. The latter member provides objective and unbiased input to case discussion.

The Occupational Health Assessment Guide Committee meets in person every three to four months to discuss the latest occupational health and related scientific knowledge, community standards of practice, and hazard identification and risk assessments to ensure the content of the Occupational Health Assessment Guide remains current. Members of the committee include the National Medical Advisor, Director of PSHP, Overseas Medical Advisor, Nursing Advisor, Medical Officer-in-Charge of the National Capital Region Occupational Health Clinic, and Medical Officers from regional offices as available. Also included are representatives of client departments, a contracted external medical expert, and other federal agency representatives.

The Occupational Health Medical Services (OHMS) Managers' Working Group meets monthly via teleconference, and once a year in-person to create, review and update standards, policies, procedures and practices as they relate to nursing and to facilitate a national standardized approach to service delivery. The Working Group includes the National Nursing Advisor and one OHMS manager from each region.

The Fitness to Work Evaluation (FTWE) Client Advisory Group was established in 2011 and meets on a quarterly basis. The FTWE Client Advisory Group serves as a means of maintaining communications with FTWE clients, answering questions regarding the FTWE process, and soliciting feedback on the program's products and performance related to FTWE. Members include representatives of key client departments as well as PSHP staff, including: the National Medical Advisor, the Director PSHP, Regional PSHP Managers, and other senior PSHP Headquarters Managers.

The Occupational Health Medical Officers' Meetings are chaired by the National Medical Advisor and attended by Medical Officers. The Medical Officers meet in person once a year and via teleconference 2-3 times a year. These meetings provide a forum for attendees to discuss and keep abreast of emerging program related medical issues, and to provide advice and direction to Medical Officers regarding their practice. It is also an opportunity for Medical Officers to improve national consistency in service provision where appropriate.

Interviews with program staff and the review of job descriptions revealed that roles and responsibilities are clear and generally well understood.

2. Risk management

2.1 Program risks

Audit criterion: Management identifies, assesses and responds to the risks that may preclude the achievement of its objectives.

Health Canada's Integrated Risk Management Framework defines risk management as "having in place a systematic approach to setting the best course of action under uncertainty by identifying, assessing, understanding, making decisions on and communicating risk issues." Effective risk management equips federal government organizations to respond actively to change and uncertainty by using risk-based information to enable more effective decision-making. Formalizing risk management activities adds rigour to the process of identifying, assessing and mitigating risks. Furthermore, it supports the communication of risk information and prioritization of program activities.

As a result, managers in all areas and levels of the department are encouraged to adopt and adapt the Risk Assessment Tool to assess risks in their respective areas of responsibility, as well as to facilitate the development and integration of their risk profiles across strategic, program and project levels.

The program manages risk informally, but consistently. The program management team is kept apprised of operational risks through regular meetings with program managers, regional managers, Occupational Health Medical Officers, Occupational Health Nurses, and clients. Meeting forums include Occupational Health Medical Officers Meetings, the Regional Managers Working Group, the Occupational Health Assessment Guide Committee, and the Fitness to Work Evaluation Client Advisory Group. PSHPalso contributes to the formal Bureau risk profile, which is reflected in the Integrated Planning and Performance Reporting System, but has yet to implement formal risk management activities at the program level.

PSHP should develop a program risk profile to identify, evaluate, assess and mitigate risk. The program risk profile exercise would benefit PSHP because it encompasses comprehensive considerations of risk types. Additionally, it would assist in prioritizing the program's many ongoing projects related to PSHP's management framework by focusing on completion of the most important projects.

Recommendation 1

It is recommended that the Senior Director General, Regions and Programs Bureau develop a program risk profile.

Management response

3. Internal control

3.1 Business processes

Audit criterion: There are documented business processes that enable consistent national service delivery.

The Specialized Health Services Directorate of the Regions and Programs Bureau is modeling key PSHP business processes and developing a costing framework for program activities. The target date for the completion of this project is Fall 2012. The objective of this exercise is to provide a means for Regions and Programs Bureau managers to:

• Obtain a clear and global view of the business processes of key services and their context, including interdependencies with other processes;
• Identify and eventually determine where and how these processes can be better aligned in order to achieve business goals in a more efficient and effective manner;
• Identify and eventually determine costing and resource implications necessary to develop organizational capacity in a sustainable and optimal manner; and
• Serve as an input for Information Management and Information Technology systems analysis and transformation.

Process variations

The audit examined the Superannuation, Fitness to Work Evaluation and Category II Health Evaluation service delivery processes in detail. The audit revealed that regional business processes used for service delivery vary amongst regional offices or geographical locations. For example, in some cases, PSHP uses designated doctors to perform physical exams in Fitness to Work Evaluations. Although the final assessments and recommendations in Fitness to Work Evaluations are always formulated by PSHP Medical Officers, in some cases designated doctors or other external medical service providers can conduct the initial evaluations (for example, history and physical examination). Procedural activities used in the oversight of these external medical service providers varied across program offices. For example:

• Some regions used formal letters of agreement outlining rates of designated doctors, whereas others did not have any formal agreements in place; and
• Some regions consistently provided designated doctors with Occupational Health Assessment Guide bulletins/revisions/updates, while other regions were inconsistent in this practice.

The variations noted above may increase the risk of inconsistent service delivery. For instance, the Occupational Health Assessment Guide provides guidance to medical professionals on performing occupational health assessments. Adherence to this Guide contributes to consistent service delivery.

In addition, PSHP has documented its service delivery processes at a national level, and work is underway to document regional variations. The PSHP acknowledges that while efforts are underway to standardize regional processes into national processes, there will always be some necessary regional variations in processes.

Information for Decision-Making

The PSHP program leverages information provided through national committee discussions to sustain and/or improve operational effectiveness. In light of regional administrative process variations, the documentation of regional processes would provide managers and medical staff with better information to enrich discussions and make more informed decisions.

Process Consistency

The operations of each region are occasionally supported by staff from another geographical location when operational demand exceeds regional staffing capacity. In such cases, documenting regional office variations in processes can serve as a training tool to help medical staff temporarily allocated to another office better understand local processes. Similarly, it would serve as an effective orientation tool for newly recruited medical professionals and administrative staff. Consequently, the training and awareness provided by documenting regional process variances will help mitigate the risk of inconsistent national service delivery.

The Regions and Programs Bureau is well positioned to comprehensively document PSHP processes and cost their activities. Activities are underway to document and cost national and regional processes. Documenting regional variations will increase the level of precision in the costing model, support the national process standardization exercise, mitigate the risk of inconsistent service delivery and improve information for decision-making.

Recommendation 2

It is recommended that the Senior Director General, Regions and Programs Bureau, document regional processes and standardize as appropriate.

Management response

3.2 Information systems

Audit criterion: Information systems support the business processes of the program.

The PSHP has developed business processes to deliver its key services. In support of these business processes, the program has acquired and developed information systems. The key national systems are:

The Activity Tracking System (ATS) is used to track program activities, such as health evaluations, immunizations, and other services delivered. This information is also used for reporting back to Treasury Board of Canada Secretariat and Public Works and Government Services Canada with respect to superannuation services. This system is used by all regions.

The Immunization Record System (IRS) was used for tracking immunization records. Effective August 7, 2012, no further new records are being entered into the system as it does not comply with provincial nursing standards for medical records. Immunization records in all regions are now tracked using paper-based medical files and various local tracking solutions such as Excel spreadsheets.

The Livelink Records Server (LRS) is the departmental records management application used for controlling corporate information across multiple repositories. Once an official paper file is created, PSHP records the file number and assigns key words into Livelink Records Server in order to track location and life-cycle status (for example, active/dormant) of employee medical files as well as corporate files. This system is used by all regions.

Some regions have also developed systems to address gaps in national systems. These include:

Medgate is a medical scheduling program and is used in one region to track client employee appointments and doctor schedules.

The TB system is used in one region to track results of tuberculosis tests.

The BEST system is a regionally developed tool to track health assessment information for use in case management and statistical analysis. This tool is used in two regions; however these systems are not connected to one another.

PSHP relies on a collection of siloed and single-purpose systems that do not adequately support the efficient delivery of services. They are ageing and generally inadequate for performing their primary functions. Additionally, some of these systems are no longer supported by their vendors, making modifications difficult and impractical. As a result, the program has resorted to maintaining paper-based records which significantly increases administrative burden. Furthermore, the program lacks sufficient and quality data to conduct business analysis to properly support program management functions such as trend analysis, planning/funding allocation, performance measurement and reporting.

Efficiency from Systems

The current information systems that are in place create inefficiencies in business processes. The following are some examples of these inefficiencies:

• Client data must be entered individually in each system. For example, depending on the service provided, each client's personal data must be entered into as many as five systems. This impacts the productivity of both medical and administrative staff and increases likelihood of input errors and data inaccuracies.
• Parallel systems were developed to address various operational gaps and challenges, while data integrity issues have resulted in implementation of local paper-based tracking tools (for example, Excel spreadsheets, etc). Systems are aging and some are no longer supported by their vendors. Modifications are difficult to implement or not feasible, meaning the systems cannot adjust to support evolving business processes.
• Paper files require considerable storage space. Two of three regions visited were exploring alternatives for expanding their file rooms to accommodate their ever growing file storage needs.

Data Mining

An important element of PSHP's mandate is to provide advice to the Treasury Board on Occupational Health and Safety matters. The process for delivery of this service is not adequately supported by existing systems. Current systems do not track health outcomes or other relevant client information (for example, number of clients seen, their occupational groups, etc.) necessary to identify emerging health trends within the federal public service, or to verify/track that employees of departments are accessing PSHP to help prevent workplace illness/injury. This limits PSHP's ability to recommend proactive and preventative health measures.

Data extraction and manipulation is also limited for program performance monitoring. The Activity Tracking System functionality captures very little of the required data to support proper performance measurement for the PSHP. This issue is discussed in greater detail in section 3.5.

The systems do not adequately support PSHP's business processes. It would be beneficial for the program to explore integrated solutions to improve program efficiency and effectiveness.

Recommendation 3

It is recommended that the Senior Director General, Regions and Programs Bureau develop a business case for an integrated solution/information system to support PSHP's business processes.

Management response

3.3 Resource management

Audit criterion: Personnel and contracts/agreements with external medical providers are managed to support Public Service Health Program activities.

The PSHP employs Medical Officers, Occupational Health Nurses, technicians, and administrative staff across the country. The program is also supported by various external medical service providers from across the country. Each regional office employs a combination of these professionals to deliver occupational health services to Public Servants.

Human Resources

The program succeeds in delivering services to Public Servants nationally despite ongoing shortages of medical professionals and administrative staff. Although shortages exist in all regions, recruitment of Medical Officers in Manitoba and the National Capital Region, as well as hiring of administrative staff in the National Capital Region is challenging. Program management has taken appropriate steps to manage these shortage. For example, all final assessments are done by PSHP Medical Officers however, Designated Doctors are sometimes used to increase efficiencies and accessibility (individual employees may choose to be seen by a family physician); screening service requests to verify all required forms have been appropriately completed before assigning the case to a Medical Officer; and staff are reallocated from other regional offices to address backlogs.

The Program employs appropriate personnel to fulfill the critical mandate. Medical staff in the three visited regions possessed valid and up to date licenses to practice medicine or nursing.

The PSHP conducts its human resource planning in the Integrated Planning and Performance Reporting System. This valuable exercise allows the program to identify its future staffing requirements and develop recruitment and staffing strategies.

Contracting Practices

Contracts protect the departments by formally setting expectations and fostering cost-effectiveness. Health Canada's delegation of financial signing authority requires formal contracts based on competitive bidding processes for services over $25,000. Formal contracts are also required for service requirements over $10,000. Although all contracts should be considered for bidding, the department has the authority to set aside the bidding process if the estimated value of the requirement is less than $25,000.

The audit examined PSHP's contracting practices related to external medical service providers. As shown in Table 1, the majority of PSHP's transactions with external medical service providers are for a low dollar value. None of these transactions individually exceeded the $10,000 threshold requiring a contract.

While most of PSHP's transactions are low dollar value, Table 2 illustrates that a relatively small number of vendors (total of 26 in 2011-12 and 29 in 2010-11) each provided $10,000 or more in services to PSHP. Transactions with these vendors totaled $1,008,847 in 2011-12 and $979,368 in 2010-11. Of these transactions, only 1.6 percent (or $16,141) were covered by contracts in 2011-12 and 9.1 percent or $89,170 in 2010-11).

The vendor analysis revealed a spending trend with external medical service providers. For example, in the population of external medical service providers with aggregate annual business with PSHP exceeding $25,000, the majority of these providers had similar levels of revenue from PSHP in 2010-11 and 2011- 12.

Program officials are focused on the delivery of quality services to their clients and typically consider each case an individual and separate transaction. As a result, attention has not been focused on the aggregated value of transactions with preferred vendors. However, PSHP's management practices would benefit from documenting contracting activities to achieve best value and enhance access, fairness and competition.

Recommendation 4

It is recommended that the Senior Director General, Regions and Programs Bureau work in collaboration with the Chief Financial Officer to better document contracting activities in order to align with Health Canada's contracting practices.

Management response

Establishing Fee Schedules

In the absence of formal contracts, it is sound business practice to have pre-determined fee schedules for each region. These schedules would guide PSHP personnel and external medical service providers on acceptable medical fees.

Two of the visited regions documented their arrangements through letters from PSHP Medical Officers to external medical service providers. However, only one of these regions included the fees to be paid for services in their letters. This region's fee schedule was aligned with the provincial fee schedule. The other region did not have a fee schedule or communicate acceptable fees to the external medical service provider in advance of the services being rendered. As a result, the regional account verification process excludes a review to determine whether invoiced rates for medical services align with provincial rates or other pre-determined acceptable rates. Furthermore, the exclusion of this comparison of rates increases the risk of overpaying for medical services in regions that have yet to establish medical rates. The program would benefit from correlating invoiced rates to provincial medical rates as part of the account verification process to minimize the risk of overpayment in regions that have yet to establish medical rates.

Recommendation 5

It is recommended that the Senior Director General Regions and Programs Bureau review invoiced rates during the account verification process to ensure alignment with pre-determined acceptable rates.

Management response

3.4 Privacy Practices

Audit criterion: There are privacy controls in place to safeguard personal information in compliance with policy obligations.

The main statutes governing the management of personal information for the PSHP are the Privacy Act and the Financial Administration Act. The purpose of the Government of Canada's Privacy Act is to protect the privacy of individuals with respect to personal information about themselves held by a government institution and to provide individuals with access to that information. To carry out its occupational health services, the PSHP collects personal information about client employees such as examination reports, test results (for example, vision and hearing), vaccination records, medical specialists' reports and workplace hazards reports. This information is classified Protected B. All personal and medical information is in clients' personal medical files which are kept in secured file rooms at PSHP regional clinics; however, some personal information is duplicated in the information systems described under section 3.2. In accordance with the Retention and Disposition Authority, medical records are kept for a total period of 30 years; 10 years as active records onsite in regional clinics (from the date of the last activity), and an additional 20 years as dormant records in offsite secure storage locations. The program estimates having over 300,000 active client employee medical records in its regional clinics.

The PSHP manages personal information under its control with care and consideration, and employees demonstrated a strong culture of security and confidentiality. For example, national PSHP forms are currently being reviewed and updated in collaboration with departmental privacy and legal experts to ensure that they continue to meet the unique confidentiality requirements and privacy rules of the Federal Government. In addition, as licensed professionals, Occupational Health Nurses and Medical Officers employed by the PSHP have received considerable professional training on general privacy and confidentiality requirements prior to joining the program. However, there are opportunities for improvement in the program's privacy practices related to Personal Information Bank descriptions, conflicting regulations, file retention, technology and consensual transmission of personal information.

Personal Information Banks

Subsection 11(1) of the Privacy Act requires departments to publish and maintain an index of Personal Information Banks. The personal information under the custody of the PSHP is described in InfoSource, Personal Information Banks 701, 702 and 703. The Personal Information Bank descriptions should be updated to provide a more accurate description of the personal information under the custody of PSHP. For example, in the case of posting assessments, health services are provided to client employees and their dependents. However, dependents are not outlined as a class of individuals in Personal Information Banks. The program should include all personal information that has been used in the Personal Information Bank as required by Government of Canada legislation and Treasury Board policy. (See recommendation 6)

Privacy Impact Assessments

Privacy Impact Assessments support departments in establishing privacy practices that comply with legal and policy requirements related to the administration of the  Privacy Act. They promote careful consideration of privacy risks where a department intends to use personal information as part of a decision-making process that directly affects the individual. Furthermore, Privacy Impact Assessments support prudent consideration of privacy risks where a department makes substantial modifications to existing programs or activities where personal information is used.

Occupational health and safety, which includes the PSHP, is considered one of the top four Health Canada Privacy Risks. At Health Canada, all Privacy Impact Assessments are to be approved by the Deputy Minister and sent to the Office of the Privacy Commissioner for review and recommendations. A draft Privacy Impact Assessment was developed for a proposed merger of the Activity Tracking System and Immunization Records System, but the merger was not implemented due to practical and technical concerns.

Conflicting Regulations

Medical Officers and Occupational Health Nurses are licensed by provincial colleges and trained in provincial privacy requirements. As federal employees, they are also bound by federal legislation. This can create challenges for medical professionals, as federal and provincial privacy requirements sometimes differ. For example, under Ontario's regulations, physicians are entitled to assume that they have the patient's implied consent for the purpose of providing (or assisting in providing) health care, except where a patient has expressly withheld consent. In many circumstances, this practice would contradict the sharing provisions of the Privacy Act, where consent is a prerequisite to the disclosure of personal information (except as provisioned in subsection 8(2) of the Act). PSHP management reports that variations in regulations were addressed with staff. However, these variations are excluded from program policy, direction or guidance. In light of contradictions in areas where federal and provincial privacy requirements differ, it would be beneficial to provide formal guidance to medical professionals via PSHP policy instruments.

File Retention Safeguards

The program retains files for all client employees. Information collected and retained is Protected B information. During regional visits, all files were locked up when not in use. All file rooms observed during regional visits were in restricted access areas; however, some files were stored in areas accessible to client employees and/or other departmental personnel. In one region, the PSHP file room was shared with another Health Canada program. While one of the regional offices was in the process of purchasing approved storage cabinets, all three regional offices used locked storage cabinets which do not meet Health Canada standards for Protected B information.

Client Consent

The PSHP developed, in collaboration with legal services, consent forms to protect the privacy rights of client employees. The audit reviewed cases that required the written consent of the client employee. Over 90 per cent of these cases had complete written consent on file. However, for 10 per cent of these cases, there were exceptions that require some improvement. These cases were brought to the program's attention and the program took corrective action.

Technological Safeguards

A review of five national and regional systems containing personal information revealed minimal technical controls to safeguard information. Most systems had unique user names to identify each user. However, approximately half of systems users shared passwords. The majority of systems did not include effective password controls such as requiring new passwords every 90 days or the use of special characters. Furthermore, there were some instances of client employee medical information being disclosed electronically beyond the Health Canada network without the required encryption as per the Health Canada Standard for Handling Protected & Classified Information.

A Privacy Impact Assessment is also a sound risk-based business tool that provides management the flexibility to design an action plan which is both cost effective and realistic to implement. While there is active oversight of privacy practices within the program, the program lacks a Privacy Impact Assessment. In the absence of a Privacy Impact Assessment, the program missed an opportunity to systematically assess and respond to privacy risks. It would be useful for the PSHP to address privacy weaknesses such as up to date Personal Information Bank descriptions by conducting a Privacy Impact Assessment.

Recommendation 6

It is recommended that the Senior Director General, Regions and Programs Bureau, update the program's Personal Information Bank descriptions and complete a Privacy Impact Assessment for the Public Service Health Program, including an assessment of conflicting regulations.

Management response

3.5 Monitoring

Audit criterion: The Public Service Health Program is monitored, including quality assurance of results and program performance.

The program is monitored primarily through regular meetings among headquarters management, regional managers, Medical Officers, Occupational Health Nurses, and clients. These meetings include the Regional Manager's Working Group, Medical Advisory Committee, Occupational Health Assessment Guide Committee, OHMS Manager's Working Group, and the Fitness to Work Evaluation Client Advisory Group.

The program has drafted a logic model to outline program inputs, outputs and outcomes. This logical relationship allows management to establish measures of performance to assess the achievement of objectives. The program has developed a draft Performance Measurement Framework Strategy based on the program's logic model. In addition, the program is developing client satisfaction surveys to extend its measures of performance. However, current plans are to track the majority of performance measures on an annual basis. More frequent, ongoing monitoring would better position the program to proactively address areas for improvement and to inform decision-making. This would be facilitated by integrated and modern information systems.

New PSHP service standards are being developed to establish and communicate service level expectations among clients and program staff. These service standards will be instrumental for setting realistic performance targets. These expectations are being developed collaboratively by key stakeholders such as program management and medical staff, Treasury Board of Canada Secretariat, and clients via a program Client Advisory Group and national Occupational Health and Safety Coordinators. The expected completion date is for Fall 2012 and full implementation by end of fiscal 2012-13.

Two of the three regions visited had implemented some ad-hoc quality control monitoring by conducting administrative reviews of medical files. However, the administrative review did not target activities of all medical staff and were not regularly conducted. By documenting the regional processes and procedures and developing clear directives, the program will attain a more standardized delivery approach and achieve overall administrative consistency and quality between the medical files. (see recommendation 2)

The program is monitored by program officials across the country. The program is moving in the right direction with the performance measurement and system integration and modernization efforts that are underway. The program would benefit from sustaining its efforts to achieve an approved and completed performance measurement framework including service standards and client satisfaction surveys.

Recommendation 7

It is recommended that the Senior Director General, Regions and Programs Bureau finalize the performance measurement strategy framework, including service standards and client satisfaction surveys.

Management response

C - Conclusion

The Public Service Health Program (PSHP) provides occupational health medical advice, guidance and services to over 125 departments and agencies representing over 250,000 public servants across Canada. In 2012-13, the program delivered key occupational health medical services from offices across the country using a budget of $14.4M.

Overall, the program's management control framework is sound, but its operating effectiveness can be further enhanced. Specifically, the program will benefit from profiling its risks, conducting a privacy impact assessment, strengthening internal controls by putting contracts in place with its external medical service providers, improving the account verification and payment processes and implementing service standards and client satisfaction surveys. Finally, a business case should be developed to replace siloed, single-purpose and antiquated systems.

The action plan prepared by management to address the recommendations will also serve to reduce regional variations thereby acquiring greater consistency of service delivery across the country.

Appendix A

Appendix B

Appendix C - Public Service Health Program Service Delivery - Description of Key Services

Occupational Health Evaluation Services

Categories of Occupational Health Evaluations

Category I

A confidential personal health declaration completed by the employee and reviewed by an occupational health professional, who will determine whether follow-up action is necessary (for example, Category II or Category III evaluation). The final assessment whether or not the employee meets occupational health requirements is made by the Health Canada PSHP assessor.

Category II

A confidential health questionnaire completed by the employee, followed by the completion of a full clinical history by an occupational health nurse. Immunizations and tests (for example, tuberculin skin test, audiogram) are provided depending on the type of work, health status and particular occupational hazards identified. If warranted, the employee is referred for a Category III evaluation. The final assessment whether or not the employee meets occupational health requirements is made by the Health Canada PSHP assessor.

Category III

A confidential health questionnaire completed by the employee, followed by the completion of a full clinical history and physical examination by a physician. Immunizations and tests (for example, tuberculin skin test, audiogram) are provided depending on the type of work, health status and particular occupational hazards identified. The final assessment whether or not the employee meets occupational health requirements is made by the Health Canada PSHP assessor.

Additional assessments may be requested at the discretion of the assessor.

Types of Occupational Health Evaluations

Pre-placement

A pre-placement health evaluation is conducted when an individual is to be employed in a specific job that has an inherent element of risk to health and safety and for which certain occupational health requirements need to be met.

Periodic

Periodic health evaluations are conducted on a schedule of one to five years. The schedule is determined by the hazard exposure and the employee's health status and age. The purpose is to determine if employees:

• continue to meet the occupational health requirements of their position;
• are being negatively affected by their work; and/or
• can continue working under the same work conditions without detriment to their health and safety or to that of others.

Pre-posting, Cross-posting and Return-from-posting

Posting-related health evaluations are conducted for employees and their dependants posted to, between and from isolated or foreign posts.

Fitness to Work Evaluations

Fitness to work evaluations are provided at the request of the employer to determine if an employee has been affected by a workplace hazard and/or is medically fit to safely and effectively perform the tasks of a specific job. The evaluations are carried out with the employee's consent and with input from the treating health professional, if applicable. The evaluations are to confirm the employee's health capability to carry out, or continue to carry out the duties of the position and, where warranted, what limitations/restrictions should be considered.

Awareness and Advice

The PSHP may provide advice on occupational health issues related to the Occupational Health Assessment Guide (for example, type and frequency of occupational health medical assessments, occupational health requirements, recommendations for health surveillance of employees with documented hazardous workplace exposures, Fitness to Work Evaluation process, medical accommodation in the workplace), and on emerging occupational health issues.

Group information sessions are also available on the following topics: Introduction to the Occupational Health Assessment Guide, Introduction to the Fitness to Work process, and Overview of the Public Service Health Program Services.

The PSHP Overseas, under the direction of the PSHP, may also provide advice on occupational health-related issues and on emerging events (for example, natural disasters such as tsunamis) which may impact the health of Canada-based staff and their dependants posted overseas.

Communicable Diseases

The management of communicable diseases means the provision of advice, immunizations and screening tests that will assist in enabling an employee to safely perform his/her duties in Canada or in a foreign country where existing living conditions may differ from those in Canada. The PSHP may facilitate access to, or directly provide, the following occupational health-related communicable diseases services.

Screening Tests and Immunizations for Communicable Diseases

Screening tests and immunizations for communicable diseases are normally undertaken at the time of the occupational health evaluation for employees at risk of contact with biologically active organisms in the course of their work (for example, laboratories, diseased animals, endemic regions).

Screening Tests

Screening tests for communicable diseases for employees at risk due to occupation, exposure or location. These requirements are outlined in the Occupational Health Assessment Guide and/or are based on identified risks and hazards.

Depending on the risk and hazard, as assessed by the PHSP, screening tests performed currently include:

• Tuberculosis screening for employees at risk;
• Biological monitoring, such as antibody titres (immunity measurement) including, but not limited to, hepatitis B, brucella, and rabies for employees working with animals, or those working with bacteria and viruses transmissible to and/or between humans; and
• Voluntary HIV testing for employees traveling abroad on government business, if proof of sero-negativity is required for entry or for performing their duties.

Immunizations

Provision of immunizations against communicable diseases for employees at risk due to occupation, exposure or location. These requirements are outlined in the Occupational Health Assessment Guide and/or are based on identified risks and hazards.

Depending on the workplace hazards and work locations, as well as the age of the recipients (in the case of dependants), immunizations are currently provided against a wide variety of infectious agents. Prophylactic medication is also provided as needed.

Awareness and Advice for Communicable Diseases

Information Sessions

The PSHP may provide information sessions on communicable diseases for workplaces in which there is an identified occupational risk or in which there has been an occupational exposure. Information sessions on communicable diseases could also be offered to employees who may be exposed to infectious agents when posted overseas.

Advice

The PSHP may issue advisories on specific communicable diseases hazards or emerging health issues (for example, SARS, H1N1) and, upon request from departments, provide immunizations and advice to employees, and their dependants while posted overseas.

In cases of occupational exposure to a communicable disease, the PSHP will ensure follow-up (for example, tuberculosis contact tracing, re-assessment) of employees, and their dependants while posted overseas.

More specifically as part of the PSHP Overseas, travel health services are provided to occupational groups listed in the  Occupational Health Assessment Guide for which overseas travel is indicated (for example, postings). The individual health consultations carried out with employees and their dependants include the following:

• Individual risk assessment;
• Counseling and advice on identified health risks, recommended prevention measures when working or living in hazardous environments, as well as recommended screening tests and immunizations.