IT Audit: Mater Dei Hospital

The National Audit Office (NAO) has issued an audit report on the overall operational effectiveness of the Information Technology (IT) and Information Systems currently being used at the Mater Dei Hospital (MDH).

The principal aim of this report was to collect and analyse evidence to determine whether MDH has the necessary controls in place to ensure that their IT and Information Systems maintain data integrity, safeguard assets, allow organisational goals to be achieved effectively and assist in making efficient use of the Government IT related resources.

During this audit, the NAO reviewed 14 software applications presently used by the Hospital as well as the entity’s website and Facebook page. This report includes a number of key findings and recommendations related to, amongst others, the:
• need to decommission one of the servers at MDH, which hosts the stock control software application that caters for the Sir Anthony Mamo Oncology Centre and the Pharmacy, Stores and Materials, Management and Logistics departments at the MDH, and migrate this to MITA’s Segregated Hosted Environment;
• complete extraction of all relevant data from the previous Patient Administration System to update the current Clinical Patient Administration System (CPAS), in view of the latter’s relevance since this is integrated with various other software applications;
• reactivation of the payroll system’s audit trail functionality and review of this system, so as to increase automation in the payroll process and reduce dependence on manual input and manual processing by the end users; and
• development of an IT strategy which promotes further integration of IT software applications within MDH such as the integration of the Day Care Unit software application with CPAS.

Furthermore, the NAO examined the IT operations at MDH and made recommendations regarding the need to develop an internal policy for the secure disposal of devices which may contain confidential data, and implement necessary controls to ensure greater adherence with Government Password policies in some of the systems. In this report NAO also recommended that users are given clear guidelines on the management of offline e-mail boxes.

NAO also noted that MDH officials had drafted a number of standard operating and downtime procedures for various software applications. NAO commends this initiative and recommended that similar procedures are drafted for the remaining software applications.