Performance Assurance

Health Information Management Module - Annual Review

Internal Audit Branch
378-1-233
Approved by Audit Committee
September 25^th, 2007

PDF

Table of Contents

• Executive Summary
• 1.0 Background
• 2.0 Objective of the Review
• 3.0 Scope and Approach of the Review
• 4.0 Observations
  • 4.1 Project Planning
  • 4.2 Project Governance
  • 4.3 Project Management Framework
• 5.0 Conclusion and Recommendation
• Appendix A - List of Interviews
• Appendix B - Management Action Plan

Executive Summary

Background

This project review has been performed by the Centre for Public Management in conjunction with Internal Audit of Correctional Service Canada (CSC) to respond to Treasury Board Secretariat (TBS) requirements under the Enhanced Management Framework¹. This review covers project management processes in place since the inception of the Health Information Management Module (HIMM)² project, with the objective of identifying lessons learned so far and opportunities for improvement which can be implemented while the project is underway to improve its chances of success.

Presently, the health information management activities within CSC are done manually. The objective of the HIMM project is to implement a commercial off-the-shelf (COTS) solution to effectively manage and share information, facilitating the management of care and the allocation of resources for Health Services. The HIMM project is scheduled to be implemented in 58 sites within CSC by 2010 and TBS has allocated $18 million to CSC for the project.

Conclusions

Overall, we found that sufficient project management mechanisms are in place for the HIMM project, given the limited scope over the past two years and setting aside weaknesses as a result of sharing the Project Management Office (PMO) with the Offender Management System Renewal (OMSR) project. As the project moves into the procurement and implementation phase, an increased focus on project management will be required. A number of initiatives to strengthen project management are already underway.

Senior management has reviewed, and agrees with, the findings contained in the report. The Management Action Plan which addresses the recommendation is included in Appendix B.

1.0 Background

The increased demand on CSC health services due to the aging offender population, high turnover rates and the general poor health of offenders (including a high rate of infectious disease) has resulted in a monumental increase in the amount and type of health related information which must be collected. The automation of offender health information has been recognized as a high priority business need. This system will be supportive of the CSC Health Services business processes by providing a means to efficiently track, monitor, and share health care information on offenders from admission through release back to the community, in an effective, accurate and timely fashion. The module is expected to accommodate all CSC health care providers across 58 sites and will have the capacity to share information with the Offender Management System (OMS) on an as-needed basis.

The Health Information Management Module (HIMM) for CSC would include a basic or core patient medical file (as an information database) to effectively manage and share pertinent medical information between institutions and regions. Over time, as costs permit, additional modules will be added which would enhance the functionality of the information management system.

Presently, the health information management activities within CSC are done manually. The objective of the HIMM project is to implement a commercial off-the-shelf (COTS) solution to effectively manage and share information, facilitating the management of care and the allocation of resources for Health Services.

The HIMM Project formally began in 2005 with the initiation of the Project Definition Phase, which included gathering user requirements and producing a Request for Information (RFI) to identify the COTS available on the market. The project experienced a delay primarily due to the dependency on the selection of the new computing platform (NCP) for CSC. This delay resulted in a project slowdown in the summer of 2006, however the project is currently being ramped up with plans for the Project Procurement and Implementation Phase. This phase includes the procurement of the COTS solution and subsequent implementation by 2010. On June 23^rd 2005, the TB decision identified the Preliminary Project Approval (PPA)⁴ for the HIMM project as:

• HIMM system computing platform at an indicative total cost estimate of $15,992,626; and
• $2,273,000 for project definition.

This review covers the work completed since the inception of the HIMM project and it is being undertaken as required under the Enhanced Management Framework (EMF), with a focus on project management effectiveness. The Centre for Public Management Inc. was contracted by Internal Audit, CSC, to work with Internal Audit staff to complete this review.

2.0 Objective of the Review

The review was carried out with the following objective:

To assess the project management processes that are being used to implement the HIMM system and provide recommendations to be incorporated for the remainder of the project to assist in its successful completion.

3.0 Scope and Approach of the Review

This review covers the project management mechanisms and processes from inception of the project in April 2005 to March 31, 2007. Where applicable we have noted improvements which have been implemented subsequent to March 31st, 2007.

As part of the review, we examined key aspects of the management of large IT projects, including:

• Project planning;
• Project governance; and
• Project management capacity

The review began in April 2007, and we carried out our examination from April to June 2007. This work involved:

• Interviews,
• Documentation review,
• Reviewing project management practices against those of recognized organizations such as the Project Management Institute's Project Management Body of Knowledge (PMBOK) and the IT Governance Institute's Control Objectives for Information and related Technology (COBiT); and,
• Detailed examination of selected project management processes.

As part of the review we performed 9 interviews of HIMM project members and key stakeholders (See Appendix A for a list of interviewees). The team also examined supporting documentation to determine whether specific processes or controls were in place.

4.0 Observations

4.1 Project Planning

In the context of project planning, the team reviewed the business case and the project charter. A business case is a structured proposal which identifies the costs, benefits risks and approach for an improvement initiative. The project charter is a contract between the project and the client, and is used as a method of communication to project stakeholders. Both of these documents are normally prepared at the outset of the project, with the business case prepared in order to secure project approval and the project charter prepared to map out the project activities.

4.1.1 Business Case

Under project planning, we expected to find that the HIMM project team had developed a business case that was comprehensive and complete, and which identified and justified the HIMM project and indicated how it related to CSC and government-wide priorities. At a minimum a business case should identify:

• the opportunities for improvement;
• the benefits of such an undertaking;
• the technical solution at a high-level;
• indicators against which to measure any improvement in program performance;
• costs (up-front, direct ongoing, indirect and potential user/client costs); and
• the risks and steps to be taken to manage those risks.

The team found that the HIMM business case (in the form of a presentation deck dated January 30, 2003) covered the opportunities for improvement, qualitative benefits, technical solution (e.g. COTS solution) and costs. It did not provide quantified savings, performance measures or the project risks. The risks that were presented related to those faced if the project did not go ahead.

4.1.2 Project Charter

We found that the HIMM project team has a project charter which defines the scope of the project. It also sets out the overall project management framework and standards to be used. The project charter also clearly defines who the internal and external stakeholders are, describes roles and responsibilities for the members of the project team and establishes the overall project governance structure. Furthermore, we found that the project charter has set out the timeframes, deliverables and financial commitments for the project.

4.2 Project Governance

We expected to find that a steering committee had been established and was operating and, in particular, that individuals at the appropriate levels had been identified and were participating on the committee. We found that, similar to the governance structure for the OMSR project, the steering committee for this project is the Information Management and Technology Committee (IMTC). The committee is made up of permanent and rotating members and chaired by the Assistant Commissioner, Corporate Services (CIO)⁵. Meeting on a quarterly basis, the IMTC mandate is to serve as a key focal point for information management/information technology/technology issues of concern to CSC. As such, the HIMM project was just one aspect of this committee's mandate. The next level of governance is the weekly manager's meeting, which is an operational meeting chaired by the Director General of Information Management Services. We noted that there were regular informal communications between the DG IMS, CIO and DG of Health Services.

Over the life of the project, there have been five project managers in the IMIT division. This resulted in a lack of consistent project management methods and styles. However, the project leader position has recently been staffed on a permanent basis.

4.3 Project Management Framework

The objective was to assess the soundness of project management processes in place and their contribution to the project's success by ensuring that an effective management control framework existed. The project management processes that we examined as part of this review included the following areas: project planning, tracking and control; risk and issue management; internal and external training and communication; project management capacity; and, project management office.

4.3.1 Project Planning, tracking and control

The project has maintained a detailed plan. With the procurement and implementation phase of the project, the project is being planned in conjunction with the OMSR continued implementation. This joint plan facilitates the sharing of human resources across the projects in order to provide the necessary expertise in a timely fashion. In addition, a project control officer position is being planned for the HIMM project.

The financial information provided by the Comptroller's branch indicates that the costs to date for the HIMM project are $1.67M as noted in Table 1 below:

Table 1
HIMM costs to March 31st, 2007

2004-2005	2005-2006	2006-2007	Total
$243 061	$680 997	$745 313	$1 669 371

The audit team noted that the expenditures increased from 2005-2006 to 2006-2007, even though the project experienced a slow down in the summer of 2006 related to the dependency on the selection of the new computing platform (NCP) for CSC. Further enquiries revealed that final costs were lower than originally forecasted for 2006-2007, as most resources were reassigned within OMS, IMS or Health Services once the delay became evident.

4.3.2 Risk and Issue Management

Risks were identified in the project charter, PPA and EPA. In addition, a risk register was maintained over the period under review, although use of the register varied with the five project managers. The current team leader plans to bolster the risk register on a going forward basis.

Some of the key risks identified in the project charter, including training, conversion and change management, have not yet been resolved. However, there is still time to resolve these issues as the project progresses.

4.3.3 Internal and External Training and Communication

Historically, Health Services activities have been documented using a paper based system, and the end users have had limited access to computers. The implementation of the HIMM will create a change in the way Health Care staff do their day to day work. This is why training becomes such an important part the HIMM project's success.

The most significant project risks identified in the HIMM project documentation are related to change management. The scope of the project includes training trainers (commonly called a “Train the Trainer” approach), but specifically excludes the training of end-users. This approach was used for the OMSR project with success; however there are a number of key differences between OMSR and HIMM which indicate a different approach is warranted, including:

• The OMSR users were familiar with computers, having used the legacy OMSR system, while the HIMM users are moving from pen and paper.
• There was an OMSR representative in each institution to provide support and training. This structure does not exist with HIMM.

Although there is a large dependency on end-user training for the success of the project, there are no plans on how this will be achieved. End user training does appear on the project plan, but there is no accountability within the plan on how it will be coordinated and delivered.

The train the trainer approach is not the issue with HIMM, since it is an effective training methodology. Our point is that the ultimate trainers and training schedule should be under the control and direction of the HIMM project.

Another issue that was raised in our interviews was access by the project team to the business. Under the current governance structure, access by the project team (including the business representatives on the project team) to members of Health Services is handled via the Director General of IMS, who coordinates with the Director General of Health Services. Normally, when business representatives are placed on a project team, they maintain their accountability to the business. This ensures that their network remains intact and the interests of the business are incorporated in the solution. In this case, the business members report to IMS, and the governance structure does not encourage them to utilize or maintain their network. This, coupled with the lack of a project steering committee, increases the risk of a disconnect between the business and the project.

4.3.4 Project Management Capacity

As noted previously, the HIMM project has had five project managers over its life. This lack of consistency and continuity impacted the project management capacity of the project. Currently a project leader has been appointed, and the Deputy Director General acts as the project manager. Based on our interviews the longer term plan is to appoint a full time project manager once the workload warrants it.

4.3.5 Project Management Office

The HIMM project has used the OMSR project office. There were a number of recommendations made to improve the function of the PMO in the OMSR Project Closure Review. These improvements are equally applicable to HIMM and are repeated here.

5.0 Conclusion and Recommendation

Overall, we found that sufficient project management mechanisms are in place for the HIMM project, given the limited scope over the past two years and setting aside weaknesses as a result of sharing the Project Management Office (PMO) with the OMSR project. As the project moves into the procurement and implementation phase, an increased focus on project management will be required. A number of initiatives to strengthen project management are already underway.

Appendix A: List of Interviews

Appendix B: Management Action Plan