3.0 Audit Results

3.1 Implementation and Effectiveness of the Digitization Process

The audit team noted that during the digitization process, SHRs were securely housed at LAC, RCMP, PSPC, and DND. During transmittal between LAC, the RCMP and PSPC, paper copies of SHRs were shipped securely and tracked throughout the process. Once received by VAC, digitized SHRs are housed in the CSDN and may be used by multiple authorized employees at the same time, which is required when a Veteran has applied for disability benefits for more than one condition.

3.2 Compliance with Processes

A review of business processes and procedures related to the digitization of SHRs indicated that some of the VAC business processes relating to the digitization process need to be updated. For example, the Procedures for Digital Imaging of Service Health Records (SHRs) (February 2011) refers to a unit which no longer exists while the Procedures for Obtaining Service Health Records (September 2014) refers to hard copies of SHRs being held within VAC, which is no longer the case.

3.3 Management Control Framework

Privacy Impact Assessments^{Footnote 3} (PIA) provide decision makers with a logical framework to identify potential privacy issues relating to a given proposal; to forecast the probable impacts associated with issues or non-compliance; and to identify actions and strategies to eliminate or reduce privacy risks.

VAC’s PIA related to digitizing service health records did not reflect the processes in place since 2013 for receiving digitized versions of service and health records through partnerships with LAC, DND, RCMP and PSPC. This issue was brought to the attention of management and, during the approval phase of the audit, an addendum to the PIA on Service Health Records Digital Imaging Initiative was completed that reflects the processes for receiving digitized versions of service health records. The addendum to the PIA did not result in the identification of new privacy risks.

Observations and interviews conducted by the audit team confirmed that employees understand their role and responsibilities. During audit interviews, staff noted that they had access to sufficient policies, procedures, and business processes and this information was available on the Department’s intranet site.

The Director General, Centralized Operations Division, is responsible for VAC’s digitization of service and health records. The Director, Benefit Operations, is responsible for the usage and retention of the information. The Chief, Client Record Operations (CRO), is responsible for the day-to-day receipt of SHRs from external departments.

Authorities, responsibilities and accountabilities relating to the digitization of SHRs are clear and communicated in memoranda of understanding^{Footnote 4} (MOU) between VAC and external partners. The audit team completed an assessment of the agreements related to the digitization of SHRs according to TBS Guideline on Service Agreements and identified the following gaps:

• The MOU with the RCMP does not include procedures related to the disclosure and use of information.
• The MOUs with LAC, RCMP, DND, and PSPC do not refer to service disruption or business continuity plans.
• The MOUs with the RCMP and DND do not include performance measures.
• The four MOUs assessed did not include guidelines on how to proceed if performance targets are not met.
• The MOU with the RCMP does not reflect the current process of digitization of SHRs.

3.4 Quality assurance and performance monitoring

The Chief, CRO, is responsible for quality assurance on the SHRs received from external departments. All digitized SHRs received at VAC from LAC, DND and PSPC are reviewed for accuracy and readability. Any issue regarding scanning quality is reported to the scanning site for corrective action. Through interviews, the audit team learned that PSPC temporarily retains the hard copies of the SHRs on site to support an effective quality assurance process. Once the review for accuracy and readability is completed and no issues are reported, PSPC returns the hard copies to the original holder of the information.

Performance indicators related to the digitization of SHRs are, in most cases, specified in MOUs between VAC and other departments. Within VAC, the Chief, CRO is responsible for the coordination, monitoring and reporting of service level agreements regarding the digitization of SHRs. The audit team noted that various reports regarding the performance level of each digitization site are available and information gathered through interviews and observations indicate that reports are reviewed and steps are taken to rectify any issues regarding performance as required. As shown in Table 1 below, results of the audit team’s analysis of the digitization site’s performance indicated that LAC Gatineau and DND are meeting performance targets, while PSPC missed the target by 4 calendar days.

Source: CSDN – Requests for SHRs from October 2014 to September 2015