Purpose

To determine if the Health Information Management Department at Stony Brook University Hospital complied with applicable requirements related to procurement and human resources. The audit covers the period June 1, 2003 through June 12, 2013.

Background

Stony Brook University Hospital (Hospital), located in Suffolk County, New York, is Long Island’s premier academic and regional medical center and, with 603 beds, the region’s only tertiary-care center and level 1 trauma center. As part of Stony Brook University, one of the four University Centers of the State University of New York (SUNY), the Hospital’s mission is to provide excellence in patient care, education, research, and community service. In fulfilling its mission, the Hospital is bound by certain federal, State, and SUNY policies and regulations governing, among other issues, electronic patient medical records, service procurement, patients’ privacy rights, and hiring and promotion practices. The Hospital’s Health Information Management Department (Department) is responsible for the collection, storage, and transmission of patient health records to meet the Hospital’s legal, professional, ethical, and administrative requirements. Annually, the Department processes, on average, approximately 132,000 inpatient and outpatient medical records and archives more than 1.5 million records, accounting for roughly 42,000 cartons of stored materials. To manage its responsibilities, the Department utilizes both in-house and outsourced staff.

Key Findings

• The Department has demonstrated a pattern of non-compliance with applicable requirements related to procurement and human resources.
• SK, Inc. (SK) was awarded a contract for medical records storage services that costs approximately $955,000 more than the lowest bid. We found inadequate evidence to support the Hospital’s rejection of the lowest bidder.
• The Hospital does not adequately verify contract payments to SK and, therefore, has limited assurance that such payments are correct. SK was paid about $701,000 for the period April 2010 to December 2012.
• The Department has not properly monitored vendor outsourcing of medical record transcription services to ensure compliance with the “no off-shore outsourcing” contract clause, which is intended to help safeguard the privacy of patient information.
• On multiple occasions, the Hospital engaged in hiring and promotion practices that were not in compliance with requirements. For instance, a Department employee hired at an annual salary of $43,000 was promoted three months later, and received a $17,000 raise, despite not meeting the minimum qualifications for the position. Nine months later, she received another raise of $12,900,

Key Recommendations

• Ensure all employees involved in the procurement process adhere to State and SUNY guidelines.
• Properly monitor the SK contract to ensure the vendor is paid only for services that are necessary and actually rendered, and there are no duplicate billings.
• Ensure key provisions of the Department’s contracts are properly monitored.
• Establish a control environment that cultivates fair and competitive hiring and promotional practices, and complies with the Hospital’s policies such as the Waiver of Recruitment.

Other Related Audits/Reports of Interest

State University of New York Downstate Medical Center: Allegations of Procurement Fraud, Waste and Abuse at State University of New York (2010-S-45)
Office for Technology: Procurement and Contracting Practices (2010-S-71)