by Staff Report
HARTFORD, CT — The state Department of Public Health compromised patients’ private information during the COVID-19 pandemic by forwarding emails to contact tracers’ personal accounts, a recent audit found.
The department also didn’t update and maintain information in the Core-CT Asset Management module for several years, waited to disable system access for some employees who left for more than two years, failed to provide 22 statutorily required reports and failed to provide supporting documents for 10 exempt employees who earned overtime totaling $5,323, the audit said.
The audit, conducted by the Auditors of Public Accounts, included but was not limited to the fiscal years ending June 30, 2022, and 2023. In total, auditors noted 14 deficiencies and recommended the department strengthen internal controls, strictly terminate employee access to all systems immediately upon separation and implement an effective centralized system to track its statutory reporting requirements.
Because DPH did not effectively monitor or enforce compliance with its confidential and protected health information policy, it was not aware that a contractor used unapproved communication methods when doing COVID contact tracing, auditors said.
The department in its audit response said it agreed with the finding and will ensure staff members periodically review contractor work for compliance going forward. It will also provide training and instruction on how to comply, if needed, it said.
A lack of managerial oversight contributed to the overtime issue, auditors noted, leading to unnecessary expenditures. In total, the department paid more than $2.2 million in overtime during the audited period, but only 89 hours of overtime was flagged during the audit.
“Payroll has recently implemented new procedures where overtime hours are reviewed and compared against the terms and conditions of applicable union contracts,” DPH said in its response. “DPH believes these new procedures will prevent exempt employees from charging overtime hours without proper executive approval.”
The department said it would create a tracking log to ensure statutorily required reports are submitted. It also said human resources, payroll and other involved units are improving workflows and developing policies for security permissions when an employee is hired, fired or transferred.