Audit of the Department of Industrial Accidents
March 23, 2021 · Department of Industrial Accidents · Read the full official report on mass.gov ↗
Published March 23, 2021 Audit covers July 1, 2017 – June 30, 2019 Under Suzanne M. Bump · 2011–2023
source
“DIA did not have adequate logical access controls for its CMS.”
Read the plain-English breakdown
This is a state performance audit of the Massachusetts Department of Industrial Accidents, the agency that handles workers' compensation disputes.
“DIA acts as the court system—the place where disputes regarding benefits are resolved—for workers’ compensation cases.”
Auditors checked whether the agency followed laws and policies for reporting, workers' compensation case handling, opioid-related treatment disputes, flextime, and parking benefits.
“In this performance audit, we determined whether DIA reported all fees, penalties, and continuances to the Workers’ Compensation Advisory Council1 (WCAC) within the timeframes established by Sections 7F and 11 of Chapter 152 of the General Laws and adjudicated workers’ compensation cases in accordance with Sections 10A and 11 of Chapter 152 of the General Laws.”
Delays and missing reports can make it harder to oversee the workers' compensation system and can hurt people waiting for decisions or benefits.
“As a result, cases could become backlogged and individuals could suffer economic losses because of delays in case processing.”
If you are an injured worker, employer, attorney, or taxpayer, this matters because the agency is supposed to move cases on time, track key information, and protect sensitive case data.
“It is also responsible for making sure employers in Massachusetts have workers’ compensation insurance.”
The agency did not report all required fees, penalties, and continuances, did not always meet required case timeframes, and had weaknesses in access controls for its case management system.
“DIA did not always meet its mandated timeframes for completing certain case claim events.”
The auditor recommended that DIA report the missing information, create procedures for reporting and case timing, improve access controls, remove terminated employees' access right away, and formally develop a continuity plan.
“DIA should report attorney fees, insurer penalties, and case continuances to WCAC.”
DIA is the state workers' compensation agency; WCAC is the oversight council; CMS is DIA's case management system; BCP means business continuity plan, a plan for keeping critical work going during disruptions.
“WCAC oversees the workers’ compensation system in Massachusetts.”
What the Auditor checked
- Did not comply Does DIA report all fees and penalties and submit continuances to the Workers’ Compensation Advisory Council (WCAC) within the timeframes established by Sections 7F and 11 of Chapter 152 of the General Laws?
- Did not comply Does DIA ensure that cases are adjudicated in accordance with the timeframes established by Sections 10A and 11 of Chapter 152 of the General Laws?
- Complied Does DIA’s Opioid Alternative Treatment Pathway Program (OATP) fulfill the intended purpose documented on OATP’s website?
- Complied Does DIA administer employee benefits related to flextime in accordance with the Massachusetts Human Resources Division’s “Time and Attendance Policy for 2012 and 2018”?
- Complied Does DIA administer employee benefits related to parking in accordance with the parking guidelines of the Division of Capital Asset Management and Maintenance?
What the Auditor found
Why it matters: WCAC could not accurately monitor penalties, fees assessed against insurers and paid to attorneys, or case continuances.
Standard: Sections 7F and 11 of Chapter 152 of the Massachusetts General Laws ( Section 7F of Chapter 152 of the Massachusetts General Laws; Section 11 of Chapter 152 of the Massachusetts General Laws )
2 recommendations
- DIA should report attorney fees, insurer penalties, and case continuances to WCAC.agency: agreed
- DIA should develop policies and procedures to establish a process for reporting attorney fees, insurer penalties, and case continuances to ensure that this information is reported to WCAC.agency: agreed
Agency response & Auditor reply
Agency: "The DIA will update its practices to ensure that all fees, penalties, and case continuances are included in the data presented to the Advisory Council during the regularly scheduled meetings."
Why it matters: Cases could become backlogged and individuals could suffer economic losses because of delays in case processing.
Standard: Sections 10A and 11 of Chapter 152 of the Massachusetts General Laws ( Section 10A(1–3) of Chapter 152 of the General Laws; Section 11 of Chapter 152 of the General Laws )
1 recommendation
- DIA should develop policies and procedures regarding the completion of single- and group-case claim events to ensure consistency in meeting its timeframes.agency: partially agreed
Agency response & Auditor reply
Agency: "The DIA will continue its efforts to meet the 28-day timeframe specified in the statute."
Why it matters: Insufficient security awareness training may lead to user error and compromise the integrity and security of protected information in DIA’s CMS.
Standard: EOTSS Information Security Risk Management Standard and Executive Order 504 ( Section 6.2.4 of the Executive Office of Technology Services and Security’s “Information Security Risk Management Standard”; Section 6 of Executive Order 504 )
2 recommendations
- DIA should keep security awareness training certificates in employee personnel files.agency: agreed
- DIA should develop a formal process to ensure that security awareness training certificates are collected and retained in each employee’s personnel file.agency: agreed
Agency response & Auditor reply
Agency: "The Department of Industrial Accidents (DIA) will work with EOLWD HR to ensure the security awareness training certificate is included in the personnel file and will retain a copy of the certificate in the DIA’s internal document management system."
Why it matters: Employees could have access to and alter CMS personal information beyond what their job duties require.
Standard: EOTSS Enterprise Access Control Security Standards and Access Management Standard ( Section 2.1 of EOTSS’s “Enterprise Access Control Security Standards”; Section 6.1.4.3 of EOTSS’s “Access Management Standard” )
1 recommendation
- DIA should develop a formal process for recording and maintaining approvals of CMS user access requests.agency: agreed
Agency response & Auditor reply
Agency: "The DIA will not change this practice, as it has been effective in ensuring that employees have only the necessary access required to perform their job functions."
Why it matters: Terminated employees could improperly access claimants’ personal health information and personally identifiable information.
Standard: EOTSS Enterprise Access Control Security Standards ( EOTSS’s “Enterprise Access Control Security Standards” )
1 recommendation
- DIA should revoke employees’ access to its CMS immediately upon termination.agency: agreed
Agency response & Auditor reply
Agency: "During the audit period this practice was 92% effective and a change in process to revoke access is not warranted."
Why it matters: DIA may not be able to ensure timely restoration of mission-critical and essential business functions or train staff sufficiently in recovery efforts for mission-critical applications such as CMS.
Standard: EOTSS Enterprise Information Security Policy and Business Continuity and Disaster Recovery Standard ( Section 14 of EOTSS’s “Enterprise Information Security Policy”; EOTSS’s “Business Continuity and Disaster Recovery Standard” )
1 recommendation
- DIA should formally develop a BCP.agency: already implemented
Agency response & Auditor reply
Agency: "The Department of Industrial Accidents (DIA) has recently implemented a complete Business Continuity Plan (BCP)."
Verified dollar findings
Money the entity was owed but failed to assess or collect - unassessed penalties, underpaid incentives.
Identified dollar findings that do not fall in a named band.
More audits of this entity
Other Office of the State Auditor reports on Department of Industrial Accidents .
-
Audit of Settlement Agreements and Confidentiality Clauses Across Multiple State Agencies - Department of Industrial Accidents (January 28, 2025)State Agency / Office · January 28, 2025 - Department of Industrial Accidents (DIA)-Review of Certain Aspects of the Workers' Compensation SystemState Agency / Office · August 21, 2014