Seal of the Commonwealth of Massachusetts
Massachusetts Audit Explorer - what the State Auditor found

← all audits

Audit of the Department of Mental Health

August 1, 2019 · Department of Mental Health · Read the full official report on mass.gov ↗

Published August 1, 2019 Audit covers July 1, 2016 – September 30, 2018 Under Suzanne M. Bump · 2011–2023

In plain English
The audit found two main problems: some patients who were ready to leave state psychiatric hospitals were not moved to less restrictive settings quickly enough, and some former employees kept access to a sensitive mental health records system too long.
source
“DMH did not effectively manage the discharge of some clients from its psychiatric hospitals to less restrictive community-based settings.”
Read the plain-English breakdown
What is this?

This is a Massachusetts State Auditor performance audit of the Department of Mental Health, covering July 1, 2016 through September 30, 2018.

“This report details the audit objective, scope, methodology, findings, and recommendations for the audit period, July 1, 2016 through September 30, 2018.”
Why was it audited?

Auditors looked at whether clinically stable patients were being discharged on time to less restrictive places, such as community-based settings.

“In this performance audit, we examined DMH’s protocols for the discharge of clients from DMH-funded state psychiatric hospitals.”
Why it matters

Delays can hurt patients and also keep scarce hospital beds from people who need them.

“Not ensuring that all clients who are ready for discharge are placed in a timely manner may negatively affect clients’ mental health and may deprive other clients of the opportunity to be placed in DMH facilities.”
What's in it for me?

If you or someone you care about needs state mental health services, this matters because timely discharge and secure records affect patient care, privacy, and access to limited beds.

“As a result, there is an increased risk of terminated employees improperly accessing and/or altering personal information in MHIS, such as clients’ names, addresses, dates of birth, and medical records.”
The bottom line

The Auditor concluded DMH needed better tracking and controls for discharge planning, and better controls for shutting off former employees’ system access.

“DMH should establish monitoring controls to ensure that anticipated discharge dates are properly recorded or that discharge is as timely as possible.”
Why it's significant

The issue is significant because Massachusetts has far fewer continuing-care psychiatric beds than it used to, and people were already waiting about 79 days for admission during the audit period.

“The reduction of beds over the years raises concerns over bed availability.”
Jargon, unpacked

MHIS means the Mental Health Information System, the database DMH uses for patient records, admissions, discharges, and treatment-plan information.

“MHIS contains all client records, including those of clients who have been admitted to, and discharged from, DMH hospitals.”

What the Auditor checked

What the Auditor found

DMH did not effectively manage some discharges from psychiatric hospitals to less restrictive community-based settings.
recordkeeping/documentationinternal controls

Why it matters: Delayed discharge can negatively affect clients' mental health, limit availability of beds for other clients, and prevent DMH from monitoring and fixing discharge process problems.

Standard: Section 27.09(1)(a), 104 CMR 27.05(4), and 104 CMR 27.11(6), plus facility discharge planning procedures. ( Section 27.09(1)(a) of Title 104 of the Code of Massachusetts Regulations; 104 CMR 27.05(4) and 27.11(6) )

2 recommendations
  • DMH should modify its standard protocol to include identifying and/or modifying the anticipated discharge date in the treatment plan meeting notes as the client approaches discharge.agency: agreed
  • DMH should establish monitoring controls to ensure that anticipated discharge dates are properly recorded or that discharge is as timely as possible.agency: agreed
Agency response & Auditor reply
Agency: "DMH disagrees with the finding that DMH “did not effectively manage the discharge of some clients from its psychiatric hospitals to less restrictive community-based settings.”"
Auditor: "As noted above, our audit showed that in some cases, DMH did not effectively manage the discharge of clients living in its facilities to less restrictive settings."
DMH did not promptly revoke former employees' access to the Mental Health Information System.
cybersecuritydata privacyinternal controls

Why it matters: Untimely access removal increases the risk that former employees could improperly access or alter clients' personal and medical information.

Standard: DMH's Information Security Handbook and the Massachusetts Executive Office of Technology Services and Security Access Management Standard. ( DMH Information Security Handbook )

1 recommendation
  • DMH should establish a formal process for disabling former employees' network access as soon as possible and monitoring controls to ensure the process is followed.agency: agreed
Agency response & Auditor reply
Agency: "The Department agrees with the Audit Finding concerning not revoking the access of 13 former employees to MHIS in a more timely manner."

More audits of this entity

Other Office of the State Auditor reports on Department of Mental Health .

See this entity's page with all 3 audits →