The Lemuel Shattuck Hospital

This is a state audit of selected information technology controls at Lemuel Shattuck Hospital in Boston, covering July 1, 2008 through January 31, 2011.

“In accordance with Chapter 11, Section 12, of the General Laws, we performed an audit of selected information technology (IT) related controls at the LSH for the period July 1, 2008 through January 31, 2011.”

Auditors reviewed whether the hospital’s IT environment was controlled well enough to protect systems, equipment, data, and operations that support patient care and hospital work.

“The primary audit objective regarding the examination of IT-related controls was to determine whether the IT environment was sufficiently controlled to support the automated systems and provide reasonable assurance that control objectives would be achieved to support the LSH’s mission.”

Weak key controls could allow people who should not have access to enter sensitive hospital areas, including places with patients, staff, resources, or confidential information.

“As a result, the LSH cannot ensure that only authorized employees have access to areas housing patients, staff, and resources or containing critical and sensitive information.”

For an ordinary Massachusetts resident, this matters because the hospital uses public funds and serves vulnerable patients, so its equipment, records, and secure areas need to be protected and accounted for.

“The LSH received $72.1 million in state funds for fiscal year 2009, $69.7 million for fiscal year 2010, and $69.5 million for fiscal year 2011.”

The hospital had two main problems: it did not reliably track who still had keys, and it did not keep a fully reliable inventory of computer equipment.

“Our audit disclosed that the LSH’s inventory control practices over computer equipment needed to be strengthened to ensure that IT resources would be properly accounted for in the LSH’s system of record for property and equipment.”

The hospital said it had started checking outstanding keys, updating its key database, revising procedures, and tightening equipment tracking; auditors still emphasized ongoing monitoring and annual reconciliation.

“The Facilities Management Department has begun an inventory of all outstanding keys in conjunction with Human Resources and Campus Registration.”

The findings are significant because poor inventory records make it harder for the hospital to know whether computer equipment is missing, misplaced, or properly used.

“The absence of a sufficiently reliable inventory of computer equipment hinders the LSH’s ability to properly account for IT resources, evaluate the allocation of equipment, identify missing equipment, and meet IT configuration objectives.”

A “perpetual inventory record” means a running, up-to-date list of equipment that should show what the hospital owns and where it is.

“Specifically, we determined that adequate controls were not in effect to provide reasonable assurance that a current, accurate, and complete perpetual inventory record of computer equipment was being maintained.”