Introduction

1. The Australian Childhood Immunisation Register (ACIR or the Register) is a national record of the immunisation¹ details of children under the age of seven, which serves a number of key public health functions. The Register contains information used for measuring and monitoring national (and regional) immunisation coverage rates for children, and is drawn on to inform parents² and immunisation providers of a child’s current immunisation status and history.³ In addition, information from ACIR is used to confirm a parent’s eligibility for certain family assistance payments, as part of an Australian Government policy to encourage the immunisation of children.⁴

2. Children under the age of seven are automatically entered on the Register once they are enrolled in Medicare. If a child is not enrolled (or not eligible) for Medicare, they are entered on the Register once ACIR receives details of their first immunisation by a provider. As at 28 February 2015, some 2 263 857 children were registered on ACIR.

3. The Register is administered by the Department of Human Services (Human Services). Section 46B of the Health Insurance Act 1973 (the Act) requires the Chief Executive Medicare⁵ to establish and keep ACIR. The Act also requires the Chief Executive Medicare to make payments to recognised immunisation providers who notify ACIR that they have immunised children in accordance with the national vaccination schedule. The Department of Health (Health) is responsible for the overall management of ACIR in the context of the National Immunisation Program (NIP) agreed by Australian Governments.⁶

4. A Business Agreement (the Agreement) between Health and Human Services documents key aspects of Human Services’ day-to-day administration of the Register, including: collecting and recording immunisation information; calculating and making payments to providers; operating ACIR-related telephony and processing services; and providing information on immunisations to parents, providers and other third parties.

Key immunisation trends

5. Vaccination against disease is an important public health intervention. Vaccination programs not only aim to protect individuals from illness (or even death) associated with vaccine preventable diseases, but are also intended to increase the level of immunity in the population⁷, thereby protecting those that are not immunised or cannot be immunised. National surveys in the late 1980s suggested that only about 53 per cent of Australian children were adequately immunised and there was room for improvement in the effectiveness of childhood immunisation programs. At present, national immunisation levels for the three key cohorts of children are just over 90 per cent, as illustrated in Figure S.1.⁸

Figure S.1: Percentage of fully immunised children for the period 1999 to 2014

 

 

Source: Department of Health, Immunise Australia website.

Note: Cohort 1 includes children aged 12 to 15 months; Cohort 2 includes those aged 24 to 27 months; and Cohort 3 includes children aged 60 to 63 months. Complete figures for Cohort 3 were not recorded in ACIR between 1999 and 2004.

6. To maintain protection for infants and children who are unable to be immunised, the Australian Government announced in April 2015 that it will take additional measures to promote childhood vaccination. From 1 January 2016, immunisation requirements for the payment of Family Tax Benefit (FTB) Part A supplement will be extended to include ‘children of all ages’.^{9 10} In addition, parents will no longer be able to claim an exemption from immunisation for their child—on religious grounds or on the basis of a conscientious objection—and still receive Child Care Benefit, Child Care Rebate, and FTB Part A supplement.¹¹ As summarised in Figure S.2, the number of children with a conscientious objection to immunisation recorded on the Register has increased steadily, with the number more than doubling in the past 10 years.^{12 13}

Figure S.2: Number of children with a conscientious objection recorded on the Register

 

 

Source: Department of Health, Immunise Australia website.

Note: Conscientious objection statistics are for a point in time, as new children are continually being added to ACIR, and records for children over the age of seven become inactive. Current policy requires parents to register their conscientious objection to immunisation as part of eligibility requirements for some family assistance payments.

 The percentage of children with a conscientious objection recorded on the Register has increased each year, from 0.23 per cent in 1999 to 1.77 per cent in 2014.

7. In April 2015, the Health Minister also announced that the 2015–16 Budget would include an extra $26 million for the NIP to: provide an additional incentive payment to providers who identify and catch up a child that is more than two months overdue for a vaccination; provide a range of communication activities, tools and resources to increase awareness and understanding of the NIP and immunisation more generally; and develop an Australian School Vaccination Register to allow recording of adolescent vaccinations.^{14 15}

Audit objective, criteria and scope

8. The audit objective was to examine the effectiveness of the Department of Human Services’ (Human Services) administration of the Australian Childhood Immunisation Register (ACIR).

9. To form a conclusion against the objective, the ANAO adopted the following high-level criteria:

• Human Services has established effective policies and procedures to support the administration of ACIR;
• Human Services has adequate procedures and controls in place for the collection, use and management of ACIR information, including to maintain the integrity of data in ACIR; and
• Human Services has sound reporting processes which support the timely, accurate and authorised dissemination of ACIR information.

10. The audit focused on Human Services’ administration of ACIR and did not include an assessment of the broader National Immunisation Program or its overall administration by the Department of Health. ACIR is largely populated using data from the Medicare customer database, which was the subject of a previous ANAO performance audit.¹⁶ The integrity of the Medicare customer database has not been examined again as part of the current audit. However, where relevant, the findings of the previous audit are noted in this report.

Overall conclusion

11. The Australian Childhood Immunisation Register (ACIR or the Register) records the immunisation details for over 2.25 million children under the age of seven. The Register is a key public health resource used to measure and monitor immunisation coverage rates for policy and planning purposes, and to inform parents and immunisation providers of a child’s immunisation status. Information from the Register is also used to confirm a parent’s eligibility for certain family assistance payments as part of an Australian Government policy to encourage childhood immunisation¹⁷, as well as for authorised research purposes. The Department of Health (Health) has responsibility for the overall management of ACIR in the context of the National Immunisation Program (NIP) agreed by Australian Governments, while the Department of Human Services (Human Services) is responsible for establishing and maintaining ACIR. A business agreement between the departments documents key aspects of Human Services’ day-to-day administration of the Register.

12. The ACIR contributes to the overall success of the NIP and the health status of individual children, and in April 2015 the Australian Government announced its intention to also establish an Australian School Vaccination Register for adolescents.¹⁸ Australian governments use data from the current Register to inform immunisation policy and planning including, most recently, a policy response to growing levels of conscientious objections to immunisation.¹⁹ Parents and immunisation providers have also come to rely on the Register as a source of information on the immunisation status of children under seven years of age, including for the administration of essential vaccines in accordance with the NIP schedule. Children will generally receive vaccinations for different diseases over a number of years, potentially from different providers, and a key challenge for Human Services is to maintain the Register’s integrity through accurate and timely data entry and revision. In its administration of ACIR, Human Services relies on information received from parents and providers²⁰, and on the reliable exchange of data between ACIR and other departmental ICT systems—the Medicare Consumer Directory (MCD) and the Centrelink program’s Income Security Integrated System (ISIS).²¹

13. Overall, Human Services’ administration of ACIR has been generally effective. The department has generally met or exceeded performance targets established in its business agreement with Health, and maintains a range of communication channels to facilitate parents’ and immunisation providers’ access to child immunisation records. System controls to maintain the integrity of data on the Register have been implemented and are generally operating as intended, although there remains scope to strengthen the ACIR quality and control framework. In particular, known impediments to the automated exchange of information between ACIR and other departmental ICT systems mean that the department must manually reconcile certain records on a daily basis—an ongoing administrative overhead. Further, while information on the Register can be added or revised on the basis of telephone advice received from immunisation providers, there is no process for monitoring ACIR telephony services for quality control purposes; and the department has not clearly communicated its expectations on the key role played by parents and immunisation providers in maintaining the integrity of ACIR data holdings.

14. Between 2011–12 and 2013–14, the ANAO’s analysis of Human Services’ documentation indicated that the department generally met or exceeded the ACIR performance targets set out in its Business Agreement with Health. During this period, the department provided 100 per cent of financial reports to stakeholders within five working days of the specified time, exceeding its target of 90 per cent. The department also exceeded its target of making 90 per cent of immunisation provider payments within seven days before the end of the month, with 100 per cent of payments made within the required timeframe. In 2013–14, some 92.5 per cent of immunisation information was processed within 10 working days, against a target of 95 per cent.²² Human Services has also established a number of useful communication channels for stakeholders, including a dedicated website and telephone lines, and outreach officers for Indigenous and multicultural customers. The Register is a key public health information resource, and effective communication channels facilitate parental access to their child’s Immunisation History Statement (IHS) and enable immunisation providers to interrogate ACIR regarding their patients’ immunisation status.

15. However, maintaining ACIR data quality remains an ongoing business risk for the department. Limited interoperability between Human Services’ ICT systems (ACIR, MCD and ISIS)²³ and external providers’ practice management software (PMS) makes it necessary for the department to supplement automated data exchange processes with daily manual data cleansing and matching activities. For instance, departmental operational reports of transactions between ACIR and MCD indicate that some 4 900 records required manual resolution over a two month period.^{24 25} Many electronic transactions between ACIR and immunisation providers also required manual investigation during this period²⁶, as did transactions between ACIR and ISIS. To contribute to ACIR data integrity and improve the efficiency of information processing, Human Services should establish a pathway for the resolution of persistent and known data synchronisation issues between ACIR and other departmental ICT systems, incorporating a planned process and timetable. There would also be benefit in the department working with PMS suppliers to identify options for addressing errors arising during data exchanges between the ACIR and provider systems.

16. The department relies on the experience of its Service Officers (SOs), supported by documented procedures, to maintain the quality of its manual reconciliation processes. However, there is currently no systematic quality control process in place to provide departmental management with additional assurance regarding the accuracy of these resource-intensive manual processes. There would be merit in the department introducing a quality control framework for manual reconciliation and review processes applying to data exchanged between ACIR and other ICT systems. Similarly, no quality control process applies to ACIR telephone calls from parents and immunisation providers, which can result in updates to information kept on the Register. Consistent with many other services provided by Human Services, the department should also apply quality call listening processes to ACIR-related telephone calls, to provide additional assurance that the Register is updated in accordance with relevant procedures.

17. Human Services advised the ANAO that in addition to its own quality control processes, it relies on parents and immunisation providers to assist in maintaining the accuracy of the Register. In particular, the department expects that parents will check that details recorded on their child’s IHS are correct, and will advise the department of any errors. The department also expects that immunisation providers will review their monthly payment summaries to check that vaccines they administered have been accurately recorded, and that payments made to them are correct. However, Human Services’ expectations in respect to maintaining the accuracy of the Register are not clearly and consistently communicated to parents and providers, and the department should include a statement to this effect in relevant communication materials, including the IHS sent to parents and the monthly payment summaries sent to providers.

18. The ANAO has made three recommendations to strengthen the ACIR quality and control framework, focusing on Human Services: establishing a pathway to resolve known impediments to the automated exchange of information between ACIR and other departmental ICT systems; introducing a process to monitor the quality of ACIR telephony services and manual data reconciliation activities on a sample basis; and clearly conveying departmental expectations relating to the role played by parents and immunisation providers in maintaining the accuracy of the Register.

19. As mentioned, the current Register contributes to the overall success of the NIP, and informs ongoing policy responses to immunisation issues—such as the $26 million 2015–16 Budget measure foreshadowed by the Australian Government in April 2015. As part of that measure, the Government proposes to establish an Australian School Vaccination Register for adolescents.²⁷ The findings and recommendations of this audit of ACIR may also inform responsible entities in the implementation and operation of the proposed school vaccination register.

Key findings by chapter

Australian Childhood Immunisation Register Governance and Stakeholder Engagement (Chapter 2)

20. The day-to-day administration of ACIR is underpinned by a formal Business Agreement between the departments of Health and Human Services. In the period 2011–12 to 2013–14, the ANAO’s analysis of Human Services’ documentation indicated that the department had generally met or exceeded the ACIR performance targets set out in the Business Agreement.²⁸ Both departments also advised that they have established a constructive working relationship, with regular contact between officials which is not limited to the formal consultative arrangements set out in the Agreement.

21. Maintaining data quality is an ongoing business risk to be managed by Human Services, and underpins the integrity of the Register. While Human Services’ Risk Management Plan (RMP) for ACIR has recently been strengthened to address risks related to the integrity of provider payments, it no longer directly addresses broader data integrity risks, and there remains scope to further strengthen the RMP.²⁹

22. The Register is a key public health information resource, which informs immunisation policy and planning, and is used day-to-day to record the immunisation status of individual children. Human Services has established a number of useful communication channels for conveying information about ACIR to stakeholders. These channels include: an ACIR website (the department’s principal communication vehicle); dedicated ACIR telephone lines; and generalist outreach officers for Indigenous and multicultural customers. These communication channels facilitate parental access to their child’s IHS and enable immunisation providers to interrogate ACIR regarding their patients’ immunisation status.

23. Human Services provides high level public reporting on ACIR program achievements through its Annual Report, and a useful set of regular internal reports to senior managers.

Management of the Australian Childhood Immunisation Register (Chapter 3)

24. The effective operation of the ACIR program relies on the integrity of data held in the Register and the quality of administrative processes used to capture, record and update data. Sound data integrity controls can assist in providing confidence to: parents that their child’s personal and immunisation information is correct and secure, and that immunisation-related eligibility checks for certain family assistance payments are accurate; health professionals checking a patient’s immunisation status; and government entities monitoring immunisation coverage levels.

25. Children are generally registered on ACIR automatically once they are enrolled in Medicare. Relevant information on the Medicare database, known as the Medicare Consumer Directory (MCD)³⁰, is synchronised daily with information kept on the Register.³¹ The ANAO’s testing of the completeness, accuracy and validity of these automated daily information exchange processes indicated that the number of data discrepancies is small relative to the total ACIR population. However, a number of persistent data synchronisation errors were identified, arising primarily from limitations in the interoperability of the relevant departmental ICT systems.³² Further data synchronisation errors arise from known system-to-system issues, such as misalignment of the business rules between systems.³³ Data synchronisation errors between ACIR and MCD are managed through daily manual reviews undertaken by departmental staff—an essential but resource-intensive exercise which does not incorporate a quality control process. To help maintain ACIR data integrity and improve the efficiency of information processing, Human Services should establish a pathway for the resolution of data synchronisation issues, incorporating a planned process and timetable.

26. Further, the department should introduce a quality control process for the daily manual review and reconciliation of data exchanged between ACIR and other ICT systems, as there is currently no systematic quality control process in place to provide departmental management with additional assurance regarding the accuracy of these processes.

27. Human Services receives information from immunisation service providers electronically, over the telephone, and in paper form. The department has established system controls to validate electronic data received from immunisation providers before it is accepted into ACIR. However, departmental staff are also required to manually resolve large numbers of these records each month, to address errors largely introduced by immunisation providers’ practice management software (PMS).³⁴ There would be benefit in the department working with PMS suppliers to identify options for addressing errors arising during data exchanges between ACIR and provider systems, so as to reduce the need for manual reconciliation processes and related administrative overheads.

28. Human Services has implemented quality control processes to check the accuracy of information entered manually by its Service Officers (SOs) from paper-based sources.³⁵ Further, the department has put in place system controls, supported by a manual reconciliation process, to support the accurate calculation of payments to service providers. However, no quality control process applies to ACIR telephone calls. The department provides a range of ACIR-related telephone lines for its customers, including immunisation providers, to enable them to obtain and supply immunisation information. Given the large number of calls involving ACIR updates, and consistent with many other services provided by Human Services, the department should apply quality call listening processes to ACIR-related telephone calls.

29. Human Services advised that in addition to its own quality control processes, it relies on parents and immunisation providers to assist in maintaining the accuracy of the Register. The department expects that parents will check that details recorded on their child’s IHS are correct, and will advise the department of any errors. Similarly, the department expects that providers will review their monthly payment summaries to check that vaccines administered by them have been accurately recorded, and that their payments are correct. However, the department’s expectations in this regard are not clearly and consistently communicated to parents and providers, and the department should include an appropriate statement in relevant communication materials, including the IHS sent to parents and the monthly payment summaries sent to providers.

Use of Australian Childhood Immunisation Register Information (Chapter 4)

30. ACIR contains private and sensitive information used to: assist parents and providers in managing childhood immunisations; and inform public health policy and planning. To manage the use of ACIR information and promote the consistent application of applicable legislative obligations and departmental processes, Human Services has established relevant system controls, as well as internal policies, guidance materials and training for ACIR staff.

31. The department’s current approach to advising parents of its policy relating to the collection and use of personal information relies on an interested parent accessing the department’s website and Privacy Policy. The ANAO’s review of privacy information appearing on the Human Services website indicated that parents are not clearly advised of: the two-way exchange of information between ACIR and Centrelink for the purpose of determining family assistance payments; and that ACIR retains and uses information after a child turns seven. There would be benefit in Human Services considering how best to inform parents of these specific aspects of the ACIR program.

32. While controls are in place to manage access to information by authorised immunisation providers, the ANAO’s review of key access controls indicated that there was not a process in place to effectively monitor staff access to ACIR.³⁶ To strengthen access controls over the ACIR database, there would be merit in Human Services establishing a process to review internal user access privileges at appropriate intervals, so that only those staff with a job requirement to access the ACIR system and secure portal are able to do so. The ANAO also observed inconsistent practice in the implementation of some information security procedures—in particular, staff satisfying themselves that an immunisation provider had secured parental consent prior to the department releasing ACIR information by telephone. There is scope to further reinforce information security procedures for ACIR telephony staff.

33. As mentioned, eligibility for some Centrelink payments is dependent on a child’s immunisation status, and ACIR data is accessed for this purpose. The department has established an automated daily process to detect mutual clients of the ACIR and Centrelink programs, so as to update ISIS with a child’s current immunisation status. To overcome known shortcomings with the automated process, Human Services conducts a daily manual reconciliation process³⁷ supplemented by a bi-annual data integrity exercise to identify and rectify discrepancies in information held on the two systems. While the biannual exercise assists in maintaining the integrity of information exchanged between the systems and provides opportunities for the analysis of the underlying causes, it is not a means to overcome persistent data synchronisation issues and related overheads. As previously discussed, the department should establish a pathway for the resolution of data synchronisation issues, incorporating a planned process and timetable, and introduce a quality control process for the manual review of data exchanged between ACIR and other departmental ICT systems.

34. Human Services has established a process for external parties to request access to personal and sensitive information, including ACIR data. The ANAO’s review of relevant ACIR data requests from 2013–2014 indicated that the department had not consistently recorded which assessment criteria were applied when granting access to ACIR data. To maintain the integrity of access procedures, there is scope to refine the current approach to recording departmental assessments and decisions relating to data requests from third parties.

Summary of entity response

35. The proposed audit report issued under section 19 of the Auditor-General Act 1997 was provided to the Department of Human Services (Human Services). In addition, a full copy of the proposed audit report was provided to the Department of Health (Health). A summary of Human Services’ response to the proposed report is outlined below, with the full response included in Appendix 1. Health did not have any comments on the proposed report, and the department’s letter is also included in Appendix 1.

The Department of Human Services (the department) agrees with recommendation 1 with qualifications and agrees with recommendations 2 and 3.

The department takes its role in administering ACIR seriously and has been highly successful in administering this large and dynamic programme. With one exception the department has consistently exceeded the Key Performance Indicators (KPIs) agreed with the Department of Health over the last two years and is on a similar track in 2015. The ANAO noted the department’s performance against the KPIs.

The department has achieved a 99.5% data match between its welfare and ACIR systems and a 98.6% match between Medicare and ACIR systems. Many of the items that did not match were as a result of complexities in the particular customer records or timing differences in processing. The ANAO noted that the number of data discrepancies was small. Whilst there is always room for improvement this needs to be balanced against the costs and benefit that can be gained.

That said the department is committed to delivering the highest level of accuracy as is feasible and will continue to seek opportunities to enhance its administration of ACIR where it is appropriate and cost effective.

Recommendations

This chapter provides an overview of immunisation in Australia and the Australian Childhood Immunisation Register (ACIR), as well as related incentives to immunise children. The chapter also outlines the audit objective, criteria, scope and methodology.

Background

1.1 Vaccination against disease is an important public health intervention. Vaccination programs not only aim to protect individuals from illness (or even death) associated with vaccine preventable diseases, but are also intended to increase the level of immunity in the population³⁸, thereby protecting those that are not immunised or cannot be immunised.³⁹

1.2 Australia has a long history of using immunisation in targeted and mass vaccination programs, and within Australia diseases such as tetanus, diphtheria and polio are now rare due to immunisation. The routine immunisation of infants in Australia began in the 1950s, and the first nationally funded infant immunisation program for diphtheria, tetanus and polio started in 1975. National surveys in the late 1980s suggested that only about 53 per cent of Australian children were adequately immunised and there was room for improvement in the effectiveness of childhood immunisation programs. By 2014, the proportion of Australian children considered fully immunised at one, two and five years of age was just over 90 per cent.

The National Immunisation Program

1.3 The National Immunisation Program (NIP) is a combined Australian, state and territory government initiative which aims to increase national immunisation rates for vaccine preventable diseases. The Australian Government Department of Health (Health) is responsible for national immunisation policy advice and overall management of the program, including the NIP Schedule, which specifies particular vaccinations and the ages when they should be given. Under the NIP, essential vaccines are funded by the Australian Government and distributed by the states and territories, and are available free of charge to eligible infants, children, adolescents and adults.

1.4 The current NIP child schedule is outlined in Table 1.1. Additional vaccines are provided under the NIP for children deemed to be in ‘at risk groups’. These include children with particular medical conditions, and Aboriginal or Torres Strait Islander children living in high risk areas.⁴⁰

Table 1.1: Current National Immunisation Program Child Schedule

Source: Department of Health, Immunise Australia website.

Note A: Depending on the brand of vaccine used, only two doses of Rotavirus may be needed at two and four months of age.

Note B: These vaccines are only given if the child did not receive the Mumps, Measles, Rubella, Varicella (MMRV) vaccine at 18 months of age.

1.5 Children are assessed as fully immunised when they have received all the required immunisations for their age group.⁴¹ Figure 1.1 shows the percentage of children assessed as fully immunised for each of the three age ranges as specified in the NIP, for the period 1999 to 2014.⁴² Cohort 1 includes children aged 12 to 15 months; cohort 2 includes those aged 24 to 27 months; and cohort 3 includes children aged 60 to 63 months. As shown in Figure 1.1, the national immunisation level in 2014 for the three cohorts was just over 90 per cent for children aged one, two and five years of age. The five year old age group achieved 90 per cent coverage for the first time in 2012, and had 92 per cent coverage in 2014.⁴³

Figure 1.1: Percentage of fully immunised children 1999 to 2014

 

 

Source: Department of Health, Immunise Australia website.

Note: Complete figures for Cohort 3 were not recorded in ACIR between 1999 and 2004.

National roles and responsibilities

1.6 As discussed, delivery of the NIP is a shared responsibility between the Australian, state and territory governments (states). The Australian Government’s role includes: developing national immunisation policy; providing funding for the purchase of vaccines for eligible individuals listed under the NIP; providing incentive payments to states based on identified performance benchmarks; and the establishment and maintenance of the Australian Childhood Immunisation Register (ACIR or the Register). State responsibilities include: distributing vaccines to immunisation providers (providers); managing the efficient and effective delivery of the NIP; and providing agreed data to ACIR. Government roles and responsibilities are set out in the National Partnership Agreement on Essential Vaccines (NPAEV), which also sets out funding and reporting arrangements for ACIR.⁴⁴

Immunisation incentives

1.7 A range of financial incentives is available to parents⁴⁵ and providers in order to improve immunisation coverage rates.

Incentives for parents

1.8 The Child Care Benefit (CCB)⁴⁶, introduced in July 2000, is intended to assist with child care costs for approved or registered care, such as: long, family or occasional day care; outside school hour care; vacation care; pre-school and kindergarten. CCB is means-tested and only payable if the child is immunised or exempt from immunisation requirements for all the milestone points in the NIP. In 2013–14, the total payments for CCB were approximately $2.3 billion.

1.9 Since July 2004 out-of-pocket child care expenses can be claimed under the Child Care Tax Rebate (CCR), which currently covers 50 per cent of out-of-pocket child care expenses up to a maximum of $7 500 per child per year. While CCR is not means tested, parents must meet certain tests (or be exempt from meeting the requirements) and meet the same immunisation requirements as for CCB. In 2013–14, total payments for CCR were approximately $2.2 billion.

1.10 The Strengthening Immunisation for Children initiative⁴⁷, which commenced on 1 July 2012, introduced the requirement that a child be fully immunised or have an approved exemption (in the years the child turns one, two and five) in order for the parent to be eligible for payment of the Family Tax Benefit Part A supplement. The requirement for a child to be fully immunised at age one was introduced as part of this initiative to supplement the existing focus on immunisation at two and five years of age and to encourage parents to make sure their child has the early vaccines at the correct age (two, four and six months).

Incentives for providers

1.11 Currently, an information (notification) payment of up to $6⁴⁸ is made to providers who administer, and notify ACIR of, an immunisation that completes one of the age-based immunisation schedule points funded under the NIP. In 2013–14, these payments totalled approximately $9.3 million.⁴⁹

Additional measures announced by the Australian Government

1.12 In April 2015 the Australian Government announced that it will take additional measures to promote childhood vaccination and protect those children who are unable to be immunised. From 1 January 2016, the Government announced that immunisation requirements for the payment of Family Tax Benefit (FTB) Part A supplement will be extended to include ‘children of all ages’.^{50 51} In addition, parents will no longer be able to claim an exemption from immunisation for their child—on religious grounds or on the basis of a conscientious objection—and still receive Child Care Benefit, Child Care Rebate, and FTB Part A supplement.⁵²

1.13 The Health Minister also announced in April 2015 that the 2015–16 Budget would include an extra $26 million for the NIP to: provide an additional incentive payment to providers who identify and catch up a child that is more than two months overdue for a vaccination; provide a range of communication activities, tools and resources to increase awareness and understanding of the NIP and immunisation more generally; and develop an Australian School Vaccination Register to allow recording of adolescent vaccinations.⁵³

1.14 The Department of Health subsequently announced that the National Human Papillomavirus Vaccination (HPV) Program Register will be expanded to become the Australian School Vaccination Register, with a view to capturing all adolescent vaccines given through school-based programs. The expanded register is expected to provide a basis for introducing recall and reminder systems to improve adolescent coverage.^{54 55}

1.15 In the 2015–16 Budget, the Australian Government announced additional funding for Human Services to establish an adult vaccination register to record all adult vaccines provided under the National Immunisation Program (NIP) from 1 September 2016.⁵⁶ The department has indicated that ACIR will be expanded to collect data on all vaccinations available under the NIP, with the exception of those provided under school based vaccination programs.⁵⁷

Existing exemptions from being immunised

1.16 As noted, currently eligibility requirements for some Australian Government family assistance payments include that a child must be fully immunised or have an approved exemption noted on the Register.⁵⁸ Table 1.2 outlines the existing approved immunisation exemptions.

Table 1.2: Existing approved immunisation exemptions

Source: Human Services.

Note A: Religious objections to immunisation are recorded as conscientious objections on the Register. There is currently only one group that has registered an exemption with the Australian Government based on religious grounds. The Government announced in April 2015 that this exemption will end from 1 January 2016.⁵⁹

1.17 As mentioned in Table 1.2, at present a parent can apply for the Register to record a conscientious objection against the immunisation of their child. Table 1.3 illustrates the number and percentage of children with a conscientious objection to immunisation recorded on the Register.⁶⁰

Table 1.3: Children with a conscientious objection recorded on the RegisterA

Source: Department of Health Immunise Australia website.

Note A: Conscientious objection statistics are for a point in time, as new children are continually being added to ACIR, and records on the Register for children over the age of seven become inactive.

Note B: As a percentage of all children recorded on the Register.

1.18 In summary, the number of children with a conscientious objection to immunisation recorded on the Register has increased steadily over time, with the number more than doubling in the past 10 years and the percentage rising from 0.23 per cent in 1999 to 1.77 per cent in 2014.

1.19 Figure 1.2 shows the 17 postcodes in Australia that have the highest number of conscientious objections recorded on the Register as at 9 September 2014.

Figure 1.2: Top 17 postcodes with the highest number of conscientious objections recorded on the Register

 

 

Source: ANAO analysis.

Note: The top three postcodes each contain more than 200 registered conscientious objections.

The Australian Childhood Immunisation Register (ACIR)

1.20 ACIR is a national register that records the immunisation details of children under the age of seven.^{61 62} It was established on a trial basis in January 1996 and included as an ongoing program in the 1997–98 Budget as a means of measuring, monitoring and targeting achievements in childhood immunisation coverage in accordance with the NIP Schedule.

1.21 The major functions of ACIR are to:

• provide an accurate measure of the immunisation coverage of children in Australia under seven years of age;
• provide an effective management tool for monitoring immunisation coverage—at national, state and local levels to improve service delivery; and
• inform recognised immunisation providers (providers) ⁶³ and parents of a child’s immunisation status.

1.22 Information from ACIR is also used to:

• inform parents and providers of a child’s immunisation status;
• populate the Immunisation History Statement (IHS)⁶⁴ that is sent to parents at milestone ages and on request;
• confirm eligibility for certain family assistance payments⁶⁵;
• provide Australian, state and territory health departments with data, including statistical and management reports, to assist with immunisation policy, planning and program delivery; and
• assist with monitoring vaccine safety, including the appropriate administration of vaccines to certain age groups.

Legislative framework for ACIR

1.23 Section 46B of the Health Insurance Act 1973 (the Act) requires the Chief Executive Medicare to establish and keep ACIR.⁶⁶ Under the Act, the Chief Executive Medicare is also required to make payments to providers who notify ACIR of the completion of a schedule of immunisations under the NIP. The Act also allows for the Chief Executive Medicare to provide both identified and de-identified information to recognised providers and other specified agencies in accordance with Section 46E.

1.24 Financial Management and Accountability Determination 2006/57 provides for the creation of the Australian Childhood Immunisation Register Special Account67, which holds funds from the Commonwealth and states to pay providers for childhood immunisations following notification to ACIR.

1.25 The Department of Health (Health) is responsible for the administration of the ACIR Special Account, while the management of ACIR—including making notification payments—is the responsibility of the Chief Executive Medicare. Funds are drawn from the ACIR Special Account on a monthly basis to make relevant payments.

Administration of ACIR

1.26 Responsibility for delivery of the ACIR program is shared between two branches within Human Services’ Health Support and Business Services Group:

• The Health Support Programs Branch in National Office is responsible for national program management and relationship management with the Health.⁶⁸
• The Medicare Providers Branch is responsible for ACIR program delivery through its Specialised Provider Services area. Two teams, located in Human Services’ Hobart and Perth Smart Centres, provide telephony and data processing services.

1.27 The ACIR budget for 2013–14 was approximately $6.7 million. The budget breakdown and staffing levels are shown in Table 1.4.

Table 1.4: Human Services’ budget and staffing levels for the ACIR program in 2013-14

Source: Department of Human Services.

1.28 In addition to its appropriated budget, in 2013–14 the ACIR program received $476 775 from Health for additional projects for the ACIR program.

Information flows to and from ACIR

1.29 ACIR exchanges information with a number of data systems, both internal and external to Human Services, to: enrol children on the Register; update personal and immunisation related information; and release immunisation related information to authorised stakeholders. Figure 1.3 illustrates the information flows to and from ACIR.

Figure 1.3: ACIR information flows

 

 

Source: ANAO analysis.

Enrolment on ACIR

1.30 When children under the age of seven are enrolled in Medicare, their details are automatically included on ACIR. As at 28 February 2015 there were some 2 263 857 children under the age of seven registered on the ACIR.

1.31 Where children are not enrolled (or not eligible) for Medicare, their details are included on the Register once ACIR receives information of their first immunisation from a provider.

Updating ACIR

1.32 The ACIR is updated continuously. Providers are able to submit immunisation information through a number of different channels, including:

• electronic transfers such as medical Practice Management Software (PMS), Medicare’s Health Professional Online Services (HPOS)⁶⁹, ACIR’s secure website, or email;
• ACIR telephone lines; or
• paper based forms.

1.33 The Queensland and Northern Territory Governments also maintain whole-of-life immunisation registers. For providers in Queensland, immunisation information can only be submitted via PMS or via paper based forms sent to Queensland Health, which updates the state register and ACIR directly. Providers in the Northern Territory are able to submit information via PMS, HPOS, or by paper based forms to ACIR or directly to the Northern Territory Health Department, which forwards the information to ACIR.

Audit objective, criteria, scope and methodology

Audit objective

1.34 The audit objective was to examine the effectiveness of the Department of Human Services’ (Human Services) administration of the Australian Childhood Immunisation Register (ACIR).

Audit criteria

1.35 To form a conclusion against the objective, the ANAO adopted the following high-level criteria:

• Human Services has established effective policies and procedures to support the administration of ACIR;
• Human Services has adequate procedures and controls in place for the collection, use and management of ACIR information, including to maintain the integrity of data in ACIR; and
• Human Services has sound reporting processes which support the timely, accurate and authorised dissemination of ACIR information.

Audit scope

1.36 The audit focused on Human Services’ administration of ACIR and did not include an assessment of the broader National Immunisation Program or its overall administration by the Department of Health. ACIR is largely populated using data from the Medicare customer database, which was the subject of a previous ANAO performance audit.⁷⁰ The integrity of the Medicare database has not been examined again as part of the current audit. However, where relevant, the findings of the previous audit are noted in this report.

Audit methodology

1.37 The audit methodology included:

• examining relevant documentation and guidance that supports Human Services’ administration of ACIR;
• reviewing ICT system controls and documentation relating to the capture, updating and dissemination of data and other information received through various sources;
• assessing the adequacy of security and privacy measures implemented in respect to the transfer of information to external users;
• interviews with key Human Services officials, including staff at the two processing centres. Interviews were also conducted with Health officials, as well as a number of external stakeholders; and
• the review of information received via the ANAO’s Citizen Input Facility.

1.38 The audit was conducted in accordance with ANAO auditing standards at a cost to the ANAO of approximately $589 063.

Structure of chapters

1.39 The structure of the remaining chapters is set out in Figure 1.4.

Figure 1.4: Report structure

Introduction

2.1 Collaboration between government entities is often necessary to effectively deliver government programs. Collaborative arrangements are often formalised to facilitate productive cross-entity relationships and establish a foundation for a working relationship. Such agreements can provide entities with a clear understanding of their respective roles, responsibilities and accountabilities, and a basis for performance reporting. They can also provide government with additional assurance that the delivery of services is efficient, effective and coordinated.⁷¹

2.2 Effective stakeholder engagement and communication facilitates a shared understanding of government policy, its desired objectives, and the contribution each party can make to achieving these objectives. Considering and responding to stakeholder feedback also provides an opportunity for entities to improve their performance and delivery of services.

2.3 To consider whether Human Services has established an effective governance and stakeholder engagement framework for the management of ACIR, the ANAO examined:

• Human Services’ implementation of relevant parts of its 2012–15 Business Agreement with Health⁷²;
• risk management, performance monitoring and reporting arrangements; and
• mechanisms for engaging with stakeholders and considering stakeholder feedback on the ACIR program.

Business agreement

2.4 Health and Human Services have established a formal agreement—the 2012–15 Business Agreement relating to the National Registers Program (the Agreement)—setting out their respective roles, responsibilities and accountabilities for the administration of ACIR.^{73 74} Figure 2.1 outlines the main components of the Agreement.

Figure 2.1: Health and Human Services bilateral agreement

 

 

Source: ANAO analysis.

2.5 Schedule A to the Agreement relates specifically to ACIR and outlines the detailed business arrangements for managing this part of the Agreement. Table 2.1 describes the responsibilities of Health and Human Services in relation to ACIR.⁷⁵

Table 2.1: Departmental responsibilities for ACIR under the Business Agreement

Source: ANAO analysis of the Agreement.

Note A: Section 46E of the Act requires that immunisation information be provided to a range of stakeholders including: registered immunisation providers; parents and guardians; persons engaged in research; and states.

Note B: The provision of information includes: immunisation coverage reports to Health and states; statistical reports to members of the National Immunisation Committee (NIC); financial reports to Health; raw de-identified data to the National Centre for Immunisation Research and Surveillance, and Health; payment statements to immunisation providers; and performance information to Health. NIC is the peak group responsible for overseeing the development, implementation and delivery of the National Immunisation Program. The NIC is chaired by an Assistant Secretary from Health, with Human Services having an observer role.

2.6 Human Services has additional responsibilities for the day-to-day management of ACIR, including: maintaining a computer system for recording immunisation information; maintaining a computer system to make notification payments and recover any overpayments as necessary; investigating and finalising any complaints concerning data provided from ACIR to parents or providers; and maintaining the ACIR secure site.

2.7 As outlined in Table 2.2, the department is complying with its expected responsibilities described in the Agreement, including through: the timely provision of specified reports to stakeholders, including Health; the provision of IHS to parents; timely payments to providers; and maintenance of required systems.

Table 2.2: Human Services’ compliance with the Agreement in 2013–14

Source: ANAO analysis.

Note: The effectiveness of the department’s implementation of these functions is assessed throughout this audit report.

Performance measurement and reporting

2.8 Performance monitoring and reporting provides the opportunity for stakeholders to measure performance against planned targets and can contribute to improvements in the delivery of programs and services.⁷⁶ In defining performance requirements, entities should take care that measures are achievable and that it is possible to collect and report on the data necessary to meet the agreed performance requirements.⁷⁷

2.9 Human Services’ monitoring and reporting on its administration of ACIR includes reporting to Health under the Agreement, as well as internal reporting to management and external (public) reporting.

ACIR performance framework

2.10 Under the Agreement, Human Services provides an annual report (on a financial year basis) to Health of its achievement against a set of performance indicators for its key deliverables.⁷⁸

2.11 Table 2.3 summarises Human Services’ reported results against the ACIR performance indicators specified in the Agreement, for the period 2011–12 to 2013–14.^{79 80}

Table 2.3: ACIR Agreement performance indicators and Human Services’ reported achievements 2011–12 to 2013–14

Source: ANAO analysis of the Agreement and Human Services’ annual reports to Health.

Notes to Table 2.3

Note A: Supplementary Identification Numbers (SINs) are allocated to children who are not identified as a Medicare-registered child. SIN percentile reports are produced quarterly and sent to Health and state/territory health departments.

Note B: Cohort 1 refers to children in the 12 to 15 month age group and cohort 2 to children in the 24 to 27 month age group.

Note C: Attachment 1 of Schedule A lists a range of reports to be provided periodically to different stakeholders. Immunisation Coverage Reports and State Management Reports are provided to state and territory health departments, and NIC Reports to members of the National Immunisation Committee.

Note D: Financial Reports relate to provider notification payments and are distributed monthly to Health and immunisation providers.

2.12 In summary, since the Agreement was established in 2012, Human Services reported it has generally met its ACIR performance targets, with the exception of: the SIN percentile results for cohort 1 in 2011–12 and 2012–13; and the immunisation records processing time for 2013–14. Human Services advised the ANAO that in these cases its performance was below specified targets because:

• in respect to SIN reporting—the ACIR has no control over when a parent enrols a child on Medicare. Human Services has proposed that the KPI for SIN percentile results be amended for the next Agreement; and
• in respect to 2013–14 processing times—the processing time for immunisation records in 2013–14 was affected by a significant increase in phone calls to the ACIR General Enquiry Line between January and March 2014, attributed to new legislation in New South Wales requiring parents to present immunisation evidence when enrolling children in child care from 1 January 2014. The need to respond to additional calls resulted in fewer Human Services staff being available to process claims data.

Other reporting on ACIR performance

2.13 Program reporting is intended to focus on the objectives of a program, its resourcing, the deliverables it produces and the KPIs that measure effectiveness.⁸¹ Program reporting includes: internal reporting such as reports to management; and external reporting, including through entity Annual Reports.

Internal reporting

2.14 To provide an overview of the ACIR program’s status and performance, internal reports are provided to senior management within Human Services each quarter. The primary internal reports on ACIR are the ACIR Quarterly Health Check Report and the Dashboard Report. The ACIR Quarterly Health Check Report provides information on:

• progress on achieving KPIs as set out in the Business Agreement with Health over the quarter;
• budget expenditure and resourcing;
• stakeholder engagement information including media reports, customer complaints, requests for information from Ministers and the public;
• IT issues; and
• the status of ongoing projects.

2.15 The Dashboard report is a summary version of the ACIR Quarterly Health Check Report, with particular focus on the achievement of KPIs, as well as current issues affecting the program.

2.16 A number of operational reports are also provided to the program team, including weekly work-on-hand reports and regular telephony reports to assist in monitoring progress against KPIs.

2.17 Overall, the department’s internal reporting arrangements provide a useful and regular set of reports to senior management on program trends and developments, progress against key areas of performance, and operational matters.

External reporting

2.18 As the entity with overall policy responsibility for the ACIR program, Health, rather than Human Services, is responsible for public reporting on the program’s achievements. While Human Services does not have any publicly reportable KPIs for the program, the department reports externally on ACIR in its Annual Report. The Annual Report contains high level information on the ACIR program over the financial year, including: the number of immunisations recorded; the number of children on the Register; the total amount paid to providers for immunisation notifications; and high level immunisation coverage statistics.

2.19 In its Annual Report, Health reports against the NIP objectives for childhood immunisation coverage rates in more depth, including achievement against KPIs for the percentage of children fully immunised by cohort group⁸², and the level of funds in Human Services’ ACIR Special Account used to pay immunisation providers.

Evaluations of the ACIR program

2.20 Program evaluation aids accountability and transparency, and contributes to improvements in program administration. It should also measure a program’s progress towards meeting its policy objectives.⁸³

2.21 Health has undertaken three external evaluations of the ACIR program, in 1997, 2000, and 2003. The 2003 program evaluation concluded that ACIR was a highly effective program and made 21 recommendations aimed at improving its operation.⁸⁴

2.22 Health advised the ANAO that initial discussions have recently taken place with Human Services and the National Immunisation Committee (NIC)⁸⁵ on a further evaluation of the ACIR program. Health further advised that it would await the outcome of the current ANAO audit before proceeding with any evaluation.

Stakeholder engagement

2.23 Human Services’ ACIR Communication Implementation Plan 2014–15 outlines the department’s communication activities for ACIR and identifies the primary target audiences as:

• parents and guardians with children under the age of seven years living in Australia⁸⁶;
• third parties such as health care providers and recognised immunisation providers;
• the Department of Health and state and territory health departments; and
• Human Services staff..

2.24 The ACIR Communication Implementation Plan covers the use of various communication channels including telephony lines, the department’s website, social media, media releases and departmental and community publications. In April 2015, the Minister for Health also announced that the 2015–16 Budget would include an extra $26 million for NIP incentives, including a community awareness campaign to promote the importance of vaccinating, and tools to assist providers to have discussions with vaccine hesitant parents.⁸⁷

Engagement with parents and providers

2.25 The department maintains several dedicated telephony lines on ACIR matters.⁸⁸ However, its primary method for communicating with parents and guardians is through online channels⁸⁹, principally through the Human Services’ website, which includes:

• background information such as: why immunisation is important; exemptions to immunisation; the NIP schedules; and the benefits of ACIR;
• information on how to enrol a child on ACIR; and
• more specific information on ACIR, such as: how a child’s immunisation information is updated; how parents may access a child’s immunisation history⁹⁰; information on IHS; how to record immunisations received overseas; and how to update or correct information.

2.26 IHS are automatically sent to the parents of all children recorded in ACIR at 18 months and five years of age. IHS provide details of all immunisations given as at the date of the statement to help parents keep track of their children’s immunisations, and for use as proof of immunisation for school entry or childcare purposes, as needed. From December 2014, it is also planned to commence a routine mailout to parents of children who turn ten, 21 and 54 months of age who are not up to date with their immunisations.

2.27 Communication with providers is also conducted principally through the department’s website, which outlines:

• how providers can register for ACIR;
• advice on submitting immunisation information and immunisation exemptions; and
• payment information, including on provider payments.

2.28 Third parties and providers also receive or are able to request a number of reports relating to information from ACIR⁹¹, and may contact the department via the ACIR telephone line.

Engagement with Indigenous and multicultural stakeholders

2.29 Aboriginal and Torres Strait Islander children are recognised as a key target group for the NIP. ACIR is used to collect, record and report on the immunisation history of Indigenous children.

2.30 The department’s approach to providing services and programs to Aboriginal and Torres Strait Islander peoples is set out in its 2012 Indigenous Servicing Strategy⁹², which aims to bring a greater focus across the entity on effective service delivery for Indigenous customers.

2.31 The ANAO’s 2013–14 performance audit of the department’s service delivery initiatives for Indigenous Australians, concluded that:

Overall, [Human Services] has developed a reasonable approach to improving its focus on supporting the delivery of service to Indigenous Australians, although there is scope to apply key elements of the approach more consistently across the department. ⁹³

2.32 The department has established a network of officers across its operations—comprising Indigenous Servicing Specialists, Indigenous Specialist Officers and Indigenous Service Officers⁹⁴—to assist in providing culturally appropriate services across its broad range of program responsibilities. However, these officers have no specific role in relation to advising on ACIR.

2.33 Human Services also maintains a network of Multicultural Service Officers (MSO) throughout Australia⁹⁵, to provide services to culturally and linguistically diverse communities.⁹⁶

2.34 Human Services advised that during 2013–14, MSOs provided a range of relevant support services to culturally and linguistically diverse communities, including:

• information sessions to newly arrived families and migrant new mothers’ groups (through local hospitals) that includes information on the importance of ACIR; and
• information sessions to international AUSAID students⁹⁷ about Child Care Benefit and the requirement for up to date immunisations as part of eligibility for Child Care Benefit.

2.35 The department further advised that MSOs have provided support to departmental staff in local Medicare offices.

Engagement with Health

2.36 Other key stakeholders include the Department of Health, as the policy agency responsible for the NIP, and the NIC. Health advised that it has a good working relationship with Human Services, with regular contact occurring between the departments which is not limited to the formal requirements of the Agreement and NIC process.

2.37 The NIC is chaired by Health and provides advice on implementation and service delivery issues relating to the NIP.⁹⁸ Its membership comprises representatives from state and territory governments, health care providers including Indigenous service providers, researchers, consumers, and other key interest groups.

2.38 While Human Services is not a member of the NIC principal body, it is a member of the NIC Data Subcommittee, which provides expert advice to the NIC on priorities and opportunities for vaccination data collection, analysis and reporting. Human Services also provides a range of ACIR reports to NIC on a regular basis, and may observe committee meetings, as necessary.

Customer and stakeholder feedback on the ACIR program

2.39 Human Services has developed a Service Commitments99 document which encourages customers to provide feedback and assist the department in improving services. The department also uses surveys, websites and phone lines, to facilitate feedback from customers.

Customer feedback

2.40 In its annual report to Health under the Agreement, Human Services incorporates information on all policy-related complaints and compliments for the ACIR program. The ANAO examined the feedback received from customers for the ACIR program for the period 2010–11 to 2013–14, as summarised in Table 2.4.

Table 2.4: ACIR customer satisfaction and complaints data

Source: ANAO analysis of Human Services’ data.

2.41 Overall, the number of complaints and compliments is very low, compared to ACIR’s customer population of around 2.2 million. The ANAO’s analysis of the complaints data indicated that¹⁰⁰:

• Approximately one third of complaints in 2013–14 related to ‘access to call centres’ and to ‘mistakes/complaint handling’; with complaints in these categories increasing significantly between 2012–13 and 2013–14.
• A significant area of customer concern was ‘self-managed services’, accounting for approximately one fifth of complaints in 2013–14, with related complaints increasing between 2012–13 and 2013–14.

2.42 The annual Customer Satisfaction Survey conducted by Human Services targets customers who have recently interacted with the department, and captures some limited feedback on the ACIR program. Survey results indicate that in 2012–13, 65.7 per cent of respondents were satisfied with the information received about their child’s immunisation history, while in 2013–14, 76.4 per cent were satisfied with the information provided.¹⁰¹

2.43 Human Services advised the ANAO that since 2011 there has been one enquiry, and six requests from the Minister in relation to the management of ACIR.

Stakeholder feedback

2.44 The ANAO interviewed a range of stakeholder groups regarding the department’s administration of ACIR and the Register’s operation.¹⁰² The stakeholders reported general satisfaction with Human Services’ management of ACIR. Positive comments included:

• reports required under the Agreement are received in a timely manner;
• ACIR provides a comprehensive record of immunisation for all children under the age of seven years;
• the ACIR management team is responsive to issues raised by stakeholders; and
• stakeholders have good access to members of the ACIR team.

2.45 Other stakeholder comments provided to the ANAO related to:

• a forum outside of the NIC to discuss issues related to ACIR;
• increased consultation on departmental decisions which impact on the operation of ACIR;
• reduced ACIR-specific support to providers in recent years potentially leading to data quality issues; and
• a national whole-of-life immunisation register.

2.46 While some opportunities currently exist for providers to provide feedback via the ACIR telephone lines and the department’s occasional participation in NIC meetings, there is limited information available for the department to assess providers’ satisfaction with the ACIR program.¹⁰³

2.47 The ANAO’s review of recent meeting minutes for the department’s broader Stakeholder Consultative Group¹⁰⁴ (SCG) did not identify any issues raised in regards to the ACIR program.

Risk management

2.48 Systematic risk management practices enable an entity to be confident that policy and program implementation, and its ongoing administration, have been designed to achieve government outcomes and objectives most effectively.¹⁰⁵

2.49 Human Services’ approach to risk management is set out in its Enterprise Risk Management Policy, Enterprise Risk Management Strategy and Enterprise Risk Management Framework.¹⁰⁶ The Enterprise Risk Management Policy states that all groups, business-as-usual programs, divisions and branches in Human Services that have a business plan must have a risk management plan. The risks identified in these plans are consolidated into risk registers and reported regularly to the department’s Executive Committee, and to the Risk, Business Continuity and Security Committee.

2.50 In accordance with Human Services’ policy and the department’s responsibilities under the Agreement, an ACIR Risk Management Plan (RMP) is prepared annually.

2.51 Table 2.5 compares key aspects of ACIR RMPs for the years 2010–11 to 2014–15.

Table 2.5: Key risks in ACIR Risk Management Plans 2010–11 to 2014–15

Source: ANAO analysis of Human Services ACIR RMPs.

2.52 Overall, the RMPs prepared from 2010–11 to 2011–12 identified the majority of key ACIR risks. Human Services advised that, in response to a change to the departmental template in November 2012, the new ACIR RMP for 2012–13 resulted in a reduced number of program risks being listed, in particular risks related to: ACIR payments; meeting Agreement requirements; data quality; and business continuity. However, there was no evidence that the ACIR program environment had changed significantly at this time (or subsequently) to justify eliminating these risks from the ACIR RMP.

2.53 Subsequently, in July 2013, an internal audit conducted by the department on health program payment risks indicated that the ACIR RMP was compliant with the Human Services Risk Management Policy and the risk management requirements of the Agreement. This audit report also recommended, however, that the program would benefit from a systematic and comprehensive analysis of payment risks. As a consequence, in the 2013–14 and 2014–15 ACIR RMP, risks associated with ACIR payments were again identified, with all residual risk levels (after treatment) rated as ‘Low’.

2.54 There remains scope to further strengthen the ACIR RMP. While payment integrity is a relevant risk to the ACIR program, and is included in the RMP, Chapter 3 of this audit report indicates that risks to data quality and integrity also merit inclusion on the ACIR RMP.¹⁰⁷

Conclusion

2.55 The day-to-day administration of ACIR is underpinned by a formal Business Agreement between the departments of Health and Human Services. In the period 2011–12 to 2013–14, the ANAO’s analysis of Human Services’ documentation indicated that the department has generally met or exceeded the ACIR performance targets set out in the Business Agreement. Both departments also advised that they have established a constructive working relationship with regular contact between officials which is not limited to the formal consultative arrangements set out in the Agreement.

2.56 Maintaining data integrity is an ongoing business risk to be managed by Human Services, and underpins the integrity of the Register. While Human Services’ Risk Management Plan (RMP) for ACIR has recently been strengthened to address risks related to the integrity of provider payments, it no longer directly addresses broader data integrity risks, and there remains scope to further strengthen the RMP.

2.57 The Register is a key public health information resource, which informs immunisation policy and planning, and is used day-to-day to record the immunisation status of individual children. Human Services has established a number of useful communication channels for conveying information about ACIR to stakeholders. These channels include: an ACIR website (the department’s principal communication vehicle); dedicated ACIR telephone lines; and generalist outreach officers for Indigenous and multicultural customers. These communication channels facilitate parental access to their child’s IHS and enable immunisation providers to interrogate ACIR regarding their patients’ immunisation status.

2.58 Human Services provides high level public reporting on ACIR program achievements through its Annual Report, with a useful set of regular internal reports provided to senior managers.

Introduction

3.1 ACIR records the immunisation details for over 2.25 million children under the age of seven. The Register is a key public health resource used to measure and monitor immunisation coverage rates for policy and planning purposes, and to inform parents and immunisation providers of a child’s immunisation status. Information from the Register is also used to confirm a parent’s eligibility for certain family assistance payments as part of an Australian Government policy to encourage childhood immunisation¹⁰⁸, as well as for authorised research purposes. The effective operation of the ACIR program relies on the integrity of data held on the Register and the quality of administrative processes used to capture data. Sound data integrity controls combined with timely and accurate administrative activities can assist in providing confidence to: parents that their child’s personal and immunisation information is correct and secure¹⁰⁹; health professionals checking a patient’s immunisation status and immunisation coverage levels; governments accessing data for policy and planning purposes; and researchers.

3.2 Within Human Services, the Health Support and Business Services Division¹¹⁰ has overall responsibility for the ACIR program. Within this group, the Health Support Programs Branch administers the overall ACIR program; while the Medicare Providers Branch provides ACIR telephony services and forms processing, via Service Officers (SOs)¹¹¹ based in Perth and Hobart. SOs also exercise key roles in helping to maintain the integrity of Registry data by undertaking daily data cleansing activities as a supplement to ACIR system controls.

3.3 To assess the adequacy of the processes and controls Human Services has in place to manage ACIR, the ANAO examined:

• the process for enrolling children on the Register, including transfers of data from the Medicare Consumer Directory (MCD) to the Register;
• controls for updating immunisation information;
• telephone and immunisation processing services for ACIR customers;
• training and support provided to SOs and immunisation providers;
• quality control procedures for the Register; and
• arrangements to support the integrity of immunisation provider payments.

Enrolling children

3.4 There are two mechanisms for enrolling a child on the Register:

• When children under the age of seven are enrolled in Medicare, they are automatically added to the Register using the information recorded in MCD.¹¹² As part of the Medicare enrolment process, customers (including children) are allocated a unique Personal Identification Number (PIN). This PIN is then used to link the customer to their Medicare card.¹¹³
• Children not enrolled in or not eligible for Medicare, are enrolled on the Register using details supplied by a recognised immunisation provider.¹¹⁴ For this type of enrolment, the child is allocated a Supplementary Identification Number (SIN).

Synchronisation between Medicare Consumer Directory and the Register

3.5 As most child enrolment information on the Register is sourced from the Medicare (MCD) database, a daily (overnight) process aims to synchronise common data holdings between the MCD and ACIR. To test the integrity of the data exchange process—including its completeness, accuracy and validity—the ANAO examined extracts of Medicare enrolment records and ACIR records with identical parameters.¹¹⁵

Completeness testing

3.6 To fulfill its intended function as a complete national register of childhood immunisations, ACIR should contain a record for every child less than seven years of age who is enrolled in Medicare, or has received an immunisation at some time (for example, children with a SIN).

3.7 To test how completely the Register captured this target population, the ANAO compared the same populations in the MCD and ACIR. The results of this analysis are shown in Table 3.1.

Table 3.1: Completeness: records in ACIR and the Medicare Consumer Directory

Source: ANAO analysis.

3.8 Over 15 000 ACIR records were not held in the MCD. The ANAO’s analysis indicated that these records were all ‘SIN’ records. That is, the records related to children without a Medicare entitlement. While these children are not entitled to Medicare, the department’s documentation states that this type of ACIR record should still be included on the MCD.

3.9 The discrepancies identified in the course of the ANAO’s testing were generally attributable to the department’s business rules¹¹⁶ either not being implemented as defined, or limitations in the business rules which meant that they did not capture all the scenarios that could occur during the data synchronisation process.

Accuracy testing

3.10 The integrity of ACIR also relies on the accurate exchange of information between MCD and the Register so that new child registrations and relevant updates to MCD, such as changes to personal details, are accurately reflected in ACIR.

3.11 The ANAO tested the accuracy of the personal data transfers from MCD to ACIR using the following fields: surname; given name; initial of middle name; gender; and date of birth. Differences in these fields between ACIR and MCD are shown in Table 3.2.

Table 3.2: Accuracy: personal details in the Medicare Consumer Directory and ACIR

Source: ANAO analysis.

3.12 Human Services advised that the accuracy of personal details in the MCD and ACIR can be affected by a number of factors. These factors include:

• Some ACIR data fields have different business rules to MCD. For example, the ‘surname’ field in each system is of a different length (up to 40 characters in MCD and 30 characters in ACIR). In addition, MCD has a free text box for very long surnames (over 40 characters). During the synchronisation process, the system business rules provide that the free text box for surnames is truncated to just 18 characters in the transfer to ACIR, which can affect the completeness of the recorded name.
• In September 2014, a broader departmental system ‘fix’—intended to rectify errors stemming from synchronisation processes for other Human Services systems—affected ACIR’s ability to correctly identify MCD updates to a child’s record. For example, where there have been multiple updates to a child’s record on the same day, the Register was only able to identify some (but not all) of the changes to the record. In addition, there remain a number of pre-‘fix’ errors that have not been rectified.
• Other known flaws in the synchronisation process (these are discussed from paragraph 3.19).
• Data entry errors.

Validity testing

3.13 In a valid data collection, each record should be unique and identifiable. In addition, there should be no duplicate records, as duplicate records can fragment data across more than one record. For ACIR, invalid (including duplicate) records can affect the completeness and accuracy of a child’s immunisation history, and the registry’s value as a reliable source of information.

3.14 To test the validity of ACIR, the ANAO tested active records to check whether each record was unique, identifiable and that no duplicate records exist. The ANAO’s testing found 814 duplicate records, where the child’s surname, given name, initial of middle name, gender, date of birth and postcode matched, but the duplicate record had a different PIN or SIN.

3.15 Some of these duplicate records may have been inherited from the MCD¹¹⁷, while others resulted from ACIR’s inability to recognise the records as potential matches, as discussed below.

Daily resolution process for SIN records

3.16 As noted earlier, children who are not enrolled (or not eligible) for Medicare will be allocated a SIN in ACIR. Should that child subsequently be enrolled in Medicare, they will be allocated a PIN and the child’s Medicare record is then added to the Register through the daily synchronisation process. In some situations, this process results in the child having two records on the Register—the earlier SIN-related record and the new PIN-related record.

3.17 The department has established an automated daily process to match ACIR SIN records with new ACIR enrolments generated by Medicare, as well as match new and existing SIN records. Where the system identifies a potential match, these records will be merged automatically or will be referred to a SO for investigation. If the SO determines that the records match, they are then merged manually. However, this manual reconciliation process is not subject to any of Human Services’ quality control procedures.

3.18 The ANAO’s review of operational reports for the period 21 August 2014 to 21 October 2014 identified 4 908 records that required manual resolution to determine potential matches between records. The ANAO’s testing highlighted the benefit of the department’s manual data matching processes, such as the manual reconciliation process, as a means of overcoming the problem of automated systems not fully resolving certain records.

Overall assessment of the completeness, accuracy and validity of ACIR enrolment data

3.19 In summary, the number of data discrepancies identified by the ANAO—relating to the completeness, accuracy and validity of ACIR enrolment—was small relative to the overall size of the ACIR population. However, a number of persistent data synchronisation errors were identified, arising primarily from limitations in the interoperability of the relevant departmental ICT systems.¹¹⁸

3.20 Human Services advised that some of the discrepancies identified by the ANAO related to the design of the system’s business rules. The department further advised that such discrepancies arose from ‘known issues’.

3.21 While the number of errors is relatively small and the reasons for errors arising may be known, the need to manually reconcile certain records on a daily basis represents an ongoing administrative overhead. Further, errors in ACIR can inconvenience customers. For example:

• an incorrect date of birth can affect the accuracy of a child’s recorded immunisation status, with possible implications for the receipt of family assistance payments by parents; and
• an incorrect name (or incorrect data) recorded on an Immunisation History Statement (IHS)¹¹⁹ may cause difficulty for a parent when enrolling their child in school or childcare.

3.22 Incorrect recording of date of birth and postcodes can also affect the reporting of immunisation coverage statistics used for public health purposes.

Updating immunisation information

3.23 The department has established several channels to enable immunisation providers to directly submit immunisation information and other updates to ACIR. Providers can use:

• their own practice management software (PMS);
• hardcopy forms which are manually entered into ACIR by SOs¹²⁰;
• the secure ACIR on-line portal;
• Medicare’s Health Professionals Online System (HPOS);
• emails to the designated ACIR inbox; and
• the ACIR provider telephone line.

3.24 Table 3.3 shows the high volumes of information received from providers through various channels, relating to almost 2.5 million immunisation ‘encounters’ in 2013–14.¹²¹

Table 3.3: Information on immunisation encounters, received during 2013–14, by channel

Source: Human Services.

Note A: Encounter information provided by phone or email is included in the figures for hardcopy forms.

Note B: Percentages do not add to 100 per cent due to rounding.

Note C: These are both functions within Medicare’s Health Professional Online System (HPOS).

Quality controls for incoming data

3.25 To help maintain the quality of incoming data to ACIR, Human Services has implemented a two-step process to identify potential errors before they are accepted into the Register:

• for information on immunisation encounters submitted electronically, a system validation process checks and verifies incoming information before it is accepted into the Register; and
• where incoming data fails the validation process, and is not automatically accepted by the Register, it is put in a ‘Pend’ (pending) queue for manual resolution by a SO.

3.26 Common reasons for information being put into the Pend queue include:

• the information received duplicates data previously supplied by a provider;
• a different provider has submitted the same information; or
• an incorrect vaccination dose number has been submitted.¹²²

3.27 The resolution of pending records is undertaken by experienced SOs in the ACIR processing teams, and departmental procedures have been established to assist them in this task. SOs interviewed by the ANAO indicated that there were regular surges in the number of Pend records, and that one common reason for surges is a system upgrade to the provider’s PMS. At the completion of a system upgrade, the PMS may send all records in the PMS to the Register—not just new records.

3.28 Figure 3.1 indicates that the majority of records in the Pend queue are received through the PMS channel, which is also the most frequently used provider channel for submitting information to ACIR. Given the administrative workload involved in processing the Pend queue and the high prevalence of Pend records stemming from PMS inputs, there would be benefit in the department working with PMS suppliers to identify options for reducing the number of data errors, so as to improve the quality of automatic synchronisation and reduce the overheads arising from manual reconciliation processes.

Figure 3.1: ACIR Pend records counts, by channel, for the period 21 August 2014 to 21 October 2014

 

 

Source: ANAO analysis of Human Services information.

3.29 Human Services advised the ANAO that Pend records are counted cumulatively by submission channel, and daily operational reports are produced showing the cumulative number of unresolved Pend records for each channel.¹²³ The reports include the date that the record was originally received by the Register, not the date the record was put into Pend; an approach which reduces the department’s ability to accurately identify how long a record has been in Pend until it has been manually resolved.¹²⁴

3.30 The Pend process is an input control which helps mitigate the risk of inaccurate information being accepted into the Register. However, there is currently no quality control process in place to provide assurance to the department of the accuracy of these manual reconciliation activities. The ANAO’s review¹²⁵ also indicates that the process involves a significant additional workload for departmental staff, and that timely processing of the Pend queue is necessary, as delays in this information being accepted into the Register may affect a child’s immunisation status and a parent’s eligibility for family assistance payments, where the delay coincides with key milestone and payment timeframes.

3.31 In summary, limited interoperability between Human Services’ ICT systems (ACIR, MCD, ISIS)¹²⁶ and external providers’ PMS requires the department to supplement automated data exchange processes with daily manual data cleansing and matching activities—an essential but resource intensive exercise. Human Services should establish a pathway for the resolution of persistent and known data synchronisation issues between ACIR and other departmental systems, incorporating a planned process and timetable. As mentioned in paragraph 3.28, there would also be benefit in the department working with PMS suppliers to identify options for addressing errors arising during data exchanges between ACIR and provider systems.

Recommendation No.1

3.32 To contribute to ACIR data integrity and improve the efficiency of information processing, Human Services should establish a pathway for the resolution of persistent and known data synchronisation issues between ACIR and other departmental ICT systems, incorporating a planned process and timetable.

Human Services’ response:

3.33 The department agrees to the recommendation with qualifications.

3.34 The department has in place a number of arrangements to maintain the accuracy of the data of the register, including an ACIR working group to drive data accuracy.127 The accuracy of matching ACIR data with welfare system data was 99.5% in November 2014. The majority of the items that did not match were as a result of complexities in the particular customer records which did not allow for automatic synchronisation. The accuracy of matching ACIR data with the Medicare system achieved about 98.6% accuracy in the same period. Many of the small number of data discrepancies are at a point in time and the result of timing differences in the processing of information within the systems. The department notes that the ANAO found the number of data errors detected in the audit to be small. A plan and timetable will be in place by July 2015 to address issues as opportunities arise and where it is cost effective.

Immunisation information from state based registers

3.35 The Queensland and Northern Territory governments each maintain whole-of-life immunisation registers, and have established different administrative arrangements for submitting information to ACIR. Providers in those states have the option of submitting information to their respective state registers (which then transmit the information to ACIR), or directly submitting their information electronically to ACIR.

3.36 In respect to data submitted from the Queensland register on immunisations received by children, Human Services undertakes a daily manual reconciliation, as requested by the Queensland Government. No manual reconciliation process is undertaken for information received from the Northern Territory register.

Stakeholders role in confirming the completeness and accuracy of ACIR data

3.37 As discussed, the ANAO identified a number of data integrity issues associated with ACIR and its control systems. In this context, Human Services advised the ANAO that the ACIR program is a ‘self-auditing program’—that is, the department expects that a parent will check the accuracy of their child’s personal and immunisation information and notify the department if amendments are required. Similarly, the department relies on providers to check their monthly payment summaries to ensure that immunisations they have administered have been accurately recorded in ACIR and that they have been paid correctly.

3.38 The ACIR website includes a departmental request that parents check the accuracy of their child’s IHS and advise the department if changes are needed. However, some further steps would be necessary before the department can take comfort from parental checks as an assurance mechanism. In particular, the department would need to clearly and consistently communicate to stakeholders its expectations and the level of reliance it places on them to share responsibility for ACIR accuracy. The inclusion of an appropriate statement in existing communications such as the IHS summary sent to parents and the monthly statement sent to providers would clearly communicate the department’s expectations regarding the role played by parents and providers in maintaining the integrity of ACIR data holdings.

Recommendation No.2

3.39 To clearly convey the department’s expectation that parents and immunisation providers will play a role in maintaining the accuracy and integrity of ACIR records, the ANAO recommends that Human Services include an appropriate statement to that effect in relevant communications with parents and providers.

Human Services response:

3.40 The department agrees with the recommendation and notes that it is continuously improving its communications with parents and providers.

3.41 The department responded to this audit finding before the audit was completed by including some additional information on its website in January 2015. This information is being further reviewed and will be updated by the end of June 2015. Amended versions of key documents will be progressively implemented in our systems from July to September 2015.

ACIR processing and telephony services

3.42 In addition to electronic channels such as the Human Services website, the department supports the ACIR program with a range of processing and telephony services, performed by SOs within the Medicare Providers Branch.¹²⁸

ACIR telephony services

3.43 The department operates three telephony lines for ACIR:

• the ACIR general line – with three sub-lines, for:
  • providers to submit immunisation information or to check the immunisation details of a child;
  • parents seeking their child’s Immunisation History Statement; and
  • general enquiries;
• the ACIR Internet line – for providers with queries regarding the ACIR secure site; and
• the ACIR Ward of the State line – for case workers who require immunisation information for children in State care.

3.44 Table 3.4 illustrates ACIR call volumes and performance for the period 2011–12 to 2013–14. Key developments during this period included:

• a 13 per cent increase in the total number of calls to ACIR telephone lines;
• a significant increase in waiting times for ACIR customers to talk to a SO;
• a significant increase in the number of calls abandoned by customers after entering a queue and prior to talking to a SO; and
• an increase in Average Speed of Answer for the ACIR General Line from 27 seconds to 3 minutes 13 seconds.¹²⁹
  

  Table 3.4: Call volumes for the ACIR telephony lines 2011–12 to 2013-14

Source: ANAO analysis of Human Services’ data.

Note A: Number of calls answered by all ACIR team SOs, after passing through the Interactive Voice Recognition (IVR) facility and entering the call queue.

Note B: Number of calls (after proceeding through IVR) abandoned by customers after entering a queue and prior to reaching a SO.

Note C: Average time a caller spends in a queue before being answered by a SO.

Note D: Average time a SO spends handling an individual call. This includes speaking to the customer, on hold, in conference mode with another SO/agent, and completing any after call work.

Note E: Service level refers to the number of calls answered within a specified KPI target. For the general line and the IHS line this target is 150 seconds; for all other lines, the KPI target is 30 seconds. In October 2014, Human Services advised that due to a change in telephony platform, service level data was not available for 2013–14. Human Services further advised that this KPI data gap was addressed by changing the performance measure to Average Speed of Answer (ASA). The service level target is now 30 seconds ASA for all lines other than the general and IHS lines which have a ASA target of seven minutes.

Note F: Prior to February 2014, these calls were answered as part of the general line.

Note G: The GPII program was closed in April 2013, however the GPII line was not closed until June 2014. Human Services advised that the majority of calls received after April 2013 were general provider enquires.

3.45 The ANAO observed a number of SOs taking calls at the two ACIR centres. For the observed calls, staff consistently completed the appropriate security checks for providers or parents. However, there were some inconsistent practices in SOs’ promotion of electronic means of accessing an IHS, and in asking if a parent had given consent for a provider to access their child’s information.¹³⁰

Other ACIR processing activities

3.46 In addition to providing telephony services, SOs in the Medicare Providers Branch are responsible for processing immunisation information received via hard copy form, email or fax, including:

• applications from immunisation providers for ACIR registration;
• provider bank account details;
• immunisation encounter information; and
• requests for an IHS.

3.47 Table 3.5 shows the time spent on ACIR-related processing activities from 2011–12 to 2013–2014.

Table 3.5: Number of minutes spent on ACIR processing activities 2011–12 to 2013–14

Source: ANAO analysis of Human Services’ data.

Note A: Based on a 7.5 hour working day.

Processing delays

3.48 As discussed in Chapter 2, under the Business Agreement with the Department of Health, the key Performance Target for processing immunisation records is ‘95 per cent processed within 10 working days of receipt’ by Human Services.

3.49 Processing delays can arise if providers do not submit details of immunisation services to ACIR in a timely manner. Table 3.6 shows the time taken for the department to receive immunisation encounter advices between 2010–11 and 2013–14.

Table 3.6: Time taken to receive immunisation service advices 2010–11 to 2013–14

Source: ANAO analysis of Human Services information.

3.50 Since 2010–11, the department has received over 75 per cent of immunisation service advices within 10 working days, while the remaining one quarter of advices have persistently taken 20 days or more to be received. While the department is not directly responsible for such delays, there would be merit in Human Services periodically reminding providers of the need to submit immunisation information in a timely manner, drawing attention to the potential impacts of any late submissions on parents and public health reporting of immunisation outcomes. The impacts include:

• For parents receiving CCB and/or CCR, their payment may be cancelled if their child is deemed overdue for a milestone immunisation 63 days after the due date, when they may have already been immunised.
• Reporting of immunisation coverage statistics may be affected where children are falsely reported as overdue.

3.51 Human Services advised the ANAO in February 2015 that it has commenced work on including information to providers on the timely submission of immunisation information in its monthly provider payment statements.

Training and guidance for providers and SOs

3.52 ACIR operators—providers and SOs—need relevant skills and knowledge, as well as accurate guidance and support to accurately maintain and update the Register. Appropriate training and guidance for providers and SOs helps mitigate the risk of Registry errors and reduces the need for costly manual corrections by the department.

3.53 The ANAO examined the training, support and guidance available to providers and SOs.

Support for immunisation providers

3.54 Immunisation providers have direct data entry access to the Register, and as noted, over 50 per cent of Pend records requiring manual resolution by SOs are sourced from providers’ inputs via their practice management software.

3.55 Human Services has established a designated telephony line for providers. Currently, the department does not provide immunisation providers with any ACIR-specific training on data entry or other matters.¹³¹ Departmental support is available through Business Development Officers (BDOs), whose role is to educate and assist health care providers to use electronic means to conduct their business, in particular on-line claiming, so as to reduce the amount of manual processing and telephone contact. This broad-banded approach primarily targets medical practices which have a high volume of claims, to assist them to submit their immunisation information electronically.¹³²

3.56 Human Services advised that where a specific provider or practice is identified as needing additional assistance in submitting their information electronically, BDOs are notified to provide follow-up support on a risk basis.¹³³

Support for ACIR staff

3.57 For new SOs, ACIR-related training is chiefly provided through on-the-job training.¹³⁴ New SOs are briefed on the program, and assigned a mentor.¹³⁵ Mentors review (and correct, where required) processed forms, and provide support during phone calls through call listening.¹³⁶ New SOs initially process less complex forms, before undertaking more complex work including phone calls. For new SOs, 100 per cent of their work is quality checked for a defined period¹³⁷, and SOs also receive monthly coaching on their quality control results, and learning and development needs.

3.58 The ANAO examined the quality checking of new SOs, and observed a different approach in place between the two ACIR service centres. In one centre, new SOs required an accuracy rate of 100 per cent for two to three weeks before gradually transitioning into the standard quality control process. In the other service centre, new SOs graduated to the standard quality control process when they received a 97 per cent accuracy rate for three to five days in a row. Human Services advised the ANAO that its e-Reference procedures do not currently specify the accuracy rate a new SO must attain, and that it is currently updating these procedures to include a specific target.

3.59 Staff are also supported by ACIR Technical Program Advisors¹³⁸ (TPAs), who provide program advice and perform quality checking of processing activities. TPAs distribute staff bulletins outlining changes to the ACIR program, policy or procedural updates and reminders on procedures, and conduct monthly technical sessions to provide refreshers on certain procedures—particularly where there are re-occurring errors.

3.60 Human Services has also established a suite of useful ACIR procedures and guidance materials for staff, relating to processing, telephony services, reporting and data cleansing activities.

Quality control

3.61 Human Services has established a Quality Framework to help maintain the accuracy and reliability of information collected by the department. Overarching guidance relating to quality control for all sub-programs (such as ACIR) in the Medicare Program is also supplemented by program specific procedures.

Quality control procedures

3.62 The ACIR Quality Control Procedures provide that a random sample of each SO’s work will be quality checked each month. Table 3.7 outlines the minimum work sample for each SO that is quality checked per month.¹³⁹

Table 3.7: Minimum SO work sample quality checked per month

Source: Human Services.

Note A: Complex forms include: Immunisation Encounter forms; Medical Contraindication forms; Payment Account Details forms; Immunisation History forms; and Provider Registration forms.

Note B: Simple forms are: Conscientious Objection forms; Verbal Update forms; Header forms; General forms; and Natural Immunity notifications.

3.63 After a work sample has been quality checked, feedback is provided to the SO and any necessary re-work is completed. The results are then entered into the ACIR Online Quality Control Reporting Tool, which also captures any identified errors and the reasons for the errors through an Error Explanation Sheet.¹⁴⁰

3.64 In addition, a quality control process for telephone calls, known as quality call listening, applies to new SOs. However, quality call listening does not apply to the many telephone calls fielded by other ACIR staff.¹⁴¹ Immunisation information can be collected and released over the phone by SOs, and there would be merit in Human Services applying standard quality call listening processes to ACIR-related telephone calls.

3.65 As mentioned earlier in this Chapter, there is currently no systematic quality control process in place to periodically assess the accuracy of the daily manual review and reconciliation of data exchanged between ACIR and other ICT systems.¹⁴² Given the frequency of these manual review activities and their essential role in maintaining the integrity of the Register, Human Services should also include these activities in its ACIR Quality Control Procedures. In May 2015, the department advised the ANAO that it had taken steps to progress this work.

Recommendation No.3

3.66 To provide additional assurance regarding the integrity of ACIR data entry and revision, the ANAO recommends that Human Services:

1. apply quality call listening procedures to ACIR telephony services; and
2. include manual ACIR data reconciliation activities in the ACIR Quality Control Procedures.

Human Services response:

3.67 The department agrees with this recommendation.

3.68 The department commenced the deployment of its national quality framework to ACIR in April 2015 before the audit was completed. The framework will cover all ACIR administration and processing, including telephony and data reconciliation by 30 September 2015.

Accuracy of Processing

3.69 Information collected from the ACIR quality control process is used for the collation of Accuracy of Processing reports on a monthly and yearly basis.¹⁴³ The department’s overall Accuracy of Processing performance for the ACIR program in 2012–13 was 95.8 per cent—a little below the KPI of 97 per cent; while the 2013–14 Accuracy of Processing result was 98.1 per cent, exceeding the KPI target.

Analysis of a sample of processed forms

3.70 To assess the effectiveness of quality control processes for the ACIR program, the ANAO: reviewed a sample of 385 processed forms for the period 31 March 2014 to 29 August 2014 to determine if the information had been accurately processed into the Register; and compared these findings with the department’s quality control results for 2013–14. The ANAO’s analysis is set out in Table 3.8.

Table 3.8: Results of ANAO sample testing of ACIR data entry

Source: ANAO analysis and Human Services 2013–14 ACIR Quality Assurance Processing Report.

Note A: Given the time period over which the ANAO collected the sampled forms, it is possible that additional errors existed but were subsequently corrected after notification from a provider or parent.

3.71 Overall, the number of processing errors identified in the ANAO’s sample was small. Three (of four) errors identified stemmed from key information not entered into the Register accurately, with the remaining processing error (natural immunity notification) relating to an incorrect vaccine entered. The processing errors in the ANAO’s sample were sourced from the same ACIR processing centre. All errors identified in the ANAO’s sample testing would have affected the recording of a child’s immunisation status, and potentially eligibility for family assistance payments.

Aim for Accuracy process

3.72 To provide confidence in the integrity of its quality checking arrangements, Human Services has established The Aim for Accuracy Health Programmes Policy. Under the policy, a representative sample of previously quality checked work will be independently re-checked at least annually, to assess whether the quality checking procedures have been followed correctly. Human Services advised that the most recent ACIR Aim for Accuracy process was conducted in March 2013, and resulted in one ACIR processing centre achieving a result below the required KPI, while the other processing centre achieved 100 per cent accuracy. Human Services further advised that while the ACIR Aim for Accuracy process was not undertaken in 2014 due to a review conducted in July 2013, it would be re-introduced for ACIR in June 2015.

Controls to support the integrity of provider payments

3.73 Recognised immunisation providers receive a payment of up to $6¹⁴⁴ after notifying Human Services that they have completed one of the age-based immunisation schedules for a patient under the National Immunisation Program (NIP). Table 3.9 summarises total payments to immunisation providers for the period 2010–11 to 2013–14.

Table 3.9: Immunisation provider payments 2010–11 to 2013–14

Source: ANAO analysis of Human Services information.

Note A: A notification refers to advice from a provider that a child has received a vaccination/s. A provider is only paid when they notify ACIR that a child has completed an age-based schedule under the NIP.

Payment process and controls

3.74 The process for making payments to providers for selected immunisation notifications is described in the department’s guide on ACIR Information Payments and Statements. Figure 3.2 illustrates the payment process for information payments to providers.

Figure 3.2: Payment process for information payments to providers

 

 

Source: ANAO analysis of Human Services’ documentation.

3.75 The ANAO observed a payment process conducted on 19 August 2014. The process was completed in accordance with the procedure outlined above.

3.76 The ANAO also observed the system controls in place for the accurate calculation of information payments to providers. These controls include:

• payments for providers are calculated and distributed through an automated process within ACIR;
• payments for providers are assessed at the antigen level, that is, providers are only eligible for payment if they complete an immunisation milestone/age schedule under the NIP; and
• a process to identify providers in the Northern Territory and make the payment to the Northern Territory Department of Health.¹⁴⁵

3.77 The payment system controls, in conjunction with the manual reconciliation process undertaken during the payment process, support the accurate calculation and payment of information payments to providers.

Detection of incorrect provider payments

3.78 Human Services relies on three mechanisms to detect incorrect provider payments:

• a validation check during the payment process;
• business rules within the Register to assess whether a child has received all the required vaccinations for that NIP milestone; and
• providers’ vigilance in checking their statement.

3.79 For the validation process, program staff check that monthly provider payments are within the projected expenditure range, including in comparison to the previous year. Any significant discrepancies are referred for further investigation.¹⁴⁶

3.80 Providers are also sent a monthly payment summary.¹⁴⁷ Human Services advised the ANAO that it relies on a provider’s attentiveness to confirm they have been paid for the correct number of vaccinations. However, as mentioned, this expectation is not explicitly communicated to providers in the payment summary or on the department’s website.¹⁴⁸

Conclusion

3.81 The effective operation of the ACIR program relies on the integrity of data held in the Register and the quality of administrative processes used to capture, record and update data. Sound data integrity controls can assist in providing confidence to: parents that their child’s personal and immunisation information is correct and secure, and that immunisation-related eligibility checks for certain family assistance payments are accurate; health professionals checking a patient’s immunisation status; and government entities monitoring immunisation coverage levels.

3.82 Children are generally registered on ACIR automatically once they are enrolled in Medicare. Relevant information on the Medicare database, known as the Medicare Consumer Directory (MCD), is synchronised daily with information kept on the Register. The ANAO’s testing of the completeness, accuracy and validity of these automated daily information exchange processes indicated that the number of data discrepancies is small relative to the total ACIR population. However, a number of persistent data synchronisation errors were identified, arising primarily from limitations in the interoperability of the relevant departmental ICT systems. Further data synchronisation errors arise from known system-to-system issues, such as misalignment of the business rules between systems. Data synchronisation errors between ACIR and MCD are managed through daily manual reviews undertaken by departmental staff—an essential but resource-intensive exercise which does not incorporate a quality control process. To help maintain ACIR data integrity and improve the efficiency of information processing, Human Services should establish a pathway for the resolution of data synchronisation issues, incorporating a planned process and timetable.

3.83 Further, the department should introduce a quality control process for the daily manual review and reconciliation of data exchanged between ACIR and other ICT systems, as there is currently no systematic quality control process in place to provide departmental management with additional assurance regarding the accuracy of these processes.

3.84 Human Services receives information from immunisation service providers electronically, over the telephone, and in paper form. The department has established system controls to validate electronic data received from immunisation providers before it is accepted into ACIR. However, departmental staff are also required to manually resolve large numbers of these records each month, to address errors largely introduced by immunisation providers’ practice management software (PMS). There would be benefit in the department working with PMS suppliers to identify options for addressing errors arising during data exchanges between ACIR and provider systems, so as to reduce the need for manual reconciliation processes and related administrative overheads.

3.85 Human Services has implemented quality control processes to check the accuracy of information entered manually by its SOs from paper-based sources. Further, the department has put in place system controls, supported by a manual reconciliation process, to support the accurate calculation of payments to service providers. However, no quality control process applies to ACIR telephone calls. The department provides a range of ACIR-related telephone lines for its customers, including immunisation providers, to enable them to obtain and supply immunisation information. Given the large number of calls involving ACIR updates, and consistent with many other services provided by Human Services, the department should apply quality call listening processes to ACIR-related telephone calls.

3.86 Human Services advised that in addition to its own quality control processes, it relies on parents and immunisation providers to assist in maintaining the accuracy of the Register. The department expects that parents will check that details recorded on their child’s IHS are correct, and will advise the department of any errors. Similarly, the department expects that providers will review their monthly payment summaries to check that vaccines administered by them have been accurately recorded, and that payments are correct. However, the department’s expectations in this regard are not clearly and consistently communicated to parents and providers, and the department should include an appropriate statement in relevant communication materials, including the IHS sent to parents and the monthly payment summaries sent to providers.

Introduction

4.1 ACIR contains information intended to assist parents and immunisation providers in the management of a child’s immunisation status, as well as information to enable researchers and other health professionals to measure and track immunisation levels in Australia. In providing information from ACIR to relevant stakeholders, suitable controls and practices should be in place to protect the privacy of individuals and to ensure information is only released to authorised entities and individuals.

4.2 To assess the effectiveness of Human Services’ management of the use and release of ACIR information to stakeholders, including measures to maintain individuals’ privacy and the confidentiality of information, the ANAO examined:

• the department’s privacy policy and practices, and communications to parents on privacy;
• use of ACIR information by the department’s Centrelink program; and
• release of ACIR information to parents, immunisation providers, and other interested parties.

Privacy and release of information

4.3 The Health Insurance Act 1973 (the Act) establishes ACIR and enables the Chief Executive Medicare to: use the database of Medicare enrolments to establish and update the Register; send information about a child’s immunisation status to parents; and provide both identified and de-identified information from ACIR to recognised providers and other specified agencies.

4.4 In practice, ACIR is considered to be an ‘opt-out’ program; that is, enrolment on the Register, and consent for a child’s immunisation information to be used, is assumed unless the parent advises the department otherwise.¹⁴⁹

4.5 In administering ACIR, Human Services is subject to the Privacy Act 1988 (the Privacy Act) and the 13 Australian Privacy Principles (APPs), which regulate how entities collect, store, provide access to, use and disclose personal (and sensitive) information.¹⁵⁰ The Privacy Act also recognises that the protection of individual privacy needs to be balanced against the interests of entities in carrying out their functions or activities.

4.6 In light of the ANAO’s recent examination of privacy in the Medicare context¹⁵¹, analysis of privacy issues in the current audit focuses on how Human Services communicates the ACIR-specific aspects of its privacy policy to parents and how the department manages the controlled release of information from ACIR to authorised parties.

Human Services’ Privacy Policy

4.7 As required under Australian Privacy Principle 1, Human Services has a publicly available Privacy Policy (the Policy) that outlines the department’s approach to privacy and how it handles personal information in relation to the payments and services it delivers. The Policy provides for the collection, use and disclosure of personal information for Medicare-related purposes, including ACIR. The Policy refers to ACIR, and keeping records of children up to the age of seven. The Policy also states that ‘When no longer required, personal information is destroyed in a secure manner, or archived or deleted in accordance with our obligations under the Privacy Act and Archives Act 1983.’¹⁵² Human Services advised that hard copy forms are archived and destroyed in accordance with the Archives Act, while information placed on the Register is currently retained indefinitely to allow parents to access their child’s immunisation history after the age of seven¹⁵³, and to provide opportunities for longitudinal statistical research.

4.8 During the course of the audit, Human Services revised its Privacy Policy to include an explicit reference to ACIR collecting information from Medicare for enrolment and claiming purposes. The department also removed references to ACIR information being shared with the Centrelink program for determining eligibility for family assistance payments—although this practice remains in place.¹⁵⁴ The department advised the ANAO that this information was removed as it is otherwise covered under the relevant (family assistance payments) legislation and is also contained in an information booklet available to parents.

Staff training on privacy

4.9 While there is no ACIR-specific training, the ANAO noted that privacy training and awareness are core components of Human Services’ entity-wide induction training for all new staff. Additionally all departmental staff are required to complete mandatory re-fresher privacy training annually.¹⁵⁵

Informing parents of privacy arrangements

4.10 Human Services communicates its privacy practices to parents through a number of channels, summarised in Table 4.1.

Table 4.1: Human Services’ communication on ACIR privacy issues to parents

Source: ANAO analysis of Human Services information.

Note A: A child may also be enrolled using the Medicare enrolment application and the Aboriginal and Torres Strait Islander Medicare enrolment and amendment form. While both forms contain general privacy information and links to the department’s privacy policy, neither refers to enrolment in ACIR.

Note B: Due to system design, the child’s record will physically remain on ACIR.

4.11 The department’s current approach to advising parents of its policy relating to the collection and use of personal information relies on an interested parent accessing the department’s website, Privacy Policy, and other claim forms and booklets. A shortcoming of this approach is that parents have no single source of ACIR privacy information, and they are also not clearly advised of the two-way exchange of information between ACIR and Centrelink for the purpose of determining family assistance payments, and that ACIR continues to retain and use their personal information after a child turns seven.¹⁵⁶ There would be benefit in Human Services considering how best to inform parents of these aspects of the ACIR program.

Limits to the use and disclosure of ACIR information

4.12 The Health Insurance Act 1973 (the Act) provides that parents may limit the disclosure of their child’s information.¹⁵⁷ Under the Act, if a parent advises the Chief Executive Medicare that they do not wish to be notified when their child needs to be immunised, information about that child may not be disclosed to a provider, the department or a prescribed body.

4.13 While this option is not clearly communicated to parents in the department’s publicly available material (see Table 4.1), internal ACIR procedures advise departmental staff on handling requests from parents to limit the use of information held on the Register. In summary, parents may:

• ‘opt out’ of receiving correspondence, such as IHS, from ACIR; and/or
• ‘withdraw consent’ for their child to be identified in information released from the Register.

4.14 As at 30 June 2014, 177 ‘opt outs’ were noted in ACIR, and there were 20 instances recorded of consent having been withdrawn. In these cases the department advised that, based on current family assistance payment policy, it does not delete a child’s records from ACIR, and continues to update the Register until the child turns seven. The department further advised that, consistent with current policy for family assistance payments, ACIR continues to transmit information regarding the child’s immunisation status to Centrelink to determine, where relevant, if the child’s parent is eligible for family assistance payments.

Managing the release of information from ACIR

4.15 Public sector entities are responsible for managing access to sensitive information, and ensuring that information is only released to authorised parties. Human Services uses a mix of system controls and operational guidance, supported by staff training, to control access and manage the release of ACIR information.

4.16 A variety of stakeholders may seek access to ACIR information:

• The department’s Centrelink program seeks information on immunisation status to confirm parents’ eligibility for certain family assistance payments;
• ACIR program staff require access to ACIR to interrogate and update immunisation records, and to provide relevant information including to parents and providers;
• parents can access their child’s immunisation history by phone or through the myGov secure portal;
• providers can access information about one or more children by phone or via the ACIR secure portal;
• researchers and other third parties may seek access to ACIR information for public health, research, and other purposes; and
• government entities may access information for policy and planning purposes.

Release and use of ACIR information by the Centrelink program

4.17 ACIR records are used by the department’s Centrelink program to confirm a parent’s eligibility for some family assistance payments.¹⁵⁸ The department uses a mix of IT system controls, supplemented by manual checking, to verify relevant eligibility criteria for family assistance payments.

4.18 The department has established a data exchange process between ACIR and the Centrelink payment system (ISIS) to ‘link’ children that are mutual clients of both programs, so as to regularly update the immunisation status of children within ISIS. An automated daily data matching process attempts to synchronise relevant ISIS and ACIR records and transmit the relevant child’s immunisation status to ISIS. If the Register cannot automatically determine whether to match a record to the ISIS request¹⁵⁹ the match attempt is either returned to ISIS or assigned to an SO to manually check ACIR. The ANAO examined relevant ACIR operational reports for the period 12 October 2014 to 24 October 2014 and noted that, for this 12-day period, 1 420 records required manual checking.¹⁶⁰

4.19 To help address shortcomings in the daily automated process, Human Services undertakes a supplementary bi-annual data integrity exercise to identify and rectify discrepancies between ISIS and ACIR. This exercise was first conducted in May 2014, with a subsequent exercise conducted in November 2014.¹⁶¹ Human Services advised that for the November 2014 exercise, 99.54 per cent of records were able to be matched. While the biannual exercise assists in maintaining the integrity of information exchanged between the systems and provides opportunities for the analysis of the underlying causes, it is not a means to overcome persistent data synchronisation issues and related overheads. As previously discussed, the department should establish a pathway for the resolution of data synchronisation issues, incorporating a planned process and timetable, and introduce a quality control process for the manual review of data exchanged between ACIR and other departmental ICT systems.

Release of ACIR information by staff via telephony services

4.20 ACIR internal procedures set out, for the benefit of SOs, steps to verify a caller’s identity prior to releasing any ACIR information. The procedures also detail the information which may be disclosed. For example, the procedures state that the following is ‘information not to be divulged’: the child’s address, provider name or location, and Medicare number.

4.21 For information disclosed over the telephone to a provider, ACIR procedures note that, before releasing the information, the SO must obtain confirmation from the provider that they have parental consent to obtain immunisation information for the child. The ANAO observed inconsistent practices by SOs when asking providers for parental consent over the telephone and there is scope for the department to further reinforce information security procedures for ACIR telephony staff. The department advised the ANAO in February 2015 that this inconsistency would be included in its regular review of eReference and training procedures.

Release of information to parents (Immunisation History Statements)

4.22 An IHS is a statement available to parents that contains a record of their child’s immunisation history. An IHS can be used to assist in keeping track of their child’s immunisation or as evidence of their child’s immunisation status for school or childcare enrolment. Parents are able to access their child’s IHS online—via the myGov website—or in hard copy. The IHS sets out:

• the child’s personal details;
• the child’s current immunisation status;
• the immunisations received to date, including the date given, the brand name of the vaccine used, and the type of provider who administered the immunisation; and
• when the next immunisation/s (where relevant) are due.

4.23 To access their child’s immunisation history through the myGov website, parents must create their own user account and password. While the ACIR program does not administer myGov, the department has established appropriate controls that permit a valid user of myGov to access their child’s ACIR record until the child turns 14 years of age.

4.24 Human Services also automatically sends a ‘milestone’ IHS to parents when their child reaches a designated age or immunisation milestone.¹⁶² These milestones are: five days before the child turns 18 months of age; once a child has completed their four year immunisation schedule (or five days after the child’s fifth birthday if they have not yet received the scheduled immunisations for four year olds); and when a child is linked to another Medicare card.

4.25 Parents can obtain a copy of their child’s IHS via a number of channels. Table 4.2 outlines these channels and the number of IHS accessed.

Table 4.2: Channels through which an IHS was viewed or requested from 2010–11 to 2013–14

Source: ANAO analysis of Human Services data.

4.26 The use of electronic channels for accessing an IHS has grown strongly in recent years, with the number of statements viewed ‘online’ via the myGov portal growing three-fold between 2010–11 and 2013–14. However, the more traditional means of communication—face-to-face at a Medicare office, phone and hardcopy ‘milestone’ statements—continue to dominate how parents are obtaining an IHS.

4.27 The timing of the first milestone statement—five days before the child turns 18 months of age—means that it is likely that a large proportion of these children will not yet have received their scheduled 18 month immunisations at the time the statement is created. In consequence, parents may need to request another statement, soon after the 18 month vaccinations are then administered, if they require a more current and complete record. While acknowledging that the current practice of automatically issuing the IHS at this time may prompt parents to arrange relevant vaccinations, there is also the potential for duplication of work, and there may be merit in Human Services and Health reviewing the timing of these statements to ensure they provide the most benefit to parents.

Release of information to providers

4.28 Providers are also able to obtain ACIR-related information, subject to certain qualifications set out in the Health Insurance Act 1973. In summary, the provider: will only use the information for the purpose it is given; will not give the information to any other person; and will take appropriate precautions to safeguard the information.¹⁶³

4.29 Once registered with Medicare, providers are able to electronically access ACIR through a number of channels, including: via PMS; the ACIR secure portal; and the Health Professional Online Service (HPOS).

4.30 The ANAO reviewed the controls Human Services has in place to manage the release of information to providers. The department applies: user ID, password and access controls; and providers must give undertakings related to the use and disclosure of ACIR information, consistent with the legislative requirements mentioned in paragraph 4.28. The ANAO also reviewed the user group list for external providers and noted that no duplicate users were listed.

4.31 When accessing ACIR electronically, providers are required to accept certain terms and conditions which include responsibility for the appropriate use and disclosure of information, even should they cease to be a provider. System controls are also in place to verify that information submitted to ACIR is from an authorised user, and to encrypt information transmitted to ACIR to protect its integrity.¹⁶⁴ However, unlike the ACIR provider telephone line, there are no system controls (for example, an on-line declaration or other mechanism) to verify that providers have obtained parental consent to access a child’s immunisation information electronically. There would be benefit in Human Services considering how best to align its practices for telephone and electronic access.

4.32 Functionality exists within ACIR to limit access to information for providers who no longer require it.¹⁶⁵ Departmental staff may also manually revoke a provider’s access. As an additional security control, an online statement is automatically produced for providers who accessed the ACIR secure portal in the past month which outlines the date, time and activity undertaken. Providers are encouraged to review this statement to identify any unauthorised use made under their user identification.

4.33 ACIR produces a range of both de-identified and identified reports for providers registered to use the ACIR secure site.¹⁶⁶ These reports can be provided on request, and are also available from the ACIR secure site. Human Services advised the ANAO that by June 2015, providers should have access to a number of additional reports on children overdue for immunisation.

Release of ACIR information to third parties

4.34 External stakeholders—including state and territory governments and researchers—seeking to obtain Medicare information and ACIR data must first apply to Human Services. The department’s External Request Evaluation Committee (EREC) assesses these requests and has established a set of guidelines, the External Request Evaluation Committee Guidelines (the Guidelines), to govern its consideration of these requests.¹⁶⁷

4.35 The Guidelines outline a number of tests that need to be satisfied, including relevant legislative and policy requirements, before any information is approved for release.¹⁶⁸ The release of sensitive data held by Human Services must also meet requirements set out in the bilateral agreement between Human Services and Health.¹⁶⁹

4.36 Human Services advised that between July 2013 and September 2014, five requests for the release of ACIR data were referred to EREC for assessment. The ANAO’s review of relevant EREC documentation¹⁷⁰ indicated that while the Committee’s decisions were clearly documented, the EREC Minutes did not always specify which of the tests set out in the Guidelines were considered relevant.¹⁷¹ To improve the transparency of decision making and maintain the integrity of its EREC assessments, there would be benefit in Human Services clearly documenting the tests applied for each request.

4.37 The guidance for applicants¹⁷² does not indicate the expected timeframes for assessing requests, although it does note that data requests should be submitted as soon as possible to allow sufficient time for review, clarification, privacy clearance and information retrieval as these can be lengthy processes.¹⁷³ Stakeholders interviewed by the ANAO commented that ad hoc data requests were not always finalised in a timely manner and could also be costly.¹⁷⁴ For the requests reviewed by the ANAO, the time from the request being submitted to the requestor being advised of the decision ranged from two weeks to four months. The department advised that expected timeframes for delivering data in approved requests can vary significantly depending on the scope and complexity of the data sought, and whether the consent of participants is required.

Access controls to ACIR systems

4.38 Relevant ACIR program staff require access to the ACIR ICT systems—mainframe and secure portal—based on the need established by their particular duties. To provide visibility of user access to these systems, each staff member should have their own user ID. In addition, as a security measure, ACIR users’ access and relevant permissions are controlled separately by the department’s IT Security area.

4.39 The ANAO reviewed the ACIR user group list and identified that all users had a unique identifier.

4.40 In preparation for this audit, in June and August 2014, Human Services reviewed all internal users’ access to the ACIR mainframe and secure site¹⁷⁵, resulting in a large number of redundant users being removed from access to the ACIR systems. While this review was timely, it was not evident that there was a process in place to effectively monitor staff access to ACIR.¹⁷⁶ Human Services advised the ANAO in February 2015 that the department had implemented a bi-annual review of internal staff access to ACIR, to strengthen access controls over the ACIR database.

Conclusion

4.41 ACIR contains private and sensitive information used to: assist parents and providers in managing childhood immunisations; and inform public health policy and planning. To manage the use of ACIR information and promote the consistent application of applicable legislative obligations and departmental processes, Human Services has established relevant system controls, as well as internal policies, guidance materials and training for ACIR staff.

4.42 The department’s current approach to advising parents of its policy relating to the collection and use of personal information relies on an interested parent accessing the department’s website and Privacy Policy. The ANAO’s review of privacy information appearing on the Human Services website indicated that parents are not clearly advised of: the two-way exchange of information between ACIR and Centrelink for the purpose of determining family assistance payments; and that ACIR retains and uses information after a child turns seven. There would be benefit in Human Services considering how best to inform parents of these specific aspects of the ACIR program.

4.43 While controls are in place to manage access to information by authorised immunisation providers, the ANAO’s review of key access controls indicated that there was not a process in place to effectively monitor staff access to ACIR. To strengthen access controls over the ACIR database, there would be merit in Human Services establishing a process to review internal user access privileges at appropriate intervals, so that only those staff with a job requirement to access the ACIR system and secure portal are able to do so. The ANAO also observed inconsistent practice in the implementation of some information security procedures—in particular, staff satisfying themselves that an immunisation provider had secured parental consent prior to the department releasing ACIR information by telephone. There is scope to further reinforce information security procedures for ACIR telephony staff.

4.44 Eligibility for some Centrelink payments is dependent on a child’s immunisation status, and ACIR data is accessed for this purpose. The department has established an automated daily process to detect mutual clients of the ACIR and Centrelink programs, so as to update ISIS with a child’s current immunisation status. To overcome known shortcomings with the automated process, Human Services conducts a daily manual reconciliation process supplemented by a bi-annual data integrity exercise to identify and rectify discrepancies in information held on the two systems. While the biannual exercise assists in maintaining the integrity of information exchanged between the systems and provides opportunities for the analysis of the underlying causes, it is not a means to overcome persistent data synchronisation issues and related overheads. As previously discussed, the department should establish a pathway for the resolution of data synchronisation issues, incorporating a planned process and timetable, and introduce a quality control process for the manual review of data exchanged between ACIR and other departmental ICT systems.

4.45 Human Services has established a process for external parties to request access to personal and sensitive information, including ACIR data. The ANAO’s review of relevant ACIR data requests from 2013–2014 indicated that the department had not consistently recorded which assessment criteria were applied when granting access to ACIR data. To maintain the integrity of access procedures, there is scope to refine the current approach to recording departmental assessments and decisions relating to data requests from third parties.

Appendices

Please refer to the attached PDF for the Appendices:

• Appendix 1: Entity Responses
• Appendix 2: International Immunisation Registers
• Appendix 3: 2014 Revised ACIR KPIs in the Agreement

 

Abbreviations

Glossary