2009 Fall Report of the Auditor General of Canada

Chapter 4—Electronic Health Records

Main Points

Introduction

Definition of an electronic health record
Canada’s model for shared responsibility
How Canada Health Infoway is funded
Focus of the audit

Observations and Recommendations

Setting the direction

Appropriate governance mechanisms are in place
Infoway’s strategic plans and activities are consistent with the funding agreements
Infoway’s goal for implementation of electronic health records needs to be clearly defined
Infoway identified risks to realizing its goal and strategic plans
Infoway has policies that govern spending but some controls need strengthening

Funding electronic health records projects

Infoway approves projects that are consistent with its strategic plans
Infoway monitors the progress of projects but needs to better document analyses of project deliverables
Infoway does not have sufficient assurance that standards are correctly implemented
Infoway has taken reasonable steps to maximize its use of funds for projects

Reporting on results

Additional information on progress achieved is needed

Being accountable to Parliament

Health Canada needs to further develop its approach to monitoring

Meeting important challenges

Meeting the 2010 goal
Upgrading systems to achieve compatibility
Implementing electronic medical records
Using new consumer health solutions
Ensuring the privacy and security of personal health information

Conclusion

About the Audit

Appendix—List of recommendations

Exhibits:

4.1—Systems that support an electronic health record, including expenditures and commitments as of 31 March 2009

4.2—Funds provided to Infoway by the federal government

4.3—Roles of parties in Infoway’s governance

Main Points

What we examined

Canada Health Infoway Inc. (Infoway) was created in 2001 as a federally funded, not-for-profit corporation to lead the national development of electronic health records (EHRs). Infoway’s goal is to ensure that, by 2010, every province and territory and the populations they serve will benefit from new health information systems that will help transform their health care system. Furthermore, Infoway’s stated goal is that 50 percent of Canadians will have their electronic health record available to their authorized health care professionals by 2010, and 100 percent by 2016.

Health Canada transfers funds to Infoway based on funding agreements that specify the obligations of each party. Infoway has been granted $1.6 billion by the federal government. Infoway has allocated $1.2 billion to invest jointly with the provinces and territories in projects to accelerate the development and use of compatible EHRs across Canada, and $400 million for other related priorities. It is the role of the provinces and territories to propose the projects to Infoway for funding and to implement them. Thus, Infoway’s ability to achieve key outcomes in its funding agreements depends on the collaboration of the provinces and territories.

We examined how Infoway manages funds from the federal government to achieve its goal of making compatible electronic health records available across Canada. In addition, we looked at the role of Health Canada, the sponsoring department, in ensuring that Infoway complies with the agreements under which it receives funding from the Department. For the most part, the audit focused on the fiscal years 2006–07 and 2007–08. Audit work for this chapter was substantially completed on 30 April 2009.

Concurrent with our audit, six provincial audit offices audited how electronic health records funded by Infoway and/or provincial governments are being implemented in their respective provinces. The provincial audit offices will each report separately; a joint summary report on all of the audits will be issued in 2010.

Why it’s important

Electronic health records (EHRs) are intended to offer solutions to a number of persistent problems in Canada’s health system, some of which can be attributed to the use of paper-based health records. With EHRs, it is expected that health care professionals would be better able to share patient information, thus avoiding unnecessary or duplicate diagnostic tests, multiple prescriptions, and the risk of adverse drug reactions. Ultimately, the use of EHRs could reduce patient wait times, reduce costs, and save lives. From its inception in 2001 until 31 March 2009, Infoway had spent $614.9 million on this initiative, and had committed an additional $614.2 million, for a total of $1.2 billion. Some experts have estimated the total cost of implementing EHRs Canada-wide at over $10 billion, and Infoway concurs.

What we found

  • Infoway has accomplished much in the eight years since its creation. Using the funding agreements with Health Canada as a starting point, Infoway developed an approach to providing for compatible electronic health records by identifying the key requirements and components of an EHR and developing a blueprint for the design of health information systems. It consulted widely with partners and stakeholders to obtain their input and support. In addition, it established appropriate governance mechanisms and developed a risk management strategy. It has implemented appropriate management controls for operational spending, although controls for contracting for goods and services need to be strengthened.
  • In the 29 EHR projects we examined, Infoway had ensured that provinces and territories designed the projects to comply with requirements such as its blueprint and standards. It had also identified project-specific risks and was monitoring them, as well as other problems that arose during the life of the project. However, Infoway has not obtained the results of conformance testing on EHR systems. This means it does not have sufficient assurance that standards have been implemented as required.
  • Infoway has made considerable efforts to report on the progress of the EHR initiative. It reports progress toward its 2010 goal as the percentage of Canadians living in provinces or territories where an EHR is available to their health care professionals. However, it has not reported on other indicators of progress, such as the extent to which completed systems meet requirements for compatibility. Nor does it report on the adoption or use of completed systems by health care professionals, although it considers low adoption rates a serious risk to the EHR initiative.
  • As the sponsoring department, Health Canada periodically obtains assurance through audits and evaluations that Infoway is complying with the funding agreements. However, at the time of the audit, the Department still had not fully developed the monitoring framework it approved in 2008 to manage risks associated with such large amounts of funding and to strengthen ongoing monitoring of the Corporation.

The entities have responded. The entities agree with all of our recommendations. Their detailed responses follow the recommendations throughout the chapter.

Introduction

4.1 Each year in Canada, hundreds of millions of health care-related transactions occur. Almost all involve handwritten records. This critical information is filed in doctors’ offices and clinics, and in nearly 1,000 hospitals. In September 2000, the first ministers unanimously agreed “to work together to strengthen a Canada-wide health infostructure to improve quality, access and timeliness of health care for Canadians” and committed to developing electronic health records.

4.2 To meet this commitment, Canada Health Infoway Inc. (Infoway) was created in 2001 as a not-for-profit corporation at arm’s-length from the government. It works with the provinces and territories to foster and accelerate the development and adoption of electronic health records across Canada.

Definition of an electronic health record

4.3 An electronic health record (EHR) is a secure and private lifetime record that describes a person’s health history and care. Such a record would be available electronically to authorized health care professionals anywhere and anytime to support the provision of high-quality care.

4.4 The terms electronic health record and electronic medical record (EMR) are often interchanged. However, in the context of this audit, they must be clearly distinguished. An EHR refers to a person’s health record that can be accessed online from many separate, compatible systems within a network. An EMR refers to an electronic patient record that can be accessed from a single system in a doctor’s office and that may, or may not, be shared with other health care professionals.

4.5 An EHR that is fully functional will allow health care professionals to view and update a patient’s health record. The EHR would include a person’s

  • age, address, and other personal details;
  • diagnostic imaging, drug, laboratory, hospital, and clinical reports;
  • infectious disease and immunization records; and
  • other health information.

4.6 To implement an EHR, Infoway has determined that the core systems described in Exhibit 4.1 must be in place.

Exhibit 4.1—Systems that support an electronic health record, including expenditures and commitments as of 31 March 2009

Name of system Expenditures ($ millions) Commitments ($ millions) Total ($ millions)

Registries

Client Registry—A list of all patients and their relevant personal information, such as names and addresses.

Provider Registry—A list of participating health care professionals who are authorized to use the system.

When completed by all jurisdictions, these registries will uniquely identify all Canadians and their doctors.

100.0 32.2 132.2

Diagnostic Imaging System (DI)

A system that electronically collects, stores, manages, distributes, and displays a patient’s images and reports, such as X-rays, ultrasounds, MRIs, and CT scans. All this information would exist in digital format, without the need for film.

217.1 118.5 335.6

Drug Information System (DIS)

A system that allows health care professionals to access, manage, share, and safeguard a patient’s medication history. For each new prescription, the system will check for allergy alerts and drug-to-drug interactions against a complete medication profile.

101.4 140.1 241.5

Laboratory Information System (LIS)

No matter where a patient is tested, this system will allow laboratory technicians to enter results into a database. Test results will be linked to the patient’s EHR and will give health care professionals more information to aid in diagnosing and treating patients.

71.8 92.5 164.3

Interoperable Electronic Health Record (iEHR)

This system will allow authorized health care professionals to view and, in some cases, to update a patient’s essential health information.

Interoperable refers to a system that has the ability to work with other systems or products. If they weren’t part of an interoperable electronic health record (iEHR), the registries, diagnostic imaging, drug information, and laboratory information systems would be unable to send or receive information from health care professionals.

124.6 230.9 355.5

Total

614.9 614.2 1,229.1
Source: Adapted from Infoway information

4.7 In creating EHRs, thousands of systems will need to be integrated. As a result, the implementation of an EHR system is an expensive, long-term initiative. Since its creation in 2001 until 31 March 2009, Infoway had spent $614.9 million on various EHR projects from the systems described in Exhibit 4.1 and had committed an additional $614.2 million, for a total of $1.2 billion. Some experts have estimated the total cost of implementing EHRs in Canada to be more than $10 billion. Infoway concurs with this estimate.

4.8 The development and implementation of EHRs is no simple matter. Canada’s health care system is huge. Millions of encounters between patients and health care professionals occur each day. According to Infoway, about 2,000 health care transactions happen per minute in Canada. Many are quite complex and all involve documentation and information flow. Each year there are

  • 440 million laboratory tests performed,
  • 382 million prescriptions filled,
  • 322 million visits to doctors’ offices,
  • 35 million diagnostic images taken, and
  • 2.8 million hospitalizations.

4.9 Electronic health records are intended to provide solutions to a number of persistent problems in Canada’s health system, some of which may be caused by the use of paper-based health records. Records in electronic form are more likely to be legible, available when needed, and more easily and quickly retrieved and made available. Other potential benefits include the following:

  • For patients—improved health care and decreased risks (such as fewer adverse drug reactions); lower chance of having duplicate, invasive, or expensive tests; and shorter waiting lists.
  • For health care professionals—an integrated view of patient data and the ability to make better decisions, thanks to up-to-date patient information.
  • For health administrators—reduced health care costs and improved health care quality.
  • For governments—support for improved long-term planning and improved health resource allocation.

In short, EHRs are expected to reduce costs, improve quality of care, and help save lives.

Canada’s model for shared responsibility

4.10 Infoway. Infoway describes its role as that of a “strategic investor” that makes focused investments to spur the development of EHRs across the country. It works with the provinces and territories, which are responsible for delivering health care, in setting a national direction, and it helps to ensure that provincial and territorial strategies are aligned with national priorities.

4.11 Infoway funds projects with its provincial and territorial partners, paying 75 percent of eligible costs. It also participates in project planning, and monitors the progress of projects and the quality of deliverables by using a “gated funding model.” Provinces and territories are reimbursed only when specific milestones, or “gates,” have been achieved. Provinces and territories usually receive 20 percent of project funding when a legal agreement for a project is signed and 30 percent of funding after Infoway has approved various project deliverables, such as project charters and system design documents.

4.12 The most significant gate in Infoway’s funding approach is the “adoption gate,” which requires provinces and territories to show that certain core systems of an EHR have been adopted by health care professionals. Adoption criteria, which are the expected use of a core system by targeted health care professionals, are established for each project, such as a diagnostic imaging, laboratory, or drug information system. For example, adoption occurs when a hospital certifies that it no longer uses film for diagnostic imaging. When adoption criteria are achieved, Infoway reimburses the final 50 percent of the project’s approved budget. Linking 50 percent of project funding to the adoption of a core system provides some assurance to Infoway that EHR systems are beginning to be used, but it provides no assurance of widespread or ongoing use.

4.13 Although each province and territory will have an EHR system adapted to its needs, it is important that provincial and territorial systems are based on an agreed set of principles and characteristics. To this end, Infoway collaborated with its partners on a design of health information systems for EHRs, called the Electronic Health Record Solution (EHRS) Blueprint (the Blueprint). Released by Infoway in 2003, the Blueprint provided a vision of how EHR information could be securely and appropriately shared across Canada using information and communications technologies. Revised in 2006, the Blueprint now provides more detail on how standards can support the sharing of health information and comply with federal, provincial, and territorial requirements, as well as privacy and security requirements across jurisdictions. Infoway believes that provincial and territorial alignment with the Blueprint and compliance with standards are essential to achieving EHRs that are compatible across the country.

4.14 Infoway has also guided the development of standards through the Standards Collaborative. The Collaborative has developed standards for each core system of an EHR. This was done by consulting health care professionals, software vendors, and representatives from the provinces and territories. Standards for the registries, diagnostic imaging, and drug information systems have been ready to use since 2006. Standards for laboratory information systems and interoperable EHRs have been available since 2007.

4.15 Although Infoway takes steps to ensure that projects align with the privacy and security requirements outlined in the Blueprint, it has no responsibility for ensuring that systems comply with any privacy laws.

4.16 Provinces and territories. The provinces and territories are responsible for developing their own EHR strategies and ensuring that they align with the Blueprint. Projects proposed by the provinces and territories and approved by Infoway are cost-shared, with Infoway paying 75 percent of eligible costs. Provinces and territories are responsible for implementing the projects and, because the total amount of funding to be provided by Infoway is capped when projects are approved, the provinces and territories assume all the risk of cost overruns.

4.17 The provinces and territories are responsible for the operating and maintenance costs of EHR systems. They also provide funds to regional health authorities and hospitals to cover other EHR initiatives not eligible for Infoway funding. The provinces and territories are responsible for ensuring that the implemented EHR systems comply with their own privacy laws.

4.18 The provinces and territories are also responsible for helping doctors, nurses, pharmacists, and other health care professionals understand and use EHRs. This is critical in private offices or clinics, where few have shifted from paper-based patient records to electronic records. The success of implementing EHRs depends on the willingness of health care professionals to use the systems, and it is the responsibility of the provinces or territories to directly inform and gain support from them.

4.19 Health Canada. Health Canada is the federal department that sponsors Infoway. It negotiated the funding agreements and prepared the related Treasury Board submissions. As the federal signatory to the agreements, Health Canada’s role is to ensure compliance with the funding agreements’ provisions. The Minister must account to Parliament for the effective ongoing administration of the agreements and the reporting of plans and results.

How Canada Health Infoway is funded

4.20 The federal government has granted a total of $1.6 billion to Infoway in a series of funding agreements (Exhibit 4.2).

Exhibit 4.2—Funds provided to Infoway by the federal government

Year Amount
($ millions)
Purpose
2001 500 Provide support for electronic health records (EHRs) and Telehealth
2003 600 Provide additional support for EHRs and Telehealth
2004 100 Provide support for public health surveillance
2007 400 Continue work on EHRs and related priorities (such as wait times support)
Source: The Canada Health Care, Early Childhood Development and Other Social Services Funding Act, 2000, and Budget Implementation Act, 2003, 2004, and 2007.

4.21 As Exhibit 4.1 shows, Infoway had spent about $614.9 million and committed just over $614.2 million in funding in support of EHRs as of March 2009. Infoway has also expended $212.4 million and committed another $134.7 million for other programs such as Patient Access to Quality Care, Public Health Surveillance, and Telehealth. The Budget Implementation Act, 2009, authorizes the payment of $500 million to Infoway for the implementation of EHRs. Some of the funds would go toward implementing EMR systems for doctors and connecting patients and points of service such as hospitals, community care facilities, and pharmacies. However, there is no funding agreement yet for this amount.

Focus of the audit

4.22 Our audit focused on whether Infoway is exercising due regard in managing funds from the federal government to achieve its goal related to implementation of EHRs that will be compatible across Canada, and whether Health Canada is ensuring that Infoway is complying with the funding agreements. We examined funding of projects in the five core systems that make up an EHR: registries, diagnostic imaging systems, drug information systems, laboratory information systems, and interoperable electronic health records (iEHRs).

4.23 We also examined the governance structure, selected management controls (executive compensation, executive travel and hospitality, and contracting for goods and services), and the appropriateness of Health Canada’s accountability arrangements under the various funding agreements. For the most part, our audit covered the 2006–07 and 2007–08 fiscal years. In some instances, such as the review of funded projects, we went back further.

4.24 We did not audit other systems, such as Infrastructure, Innovation and Adoption; Patient Access to Quality Care; Public Health Surveillance; and Telehealth because they are not among the five core systems of an EHR listed in Exhibit 4.1.

4.25 More details on the audit objectives, scope, approach, and criteria are in About the Audit at the end of this chapter.

Observations and Recommendations

Setting the direction

4.26 Infoway’s funding agreements call for the Corporation to provide effective management and stewardship of the $1.6 billion allocated to it since 2001. We examined the governance mechanisms that allow Infoway to carry out its mandate and objectives. We expected Infoway to have clearly defined roles and responsibilities for the parties within the governance structure, and to have an independent Board of Directors that uses appropriate practices in exercising its stewardship role.

Appropriate governance mechanisms are in place

4.27 We reviewed documentation related to the governance structure, including the Board of Directors’ Charter, the terms of reference for the Board’s committees, and the Board and Committee minutes and packages since March 2006. As well, we interviewed the Chair and the Vice-Chair of the Board, and two other directors. We found that the roles and responsibilities are clearly defined (Exhibit 4.3).

Exhibit 4.3—Roles of parties in Infoway’s governance

Party Role

Members

Federal, provincial, and territorial deputy ministers of health

  • Appoint external auditors and review financial statements
  • Appoint seven directors to the Board, who may but need not be government employees
  • Elect six directors at large, who shall not be government employees

Board of Directors

Two federal appointees

Five provincial or territorial appointees

Six elected directors at large

  • Reviews and approves, as need be, the organizational structure, strategic planning processes, risk management, and corporate policies
  • Oversees finance and audits
  • Provides advice and counsel to management on critical or sensitive issues
  • Appoints the President and Chief Executive Officer (CEO) and approves his or her compensation
  • Approves funding of projects over a monetary threshold and oversees the quality and integrity of projects funded
Board Committees  

Governance Committee

  • Assists the Board in fulfilling its obligations by providing a focus on corporate governance, with a view to enhancing the Board’s performance

Finance, Investment, and Audit Committee

  • Assists the Board in fulfilling its oversight of the financial affairs of the Corporation, investment of the financial assets, effective internal controls and financial reporting, audits and risk management functions, public accountability, and corporate compliance with laws and regulations and the Code of Business Conduct

Compensation and Human Resources Committee

  • Serves as an advisory committee and assists the Board in discharging its responsibilities that relate to compensation, organization structure, and executive staffing
Officers and Management  

President and CEO and executive team

 

  • Executes strategies and plans approved by the Board
  • Is accountable for meeting performance targets and goals set by the Board
Source: Adapted from Canada Health Infoway, Annual Report 2007–2008, page 29

4.28 The Board’s role is to provide independent judgment on a broad range of issues. It is responsible for, among other things, ensuring that the Corporation operates in a manner that preserves its financial integrity and in accordance with the by-laws, funding agreements, applicable laws, and policies approved by the Board. Board members are required to comply with all corporate policies, including the Code of Business Conduct and the Conflict of Interest Policy. In line with this, directors sign forms each year in which they attest to their independence. Directors we interviewed informed us that those who declare a potential conflict of interest do not participate in any discussion of that issue at Board meetings, nor do they vote on the matter. Our review of the meeting minutes supports this assertion. Thus, we found that the Board of Directors demonstrates independence and that appropriate measures are in place to deal with conflicts of interest.

4.29 In order to determine whether the Board uses appropriate practices in exercising its stewardship role, we conducted a literature search and identified good practices for boards. We noted that Infoway’s Board and committees follow several of these practices, such as

  • reviewing and approving strategic plans;
  • monitoring Infoway’s performance;
  • overseeing management performance evaluations and compensation;
  • obtaining independent advice on compensation packages;
  • holding in camera sessions, without management present, when issues such as executive compensation and audits are discussed;
  • reviewing the succession plan for the executive team;
  • ensuring that appointments to the Board are staggered; and
  • periodically reviewing the performance of the Board.

4.30 Based on our audit work, we concluded that Infoway’s Board of Directors uses appropriate practices in exercising its stewardship role.

Infoway’s strategic plans and activities are consistent with the funding agreements

4.31 The funding agreements require Infoway to prepare an annual corporate plan including a budget, objectives, and expected outcomes. In order for Infoway to achieve its objectives, it must develop and implement strategic plans and activities that will lead to electronic health records (EHRs) that are compatible across the country and consistent with the expectations of the federal, provincial, and territorial governments.

4.32 We expected Infoway to implement strategic plans based on the funding agreements. We also expected Infoway to implement operational plans to realize its strategic plans.

4.33 We examined Infoway’s strategic documents, such as the corporate business plans (for the 2007–2008, 2008–2009, and 2009–2010 fiscal years), the Blueprint, and Infoway’s strategic framework, Vision 2015. We found that Infoway produces strategic plans consistent with the purpose, objectives, and conditions set out in the funding agreements. These plans identify priorities along with measurable goals and targets. The Corporation has also set indicators and targets to measure progress on achieving the goals of these plans.

4.34 We also found that Infoway has developed an approach to implementing EHRs, using the funding agreements with Health Canada as a starting point. Infoway has annual operational plans and budgets, and investment strategies for each EHR system. These documents are consistent with the strategic plans and have measurable goals and targets to assess performance.

Infoway’s goal for implementation of electronic health records needs to be clearly defined

4.35 Infoway’s goal consists of two elements:

  • By 2010, every province and territory and the populations they serve will benefit from new health information systems that will help transform their health care system.
  • By 2010, 50 percent of Canadians and, by 2016, 100 percent will have their electronic health record available to their authorized health care professionals.

4.36 Achievement of the first element means that every jurisdiction will have at least one system in place. With respect to the second element, Infoway officials told us that having EHRs “available” does not necessarily mean that they are being used or that they are compatible across the country. We did not find this clearly explained in Infoway’s business plans or annual reports.

4.37 We are concerned that the way the 2010 goal is stated may lead Canadians to believe that, when achieved, 50 percent of them will have an EHR that is used by their health care professionals and shared within and, if necessary, across jurisdictions.

4.38 Recommendation. To ensure Parliament and Canadians properly understand Infoway’s goal, the Corporation should further explain in its public reports what is meant by having an electronic health record available to authorized health care professionals.

Infoway’s response. We agree with the recommendation and we will make additional efforts to elaborate on the goal of having an electronic health record available to authorized health care providers in our public reporting commencing with our 2009–10 Annual Report and/or the 2010–11 Corporate Business Plan. Implementation of electronic health records is a complex task, as is reporting on progress. We have made continuous improvements to progress reporting and will continue to enhance our reporting in the future. Infoway reports on a regular basis jurisdictional progress to making electronic health records available to Canadians. For example, we provide members of Parliament and Senators with copies of our Annual Report and Corporate Business Plan. We also post these materials on our website to help ensure the broadest possible distribution to Canadians.

Infoway identified risks to realizing its goal and strategic plans

4.39 Developing and implementing EHRs that are compatible across Canada is a complex and challenging task that involves the collaboration of many stakeholders and the integration of thousands of existing health information systems. Identifying and effectively managing the risks to this initiative are critical if Infoway is to fulfill its mandate and achieve its goal.

4.40 In accordance with the funding agreements, we expected Infoway to have identified corporate risks that need to be managed so that it can realize both its goal and the objectives set out in its strategic plans.

4.41 We found that Infoway has developed a Corporate Risk Management Framework and a risk management system to address risks identified in its strategic plans. The Framework describes risks to the achievement of the Corporation’s goal, the likelihood of each risk occurring, and the potential impact of each risk. According to Infoway, its highest risks are

  • failure to achieve the 2010 goal;
  • privacy or security breaches of EHR systems;
  • failure to achieve interoperable, replicable, and reusable systems that implement standards;
  • vendor resistance to adoption of standards;
  • slow adoption of EHR systems by health care professionals; and
  • failure to deliver projects on time, within budget, and of the quality or performance expected.

4.42 The Framework presents the mitigation strategies that Infoway can use, given its mandate, to address these risks. It is regularly updated and presented to and discussed by the Finance, Investment, and Audit Committee and the Board of Directors.

Infoway has policies that govern spending but some controls need strengthening

4.43 We examined Infoway’s policies with respect to executive compensation, executive travel and hospitality, and contracting for goods and services. Treasury Board policies do not apply to Infoway because it is not a government department or agency. Infoway has therefore established its own policies in these areas. We also examined the appropriateness of the management controls in place to ensure that these costs are managed in accordance with these policies. For the 2007–08 fiscal year, compensation for the executive team was $3.9 million. Travel and hospitality for the four executives included in our sample was $266,000. The value of the contracts in 2007–08 for operating, program, and project costs, including the related amendments and extensions, was $13.2 million.

4.44 Executive compensation. Infoway’s Compensation Policy states that it will develop and maintain salary practices and procedures that provide an effective means of controlling salary expenditures while being responsive to changing market conditions. Thus, we expected Infoway to have established executive compensation packages, in accordance with its policies, that reflect due consideration for comparable benchmarks and the principles of prudence and probity.

4.45 We found that Infoway’s policies reflect the principles of prudence and probity and give due consideration to comparable benchmarks. We also found that the policies had been followed in establishing the compensation packages. Some of the supporting management controls over executive compensation include the following:

  • compensation is governed by a strategy and policy approved by the Board;
  • market surveys (to compare compensation rates in similar organizations) are conducted every two years by an independent compensation consulting firm;
  • the President and CEO’s compensation package is approved by the Board; and
  • individuals’ objectives are linked to corporate objectives at the start of each year and performance is assessed annually based on those objectives.

4.46 We tested the management controls and the way the compensation policy was applied by examining the files of half of the executive team. We found that the controls were adequate to ensure compliance with the policies.

4.47 We also examined the disclosure of information related to executive compensation. Section 7.1 of the 2007 Canada Health Infoway Funding Agreement with the federal government requires Infoway to disclose in its annual report the total amount paid to its management team. In its 2007–2008 Annual Report, Infoway stated that the total remuneration of the management team for the fiscal year ended 31 March 2008 was $3.9 million. This represents the base salary, car allowance, performance bonus, retention bonus, and RRSP or pension contributions for nine full-time equivalents.

4.48 Executive travel and hospitality. Infoway has established policies for travel as well as hospitality and gifts. Thus, we expected Infoway to ensure that travel and hospitality expenses are managed in accordance with its policies. We compared Infoway’s policies with those of the Treasury Board of Canada. While not binding on Infoway, the Treasury Board policies provide a relevant point of comparison. We noted that the travel policy provisions were similar in all important respects, except that Infoway’s policy requires verbal rather than written approval of the supervisor prior to travel. In comparing the hospitality policies, we noted that Infoway’s policy does not specify dollar limits as does the federal policy. Instead, Infoway’s policy states that the reasonableness of expenses should be in accordance with its Code of Business Conduct.

4.49 We examined travel and hospitality claims selected at random from the 2007–08 fiscal year and found that the policies had been followed in all important respects and that appropriate management controls were in place.

4.50 Contracting for goods and services. Infoway has established a procurement policy for the acquisition of goods and services. Thus, we expected Infoway to ensure that contracts for goods and services are managed in accordance with its policy. We were told that the procurement policy was adapted from several organizations’ policies, including the federal government’s. We compared Infoway’s policy with those of the Treasury Board of Canada. We noted that the federal policy specifies monetary thresholds above which contract amendments must be competitively awarded. Infoway, however, does not require that contract amendments be competitively awarded if the initial contract was competitively awarded.

4.51 Infoway’s procurement policy and guidelines specify a number of management controls, including signing authorities and thresholds for approvals. They also require that management decisions to forgo competitive bidding be disclosed to the Finance, Investment, and Audit Committee of the Board of Directors.

4.52 To test the effectiveness of these controls, we examined a sample of 30 contracts chosen at random and all 5 contracts that were exempt from competitive bidding, as per Infoway’s policy, because of the contractors’ unique and specialized expertise. These contracts were for goods and services obtained in the 2006–07 and 2007–08 fiscal years. We found control weaknesses that create an increased risk of contract disputes or deliverables that may not meet Infoway’s expectations. For example,

  • 13 of the 35 contracts we reviewed were put in place after work began or was completed (often by several weeks); and
  • 14 of the 35 contracts in our sample were amended; of the 14 contracts, 10 were amended three to seven weeks after the original contract or amendment had expired.

4.53 Recommendation. Infoway should review and strengthen its management controls over contracting for goods and services to reduce the risk of contract disputes.

Infoway’s response. We agree to review and analyze current practices to strengthen management controls. Improvements to management controls related to the timing of contract signatures will be put in place by the end of the 2009–10 fiscal year. We do not pay any invoice unless the contract is acceptably executed and the Infoway manager has certified that the product or service has been appropriately delivered by the contractor.

4.54 Amending contracts for goods and services. Infoway’s policy does not require information concerning amendments to contracts awarded competitively to be reported to the Board’s Finance, Investment, and Audit Committee. We found that 8 of the 35 contracts we examined were, in accordance with the policy, amended several times without using a competitive process. This raised their value significantly. In one particularly significant instance, we found that a one-year contract for $144,000, originally competitively awarded, was amended five times over two and a half years, raising its total value to $726,000. In our opinion, this practice is not conducive to the fair and transparent awarding of contracts and it raises questions about the appropriateness of Infoway’s contracting policy. Also, not reporting significant contract amendments to the Committee restricts its ability to monitor the effectiveness of internal controls and its members from exercising their duties as directors.

4.55 Recommendation. Infoway should review its contracting policy with respect to contract amendments and extensions to ensure fairness, transparency, and disclosure to the Board.

Infoway’s response. We agree to review the contracting policy with respect to amendments and extensions and to present the proposed revisions to the Board for approval prior to the fourth quarter of the 2009–10 fiscal year.

Infoway’s Board-approved contracting policy was developed to respond to competitive market conditions and the often unique and rare combination of skill sets required to deliver the Corporation’s mandate. The current policy reflects the necessary balance between market competiveness, the Corporation’s business requirements, and due respect for the expenditure of public funds. We are compliant with the current policy related to the tendering of amendments and extensions and the reporting of those amendments and extensions to the Board of Directors.

Funding electronic health records projects

4.56 Since it was founded in 2001, Infoway has approved about $1.2 billion in funding for projects related to the five core systems of an electronic health record (EHR) (Exhibit 4.1). Most of these projects are cost-shared with the provinces and territories and involve projects critical to the success of Infoway’s goal of 50 percent of Canadians having an EHR available to their authorized health care professionals by 2010 and 100 percent by 2016.

4.57 Infoway approves each project based on the project’s potential for success and commitment to satisfying requirements, such as aligning with the Blueprint and complying with standards. It funds projects using a gated funding model that ties reimbursement to the achievement of project milestones. As mentioned in paragraph 4.12, for most EHR projects, 50 percent of the funding Infoway reimburses to the provinces and territories is directly tied to adoption of systems that it funded.

4.58 We reviewed 29 projects approved by Infoway. We chose the sample from those projects that are deemed to be core systems for an EHR: registries, diagnostic imaging systems, drug information systems, laboratory information systems, and interoperable electronic health records (iEHRs). From the Corporation’s inception in 2001 to 31 March 2009, the projects we chose to review accounted for $886 million or 72 percent of funding approved by Infoway for investment in the five core systems.

Infoway approves projects that are consistent with its strategic plans

4.59 We expected Infoway to ensure that it funds projects consistent with its strategic plans and, most importantly, the Blueprint.

4.60 We found that Infoway has established and consistently applied an approval process that assessed proposed projects against the requirements for EHRs that are compatible across the country. The Corporation has also established legal agreements for each project with the provinces and territories, to provide Infoway with greater assurance that the requirements will be respected.

4.61 To ensure that projects address issues related to privacy and security, and to satisfy the terms of its funding agreements with Health Canada, Infoway requires jurisdictions to submit, or make available for review, privacy impact assessments (PIAs) for projects that will ultimately involve personal health information. Infoway examines these assessments to ensure that projects have addressed their privacy and security requirements. In those projects we examined that required PIAs, we found that the jurisdictions had submitted them, or made them available, to Infoway for review.

4.62 We also found that project documentation submitted to Infoway at the time of approval outlined how all the projects we reviewed would comply with standards and align with the Blueprint, or would do so over time. Requirements related to standards and the Blueprint were also included in project statements of work.

Infoway monitors the progress of projects but needs to better document analyses of project deliverables

4.63 We expected Infoway to monitor the progress of EHR projects to ensure that project objectives are achieved and project risks are managed.

4.64 We found that Infoway has established a process for monitoring its funding of projects, but the process could be better documented and more steps could be taken to ensure that its requirements are satisfied.

4.65 Documentation of project deliverables and analyses. Infoway obtains most of its information on the progress of its projects through progress reports submitted by the provinces and territories. It also stays informed of progress by reviewing project deliverables, being part of project steering committees, and communicating informally with the provinces and territories.

4.66 Infoway’s project managers compile the information obtained through these methods into monthly project status reports. These reports assess how well a project is progressing against the approved plan. They also provide a current assessment of various risks and issues that may have an impact on the project.

4.67 We reviewed project status reports prepared by Infoway and found that project management teams are monitoring issues and risks. We also found that Infoway had established and consistently followed its process for reviewing and approving project deliverables. However, we noted that analyses to support the approval of project deliverables were not always fully documented. Because the approval of project deliverables is tied to the release of funds, often worth hundreds of thousands of dollars, analyses to ensure that the project requirements have been met and that acceptable quality has been achieved ought to be better documented to ensure accountability and transparency.

4.68 Recommendation. To ensure accountability and transparency, Infoway should better document its analyses of project deliverables to support its decision to release funds.

Infoway’s response. We agree that there is scope for improvement to deliverables documentation and the Corporation will address this issue immediately. This will build on Infoway’s documentation process and methodology for the approval of deliverables, including the third-party claims verification process that assesses the adequacy and effectiveness of the policies, controls, and systems in place for the management of Infoway-funded projects.

Infoway does not have sufficient assurance that standards are correctly implemented

4.69 Conformance testing. As a condition of funding, Infoway requires projects to comply with standards and align with the Blueprint. According to Infoway, projects must comply with these requirements in order to achieve EHRs that are compatible across the country.

4.70 To ensure that projects have satisfied these requirements, it is important that systems be tested. Infoway has acknowledged that it must verify compliance with standards to achieve its vision of EHRs that are compatible across the country. It has informed its Board of Directors that the failure to correctly implement standards poses risks to high-quality health care, patient safety, and the privacy of patient information. Infoway told us that it has a plan and an approach to ensure the compatibility of systems across Canada in those instances where there are variances in standards conformance. However, we noted that the approach to dealing with these variances has not yet been fully developed. Consequently, we believe the inconsistent implementation of standards remains a risk to national compatibility. Infoway’s own assessment of risk regarding the compatibility of EHR systems is rated as high.

4.71 Conformance testing determines if a standard or specification has been correctly implemented in a system. Because standards may be interpreted and implemented in different ways, conformance testing can help reduce the risks associated with the improper implementation of standards.

4.72 Infoway acknowledges the value of conformance testing and has taken a number of steps to support testing by the provinces and territories. For example, the Corporation has defined guidelines for the implementation of standards. It has also developed tools that the provinces and territories can use to test their systems.

4.73 However, we found that Infoway does not obtain from the provinces and territories the results of conformance testing on EHR systems. Consequently, the Corporation does not have sufficient assurance that EHR systems will be correctly implemented.

4.74 Recommendation. To ensure that standards will be properly implemented in the five core systems of an electronic health record, Infoway should obtain from the provinces and territories the results of conformance testing on systems it will fund, and obtain assurance that non-conformance issues, if any, will be resolved.

Infoway’s response. On a go forward basis, for new investment approvals, and with the cooperation of the jurisdictions, we agree to work to obtain the results of conformance testing from the jurisdictions on the five core electronic health record systems we will fund in the future and obtain assurance that non-conformance issues, if any, will be resolved.

We have acknowledged that there will be variations in systems requirements and thus standards requirements within jurisdictions. Jurisdictions have the mandate and authority to ensure conformance and perform user acceptance testing to their specific requirements. They are most familiar with those requirements and are best positioned to ensure they are met. Some differences are valid within a specification and require no action, whereas some are due to different maintenance releases of a standard used by various jurisdictions largely driven by their timeline for implementation. Despite variances in standards conformance, the use of a standard within a jurisdiction will ensure interoperability within that jurisdiction.

Pan-Canadian interoperability can still be achieved and differences in standards can be mitigated by

  • ensuring the same standard is used for cross-jurisdictional interoperability, or
  • mapping to accommodate differences in the implementation of the standard.

We believe that this is not only feasible but also practical and cost effective.

Infoway has taken reasonable steps to maximize its use of funds for projects

4.75 We expected Infoway, in accordance with the funding agreements with Health Canada, to show that it collaborates with its federal, provincial, and territorial partners and other stakeholders to ensure the best use of funds for EHR projects.

4.76 We found that Infoway has taken reasonable steps to maximize the use of funding. The Corporation has developed and supports initiatives that make it possible for its partners to replicate and reuse information and knowledge in their EHR projects. As mentioned before, foremost among these are the Blueprint and the Standards Collaborative.

4.77 Infoway also promotes the reuse of common systems through agreements with preferred providers. This is designed to reduce costs, encourage replication, streamline the Corporation’s project approval process, and ensure that projects adhere to requirements for national compatibility. Agreements with preferred providers are established only after the vendor has successfully completed a provincial or territorial procurement process or a procurement process coordinated by Infoway on behalf of the provinces or territories.

4.78 Infoway has developed sets of web-based toolkits that contain a variety of project documents such as case studies, templates, plans, and reports. The toolkits are designed to help reduce the risk, time, and cost of implementing projects.

Reporting on results

4.79 As mentioned earlier, Infoway has developed a measurable goal and targets to assess its progress in developing and deploying electronic health records (EHRs) across the country. These provide the basis for reporting on progress it has achieved.

4.80 The funding agreements acknowledge that Infoway’s ability to achieve key outcomes depends on collaboration with the provinces and territories. Although Infoway needs provinces and territories representing 50 percent of Canada’s population to implement each EHR system to achieve its 2010 goal, it relies on the provinces and territories to set their own pace for implementation.

4.81 In accordance with the 2007 Funding Agreement’s requirement regarding ongoing performance monitoring strategies, we expected Infoway to have selected performance indicators and targets to measure progress on achieving the goal identified in its strategic plans and to report on progress achieved compared with expected performance.

4.82 We reviewed Infoway’s corporate goal and targets from 2005–2006 to 2009–2010. We examined its public reporting and internal reporting against this goal and these targets. We also analyzed the methods it has used to describe and report progress.

Additional information on progress achieved is needed

4.83 Reporting on progress achieved. Reporting progress on a complex task such as creating EHRs that are compatible across the country is difficult. Infoway reports progress against its 2010 goal by measuring the percentage of Canadians living in provinces or territories where an EHR is available to their health care professionals. As each province or territory implements all the core systems required for an EHR, its percentage of the total Canadian population is counted toward Infoway’s 2010 goal. In its 2009–2010 Corporate Business Plan, Infoway reported that 17 percent of Canadians live in provinces or territories where an EHR is available to their authorized health care professionals. More than half of these Canadians live in Alberta.

4.84 Infoway’s 2010 goal concerns the availability of EHRs. Thus, it reports as complete those projects that are available for use. However, the Corporation has not publicly reported progress on other areas critical to the achievement of EHR systems across the country—for example, the adoption or use of systems by health care professionals.

4.85 We found that although Infoway allocates 50 percent of its project funding to the achievement of adoption targets outlined in legal agreements for projects, the Corporation does not report on the adoption or use of systems it funds in the 2008–2009 Annual Report or 2009–2010 Corporate Business Plan. We found that some projects reported as 95 to 100 percent complete with respect to availability had not fully achieved adoption targets or were not being used. For example, the Alberta drug information system is available to health care professionals, but Infoway’s internal reporting indicates that the project has been on hold for about one year because the system is not using the pan-Canadian standard required to fully achieve the project’s adoption targets. Quebec’s client registry is also available for use, but Infoway’s project status reports indicate that the project is facing a significant risk related to the implementation and use of the system.

4.86 We believe that by reporting on the adoption or use of the EHR systems it funds, Infoway would provide assurance to Parliament and Canadians that the new systems are not only available but are beginning to be used as envisioned.

4.87 We found that Infoway has not publicly reported on another critical area—the extent to which systems comply with standards and align with the Blueprint. A core principle of Infoway’s funding agreements with Health Canada is to work to achieve EHRs that are compatible across the country. Although not required under the funding agreements, Infoway ought to report on the extent to which completed systems meet the requirements for national compatibility in order to provide a better sense of progress. This information would provide additional insight into whether the objectives of the funding agreements are being achieved. For example, Infoway is reporting in its 2009–2010 Corporate Business Plan that a completed EHR system is available to all health care professionals in Prince Edward Island and Alberta. Although both provinces have made EHRs available to health care professionals, not all core systems of their EHR have implemented the standards necessary for national compatibility. In addition, both provinces will need to make additional investments before they are able to exchange information with other provinces and territories. Obtaining the results of conformance tests would help Infoway to report on compliance with standards.

4.88 Recommendation. To ensure Parliament and Canadians have sufficient information about progress achieved, Infoway should report on the extent to which electronic health record systems have been adopted by health care professionals and are compliant with standards.

Infoway’s response. We agree with the recommendation, recognizing, however, that solution implementation and availability must be completed before adoption can occur. These major project initiatives often take 24 to 36 months to be fully implemented.

Infoway, in conjunction with the jurisdictions, will endeavour to develop measures on the extent to which EHR systems have been adopted by health care providers. Further, Infoway will work with jurisdictions to develop a standards compliance report.

4.89 Reporting results achieved compared with expected results. Infoway reports annually on expected results for the coming year and on the performance results of the previous year. However, we found that the Corporation does not compare results achieved with expected results in either its corporate business plans or annual reports. Nor does it explain differences between its achievements and its expectations. For example, in the 2008–2009 Corporate Business Plan, Infoway expected that 28 percent of Canadians would have an EHR available to their health care provider by 31 March 2009. According to the 2008–2009 Annual Report and the 2009–2010 Corporate Business Plan, the progress Infoway reported was 17 percent, or 11 percentage points less than expected. Infoway provides no indication in its Corporate Business Plan or Annual Report that it has fallen short of expected progress, and it does not explain the reasons for the shortfall.

4.90 Recommendation. To ensure Parliament and Canadians have sufficient information about progress achieved, Infoway should report on results achieved compared with expected results and explain any difference.

Infoway’s response. We agree to report on variances between expected results and achievements related to the electronic health record goal line in our public reporting beginning with the 2009–10 Annual Report.

This will build on the Corporation’s existing reporting on expected results and actual performance in its Annual Report (in the section entitled, Delivering Results: Performance Against Objectives). We provide members of Parliament (MPs) and Senators with copies of our Annual Report and Corporate Business Plan. Last year, we undertook an initiative (which we plan to repeat annually) to provide MPs and Senators with jurisdictional fact sheets to highlight EHR advancements within their respective region.

4.91 Reporting on progress in achieving performance targets. Infoway has developed performance targets for each core system of an EHR. For example, by 2010, Infoway is expecting laboratory information systems to capture and store 75 percent of information on laboratory test results. By 2016, it expects to provide 95 percent of hospital and public health laboratories in eight provinces and territories with access to patients’ laboratory test profiles. Infoway is also expecting drug information systems to electronically capture and store 75 percent of information on dispensed medication.

4.92 We found that although Infoway has reported these targets publicly in its 2007–2008 and 2008–2009 corporate business plans, the Corporation has not reported its progress in achieving the targets. Reporting on the extent to which health care professionals are using EHR systems would provide useful information to Infoway management and more complete information to Parliament and Canadians.

4.93 Recommendation. To ensure Parliament and Canadians have sufficient information about progress achieved, Infoway should report on the results achieved for performance targets established for each core system of the electronic health record.

Infoway’s response. We agree with the recommendation. The Corporation will need to finalize its work with the jurisdictions on both data availability and data quality, to ensure that additional reporting will be accurate. This will build on the Corporation’s existing reports on the value, benefits, and advancement that electronic health record systems are delivering to Canadians through our proactive media relations efforts, corporate materials, and the Internet, as well as through hundreds of public presentations and speaking engagements.

Being accountable to Parliament

4.94 Health Canada’s funding of Infoway is provided through a series of grants (made in 2001, 2003, 2004, and 2007). Accountability measures that apply to Infoway are defined in the funding agreements between the Corporation and Health Canada. These measures are intended to ensure that Health Canada is able to account to Parliament for Infoway’s use of funding provided by the federal government.

4.95 The terms and conditions of funding agreements between Health Canada and Infoway have evolved over time as the expectations of governments have changed. Funding that Infoway received in 2001, 2003, and 2004 totalling $1.2 billion was provided in a lump sum transfer of funds, and use of the funds was subject to fewer reporting and evaluation requirements.

4.96 The 2007 Infoway funding agreement included several new provisions to strengthen Infoway’s accountability to Health Canada. For example, under the 2007 funding agreement, funding to Infoway of $400 million is to be provided only on a needs basis. The funding agreement requires Infoway to submit annual cash flow statements estimating its financial requirements for the upcoming year. As of 31 March 2009, Infoway had drawn down about $162 million in funding against the 2007 agreement. The agreement also allows the Minister to conduct an evaluation of Infoway’s activities and to request additional information for the purpose of keeping the Accounts of Canada.

Health Canada needs to further develop its approach to monitoring

4.97 Since 2001, the federal government has granted to Infoway a total of $1.6 billion in a series of funding agreements. Health Canada’s role as the federal signatory on the funding agreements is to ensure that Infoway is complying with the funding agreements. We therefore expected that Health Canada would have appropriate mechanisms in place to ensure that Infoway is complying with the funding agreements.

4.98 Health Canada periodically obtains assurance of compliance with the funding agreements. Per the funding agreements, Infoway hires an independent auditor to conduct an annual compliance audit of its compliance with the terms of the funding agreements. Also, independent evaluations are conducted every five years. We did not audit any of these independent audits and evaluations. These audits and evaluations are the most important sources of information for ensuring that Infoway is complying with the funding agreements and is achieving objectives outlined in the agreements. All compliance audits to date, and the evaluation completed in 2006, have concluded that Infoway is complying with the funding agreements in all important respects and is making progress toward its objectives.

4.99 Health Canada also needs to regularly monitor Infoway’s activities so that it has early warning of potential non-compliance. Although Infoway was created in 2001, Health Canada has just approved, in 2008, a monitoring framework to help the Department and the federal government reduce the inherent risk associated with such large amounts of funding. The framework identifies Infoway’s accountability requirements, as outlined in the funding agreements. It also identifies 14 processes necessary to assess the Corporation’s compliance with those requirements. At the time of the audit, eight of these processes had been developed. For example, the monitoring framework describes the process to follow in reviewing annual reports and corporate business plans.

4.100 We noted that at the time of the audit, Health Canada had not yet developed the remaining six processes. For example, the Department had identified the need for a risk assessment tool to identify and assess areas of risk to compliance with the funding agreements, but it had not yet developed one.

4.101 Recommendation. To better fulfill its responsibility for monitoring Infoway’s compliance with the funding agreements, Health Canada should fully develop and implement its monitoring framework.

Health Canada’s response. Health Canada agrees with the Auditor General’s recommendation.

The Department recognizes the importance of monitoring Infoway’s compliance with the funding agreements and has been monitoring its compliance since the first funding agreement in 2001. As of September 2009, the Department has developed a comprehensive framework to monitor Infoway’s compliance more systematically. The framework includes an overview of Infoway’s deliverables and activities for a given fiscal year, schedules with the timing of annual and ad hoc deliverables and activities, and a description of federal activities to support due diligence. The framework also includes 14 appendices that set out detailed procedures and tools used to support monitoring, including a risk assessment tool and checklists to foster consistency and transparency (such as factors to consider in reviewing the Annual Report), and procedures to be followed for specific events and activities (such as ministerial appointments to the Board). The framework will be updated periodically, as needed.

The Department welcomes the Auditor General’s support for our approach to monitoring investments in Infoway.

Meeting important challenges

4.102 Our chapter notes that even though Infoway has made a significant contribution to the development and implementation of EHRs, other important challenges remain. These include ensuring that systems have been adopted and that tangible benefits of EHRs are realized throughout the country. Understanding these challenges provides the context for understanding the major task facing Infoway, Health Canada, and the provinces and territories. Thus, this section is forward-looking and is not based on our audit work. It is intended to help readers of this report to put the observations noted in the chapter in perspective.

Meeting the 2010 goal

4.103 Infoway is facing major challenges in reaching its 2010 goal of 50 percent of Canadians having an EHR available to their authorized health care professionals. As previously noted, Infoway is dependent on the provinces and territories to secure funds and implement the projects. According to Infoway, as of 31 March 2009, only 17 percent of Canadians lived in a province or territory where a complete EHR system was available. Infoway anticipates that it will achieve the 50 percent goal by 31 December 2010. At the same time, we noted that Infoway’s own assessment of the risk to achieving the goal is high.

Upgrading systems to achieve compatibility

4.104 Not all completed EHR projects have implemented the standards required for national compatibility. According to Infoway, some of these projects will do so only after they have been upgraded as part of future projects. It is not clear who will provide the funding needed to ensure that all systems will be compatible or when this funding will be provided.

Implementing electronic medical records

4.105 Infoway has estimated that about 80 percent of patient encounters with the health care system take place with doctors and specialists outside a hospital setting. A survey conducted in 2007 found that approximately 10 percent of Canadian doctors maintain their patients’ health records electronically. Another 26 percent of doctors use a mix of electronic and paper-based records. Unless the percentage of primary care doctors using electronic medical records (EMRs) increases significantly, the potential benefits offered by electronic health records (EHRs) will not be fully realized (see paragraph 4.4 on the difference between an EMR and EHR). As previously mentioned, the Budget Implementation Act, 2009, authorizes the payment of $500 million to Infoway. However, there is no funding agreement yet for this amount. Some of these funds would go toward the implementation of EMR systems.

Using new consumer health solutions

4.106 New health information systems designed to allow patients direct access and control over their personal health information are becoming more common. These systems are often referred to as consumer health platforms or solutions. It is expected that patients will use these platforms or solutions to share personal health information with health care professionals as well as with EHRs, EMRs, and hospital information systems. Companies have indicated their intent to provide consumer health solutions to Canadians.

4.107 As mentioned previously, nationally compatible EHRs require that all components of the system be standards-based and comply with compatibility requirements. Consumer health solutions are no different. It will be important that the vendors of these systems offer solutions compatible with the systems Infoway has funded to date.

4.108 Infoway has begun to address this challenge by launching a certification service to ensure that consumer health solutions available for sale meet the Corporation’s requirements for privacy, security, and compatibility. Certification is expected to assure individual Canadians and other stakeholders, such as doctors and pharmacies, that consumer health solutions from certified vendors are compatible with existing EHR systems.

4.109 According to Infoway, the success of its certification service will ultimately depend on the extent to which provinces and territories, hospitals, doctors, pharmacists, laboratories, and suppliers of software products comply with standards themselves. This dependency accentuates the importance of Infoway’s continuing to approve projects that commit to complying with standards and taking steps to verify that EHR projects implement those standards.

Ensuring the privacy and security of personal health information

4.110 The concept of EHRs that are compatible across the country is based on the premise that Canadians’ health information will be available to their health care professionals no matter where they live or where they may be when they need health care services. The sharing of data among the provinces and territories is critical to the achievement of EHRs that are compatible across the country. This is particularly true for Canadians who live in smaller provinces and territories and require specialized care available only in larger centres. It is also of concern to Canadians who move from one part of the country to another, travel often, or live in one place but work or study in another.

4.111 Different provincial and territorial laws regarding the collection, use, and disclosure of personal health information pose a challenge to the sharing of this information between jurisdictions. Although Infoway is not responsible for resolving these legislative differences, the Corporation has set up discussions between provincial and territorial ministries of health, and agencies in each province and territory responsible for ensuring that provincial and territorial privacy laws are respected.

4.112 Together with the Privacy Forum, Infoway has established working groups to focus efforts on common approaches for accountability, consent, secondary uses, and flow of data between jurisdictions.

4.113 Finally, a privacy breach of EHR systems has the potential to undermine the strong support among Canadians for the EHR initiative. Such a breach would also negatively affect support for EHRs among health care professionals.

Conclusion

4.114 Overall, we found that Canada Health Infoway is exercising due regard in managing funds from the federal government to achieve its goal related to the implementation of electronic health records (EHRs) across Canada.

4.115 Our examination of EHRs shows that Infoway has set a good foundation for the work it is doing by applying appropriate governance mechanisms to carry out its mandate and objectives. It has also implemented strategic plans, such as the Blueprint, that are consistent with its funding agreements with Health Canada. These plans guide its investments in creating EHRs that are compatible across Canada. Infoway has set a goal for this initiative, but it could be more clearly defined. It has also implemented appropriate management controls for operational spending, although controls for contracting for goods and services need to be strengthened.

4.116 We found that Infoway is exercising due regard in approving, monitoring, and making best use of its funds for EHR projects. However, Infoway ought to better document its analyses of project deliverables before releasing payments. Infoway approves projects that are designed to align with the Blueprint and comply with standards. However, it does not have sufficient assurance that, once implemented, projects will comply with these requirements.

4.117 We observed that Infoway reports progress on achieving the goal identified in its strategic plans and the funding agreements. However, the Corporation does not annually report progress achieved against expected progress and it does not report on its performance targets that are related to the use of EHR systems. Also, it does not report on project adoption and project compliance with requirements for national compatibility. This information is important to providing a complete picture of progress achieved.

4.118 Through annual independent compliance audits and periodic evaluations, Health Canada ensures that Infoway complies with the funding agreements. However, at the time of the audit, the Department had not yet fully developed an approach to its ongoing monitoring activities to detect early warning of potential non-compliance.

4.119 Infoway has accomplished much in the eight years since its creation. Progress achieved thus far required the collaboration of Infoway, all provinces and territories, and other stakeholders. Significant challenges remain to ensuring that tangible benefits of EHRs are realized across the country.

About the Audit

All of the audit work in this chapter was conducted in accordance with the standards for assurance engagements set by The Canadian Institute of Chartered Accountants. While the Office adopts these standards as the minimum requirement for our audits, we also draw upon the standards and practices of other disciplines.

Objectives

The overall audit objective was to determine whether Canada Health Infoway Inc. (Infoway) is exercising due regard in managing funds from the federal government to achieve its goal of implementing compatible electronic health records across Canada, and whether Health Canada ensures that Canada Health Infoway Inc. complies with the funding agreements.

The audit sub-objectives were to determine whether

  • Infoway is implementing strategic plans consistent with the funding agreements to guide its funding of compatible electronic health records across Canada;
  • Infoway is exercising due regard in approving, monitoring, and maximizing its use of funds for electronic health records projects;
  • Infoway reports progress on achieving the goal identified in its strategic plans and the funding agreements;
  • Infoway has appropriate governance mechanisms to carry out its mandate and objectives;
  • Health Canada ensures that Infoway complies with the funding agreements; and
  • Infoway has appropriate management controls in selected areas.

Scope and approach

Our audit focused on Canada Health Infoway Inc.’s funding of compatible electronic health records (EHRs) across Canada. We reviewed 29 projects approved by Infoway. We chose the sample from those projects that are deemed to be the five core systems for an EHR: registries, diagnostic imaging systems, drug information systems, laboratory information systems, and interoperable electronic health records. Projects were selected in order to provide a high degree of coverage of total approved funding, as well as at least 50 percent of approved funding for each of the five core systems. As of 31 March 2009, the projects we chose to review accounted for $886 million or 72 percent of funding approved by Infoway for investment in the core systems. We did not audit other systems such as Infrastructure, Innovation and Adoption; Patient Access to Quality Care; Public Health Surveillance; and Telehealth.

We examined the governance structure, selected management controls (executive compensation, executive travel and hospitality, and contracting for goods and services). We looked at 35 contracts out of a total of 555 contracts ranging in value from $179.89 to $6.8 million awarded between 1 April 2006 and 31 March 2008. Of the 35 contracts, 30 were selected at random. The other 5 were selected because they had been exempted from competitive bidding, per Infoway’s policy.

Finally, we reviewed the appropriateness of Health Canada’s accountability arrangements under the various funding agreements. Due to the difficulty in obtaining reliable data, our audit did not attempt to compare Canada’s progress in developing and implementing electronic health records with that of other countries.

Criteria

Listed below are the criteria that were used to conduct this audit and their sources.

Criteria Sources
Canada Health Infoway Inc.

We expected that Canada Health Infoway Inc. would have clearly defined roles and responsibilities of the parties in the governance structure.

  • The Canadian Institute of Chartered Accountants, 20 Questions Directors of Not-for-Profit Organizations Should Ask About Governance, page 19
  • Excellence in Canada’s Health System; Principles for Governance, Management, Accountability and Shared Responsibility, page 14

We expected that Canada Health Infoway Inc. would have an independent Board of Directors that uses appropriate practices in exercising its stewardship role.

  • Health Canada Accountability Framework for Canada Health Infoway, page 23
  • Canada Corporations Act, subsections 98(1) to (4)
  • Canada Health Infoway, Board of Directors’ Charter #5 and #6 (21 September 2005)

We expected that Canada Health Infoway Inc. would implement strategic plans that are consistent with the funding agreements.

  • Enterprise Value: Governance of IT Investments, Val IT Framework 2.0–VG1.5, page 33
  • 2007 Canada Health Infoway Funding Agreement, section 4.1, page 8
  • 2003 Canada Health Infoway Funding Agreement, section 3.4.1, page 6

We expected that Canada Health Infoway Inc. would have operational plans to realize its strategic plans.

  • Enterprise Value: Governance of IT Investments, Val IT Framework 2.0–VG2.4, page 35

We expect Canada Health Infoway Inc. would have identified corporate risks that need to be managed to realize its strategic plans.

  • 2007 Canada Health Infoway Funding Agreement, section 1.5, page 3

We expected that Canada Health Infoway Inc. would have established executive compensation packages, in accordance with its policies, that reflect due consideration for comparable benchmarks and the principles of prudence and probity.

  • Canada Health Infoway, Board of Directors’ Charter (21 September 2005)
  • Canada Health Infoway’s Compensation Policy

We expected that Canada Health Infoway Inc. would ensure that travel and hospitality expenses are managed in accordance with its policies.

  • Canada Health Infoway’s Travel Policy and Hospitality and Gifts Policy
  • Canada Health Infoway, By-Law No.1 (18 January 2001)
  • Canada Health Infoway, Signing Authorities (6 December 2006)

We expected that Canada Health Infoway Inc. would ensure that contracts for goods and services are managed in accordance with its policies.

  • Canada Health Infoway’s Procurement Policy
  • The Canadian Institute of Chartered Accountants, 20 Questions Directors of Not-for-Profit Organizations Should Ask About Governance, page 16

We expected that Canada Health Infoway Inc. would ensure that the projects it funds are consistent with its strategic plans and the EHRS Blueprint.

  • Enterprise Value: Governance of IT Investments, Val IT Framework 2.0–VG2.4, page 35

We expected that Canada Health Infoway Inc. would monitor the progress of electronic health records projects to ensure that project objectives are achieved and project risks are managed.

  • Enterprise Value: Governance of IT Investments, Val IT Framework 2.0–VG5.3, IM6.2, and IM6.3, pages 41 and 81
  • 2007 Canada Health Infoway Funding Agreement, sections 5.1.3 to 5.1.5, 5.2.3, and 5.2.6, pages 10 and 11

We expected that Canada Health Infoway Inc. would show that it collaborates with federal, provincial, and territorial partners, and other stakeholders, to maximize its use of funds for electronic health records projects.

  • 2007 Canada Health Infoway Funding Agreement, sections 5.1.3, 5.2.2, and 5.2.4, pages 10 and 11

We expected that Canada Health Infoway Inc. would have identified performance indicators and targets to measure progress on achieving the goal identified in its strategic plans and the funding agreements.

  • Enterprise Value: Governance of IT Investments, Val IT Framework 2.0–VG5.1, page 41
  • 2007 Canada Health Infoway Funding Agreement, section 1.5 (v), page 3

We expected that Canada Health Infoway Inc. would report progress achieved compared with expected performance.

  • Enterprise Value: Governance of IT Investments, Val IT Framework 2.0– VG5.1 and VG5.3, page 41
  • 2007 Canada Health Infoway Funding Agreement, section 7.1.1(b), page 15
  • 2004 Canada Health Infoway Funding Agreement, sections 5.1.5 and 5.2.1.5, pages 13 and 14
Health Canada

We expected that Health Canada would have implemented appropriate mechanisms for ensuring that Canada Health Infoway Inc. complies with the funding agreements.

  • Health Canada Accountability Framework for Canada Health Infoway
  • 2007 Canada Health Infoway Funding Agreement, Preamble

Management reviewed and accepted the suitability of the criteria used in the audit.

Period covered by the audit

For the most part, our audit focused on the 2006–07 and 2007–08 fiscal years. In some instances, we went back further.

Planning and reporting: 2005–06 to 2009–10

EHR projects: 2003–04 to 2009–10

Executive compensation: 2006–07 to 2008–09

Travel and hospitality: 2007–08

Contracting: 2006–07 to 2007–08

Health Canada: 2001–02 to 2008–09

Audit work for this chapter was substantially completed on 30 April 2009.

Audit team

Assistant Auditor General: Neil Maxwell
Principal: Louise Dubé
Director: Holly Shipton

Ian Campbell
Mark Carroll
Daphné Lamontagne
Jean-François Luc
Marie-Ange Massunken

For information, please contact Communications at 613-995-3708 or 1-888-761-5953 (toll-free).

Appendix—List of recommendations

The following is a list of recommendations found in Chapter 4. The number in front of the recommendation indicates the paragraph where it appears in the chapter. The numbers in parentheses indicate the paragraphs where the topic is discussed.

Recommendation Response
Setting the direction

4.38 To ensure Parliament and Canadians properly understand Infoway’s goal, the Corporation should further explain in its public reports what is meant by having an electronic health record available to authorized health care professionals. (4.35–4.37)

Infoway’s response. We agree with the recommendation and we will make additional efforts to elaborate on the goal of having an electronic health record available to authorized health care providers in our public reporting commencing with our 2009–10 Annual Report and/or the 2010–11 Corporate Business Plan. Implementation of electronic health records is a complex task, as is reporting on progress. We have made continuous improvements to progress reporting and will continue to enhance our reporting in the future. Infoway reports on a regular basis jurisdictional progress to making electronic health records available to Canadians. For example, we provide members of Parliament and Senators with copies of our Annual Report and Corporate Business Plan. We also post these materials on our website to help ensure the broadest possible distribution to Canadians.

4.53 Infoway should review and strengthen its management controls over contracting for goods and services to reduce the risk of contract disputes. (4.43–4.52)

Infoway’s response. We agree to review and analyze current practices to strengthen management controls. Improvements to management controls related to the timing of contract signatures will be put in place by the end of the 2009–10 fiscal year. We do not pay any invoice unless the contract is acceptably executed and the Infoway manager has certified that the product or service has been appropriately delivered by the contractor.

4.55 Infoway should review its contracting policy with respect to contract amendments and extensions to ensure fairness, transparency, and disclosure to the Board. (4.54)

Infoway’s response. We agree to review the contracting policy with respect to amendments and extensions and to present the proposed revisions to the Board for approval prior to the fourth quarter of the 2009–10 fiscal year.

Infoway’s Board-approved contracting policy was developed to respond to competitive market conditions and the often unique and rare combination of skill sets required to deliver the Corporation’s mandate. The current policy reflects the necessary balance between market competiveness, the Corporation’s business requirements, and due respect for the expenditure of public funds. We are compliant with the current policy related to the tendering of amendments and extensions and the reporting of those amendments and extensions to the Board of Directors.

Funding electronic health records projects

4.68 To ensure accountability and transparency, Infoway should better document its analyses of project deliverables to support its decision to release funds. (4.63–4.67)

Infoway’s response. We agree that there is scope for improvement to deliverables documentation and the Corporation will address this issue immediately. This will build on Infoway’s documentation process and methodology for the approval of deliverables, including the third-party claims verification process that assesses the adequacy and effectiveness of the policies, controls, and systems in place for the management of Infoway-funded projects.

4.74 To ensure that standards will be properly implemented in the five core systems of an electronic health record, Infoway should obtain from the provinces and territories the results of conformance testing on systems it will fund, and obtain assurance that non-conformance issues, if any, will be resolved.
(4.69–4.73)

Infoway’s response. On a go forward basis, for new investment approvals, and with the cooperation of the jurisdictions, we agree to work to obtain the results of conformance testing from the jurisdictions on the five core electronic health record systems we will fund in the future and obtain assurance that non-conformance issues, if any, will be resolved.

We have acknowledged that there will be variations in systems requirements and thus standards requirements within jurisdictions. Jurisdictions have the mandate and authority to ensure conformance and perform user acceptance testing to their specific requirements. They are most familiar with those requirements and are best positioned to ensure they are met. Some differences are valid within a specification and require no action, whereas some are due to different maintenance releases of a standard used by various jurisdictions largely driven by their timeline for implementation. Despite variances in standards conformance, the use of a standard within a jurisdiction will ensure interoperability within that jurisdiction.

Pan-Canadian interoperability can still be achieved and differences in standards can be mitigated by

  • ensuring the same standard is used for cross-jurisdictional interoperability, or
  • mapping to accommodate differences in the implementation of the standard.

We believe that this is not only feasible but also practical and cost effective.

Reporting on results

4.88 To ensure Parliament and Canadians have sufficient information about progress achieved, Infoway should report on the extent to which electronic health record systems have been adopted by health care professionals and are compliant with standards. (4.83–4.87)

Infoway’s response. We agree with the recommendation, recognizing, however, that solution implementation and availability must be completed before adoption can occur. These major project initiatives often take 24 to 36 months to be fully implemented.

Infoway, in conjunction with the jurisdictions, will endeavour to develop measures on the extent to which EHR systems have been adopted by health care providers. Further, Infoway will work with jurisdictions to develop a standards compliance report.

4.90 To ensure Parliament and Canadians have sufficient information about progress achieved, Infoway should report on results achieved compared with expected results and explain any difference. (4.89)

Infoway’s response. We agree to report on variances between expected results and achievements related to the electronic health record goal line in our public reporting beginning with the 2009–10 Annual Report.

This will build on the Corporation’s existing reporting on expected results and actual performance in its Annual Report (in the section entitled, Delivering Results: Performance Against Objectives). We provide members of Parliament (MPs) and Senators with copies of our Annual Report and Corporate Business Plan. Last year, we undertook an initiative (which we plan to repeat annually) to provide MPs and Senators with jurisdictional fact sheets to highlight EHR advancements within their respective region.

4.93 To ensure Parliament and Canadians have sufficient information about progress achieved, Infoway should report on the results achieved for performance targets established for each core system of the electronic health record.
(4.91–4.92)

Infoway’s response. We agree with the recommendation. The Corporation will need to finalize its work with the jurisdictions on both data availability and data quality, to ensure that additional reporting will be accurate. This will build on the Corporation’s existing reports on the value, benefits, and advancement that electronic health record systems are delivering to Canadians through our proactive media relations efforts, corporate materials, and the Internet, as well as through hundreds of public presentations and speaking engagements.

Being accountable to Parliament

4.101 To better fulfill its responsibility for monitoring Infoway’s compliance with the funding agreements, Health Canada should fully develop and implement its monitoring framework.
(4.97–4.100)

Health Canada’s response. Health Canada agrees with the Auditor General’s recommendation.

The Department recognizes the importance of monitoring Infoway’s compliance with the funding agreements and has been monitoring its compliance since the first funding agreement in 2001. As of September 2009, the Department has developed a comprehensive framework to monitor Infoway’s compliance more systematically. The framework includes an overview of Infoway’s deliverables and activities for a given fiscal year, schedules with the timing of annual and ad hoc deliverables and activities, and a description of federal activities to support due diligence. The framework also includes 14 appendices that set out detailed procedures and tools used to support monitoring, including a risk assessment tool and checklists to foster consistency and transparency (such as factors to consider in reviewing the Annual Report), and procedures to be followed for specific events and activities (such as ministerial appointments to the Board). The framework will be updated periodically, as needed.

The Department welcomes the Auditor General’s support for our approach to monitoring investments in Infoway.

 


Definitions:

Standards Collaborative—A body created in 2006 after extensive consultation with and approval by the boards of Infoway and the Canadian Institute for Health Information (CIHI), as well as the federal, provincial, and territorial Conference of Deputy Ministers of Health. Its mandate is to develop, maintain, and support the implementation of national standards. The Collaborative also plays a formal liaison role with organizations developing international standards. (Return)

Privacy Forum—The Privacy Forum was established to encourage privacy officers and representatives from federal, provincial, and territorial health departments to discuss privacy governance matters as they relate to electronic health information management. (Return)

 

PDF Versions

To access the Portable Document Format (PDF) version you must have a PDF reader installed. If you do not already have such a reader, there are numerous PDF readers available for free download or for purchase on the Internet: