CYPRUS: Effectiveness and efficiency of IT Systems, for Health insurance claims to and from EU member states
28.05.2022
According to EU legislation, healthcare insured citizens from member states as well as their dependents residing in member states are entitled to access to the EU country’s national healthcare system in the country of residence or elsewhere in the EU. Healthcare can be provided with the use of specific Forms S1, S2 and the European Health Insurance Card – EHIC. All medical bill claims from medical institutions in the country of residence are forwarded to the medical insurance providers of the country of origin.
The Ministry of Health of Cyprus is in charge of managing claims from medical institutions from other countries and to forward claims from medical institutions partnered with the General Healthcare System (GHS). Therefore, it has developed inhouse IT systems to facilitate each process.
SAI Cyprus conducted audit on these systems as well as the general controls of the IT environment of the relevant sector of the Ministry.
Our main findings and recommendations where the following.
1. Incoherent development and release methodology.
Although there are standards and methodologies for inhouse application development in place these were not followed for Health Insurance claims systems. This resulted in lack of user and technical specifications and user acceptance testing before moving to production.
2. Lack of documentation
No official manuals or documented process exist. Some of the officials assigned to these tasks had personal notes for the steps to follow for which the management was not aware.
3. Design Complexity
During overview of processes with the auditee’s staff, we have witnessed a great amount of different screens with as many as 14 buttons each, which at some occasions should be pressed sequentially. There were also many repetitive fields in each screen, where information should be inserted manually. It was noted that it added to the users difficulty of use and understanding of the processes in place. There is not a workflow in place and the sequence is complicated.
4. Ineffective controls
Although some controls have been applied to important fields, they were easily bypassed by the users. Also, error messages were ineffective as they were applied mostly as warning messages rather than preventive for the user.
