KOSOVO: Highlights of IT audit from SAI Kosovo
The National Audit Office of Republic of Kosovo* has conducted the IT audit Pharmaceutical Stock Information Management System.
The Ministry of Health (MH), specifically the Pharmacy Division (PD), is responsible for supplying medicines and disposable materials from the Essential Medicines List (EML) to Primary Health Care (PHC) institutions based on the planning of those Institutions for 34 Main Family Medicine Centers (MFMCs).
In order to improve the supply and management of pharmaceutical stock in healthcare institutions, the Ministry of Health began developing the Pharmaceutical Stock Management System (PSMS) in 2013. This centralized system is responsible for managing the supply of medicines and medical materials, both from the essential medicines list and those not on the essential medicines list, for all health care institutions in the Republic of Kosovo.
Figure below shows the activities summarized in the Pharmaceutical Stock Management System
The objective of this audit was to assess the management of the Pharmaceutical Stock System and the security of information related to this system at the Ministry of Health, as well as the system’s utilization by public healthcare institutions in Kosovo.
In order to achieve the audit objective, we have focused on IT governance, information security and application controls. Also, the findings are structured into three parts, interconnected according to the audit issues as shown in figure below.
The Ministry lacks adequate mechanisms for IT governance despite significant investments in expanding systems. Over 6.1 million euros have been invested in expanding and improving hardware infrastructure across the territory of Kosovo, including healthcare systems and the Pharmaceutical Stock Management System. However, full implementation of the system has not been achieved by all pharmacies at various healthcare levels, up to the distribution of medicines to patients. There is a lack of clear responsibilities for managing the system, as well as IT policies and procedures.
The Ministry of Health has not taken appropriate actions regarding the information security of the Pharmaceutical Stock Management System. There is a lack of a risk management plan for information systems and inadequate controls for information security. Additionally, the ministry has not properly managed logical access to the system, implemented a confidentiality statement, or established a dual hardware infrastructure for data recovery in case of system interruptions. These deficiencies increase the risk to patient privacy protection, data integrity, and pose a threat of data loss and service disruption for patients.
The Pharmaceutical Stock Management System has deficiencies in data registration and report generation. The lack of connection with central systems increases the risk of inaccurate data placement, while the failure to set expiration date limits for accepted items and not adjusting report generation according to officials’ requests create extra work for officials and jeopardize the efficiency of medication use. Furthermore, the lack of technical measures in the system jeopardizes the protection of patients’ personal data.
In conclusion
The Ministry of Health has not fully implemented this system in all healthcare units, pharmacies in hospital wards and clinics, as well as Family Medicine Centers. This has led to inadequate management of pharmaceutical stock, lack of proper planning, and inefficient use of medicines and medical supplies. Additionally, there are weaknesses in information security and application controls within this system.
In order to address the identified issues related to the Pharmaceutical Stock Management System, we have provided 16 recommendations to the Ministry of Health, including the Hospital and University Clinic Service of Kosovo and Health Institutions.
* This designation is without prejudice to positions on status and is in line with UNSCR 1244/1999 and the ICJ Opinion on the Kosovo declaration of independence.