REPORT HIGHLIGHTS ILLINOIS PRESCRIPTION MONITORING PROGRAM PERFORMANCE AUDIT Release Date: September 15, 2021 State of Illinois, Office of the Auditor General FRANK J. MAUTINO, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov REPORT HIGHLIGHTS Background: On July 21, 2020, the Legislative Audit Commission passed Resolution Number 154 directing the Office of the Auditor General to conduct a performance audit of the Illinois Prescription Monitoring Program (ILPMP) operated by the Department of Human Services (DHS) (See Appendix A). According to DHS, the mission of the ILPMP is to provide prescribers, dispensers, and health providers with the ability to view their current or prospective patient’s controlled substance prescriptions dispensed in Illinois. The ILPMP utilizes an electronic database to collect, store, and access prescription information. A Prescription Monitoring Program (PMP) continues to be among the most promising state-level interventions to improve opioid prescribing, inform clinical practice, and protect patients at risk. Key Findings: • Of the 50 states, 49 had a statewide PMP during this review. Most states (84%) used a single contractor to perform all four functions associated with a statewide PMP. Illinois, however, was one of only three states that utilized multiple contractors while performing some functions in- house. • DHS had not fully implemented the ILPMP by the required dates. DHS was required to establish rules requiring all Electronic Health Record (EHR) systems to interface with the ILPMP and establish actions to be taken if a prescriber’s EHR did not effectively interface, as required. This interfacing would ensure all providers have access to patient records. Although rules on EHRs were established late, DHS could not provide the percent of EHRs that had been interfaced by the required date of January 1, 2021. According to DHS, they have no way of knowing when all EHRs would be fully interfaced, as required. • The Illinois Controlled Substances Act (Act) requires all licensed prescribers to register with the ILPMP as of January 1, 2018. However, as of December 2020, only 68 percent of prescribers were registered. • Not all dispensers are providing data on the dispensing of controlled substances to the ILPMP, as required. DHS is not conducting follow-up with these dispensers to ensure they provide data or to determine why they are not providing data. The Act gives DHS the ability to impose fines for willfully failing to report the dispensing of a controlled substance. However, according to DHS, no fines have been imposed. • Dispensers are required to submit information on dispensed controlled substances by the end of the next business day. Since the required dispensed date is not being submitted by dispensers or tracked by DHS, DHS has no way of calculating if dispensers are submitting information in a timely manner. • During a review of general IT controls, our IS auditors found the ILPMP data, as well as reporting with respect to that data, cannot be relied upon. The review found deficiencies in the areas of contractual services, business processes, change control, disaster recovery, and security. We also tested 60 prescription records for compliance with the Act and Administrative Code. Of the 60 prescription records reviewed, all (100%) contained missing or inaccurate information. Other specific issues with the data included the following: — Regarding license numbers, there were entries with: ~ No license number; ~ Only one letter or one number in place of the license number; ~ The word “test” in place of the license number; and ~ Alpha and numeric values which do not comprise a license number. — Once the user’s license is initially validated, it is not revalidated to ensure continued validation. Of the 48,818 user accounts, there were 19,501 users that appear to have never logged in. In addition, there were 3,928 accounts with a last login date of more than 12 months. — For the last 12 months of active data provided by DHS (17,075,814 prescription records): ~ 273,923 records were for prescriptions filled prior to the time period requested; ~ 67,520 records contained an animal species code; and ~ 465 records contained a birthdate with an age over 110. — DHS was also not ensuring all users with access rights to the ILPMP database had valid licenses. Through a comparison with Department of Financial and Professional Regulation (DFPR) licensing data, we identified 2,287 registered users without a valid license. • DHS had not established an interagency agreement with DFPR to ensure ILPMP licensing data did not contain invalid or outdated information. DHS had also not established a process with the Department of Public Health (DPH) to conduct data reviews of sports and accident injuries, as required by the Act. • Although the ILPMP Policies and Procedures Manual covers significant procedures such as data security and law enforcement requests, the Manual is outdated. This outdated Manual supports that DHS has not established general IT controls over the data and needs to be updated to ensure these procedures are effectively implemented. Key Recommendations: The audit report contains ten recommendations directed to DHS and one recommendation directed to DHS and DPH including: • DHS should fully implement an ILPMP in accordance with State requirements by ensuring all EHRs are fully interfaced with the ILPMP, as required. • DHS should update the Illinois Administrative Code to align with the Act related to imposing fines, and develop a formal plan to help ensure dispensing reporting requirements are being implemented as required. • DHS should establish general information technology controls over the data and correct the significant deficiencies related to contractual services, business processes, change control, disaster recovery, and security. Until these deficiencies are corrected, the ILPMP data and reporting with respect to that data cannot be relied upon. • DHS should establish a process to ensure the licensing data utilized by the ILPMP does not contain invalid or outdated information. DHS should consider establishing an interagency agreement with the DFPR outlining each agency’s responsibilities related to licensing data. • DHS and DPH should establish a process to conduct data reviews of sports and accident injuries as required by the Act. In addition, DHS should alert prescribers whose discharged patients were dispensed a controlled substance about the risk of addition and applicable guidelines. • DHS should update the ILPMP Policies and Procedures Manual as it is currently outdated. The updates should include current policies related to law enforcement requests. • DHS should ensure dispensers are submitting specific information as required by the Act and the Illinois Administrative Code. This includes addressing all of the discrepancies identified during testing. • DHS should ensure all prescribers possessing an Illinois Controlled Substance license are registered with the ILPMP as required by the Act. • DHS should address the identified monitoring issues and related deficiencies. DHS should also address the identified program assessment issues and related deficiencies by ensuring program assessment reports contain complete and accurate information and reinstating the exchange of data with DPH to monitor significant drug-related issues. • DHS should address the identified ILPMP Committee weaknesses for the Prescription Monitoring Program Advisory Committee, Peer Review Committee, and long term care Advisory Committee, which has not been established to date. This performance audit was conducted by the staff of the Office of the Auditor General.