State of New York Office of the State Comptroller Division of Management Audit and State Financial Services

Transcription

1 State of New York Office of the State Comptroller Division of Management Audit and State Financial Services NEW YORK CITY DEPARTMENT OF HEALTH CONTROLS OVER VITAL RECORDS REPORT 99-N-6 H. Carl McCall Comptroller

2 State of New York Office of the State Comptroller Division of Management Audit and State Financial Services Report 99-N-6 Neal L. Cohen, M.D. Commissioner New York City Department of Health 125 Worth Street New York, NY Dear Dr. Cohen: The following is our audit report on the evaluation of internal controls over vital records at the Office of Vital Records of the Department of Health. This audit was performed pursuant to the State Comptroller s authority as set forth in Article V, Section 1 of the State Constitution; Article II, Section 8 of the State Finance Law; and Article III of the General Municipal Law. Major contributors to this report are listed in Appendix A. May 25, 2000 OSC Management Audit reports can be accessed via the OSC Web Page : If you wish your name to be deleted from our mailing list or if your address has changed, contact the Management Audit Group at (518) or at the Office of the State Comptroller, Alfred E. Smith State Office Building, 13th Floor, Albany, NY

3 Executive Summary New York City Department of Health Controls Over Vital Records Scope of Audit The New York State Department of Health is responsible for the registration of all vital events that occur in the State, outside of New York City (City). The Office of Vital Records (OVR) within the New York City Department of Health (DOH) is responsible for the registration, issuance, archival and maintenance of the birth and death certificates for the City. DOH reported total expenditures of $465 million for the fiscal year ended June 30, 1999, with an employee headcount of 2,915. Original birth and death documents are generally prepared by authorized agents (e.g., physicians, hospital staff, funeral directors) and filed with the Office of Vital Records, where they are indexed, recorded and stored. OVR provides certified copies of vital records at a cost of $15 each to those who request them in person, by mail or via telephone. For the fiscal year ended June 30, 1999, OVR reported revenues of $10.9 million from the issuance of birth and death certificates. As of August 1999, OVR s staff consisted of 115 employees. For the 19 months that ended on July 31, 1999, OVR officials reported that they had registered 195,162 births and 97,974 deaths. For the same period, OVR reported that certified copies of 508,402 birth certificates and 623,164 death certificates were issued. For the period of January 1, 1998 to July 31, 1999, we evaluated the internal controls over vital records, namely birth and death certificates, administered by OVR. Our performance audit addressed the following questions:! Has the Office of Vital Records established an adequate system of internal controls over the reporting, registration, processing and safeguarding of the vital records for which it is responsible?! Does the Office of Vital Records register and process all vital records accurately and properly? This audit was suspended in 1997 when our staff was asked to leave the audit site by DOH management. At that time, the City of New York challenged the Comptroller s legal authority to conduct non-financial audits of City agencies. The Comptroller s authority to conduct these audits was confirmed by the New York Court of Appeals in a decision rendered April 1, 1999.

4 Audit Observations and Conclusions Effective controls over vital records are important in society to provide a legal record of births and deaths, to collect medical and demographic information in support of health programs, and to guard against the misuse of vital records to perpetrate identity fraud. However, we found several weaknesses in DOH s controls over the reporting, registering and processing of vital records that increase the risk that the reported number of the City s birth and death records may not be accurate or complete. In addition, we found that the vital records at the Brooklyn and Queens sites may not be adequately safeguarded. For one month that we sampled (April 1998), hospitals and birthing centers reported 239 fewer births than DOH reported as registered. As a result, DOH could not be reasonably assured that the number of registered births it reported for that month is accurate and reliable. Also, our analysis of the birth registration database revealed that in the first seven months of 1999, DOH reported 70,910 registered births, while the database showed 70,872 births, a difference of 38 births. According to DOH officials, these differences will be corrected once the 1999 file is closed in June However, until that time, the 1999 database may not be totally accurate or reliable. Birth certificate numbers are supposed to be assigned in sequential order and entered onto DOH s birth registration database. We found that for births occurring late in the year and filed in the subsequent year, the birth certificate numbers were assigned out of sequence; and that gaps in the numbering sequence are created when birth records are rejected before they are inputted onto the system. This increases the risk that DOH may not have full accountability over all the birth certificate numbers. We also found that 36,365 (18.6 percent) of the 195,036 registered births during our audit period had been registered more than 10 days after the actual births, which exceeds the maximum of 5 business days required by law. Of these, 115 of the births had been registered more than 100 days after the child was born. The long delays in registering births make it difficult for the public to obtain certified copies of birth certificates on a timely basis. (See pp. 7-10) We found a lack of documentation supporting OVR s issuance of certified copies of birth certificates, which increases the risk that unauthorized individuals can obtain copies of vital records. For example, 8 of the 27 applications for vital records that we sampled were missing, and there was no evidence that applicants provided the required evidence of identity for the other 19 applications. (See p. 12) We also found that OVR does not keep a log of voided death certificates; nor does it maintain adequate records for the voided birth certificates. In addition, we found that 93 (23 percent) of 407 death certificates voided in February 1999 had not been voided properly, increasing the risk that such certificates could have been used for illegal purposes. (See pp )

5 We also found poor fire prevention controls at DOH s storage locations in Brooklyn and Queens, where certain vital records are kept. As a result, there is a significant risk that original copies of vital records stored at these locations could be destroyed by fire, causing great inconvenience to the public. (See pp ) We made 11 recommendations to DOH officials to address the weaknesses we identified in our report. Comments of DOH Officials In response to our draft report, DOH officials generally agreed with the recommendations made in this report and indicated that they have either implemented or are in the process of implementing them. However, they disagreed with the audit s conclusions concerning potential risks to the accuracy and completeness of birth and death records. A complete copy of DOH s response is included as Appendix B to this report.

6 Contents Introduction Controls Over Vital Records Appendix A Appendix B Background... 1 Audit Scope, Objectives and Methodology... 2 Response of DOH Officials to Audit... 4 Birth Registration... 7 Recommendations Processing of Birth Certificates Recommendations Death Registration Controls Over Voided Certificates Recommendations Physical Controls at DOH Storage Sites Recommendations Procedures Manual Recommendation Major Contributors to This Report Response of New York City Department of Health Officials

7 Introduction Background New York s Vital Records Registration System (System) began in 1880 when the State Legislature created the State Board of Health. The System was established out of a need to provide a legal record of births and deaths and to collect medical and demographic information in support of public health programs. Article 41 of the New York State Public Health Law provides that the New York State Department of Health is responsible for the registration of all vital events that occur in the State, outside of New York City (City). Title V of the New York City Health Code contains provisions for the reporting of specified vital events that is, births, fetal deaths and other deaths in the City. Pursuant to the New York City Administrative Code, the Office of Vital Records (OVR) within the New York City Department of Health (DOH) is responsible for the processing, registration, issuance, archival and maintenance of the City s birth and death certificates. For the fiscal year ended June 30, 1999, DOH reported total expenditures of $465 million, with an employee head count of 2,915. OVR comprises four primary work units: Registration, Public Service Operations, Records Management and Corrections. For the fiscal year ended June 30, 1999, OVR reported revenues of $10.9 million from the issuance of birth and death certificates. As of August 1999, its staff consisted of 115 employees. For the 19 months that ended on July 31, 1999, OVR reported registering 195,162 births and 97,974 deaths. For the same period, OVR reported that certified copies of 508,402 birth certificates and 623,164 death certificates had been issued. To register births, DOH uses the Electronic Birth Certificate (EBC) system, which allows hospitals and birthing centers to create an original birth certificate and to transmit the required birth information electronically to DOH. Information on each birth is recorded by the hospital on a diskette, which is sent to OVR s Registration Unit along with the original birth certificates. Individuals seeking copies of birth certificates can obtain them by making requests in person or by mail, telephone or fax machine. In January 1997, in an effort to provide better management and greater accountability, DOH implemented its own computer application system, known as the Cash Management System (CMS), which interfaces with the City s mainframe computer system. CMS is used to print certified copies of the birth certificates, issue receipts, sort the number of certificates issued daily by cashier ID number and workstation, and reconcile the cash received.

8 The registration and issuance of death certificates is a completely manual operation, and is handled by the Registration Unit. Death certificates are prepared by hospital staff members and funeral directors, who bring the original death certificate to the Unit for registration. Unit personnel assign a number to each death, then register and record the death in a log book. Certified copies of the original death certificate are made on special prenumbered blank paper with raised seals, which is pre-loaded into a photocopy machine. Audit Scope, Objectives and Methodology The audit scope covered the period of January 1, 1998 to July 31, The purpose of this performance audit was to evaluate the internal controls over vital records birth and death certificates maintained by the New York City Department of Health s Office of Vital Records. We sought to determine whether OVR maintains adequate controls over its handling of vital records, and whether the records are being registered and processed accurately and properly. To accomplish these objectives, we selected a random sample of 25 out of a population of 190,927 birth certificate numbers registered during our audit period and sought to verify that the original certificates, which have raised seals, existed with the required information indicated, and that information had been recorded accurately in DOH s Cash Management System (CMS). In addition, we selected a random month from that period (April 1998), and verified the accuracy of the number of registered births DOH had reported that month by comparing it with the number of births the hospitals and birthing centers had reported on their transmittal sheets to the Registration Unit. For another random month in our audit period (June 1999), we selected a random sample of certified copies of 27 out of a population of 20,184 birth certificates issued from the CMS system. We then sought to determine whether the original certificates existed and whether the information on the certified copies matched that on the original certificates. We also sought to verify that the required information was indicated on the applications filed for the 27 certified copies and that the applicants had been authorized individuals. For the same month, we reconciled the amount of blank birth certificate paper used with the number of certified copies of birth certificates issued from one of eight CMS work stations. Using a random month selected from the seven months in 1999 (February 1999), we selected a random sample of 25 death certificate numbers registered during that month and sought to verify that the original death certificates existed and that the required information was indicated on the original certificates. We also sought to determine whether the death certificates voided during the month had been recorded and voided properly. 2

9 We also performed a limited general and application control review of the Electronic Birth Registration System, Cash Management System and Correction Tracking System to determine the accuracy and reliability of these systems data. As part of our audit, we performed an analytical review of the birth registration database covering our audit period, using a computer-assisted audit technique called Audit Command Language (ACL). In addition, we interviewed agency officials and reviewed applicable laws, rules, regulations, policies and procedures. Except as discussed in the following paragraph, we conducted our audit in accordance with generally accepted government auditing standards. Such standards require that we plan and perform our audit to adequately assess those operations of DOH which are included in the audit scope. Further, these standards require that we understand DOH s internal control structure and compliance with those laws, rules and regulations that are relevant to the operations which are included in our audit scope. An audit includes examining, on a test basis, evidence supporting transactions recorded in the accounting and operating records and applying such other auditing procedures as we consider necessary in the circumstances. An audit also includes assessing the estimates, judgments and decisions made by management. We believe that our audit provides a reasonable basis for our findings, conclusions and recommendations. As is our practice, we notified DOH officials at the outset of the audit that we would request a representation letter in which management provides assurances, to the best of their knowledge, concerning the relevance, accuracy and competence of the evidence provided to the auditors during the course of the audit. The representation letter is intended to confirm oral representations made to the auditors and to reduce the likelihood of misunderstandings. Agency officials normally use the representation letter to assert that, to the best of their knowledge, all relevant financial and programmatic records and related data have been provided to the auditors. They affirm either that the agency has complied with all laws, rules and regulations applicable to its operations that would have a significant effect on the operating practices being audited, or that any exceptions have been disclosed to the auditors. However, officials at the New York City Mayor s Office of Operations have informed us that, as a matter of policy, Mayoral agency officials do not provide representation letters in connection with our audits. As a result, we lack assurance from DOH officials that all relevant information was provided to us during this audit. We consider this refusal to provide a representation letter to be a scope limitation on our audit. Therefore, readers of this report 3

10 should consider the potential effect of this scope limitation on the findings and conclusions presented in the report. We use a risk-based approach to select activities to audit. We focus our audit efforts on those activities we have identified through a preliminary survey as having the greatest probability for needing improvement. Consequently, by design, we use finite audit resources to identify where and how improvements can be made. We devote little audit effort reviewing operations that may be relatively efficient or effective. As a result, we prepare our audit reports on an exception basis. This report, therefore, highlights those areas needing improvement and generally does not address activities that may be functioning properly. Response of DOH Officials to Audit A draft copy of this report was provided to DOH officials for their review and comment. Their comments were considered in preparing this report and are included as Appendix B. In response to our draft report, DOH officials stated that the audit identified some operational findings and that they already implemented the recommendations. Department officials disagreed with the audit s broad conclusions concerning potential risks to the accuracy and completeness of birth and death records. DOH officials also asserted that the audit report did not take into account how large data systems are created, modified and controlled. They stated that the audit s use of discrepancies between preliminary and final numbers were not evidence of problems, but evidence of the normal process of reviewing and modifying the file. As a result of our review of DOH s response to the draft report and a subsequent meeting with DOH officials, we agreed with DOH s position on several issues and made certain revisions to our report. For example, we deleted our finding concerning differences between the number of births reported as registered in 1998 versus the number of births shown on the database, because the DOH Vital Statistics book we used for comparative purposes represented birth occurrences instead of birth registrations. We modified recommendation 2 regarding the accuracy of the birth registration database, by clarifying that our concern is with the timeliness of update of data. We deleted our finding related to OVR s accountability over blank birth certificate paper and the related recommendation 7. We also modified recommendation 11 regarding the tracking of birth documents at the Queens location. Notwithstanding the revisions we made to the draft report, the findings and recommendations contained within this final report are valid and were agreed to by DOH officials. For example, we noted discrepancies between the number of birth certificates submitted for filing by hospitals and the number 4

11 of births registered by DOH for the month of April DOH officials acknowledged that discrepancies existed between these records and stated that OVR will consistently notate the disposition of each birth record on the hospital transmittal sheets. We also noted differences in the number of registered births reported by DOH and the number of births reflected on the database in calendar year DOH officials acknowledged that the data do not match because of the process followed to close and cleanse the database, including removal of duplicate entries. DOH officials stated that they will revise their procedures to identify duplicate entries quarterly, instead of once a year. For these and other reasons, such as the lack of documentation supporting the issuance of copies of birth certificates, inadequate record keeping and lack of accountability over voided birth and death certificates, and poor physical controls over vital records at DOH storage sites, we believe there is sufficient justification to conclude there are risks that the reported number of City birth and death records may not be accurate or complete, and that the vital records at the Brooklyn and Queens storage sites may not be adequately safeguarded. Within 90 days after the release of the final report, we request that the Commissioner of the New York City Department of Health report to the State Comptroller, advising what steps were taken to implement the recommendations contained in the report, and, where recommendations were not implemented, the reasons therefor. 5

12 6

13 Controls Over Vital Records The responsibility for safeguarding vital records, namely birth and death certificates, is very important. Information contained in these records is necessary for performing many functions in society, such as obtaining a driver s license or applying for Social Security benefits; but when the wrong person gains control of it, the result can be financially and emotionally devastating. For example, fraudulently-obtained birth certificates can be used to obtain Social Security cards or other documents with which to create a false identity. Thus, responsible government agencies must exercise adequate controls over vital records, so that they will be able to provide a legal record of births and deaths, collect medical and demographic information in support of health programs, and guard against the misuse of vital records for identity fraud. However, we found weaknesses in DOH s internal controls over the reporting, registering and processing of vital records that increase the risk that the reported number of City birth and death records may not be accurate or complete. We also found that the vital records at the Brooklyn and Queens sites may not be adequately safeguarded. Birth Registration The New York City Health Code requires that all live births occurring in New York City on or after January 1, 1997, at facilities reporting 100 or more live births per year, shall be reported to DOH electronically by means of a computer program specified and provided or otherwise authorized for use by DOH. At their election and upon approval by DOH, all facilities reporting a smaller number of live births per year may choose either to implement an electronic birth certificate reporting system or to continue reporting births on approved paper forms. The New York City Health Code states that births occurring in New York City shall be reported to DOH and filed within five business days after birth. DOH uses the Electronic Birth Certificate System (EBC) to register births in New York City. As of August 1999, there were 48 New York City hospitals, including 2 birthing centers that use the system. EBC was designed to improve the method of reporting births, reduce the number of birth certificate errors, decrease the workload and improve OVR staff productivity. The hospital records information about each birth on a diskette that is sent to OVR s Registration Unit along with the original birth certificate. Each time OVR receives the diskette and certificates along with a transmittal sheet, an employee is supposed to record in a log book the total number of birth certificates received in the transaction. The number of original birth 7

14 certificates is then verified by comparison with amounts listed on the accompanying transmittal sheet. If the birth information on the diskette agrees with that on the original birth certificate, the birth is then registered and downloaded on to DOH s computer system. If there is a discrepancy, DOH contacts the hospital to resolve the matter. Each birth is assigned a birth certificate number in numerical sequence. Subsequently, the birth registration database is uploaded to the City s mainframe computer system located in Brooklyn. Sample Review We selected a random sample of 25 birth certificate numbers registered during our audit period and sought to determine whether the original birth certificates existed and whether the information on the original certificates had been recorded accurately in the CMS. Our review found no exceptions. Reconciliation of Birth Certificate Registration OVR is required to keep accurate records on all of the births it registers in New York City. We selected a random month (April 1998) and sought to determine whether the number of registered births DOH had reported for that month was accurate. We found that, although DOH had reported 10,358 registered births for that month, the supporting documentation did not agree with that number. Rather, the hospitals and birthing centers transmittal sheets for that period showed 10,119 registered births, a difference of 239 births. As a result, DOH could not be reasonably assured that the number of registered births it reported for that month is accurate and reliable. Analysis of the Birth Registration Database We obtained a download of the birth registration database of all births registered by OVR during the period of January 1, 1998 to July 31, When we analyzed the database comprising of 195,036 registered births using the Audit Command Language (ACL) program, we found the following:! For the seven months in 1999, OVR reported 70,910 registered births, compared to only 70,872 registered births recorded in the database, a difference of 38 births. In response to our draft report, DOH officials stated that until the 1999 file is closed, the data are continually cleaned including the removal of duplicates and the addition of late-filed certificates. They also indicated that DOH has revised its procedures as of February 14, 2000 and will identify duplicates quarterly, rather than once a year. 8

15 ! Although birth certificate numbers are supposed to be assigned sequentially for each birth registered, we found 57 gaps in the numbering sequence for births registered during our audit period. In response to our draft report, DOH officials indicated that 18 of these instances were due to births that occurred in 1997 but were registered late in 1998, and that this created the appearance of a gap of missing certificate numbers. However, upon our review, they acknowledged that even though the certificate numbers were accounted for, they were assigned out of sequence. DOH officials further stated that most of the other 39 gaps were due to the expunging of a duplicate record or rejection of records pending their replacement on the database system. They explained that the certificate numbers for these records remain on their on-line database system but were excluded from the database that was provided to us for our analytical review. However, they acknowledged that there were other instances where the birth records were rejected before they were data entered and that in these instances, the certificate numbers already assigned would not be on the database system, thus creating a gap of missing numbers.! Despite the City s Health Code provision that requires hospitals and birthing centers to file or register births with DOH within 5 business days after the baby is born, we found that 36,365 of the 195,036 births (18.6 percent) had been registered more than 10 days after the birth. Specifically, 115 of the births had been registered more than 100 days after birth; 1 of these had been registered 3 years after the child was born; and another had been recorded as being registered 18 years after birth. In response to our draft report, OVR officials stated that 31 of the 115 births (29 home births and 2 foundlings {abandoned babies}) were not filed through a hospital. They also indicated that the 18 year-late birth registration was filed on time, but that a data entry error occurred when the record was corrected and the file date was inadvertently changed. They further stated that this error would have been corrected before the 1999 file was closed. According to DOH officials, OVR will increase the frequency of review of hospital filing time to monthly, and contact hospitals that file late with phone calls and letters. 9

16 ! We found an invalid transaction for one birth. The database showed a registration date (6/29/99), which was 27 days before the date of birth (7/26/99). In response to our draft report, OVR officials replied that there was a key entry error in the birth date and that the original birth record was filed three days after the date of birth (6/26/99). They also stated that this error would have been corrected before the 1999 file was closed.! There were 126 instances of individuals listed with the same name, birth date and registration date, but with different birth certificate numbers and, in some instances, different institution codes. In response to our draft report, OVR officials indicated that only 7 of the 126 were duplicate entries; the remaining 119 comprised unique records and multiple births (e.g., twins, triplets). They further stated that the seven duplicates were filed in 1999 (first seven months) and that they would be removed from the 1999 database by June As a result, DOH does not have complete assurance that all City births are being registered and reported accurately. In addition, the long delays in registering births have an adverse affect on the public because they make it difficult to obtain certified copies of birth certificates on a timely basis. 10

17 Recommendations 1. Take appropriate steps to maintain accurate statistics regarding birth registrations. On a test basis, verify the accuracy of birth registration totals by comparing them with data reported on the transmittal sheets submitted by hospitals and birthing centers. (DOH officials replied that the notations made by OVR staff on the hospitals transmittal sheets indicating rejected certificates have not always been consistently notated by staff. They further stated that they will train staff to accurately and consistently notate the disposition of each birth record on the transmittal sheet as of April 3, 2000.) 2. Update the birth registration database on a more timely basis. DOH should also ensure that all birth certificate numbers be accounted for on their database system and be used in numerical sequence. (DOH officials replied that the exceptions noted in 1999 will be corrected once the 1999 file is closed in June They further stated that new procedures were put in place on February 14, 2000 to review and identify duplicates quarterly, instead of yearly.) 3. DOH should develop computer edit checks to prevent the inputting of invalid transactions. (DOH officials replied that full computer edit checks are built into all vital records processing systems except the Corrections Tracking System, which is a separate system that is scheduled to be replaced.) 4. Enforce the requirement that births are to be registered within five business days after birth. Instruct the hospitals and birthing centers to submit birth documents on a timely basis. (DOH officials replied that OVR will increase the frequency of review of hospital filing time to monthly. They also stated that to date, OVR has visited 12 hospitals and anticipates improvement in hospital performance. ) 11

18 Processing of Birth Certificates Individuals seeking copies of birth certificates can obtain them by making requests to OVR in person or by mail, telephone or fax machine. Each customer is assigned a receipt number; and receipt-specific transactions are recorded in CMS, which is used to print certified copies of the birth certificates, issue receipts, sort the number of certificates issued daily by individual work station and reconcile the cash received. OVR s Public Service Operations Unit (PSO) is responsible for issuing certified copies of birth certificates to the public. It uses eight CMS work stations to handle customer requests. Sample Review For a randomly-selected month during our audit period (June 1999), we selected a random sample of certified copies of 27 birth certificates issued from CMS. We determined that the original birth certificates did exist, and compared the information on the originals with that recorded on CMS. We found no exceptions. Applications for Certified Copies of Birth Certificates OVR s procedures generally state that, in addition to applying for a certified copy of one s own birth certificate, parents or guardians can apply for a certified copy of their child s birth certificate. Applicants are required to present a valid photo-identification, or two utility bills that show proof of mailing address. In addition, OVR is required to retain for six months the applications that were used to request such certified copies. We found that OVR did not maintain adequate documentation to support the issuance of the copies. Our review of the applications pertaining to our random sample of 27 birth certificates issued from CMS in June 1999 revealed the following:! Eight (30 percent) of the 27 sampled applications could not be found. Therefore, we were unable to determine whether only authorized individuals had received certified copies of certain birth certificates.! None of the 19 applications we found indicated that the applicant had provided the required identification (e.g., driver s license). Without evidence that proper identification had been provided, DOH could not be assured that the applicants had been entitled to receive certified copies of the birth certificates. 12

19 Recommendations 5. Verify that applications for certified copies of birth certificates are being filled out and maintained properly. (DOH officials replied that effective January 21, 2000, OVR began using a three-part form which ensures the proper filing of all applications. They also stated that incomplete application forms will not be cashiered and that copies of applications will be retained for one year, an increase in the current retention period of six months.) 6. Document the type of documents the applicant must provide when requesting a certified copy of a birth certificate. (DOH officials replied that effective March 16, 2000, cashiers will indicate on the application the type of identification presented to receive a copy of a birth or death certificate.) 7. Recommendation deleted. Death Registration OVR is responsible for registering and issuing certified copies of death certificates, as well as permits for burial, cremation and disinterment. It is also responsible for the archival and maintenance of death certificates. Operating with three shifts of employees who provide the service 24 hours a day, 7 days a week, the Registration Unit is responsible for registering and issuing certified copies of death certificates to individuals who request them. During the period of January 1, 1998 to July 31, 1999, OVR reported 97,974 registered deaths. Death certificates are prepared by the hospitals and funeral directors, and are registered by OVR upon receipt. A death is registered when a funeral director brings in the death certificate, along with a burial permit to be registered with the Registration Unit. The Unit maintains a log of all of the death certificates that have been registered, and assigns a certificate number to each death certificate. The certificate is then forwarded to OVR s Records Management Unit for microfilming, after which it is placed in a binder for storage in DOH s vault area. Death certificates from 1988 to the present are stored at DOH s Central Office in Manhattan, while death certificates prior to 1988 are stored at a DOH facility located in Brooklyn. 13

20 When a request for a certified copy is made, Unit staff conduct a physical search for the original death certificate on file. Once found, the certificate is photocopied on pre-numbered blank death certificate paper that carries a raised seal and is pre-loaded on to a photocopy machine. Sample Review Using a random month selected from the seven months in 1999 (February 1999), we examined a random sample of 25 death certificate numbers registered in an effort to determine whether the original death certificates existed and whether they contained all the required information. Our review found no exceptions. Controls Over Voided Certificates On occasion, a certified copy of a birth or death certificate may be unacceptable because the copy is damaged or is unclear. In such instances, the document is voided. OVR s procedures require that a log be maintained of such voided certificates and that voided certificates be clearly marked void and have their seals torn. Voided Birth Certificates OVR s procedures require that data identifying the voided birth certificates be entered in a log book each day by the supervisor of the Public Service Operations Unit. The entry should contain the date of issue, date of voiding, date of birth, birth certificate number, blank certificate number and reason for the void. Our review found that the log book maintained by the PSO Unit had not been filled out properly. We found that all of the voided birth certificates had not been recorded in the log book, and that some of these certificates had not been marked VOID. Nor were Unit personnel recording the actual date the void occurred or the reason for the void. The only date recorded was the date the certificate was issued. As a result, OVR could not be assured that all voided birth certificates were accounted for; and there was a greater risk of impropriety because some of the certificates had not been voided properly. Voided Death Certificates We found that, because the Registration Unit does not maintain a log for voided death certificates, OVR is unable to account for all death certificates that have been voided. Also, our review of 407 voided death certificates for our sampled month (February 1999) found that 93 certificates (23 percent) had not been voided properly. In all of these 93 cases, either the certificate was stamped 14

21 VOID or the seal was torn or mutilated, but not both. As a result, the risk increases that the certificates could be used for illegal purposes. Recommendations 8. Maintain proper and accurate records for voided birth and death certificates. (DOH officials replied that effective January 31, 2000, OVR standardized the recording of voided birth and death certificates in logs that list the certificate number, the reason for the void, the date voided and the date recorded. They also stated that PSO staff are also recording the voids in certificate number order, which will make it easier to locate voided certificates.) 9. Void all birth and death certificates properly. (DOH officials replied that effective January 31, 2000, OVR standardized the method to void documents as follows: the seals are torn and both the body of the document and the seal are stamped void. ) Physical Controls at DOH Storage Sites Original birth and death documents are stored primarily at three DOH locations the Central Office in Manhattan, and other offices in Queens and Brooklyn. We found that physical controls were adequate at the Central Office, where birth certificates dating from 1935 to the present and death certificates dating from 1988 to the present are stored in a vault area. However, we found weaknesses in controls at the Queens and Brooklyn locations. The Queens location is used to store sealed birth documents. These records are kept in a two-level vault area where neither a sprinkler system nor a fire extinguisher had been installed. Just one smoke detector had been installed on one level. We found that information on the retrieval and return of birth documents is recorded on loose sheets of paper that are kept in a file. If these sheets are lost or misplaced, then accountability over these birth documents would be compromised. Birth certificates dating from 1910 to 1934 and death certificates dating from years prior to 1988 are stored in a vault at the Brooklyn location. At this 15

22 location there were four fire extinguishers, however; we found no sprinkler system or smoke detector in the storage area of the vault. As a result of the poor fire prevention measures at the Queens and Brooklyn locations, there is a significant risk that the original vital records stored there could be destroyed, causing great inconvenience to the public. In response to our preliminary audit findings, OVR officials agreed that these deficiencies existed and expressed serious concerns regarding the inadequate fire detection measures at these locations. Recommendations 10. Safeguard the vital records by installing adequate fire prevention measures at the Queens and Brooklyn locations. (DOH officials replied that fire prevention measures were enhanced on January 11, 2000, in that four additional fire extinguishers were installed for a total of eight at the Brooklyn site, and six fire extinguishers were placed at the Queens site in addition to a smoke detector already there.) 11. Record the retrieval and return of the sealed birth documents stored at the Queens location in a log book for better accountability. Procedures Manual Even though OVR comprises four units: Registration, Public Service Operations, Records Management and Corrections, it has not yet prepared a procedures manual for each one. It has procedures only for the PSO Unit, issued in August Such a manual would provide increased assurance that all of OVR s procedures are being applied consistently and implemented effectively. 16

23 Recommendation 12. Prepare and issue written procedures that would cover all four OVR units. (DOH officials replied that procedures manuals for all of the OVR units should be completed by April 2001.) 17

24 Major Contributors to This Report Kevin McClune Walter Mendelson Howard Feigenbaum Albert Kee Charles Johnson Arthur Lebowitz Sheila Jones Robert Tabi Debra Wolrich Marticia Madory Appendix A

25 Appendix B

26 B-2

27 B-3

28 B-4

29 B-5

30 B-6

31 B-7

32 B-8

33 B-9

34 B-10