Disadvantages of Spreadsheets – Obstacles to Compliance in the Healthcare Industry

Most of the regulatory compliance issues we talked about concerning spreadsheets have been related to financial data. But there are other kinds of data that are stored in spreadsheets which may also cause regulatory problems in the future.

In the US, a legislation known as HIPAA or Health Insurance Portability and Accountability Act is changing the way health care establishments and practitioners handle patient records. The HIPAA Privacy Rule is aimed at protecting the privacy of individually identifiable health information a.k.a. protected health information (PHI).

Examples of PHI include common identifiers like a patient’s name, address, Social Security Number, and so on, which can be used to identify the patient. HIPAA covers a wide range of health care organisations and service providers, including: health plan payers, health care clearing houses, hospitals, doctors, dentists, etc.

To protect the confidentiality, integrity, and availability of PHI, covered entities are required to implement technical policies such as access controls, authentication, and audit controls. These can easily be implemented on server-based systems.

Sad to say, many health care organisations who have started storing data electronically still rely on spreadsheet-based systems. Those policies are hard to implement in spreadsheet-based systems, where files are handled by end-users who are overloaded with their main line of work (i.e. health care) and have very little concern for data security.

In some of these systems, spreadsheet files containing PHI may have multiple versions in different workstations. Chances are, none of these files have any access control or user authentication mechanism whatsoever. Thus, changes can easily be made without proper documentation as to who carried out the changes.

And because the files are normally easily accessible, unauthorised disclosures – whether done intentionally or accidentally – will always be a lingering threat. Remember that HIPAA covered entities who are caught disclosing PHI can be fined from $50,000 up to $500,000 plus jail time.

But that’s not all. Through the HITECH Act of 2009, business associates of covered entities will now have to comply with HIPAA standards as well. Business associates are those companies who are performing functions and services for covered entities.

Examples of business associates are accounting firms, law firms, consultants, and so on. They automatically need to comply with the standards the moment they too deal with PHI.

More Spreadsheet Blogs

Spreadsheet Risks in Banks

Top 10 Disadvantages of Spreadsheets

Disadvantages of Spreadsheets – obstacles to compliance in the Healthcare Industry

How Internal Auditors can win the War against Spreadsheet Fraud

Spreadsheet Reporting – No Room in your company in an age of Business Intelligence

Still looking for a Way to Consolidate Excel Spreadsheets?

Disadvantages of Spreadsheets

Spreadsheet woes – ill equipped for an Agile Business Environment

Spreadsheet Fraud

Spreadsheet Woes – Limited features for easy adoption of a control framework

Spreadsheet woes – Burden in SOX Compliance and other Regulations

Spreadsheet Risk Issues

Server Application Solutions – Don’t let Spreadsheets hold your Business back

Why Spreadsheets can send the pillars of Solvency II crashing down

amazon.co.uk

amazon.com

Check our similar posts

The Types of Industries That Can Benefit from Field Service Software

Initially, field service software was designed with field techs and their managers in mind. However, in the recent past, other industries have taken this path to better the performance of their businesses. Any industry that deploys skilled laborers and assets to off-site locations benefits from field service software. It’s all about resource allocation and data centralization for efficient management and running of the business? activities. With field service software, you got all your business? functions logged in one place.

So, who needs field service management software? Professionals like electricians, plumbers, IT technicians, construction workers, and carpenters all find it useful. Moreover, there?s a wide range of application in many different types of industries.

Here are some industries that benefit from field service management software.

Fire and Life Safety

In a fire and life safety industry, equipment and safety systems should be kept running at peak efficiency. Therefore, it’s necessary to provide appropriate services that will ensure the smooth running of processes. On top of complying with government codes, fire and security systems installed should offer reliable services. Since service is at the core of this industry?s operation, most people in fire and security industries are turning to field service software to automate operations of their service delivery. With the field service software tools, the industry can easily monitor security technologies, quickly respond to customers, and manage compliance, inspections, and procedures effectively.

Medical Device Enterprises

For medical device companies seeking to improve their services, sales, and compliance, field service software becomes very essential for the smooth running and operations of their functions. The medical device enterprises that greatly benefit from this software include those offering installations, repair, and maintenance of medical equipment. With the comprehensive field service tools, service delivery and performance is greatly improved.

Moreover, with the field service software, these industries find better ways of tracking critical records needed for regulatory compliance since the medical industry is one of the most regulated industries in the globe. For the companies doing the manufacturing of medical equipment, they can integrate field service software in their accounting systems to streamline their invoice processes and shorten their billing cycles.

IT and Communications Services Companies

With the remarkable technological advancements in the recent past, Internet service providers, cable companies, and communications organizations are looking for better ways of service delivery to keep up with the pace of the growing technology. Connections are becoming more complex day by day propelled by an explosion in new data sources, and the use of the devices. To keep up with the increased demand for instant services by customers, the IT and communication service companies, are turning to field service software to make their service delivery more effective.

A combination of the robust, advanced scheduling system and rich functionality makes this software very useful to the communication service companies. They can use the software to design and install complex internet infrastructure. Moreover, field service software can be used by these companies to set up recurring maintenance plans to maintain the installed internet systems.

Oil and Gas Enterprises

Most oil and gas industries are faced by complexities which need special handling for better business performance. Since the running of projects is at the cornerstone of their businesses, they’re always looking for better ways to ensure a smooth running of their project activities. For this reason, most of the oil and gas enterprises that have discovered the benefits of field service software are integrating the main activities of their projects in this software.

With the project-based software tools, there?s an efficient flow of information and transparency throughout the enterprise ensuring excellent project management. With the checklist feature included in most field service software, inspections, compliance, site surveys, and maintenance of procedures is made easier in oil and gas companies.

Facilities Management Industry

Given that this is a service industry, high-level of efficiency is paramount. To meet customer expectations and battle against cost, most facility management industries are turning to field service software. With the comprehensive tools included in the field service software, supervisors can assign tasks to their reports, monitor their progress, and receive alerts on critical issues while in a remote place or at the comfort of their office.

Maintenance and emergency repairs in the facility management industry are greatly supported by this software ensuring increased productivity and efficiency. Additionally, with field service software the industries benefit from a streamlined workflow and improved communication that greatly reduces administration time and cost.

Industrial Equipment Enterprises

Industrial equipment companies aim at maximizing their overall productivity and preventing equipment downtime. There?s a wide range of activities that take place in industrial equipment companies which require field service software for higher levels of efficiency.

From load testing, installation projects, and load testing to emergency repairs, this software, enables the managers to design work orders, and get them ready for scheduling, and distribute them in a moment. With the equipment and asset tracking software, the supervisors can gain instant visibility into the equipment and assets in the field to ensure their regular maintenance. The scheduling and resourcing tools ensure the supervisors are in full control over the dispatching of their workforce, their schedules, and the route taken by each for maximum work output. Additionally, with the field service software, industrial equipment companies can meet their customer expectations.

Construction Industry

Since construction work involve both site work and office work, building industries find field service software very useful in integrating their field and office activities. Field service software is designed to establish effective communication between the office staff and the field operators. With inclusive software tools, the supervisors can easily manage daily inspections and receive feedback from the field workers without leaving the office. Moreover, documentation is simplified, and everything is documented in a central place so that it’s easier to retrieve important information at any time. With field service software, building industries can manage their construction efficiently while minimizing cost, and saving on time.

Filed service software is gaining popularity in the industrial world as most enterprises seek to improve their business? performance, and keep up with the competition. Moreover, more companies are expected to come on board as the field service software companies work extra hard to add more tools to suit a wide range of functions.

How to Reduce Costs when Complying with SOX 404

Section 404 contains the most onerous and most costly requirements you’ll ever encounter in the Sarbanes-Oxley Act (SOX). In this article, we?ll take a closer look at the salient points of this contentious piece of legislation as it relates to IT. We?ll also explain why companies are encountering difficulties in complying with it.

Then as soon as we’ve tackled the main issues of this section and identify the pitfalls of compliance, we can then proceed with a discussion of what successful CIOs have done to eliminate those difficulties and consequently bring down their organisation’s IT compliance costs. From this post, you can glean insights that can help you plan a cost-effective way of achieving IT compliance with SOX.

SOX 404 in a nutshell

Section 404 of the Sarbanes-Oxley Act, entitled Management Assessment of Internal Controls, requires public companies covered by the Act to submit an annual report featuring an assessment of their company?s internal controls.

This ?internal control report? should state management’s responsibility in establishing/maintaining an adequate structure and a set of procedures for internal control over your company?s financial reporting processes. It should also contain an assessment of the effectiveness of those controls as of the end of your most recent fiscal year.

Because SOX also requires the public accounting firm that conducts your audit reports to attest to and report on your assessments, you can’t just make baseless claims regarding the effectiveness of your internal controls. As a matter of fact, you are mandated by both SEC and PCAOB to follow widely accepted control frameworks like COSO and COBIT. This framework will serve as a uniform guide for the internal controls you set up, the assessments you arrive at, and the attestation your external auditor reports on.

Why compliance of Section 404 is costly

Regardless which of the widely acceptable control frameworks you end up using, you will always be asked to document and test your controls. These activities can consume a considerable amount of man-hours and bring about additional expenses. Even the mere act of studying the control framework and figuring out how to align your current practices with it can be very tricky and can consume precious time; time that can be used for more productive endeavours.

Of course, there are exceptions. An organisation with highly centralised operations can experience relative ease and low costs while implementing SOX 404. But if your organisation follows a largely decentralised operation model, e.g. if you still make extensive use of spreadsheets in all your offices, then you’ll surely encounter many obstacles.

According to one survey conducted by FEI (Financial Executives International), an organisation that carried out a series of SOX-compliance-related surveys since the first year of SOX adoption, respondents with centralised operations enjoyed lower costs of compliance compared to those with decentralised operations. For example, in 2007, those with decentralised operations spent 30.1 % more for compliance than those with centralised operations.

The main reason for this disparity lies in the disorganised and complicated nature of spreadsheet systems.

Read why spreadsheets post a burden when complying with SOX and other regulations.

Unfortunately, a large number of companies still rely heavily on spreadsheets. Even those with expensive BI (Business Intelligence) systems still use spreadsheets as an ad-hoc tool for data processing and reporting.

Because compliance with Section 404 involves a significant amount of fixed costs, smaller companies tend to feel the impact more. This has been highlighted in the ?Final Report of the Advisory Committee on Smaller Public Companies? published on April 23, 2006. In that report, which can be downloaded from the official website of the US Securities and Exchange Commission, it was shown that:

Companies with over $5 Billion revenues spent only about 0.06% of revenues on Section 404 implementation
Companies with revenues between $1B – $4.9B spent about 0.16%
Companies with revenues between $500M – $999M spent about 0.27%
Companies with revenues between $100M – $499M spent about 0.53%
Companies with revenues less than $100M spent a whopping 2.55% on Section 404

Therefore, not only can you discern a relationship between the size of a company and the amount that the company ends up spending for SOX 404 relative to its revenues, but you can also clearly see that the unfavourable impact of Section 404 spending is considerably more pronounced in the smallest companies. Hence, the smaller the company is, the more crucial it is for that company to find ways that can bring down the costs of Section 404 implementation.

How to alleviate costs of section 404

If you recall the FEI survey mentioned earlier, it was shown that organisations with decentralised operations usually ended up spending more for SOX 404 implementation than those that had a more centralized model. Then in the ?Final Report of the Advisory Committee on Smaller Public Companies?, it was also shown that public companies with the smallest revenues suffered a similar fate.

Can we draw a line connecting those two? Does it simply mean that large spending on SOX affects two sets of companies, i.e., those that have decentralised operations and those that are small? Or can there be an even deeper implication? Might it not be possible that these two sets are actually one and the same?

From our experience, small companies are less inclined to spend on server based solutions compared to the big ones. As a result, it is within this group of small companies where you can find a proliferation of spreadsheet systems. In other words, small companies are more likely to follow a decentralised model. Spreadsheets were not designed to implement strict control features, so if you want to apply a control framework on a spreadsheet-based system, it won’t be easy.

For example, how are you going to conduct testing on every single spreadsheet cell that plays a role in financial reporting when the spreadsheets involved in the financial reporting process are distributed across different workstations in different offices in an organisation with a countrywide operation?

It’s really not a trivial problem.

Based on the FEI survey however, the big companies have already found a solution – employing a server-based system.

Typical server based systems, which of course espouse a centralised model, already come with built-in controls. If you need to modify or add more controls, then you can do so with relative ease because practically everything you need to do can be carried out in just one place.

For instance, if you need to implement high availability or perform backups, you can easily apply redundancy in a cost-effective way – e.g. through virtualisation – if you already have a server-based system. Aside from cost-savings in SOX 404 implementation, server-based systems also offer a host of other benefits. Click that link to learn more.

Not sure how to get started on a cost-effective IT compliance initiative for SOX? You might want to read our post How To Get Started With Your IT Compliance Efforts for SOX.?

A Small External Enterprise Development Team is Cheaper than Your Own

Time is money in the application development business. We have to get to market sooner so someone else does not gazump us, and pip us at the post. We increase the likelihood of this with every delay. Moreover, the longer your in-house team takes to get you through the swamp, the higher the project cost to you.

Of course, in theory this should not be the case. Why bring in a team from outside, and pay more to support their corporate structure? Even going for a contract micro team ought not to make financial sense, because we have to fund their mark-up and their profit taking. Our common sense tells us that this is crazy. But, hold that thought for a minute. What would you say if a small external enterprise development team was actually cheaper? To achieve that, they would have to work faster too.

The costs of an Enterprise Internal Development Team

Even if you were able to keep your own team fully occupied ? which is unlikely in the long term ? having your own digital talent pool works out expensive when you factor in the total cost. Your difficulties begin with the hiring process, especially if you do not fully understand the project topic, and have to subcontract the hiring task.

If you decide to attempt this yourself, your learning curve could push out the project completion date. Whichever way you decide to go, you are up for paying advertising, orientation training, technical upskilling, travel expenses, and salaries all of which are going to rob your time. Moreover, a wrong recruitment decision would cost three times the new employee?s annual salary, and there is no sign of that changing.

But that is not all, not all by far. If want your in-house team to keep their work files in the office, then you are going to have to buy them laptops, plus extra screens so they can keep track of what they are doing. Those laptops are going to need desks, and those employees, chairs to sit in. Plus, you are going to need expensive workspace with good security for your team?s base.

If we really wanted to lay it on, we would add software / cloud costs, telephony, internet access, and ongoing technical training to the growing pile. We did a quick scan on PayScale. The median salary of a computer programmer in Ireland is ?38,000 per year and that is just the beginning. If you need a program manager for your computer software, their salary will be almost double that at ?65,000 annually.

Advantages of R&D outsourcing

The case for a small externally sourced enterprise development team revolves around the opportunity cost ? or loss to put in bluntly ? of hiring your own specialist staff for projects. If you own a smaller business with up to 100 people, you are going to have to find work for idle digital fingers, after you roll out your in-house enterprise project. If you do not, you head down the road towards owning a dysfunctional team lacking a core, shared objective to drive them forward.

Compared to this potential extravagance, hiring a small external enterprise development team on an as-needed basis makes far more sense. Using a good service provider as a ?convenience store? drives enterprise development costs down through the floor, relative to having your own permanent team. Moreover, the major savings that arise are in your hands and free to deploy as opportunities arise. A successful business is quick and nimble, with cash flow on tap for R & D.