The audit objective was to examine the effectiveness of the Department of Human Services’ administration of the Australian Childhood Immunisation Register.

Summary

Introduction

1. The Australian Childhood Immunisation Register (ACIR or the Register) is a national record of the immunisation1 details of children under the age of seven, which serves a number of key public health functions. The Register contains information used for measuring and monitoring national (and regional) immunisation coverage rates for children, and is drawn on to inform parents2 and immunisation providers of a child’s current immunisation status and history.3 In addition, information from ACIR is used to confirm a parent’s eligibility for certain family assistance payments, as part of an Australian Government policy to encourage the immunisation of children.4

2. Children under the age of seven are automatically entered on the Register once they are enrolled in Medicare. If a child is not enrolled (or not eligible) for Medicare, they are entered on the Register once ACIR receives details of their first immunisation by a provider. As at 28 February 2015, some 2 263 857 children were registered on ACIR.

3. The Register is administered by the Department of Human Services (Human Services). Section 46B of the Health Insurance Act 1973 (the Act) requires the Chief Executive Medicare5 to establish and keep ACIR. The Act also requires the Chief Executive Medicare to make payments to recognised immunisation providers who notify ACIR that they have immunised children in accordance with the national vaccination schedule. The Department of Health (Health) is responsible for the overall management of ACIR in the context of the National Immunisation Program (NIP) agreed by Australian Governments.6

4. A Business Agreement (the Agreement) between Health and Human Services documents key aspects of Human Services’ day-to-day administration of the Register, including: collecting and recording immunisation information; calculating and making payments to providers; operating ACIR-related telephony and processing services; and providing information on immunisations to parents, providers and other third parties.

Key immunisation trends

5. Vaccination against disease is an important public health intervention. Vaccination programs not only aim to protect individuals from illness (or even death) associated with vaccine preventable diseases, but are also intended to increase the level of immunity in the population7, thereby protecting those that are not immunised or cannot be immunised. National surveys in the late 1980s suggested that only about 53 per cent of Australian children were adequately immunised and there was room for improvement in the effectiveness of childhood immunisation programs. At present, national immunisation levels for the three key cohorts of children are just over 90 per cent, as illustrated in Figure S.1.8

Figure S.1: Percentage of fully immunised children for the period 1999 to 2014

Source: Department of Health, Immunise Australia website.

Note: Cohort 1 includes children aged 12 to 15 months; Cohort 2 includes those aged 24 to 27 months; and Cohort 3 includes children aged 60 to 63 months. Complete figures for Cohort 3 were not recorded in ACIR between 1999 and 2004.

6. To maintain protection for infants and children who are unable to be immunised, the Australian Government announced in April 2015 that it will take additional measures to promote childhood vaccination. From 1 January 2016, immunisation requirements for the payment of Family Tax Benefit (FTB) Part A supplement will be extended to include ‘children of all ages’.9 10 In addition, parents will no longer be able to claim an exemption from immunisation for their child—on religious grounds or on the basis of a conscientious objection—and still receive Child Care Benefit, Child Care Rebate, and FTB Part A supplement.11 As summarised in Figure S.2, the number of children with a conscientious objection to immunisation recorded on the Register has increased steadily, with the number more than doubling in the past 10 years.12 13

Figure S.2: Number of children with a conscientious objection recorded on the Register

Source: Department of Health, Immunise Australia website.

Note: Conscientious objection statistics are for a point in time, as new children are continually being added to ACIR, and records for children over the age of seven become inactive. Current policy requires parents to register their conscientious objection to immunisation as part of eligibility requirements for some family assistance payments.

 The percentage of children with a conscientious objection recorded on the Register has increased each year, from 0.23 per cent in 1999 to 1.77 per cent in 2014.

7. In April 2015, the Health Minister also announced that the 2015–16 Budget would include an extra $26 million for the NIP to: provide an additional incentive payment to providers who identify and catch up a child that is more than two months overdue for a vaccination; provide a range of communication activities, tools and resources to increase awareness and understanding of the NIP and immunisation more generally; and develop an Australian School Vaccination Register to allow recording of adolescent vaccinations.14 15

Audit objective, criteria and scope

8. The audit objective was to examine the effectiveness of the Department of Human Services’ (Human Services) administration of the Australian Childhood Immunisation Register (ACIR).

9. To form a conclusion against the objective, the ANAO adopted the following high-level criteria:

  • Human Services has established effective policies and procedures to support the administration of ACIR;
  • Human Services has adequate procedures and controls in place for the collection, use and management of ACIR information, including to maintain the integrity of data in ACIR; and
  • Human Services has sound reporting processes which support the timely, accurate and authorised dissemination of ACIR information.

10. The audit focused on Human Services’ administration of ACIR and did not include an assessment of the broader National Immunisation Program or its overall administration by the Department of Health. ACIR is largely populated using data from the Medicare customer database, which was the subject of a previous ANAO performance audit.16 The integrity of the Medicare customer database has not been examined again as part of the current audit. However, where relevant, the findings of the previous audit are noted in this report.

Overall conclusion

11. The Australian Childhood Immunisation Register (ACIR or the Register) records the immunisation details for over 2.25 million children under the age of seven. The Register is a key public health resource used to measure and monitor immunisation coverage rates for policy and planning purposes, and to inform parents and immunisation providers of a child’s immunisation status. Information from the Register is also used to confirm a parent’s eligibility for certain family assistance payments as part of an Australian Government policy to encourage childhood immunisation17, as well as for authorised research purposes. The Department of Health (Health) has responsibility for the overall management of ACIR in the context of the National Immunisation Program (NIP) agreed by Australian Governments, while the Department of Human Services (Human Services) is responsible for establishing and maintaining ACIR. A business agreement between the departments documents key aspects of Human Services’ day-to-day administration of the Register.

12. The ACIR contributes to the overall success of the NIP and the health status of individual children, and in April 2015 the Australian Government announced its intention to also establish an Australian School Vaccination Register for adolescents.18 Australian governments use data from the current Register to inform immunisation policy and planning including, most recently, a policy response to growing levels of conscientious objections to immunisation.19 Parents and immunisation providers have also come to rely on the Register as a source of information on the immunisation status of children under seven years of age, including for the administration of essential vaccines in accordance with the NIP schedule. Children will generally receive vaccinations for different diseases over a number of years, potentially from different providers, and a key challenge for Human Services is to maintain the Register’s integrity through accurate and timely data entry and revision. In its administration of ACIR, Human Services relies on information received from parents and providers20, and on the reliable exchange of data between ACIR and other departmental ICT systems—the Medicare Consumer Directory (MCD) and the Centrelink program’s Income Security Integrated System (ISIS).21

13. Overall, Human Services’ administration of ACIR has been generally effective. The department has generally met or exceeded performance targets established in its business agreement with Health, and maintains a range of communication channels to facilitate parents’ and immunisation providers’ access to child immunisation records. System controls to maintain the integrity of data on the Register have been implemented and are generally operating as intended, although there remains scope to strengthen the ACIR quality and control framework. In particular, known impediments to the automated exchange of information between ACIR and other departmental ICT systems mean that the department must manually reconcile certain records on a daily basis—an ongoing administrative overhead. Further, while information on the Register can be added or revised on the basis of telephone advice received from immunisation providers, there is no process for monitoring ACIR telephony services for quality control purposes; and the department has not clearly communicated its expectations on the key role played by parents and immunisation providers in maintaining the integrity of ACIR data holdings.

14. Between 2011–12 and 2013–14, the ANAO’s analysis of Human Services’ documentation indicated that the department generally met or exceeded the ACIR performance targets set out in its Business Agreement with Health. During this period, the department provided 100 per cent of financial reports to stakeholders within five working days of the specified time, exceeding its target of 90 per cent. The department also exceeded its target of making 90 per cent of immunisation provider payments within seven days before the end of the month, with 100 per cent of payments made within the required timeframe. In 2013–14, some 92.5 per cent of immunisation information was processed within 10 working days, against a target of 95 per cent.22 Human Services has also established a number of useful communication channels for stakeholders, including a dedicated website and telephone lines, and outreach officers for Indigenous and multicultural customers. The Register is a key public health information resource, and effective communication channels facilitate parental access to their child’s Immunisation History Statement (IHS) and enable immunisation providers to interrogate ACIR regarding their patients’ immunisation status.

15. However, maintaining ACIR data quality remains an ongoing business risk for the department. Limited interoperability between Human Services’ ICT systems (ACIR, MCD and ISIS)23 and external providers’ practice management software (PMS) makes it necessary for the department to supplement automated data exchange processes with daily manual data cleansing and matching activities. For instance, departmental operational reports of transactions between ACIR and MCD indicate that some 4 900 records required manual resolution over a two month period.24 25 Many electronic transactions between ACIR and immunisation providers also required manual investigation during this period26, as did transactions between ACIR and ISIS. To contribute to ACIR data integrity and improve the efficiency of information processing, Human Services should establish a pathway for the resolution of persistent and known data synchronisation issues between ACIR and other departmental ICT systems, incorporating a planned process and timetable. There would also be benefit in the department working with PMS suppliers to identify options for addressing errors arising during data exchanges between the ACIR and provider systems.

16. The department relies on the experience of its Service Officers (SOs), supported by documented procedures, to maintain the quality of its manual reconciliation processes. However, there is currently no systematic quality control process in place to provide departmental management with additional assurance regarding the accuracy of these resource-intensive manual processes. There would be merit in the department introducing a quality control framework for manual reconciliation and review processes applying to data exchanged between ACIR and other ICT systems. Similarly, no quality control process applies to ACIR telephone calls from parents and immunisation providers, which can result in updates to information kept on the Register. Consistent with many other services provided by Human Services, the department should also apply quality call listening processes to ACIR-related telephone calls, to provide additional assurance that the Register is updated in accordance with relevant procedures.

17. Human Services advised the ANAO that in addition to its own quality control processes, it relies on parents and immunisation providers to assist in maintaining the accuracy of the Register. In particular, the department expects that parents will check that details recorded on their child’s IHS are correct, and will advise the department of any errors. The department also expects that immunisation providers will review their monthly payment summaries to check that vaccines they administered have been accurately recorded, and that payments made to them are correct. However, Human Services’ expectations in respect to maintaining the accuracy of the Register are not clearly and consistently communicated to parents and providers, and the department should include a statement to this effect in relevant communication materials, including the IHS sent to parents and the monthly payment summaries sent to providers.

18. The ANAO has made three recommendations to strengthen the ACIR quality and control framework, focusing on Human Services: establishing a pathway to resolve known impediments to the automated exchange of information between ACIR and other departmental ICT systems; introducing a process to monitor the quality of ACIR telephony services and manual data reconciliation activities on a sample basis; and clearly conveying departmental expectations relating to the role played by parents and immunisation providers in maintaining the accuracy of the Register.

19. As mentioned, the current Register contributes to the overall success of the NIP, and informs ongoing policy responses to immunisation issues—such as the $26 million 2015–16 Budget measure foreshadowed by the Australian Government in April 2015. As part of that measure, the Government proposes to establish an Australian School Vaccination Register for adolescents.27 The findings and recommendations of this audit of ACIR may also inform responsible entities in the implementation and operation of the proposed school vaccination register.

Key findings by chapter

Australian Childhood Immunisation Register Governance and Stakeholder Engagement (Chapter 2)

20. The day-to-day administration of ACIR is underpinned by a formal Business Agreement between the departments of Health and Human Services. In the period 2011–12 to 2013–14, the ANAO’s analysis of Human Services’ documentation indicated that the department had generally met or exceeded the ACIR performance targets set out in the Business Agreement.28 Both departments also advised that they have established a constructive working relationship, with regular contact between officials which is not limited to the formal consultative arrangements set out in the Agreement.

21. Maintaining data quality is an ongoing business risk to be managed by Human Services, and underpins the integrity of the Register. While Human Services’ Risk Management Plan (RMP) for ACIR has recently been strengthened to address risks related to the integrity of provider payments, it no longer directly addresses broader data integrity risks, and there remains scope to further strengthen the RMP.29

22. The Register is a key public health information resource, which informs immunisation policy and planning, and is used day-to-day to record the immunisation status of individual children. Human Services has established a number of useful communication channels for conveying information about ACIR to stakeholders. These channels include: an ACIR website (the department’s principal communication vehicle); dedicated ACIR telephone lines; and generalist outreach officers for Indigenous and multicultural customers. These communication channels facilitate parental access to their child’s IHS and enable immunisation providers to interrogate ACIR regarding their patients’ immunisation status.

23. Human Services provides high level public reporting on ACIR program achievements through its Annual Report, and a useful set of regular internal reports to senior managers.

Management of the Australian Childhood Immunisation Register (Chapter 3)

24. The effective operation of the ACIR program relies on the integrity of data held in the Register and the quality of administrative processes used to capture, record and update data. Sound data integrity controls can assist in providing confidence to: parents that their child’s personal and immunisation information is correct and secure, and that immunisation-related eligibility checks for certain family assistance payments are accurate; health professionals checking a patient’s immunisation status; and government entities monitoring immunisation coverage levels.

25. Children are generally registered on ACIR automatically once they are enrolled in Medicare. Relevant information on the Medicare database, known as the Medicare Consumer Directory (MCD)30, is synchronised daily with information kept on the Register.31 The ANAO’s testing of the completeness, accuracy and validity of these automated daily information exchange processes indicated that the number of data discrepancies is small relative to the total ACIR population. However, a number of persistent data synchronisation errors were identified, arising primarily from limitations in the interoperability of the relevant departmental ICT systems.32 Further data synchronisation errors arise from known system-to-system issues, such as misalignment of the business rules between systems.33 Data synchronisation errors between ACIR and MCD are managed through daily manual reviews undertaken by departmental staff—an essential but resource-intensive exercise which does not incorporate a quality control process. To help maintain ACIR data integrity and improve the efficiency of information processing, Human Services should establish a pathway for the resolution of data synchronisation issues, incorporating a planned process and timetable.

26. Further, the department should introduce a quality control process for the daily manual review and reconciliation of data exchanged between ACIR and other ICT systems, as there is currently no systematic quality control process in place to provide departmental management with additional assurance regarding the accuracy of these processes.

27. Human Services receives information from immunisation service providers electronically, over the telephone, and in paper form. The department has established system controls to validate electronic data received from immunisation providers before it is accepted into ACIR. However, departmental staff are also required to manually resolve large numbers of these records each month, to address errors largely introduced by immunisation providers’ practice management software (PMS).34 There would be benefit in the department working with PMS suppliers to identify options for addressing errors arising during data exchanges between ACIR and provider systems, so as to reduce the need for manual reconciliation processes and related administrative overheads.

28. Human Services has implemented quality control processes to check the accuracy of information entered manually by its Service Officers (SOs) from paper-based sources.35 Further, the department has put in place system controls, supported by a manual reconciliation process, to support the accurate calculation of payments to service providers. However, no quality control process applies to ACIR telephone calls. The department provides a range of ACIR-related telephone lines for its customers, including immunisation providers, to enable them to obtain and supply immunisation information. Given the large number of calls involving ACIR updates, and consistent with many other services provided by Human Services, the department should apply quality call listening processes to ACIR-related telephone calls.

29. Human Services advised that in addition to its own quality control processes, it relies on parents and immunisation providers to assist in maintaining the accuracy of the Register. The department expects that parents will check that details recorded on their child’s IHS are correct, and will advise the department of any errors. Similarly, the department expects that providers will review their monthly payment summaries to check that vaccines administered by them have been accurately recorded, and that their payments are correct. However, the department’s expectations in this regard are not clearly and consistently communicated to parents and providers, and the department should include an appropriate statement in relevant communication materials, including the IHS sent to parents and the monthly payment summaries sent to providers.

Use of Australian Childhood Immunisation Register Information (Chapter 4)

30. ACIR contains private and sensitive information used to: assist parents and providers in managing childhood immunisations; and inform public health policy and planning. To manage the use of ACIR information and promote the consistent application of applicable legislative obligations and departmental processes, Human Services has established relevant system controls, as well as internal policies, guidance materials and training for ACIR staff.

31. The department’s current approach to advising parents of its policy relating to the collection and use of personal information relies on an interested parent accessing the department’s website and Privacy Policy. The ANAO’s review of privacy information appearing on the Human Services website indicated that parents are not clearly advised of: the two-way exchange of information between ACIR and Centrelink for the purpose of determining family assistance payments; and that ACIR retains and uses information after a child turns seven. There would be benefit in Human Services considering how best to inform parents of these specific aspects of the ACIR program.

32. While controls are in place to manage access to information by authorised immunisation providers, the ANAO’s review of key access controls indicated that there was not a process in place to effectively monitor staff access to ACIR.36 To strengthen access controls over the ACIR database, there would be merit in Human Services establishing a process to review internal user access privileges at appropriate intervals, so that only those staff with a job requirement to access the ACIR system and secure portal are able to do so. The ANAO also observed inconsistent practice in the implementation of some information security procedures—in particular, staff satisfying themselves that an immunisation provider had secured parental consent prior to the department releasing ACIR information by telephone. There is scope to further reinforce information security procedures for ACIR telephony staff.

33. As mentioned, eligibility for some Centrelink payments is dependent on a child’s immunisation status, and ACIR data is accessed for this purpose. The department has established an automated daily process to detect mutual clients of the ACIR and Centrelink programs, so as to update ISIS with a child’s current immunisation status. To overcome known shortcomings with the automated process, Human Services conducts a daily manual reconciliation process37 supplemented by a bi-annual data integrity exercise to identify and rectify discrepancies in information held on the two systems. While the biannual exercise assists in maintaining the integrity of information exchanged between the systems and provides opportunities for the analysis of the underlying causes, it is not a means to overcome persistent data synchronisation issues and related overheads. As previously discussed, the department should establish a pathway for the resolution of data synchronisation issues, incorporating a planned process and timetable, and introduce a quality control process for the manual review of data exchanged between ACIR and other departmental ICT systems.

34. Human Services has established a process for external parties to request access to personal and sensitive information, including ACIR data. The ANAO’s review of relevant ACIR data requests from 2013–2014 indicated that the department had not consistently recorded which assessment criteria were applied when granting access to ACIR data. To maintain the integrity of access procedures, there is scope to refine the current approach to recording departmental assessments and decisions relating to data requests from third parties.

Summary of entity response

35. The proposed audit report issued under section 19 of the Auditor-General Act 1997 was provided to the Department of Human Services (Human Services). In addition, a full copy of the proposed audit report was provided to the Department of Health (Health). A summary of Human Services’ response to the proposed report is outlined below, with the full response included in Appendix 1. Health did not have any comments on the proposed report, and the department’s letter is also included in Appendix 1.

The Department of Human Services (the department) agrees with recommendation 1 with qualifications and agrees with recommendations 2 and 3.

The department takes its role in administering ACIR seriously and has been highly successful in administering this large and dynamic programme. With one exception the department has consistently exceeded the Key Performance Indicators (KPIs) agreed with the Department of Health over the last two years and is on a similar track in 2015. The ANAO noted the department’s performance against the KPIs.

The department has achieved a 99.5% data match between its welfare and ACIR systems and a 98.6% match between Medicare and ACIR systems. Many of the items that did not match were as a result of complexities in the particular customer records or timing differences in processing. The ANAO noted that the number of data discrepancies was small. Whilst there is always room for improvement this needs to be balanced against the costs and benefit that can be gained.

That said the department is committed to delivering the highest level of accuracy as is feasible and will continue to seek opportunities to enhance its administration of ACIR where it is appropriate and cost effective.

Recommendations

Recommendation No.1

Paragraph 3.32

To contribute to ACIR data integrity and improve the efficiency of information processing, Human Services should establish a pathway for the resolution of persistent and known data synchronisation issues between ACIR and other departmental ICT systems, incorporating a planned process and timetable.

Human Services’ response: Agreed with qualifications.

Recommendation No.2

Paragraph 3.39

To clearly convey the department’s expectation that parents and immunisation providers will play a role in maintaining the accuracy and integrity of ACIR records, the ANAO recommends that Human Services include an appropriate statement to that effect in relevant communications with parents and providers.

Human Services’ response: Agreed.

Recommendation No.3

Paragraph 3.66

To provide additional assurance regarding the integrity of ACIR data entry and revision, the ANAO recommends that Human Services:

apply quality call listening procedures to ACIR telephony services; and

include manual ACIR data reconciliation activities in the ACIR Quality Control Procedures.

Human Services’ response: Agreed.

1. Introduction

This chapter provides an overview of immunisation in Australia and the Australian Childhood Immunisation Register (ACIR), as well as related incentives to immunise children. The chapter also outlines the audit objective, criteria, scope and methodology.

Background

1.1 Vaccination against disease is an important public health intervention. Vaccination programs not only aim to protect individuals from illness (or even death) associated with vaccine preventable diseases, but are also intended to increase the level of immunity in the population38, thereby protecting those that are not immunised or cannot be immunised.39

1.2 Australia has a long history of using immunisation in targeted and mass vaccination programs, and within Australia diseases such as tetanus, diphtheria and polio are now rare due to immunisation. The routine immunisation of infants in Australia began in the 1950s, and the first nationally funded infant immunisation program for diphtheria, tetanus and polio started in 1975. National surveys in the late 1980s suggested that only about 53 per cent of Australian children were adequately immunised and there was room for improvement in the effectiveness of childhood immunisation programs. By 2014, the proportion of Australian children considered fully immunised at one, two and five years of age was just over 90 per cent.

The National Immunisation Program

1.3 The National Immunisation Program (NIP) is a combined Australian, state and territory government initiative which aims to increase national immunisation rates for vaccine preventable diseases. The Australian Government Department of Health (Health) is responsible for national immunisation policy advice and overall management of the program, including the NIP Schedule, which specifies particular vaccinations and the ages when they should be given. Under the NIP, essential vaccines are funded by the Australian Government and distributed by the states and territories, and are available free of charge to eligible infants, children, adolescents and adults.

1.4 The current NIP child schedule is outlined in Table 1.1. Additional vaccines are provided under the NIP for children deemed to be in ‘at risk groups’. These include children with particular medical conditions, and Aboriginal or Torres Strait Islander children living in high risk areas.40

Table 1.1: Current National Immunisation Program Child Schedule

Disease immunised against

Birth

Two, four and six months of age

12 months of age

18 months of age

4 years of age

Diphtheria

 

Y

 

 

Y

Hepatitis B

Y

Y

 

 

 

Hib

 

Y

Y

 

 

Measles

 

 

Y

Y

YB

Meningococcal C

 

 

Y

 

 

Mumps

 

 

Y

Y

YB

Pertussis

 

Y

 

 

Y

Pneumococcal

 

Y

 

 

 

Polio

 

Y

 

 

Y

Rotavirus

 

YA

 

 

 

Rubella

 

 

Y

Y

YB

Tetanus

 

Y

 

 

Y

Varicella

 

 

 

Y

 

Source: Department of Health, Immunise Australia website.

Note A: Depending on the brand of vaccine used, only two doses of Rotavirus may be needed at two and four months of age.

Note B: These vaccines are only given if the child did not receive the Mumps, Measles, Rubella, Varicella (MMRV) vaccine at 18 months of age.

1.5 Children are assessed as fully immunised when they have received all the required immunisations for their age group.41 Figure 1.1 shows the percentage of children assessed as fully immunised for each of the three age ranges as specified in the NIP, for the period 1999 to 2014.42 Cohort 1 includes children aged 12 to 15 months; cohort 2 includes those aged 24 to 27 months; and cohort 3 includes children aged 60 to 63 months. As shown in Figure 1.1, the national immunisation level in 2014 for the three cohorts was just over 90 per cent for children aged one, two and five years of age. The five year old age group achieved 90 per cent coverage for the first time in 2012, and had 92 per cent coverage in 2014.43

Figure 1.1: Percentage of fully immunised children 1999 to 2014

Source: Department of Health, Immunise Australia website.

Note: Complete figures for Cohort 3 were not recorded in ACIR between 1999 and 2004.

National roles and responsibilities

1.6 As discussed, delivery of the NIP is a shared responsibility between the Australian, state and territory governments (states). The Australian Government’s role includes: developing national immunisation policy; providing funding for the purchase of vaccines for eligible individuals listed under the NIP; providing incentive payments to states based on identified performance benchmarks; and the establishment and maintenance of the Australian Childhood Immunisation Register (ACIR or the Register). State responsibilities include: distributing vaccines to immunisation providers (providers); managing the efficient and effective delivery of the NIP; and providing agreed data to ACIR. Government roles and responsibilities are set out in the National Partnership Agreement on Essential Vaccines (NPAEV), which also sets out funding and reporting arrangements for ACIR.44

Immunisation incentives

1.7 A range of financial incentives is available to parents45 and providers in order to improve immunisation coverage rates.

Incentives for parents

1.8 The Child Care Benefit (CCB)46, introduced in July 2000, is intended to assist with child care costs for approved or registered care, such as: long, family or occasional day care; outside school hour care; vacation care; pre-school and kindergarten. CCB is means-tested and only payable if the child is immunised or exempt from immunisation requirements for all the milestone points in the NIP. In 2013–14, the total payments for CCB were approximately $2.3 billion.

1.9 Since July 2004 out-of-pocket child care expenses can be claimed under the Child Care Tax Rebate (CCR), which currently covers 50 per cent of out-of-pocket child care expenses up to a maximum of $7 500 per child per year. While CCR is not means tested, parents must meet certain tests (or be exempt from meeting the requirements) and meet the same immunisation requirements as for CCB. In 2013–14, total payments for CCR were approximately $2.2 billion.

1.10 The Strengthening Immunisation for Children initiative47, which commenced on 1 July 2012, introduced the requirement that a child be fully immunised or have an approved exemption (in the years the child turns one, two and five) in order for the parent to be eligible for payment of the Family Tax Benefit Part A supplement. The requirement for a child to be fully immunised at age one was introduced as part of this initiative to supplement the existing focus on immunisation at two and five years of age and to encourage parents to make sure their child has the early vaccines at the correct age (two, four and six months).

Incentives for providers

1.11 Currently, an information (notification) payment of up to $648 is made to providers who administer, and notify ACIR of, an immunisation that completes one of the age-based immunisation schedule points funded under the NIP. In 2013–14, these payments totalled approximately $9.3 million.49

Additional measures announced by the Australian Government

1.12 In April 2015 the Australian Government announced that it will take additional measures to promote childhood vaccination and protect those children who are unable to be immunised. From 1 January 2016, the Government announced that immunisation requirements for the payment of Family Tax Benefit (FTB) Part A supplement will be extended to include ‘children of all ages’.50 51 In addition, parents will no longer be able to claim an exemption from immunisation for their child—on religious grounds or on the basis of a conscientious objection—and still receive Child Care Benefit, Child Care Rebate, and FTB Part A supplement.52

1.13 The Health Minister also announced in April 2015 that the 2015–16 Budget would include an extra $26 million for the NIP to: provide an additional incentive payment to providers who identify and catch up a child that is more than two months overdue for a vaccination; provide a range of communication activities, tools and resources to increase awareness and understanding of the NIP and immunisation more generally; and develop an Australian School Vaccination Register to allow recording of adolescent vaccinations.53

1.14 The Department of Health subsequently announced that the National Human Papillomavirus Vaccination (HPV) Program Register will be expanded to become the Australian School Vaccination Register, with a view to capturing all adolescent vaccines given through school-based programs. The expanded register is expected to provide a basis for introducing recall and reminder systems to improve adolescent coverage.54 55

1.15 In the 2015–16 Budget, the Australian Government announced additional funding for Human Services to establish an adult vaccination register to record all adult vaccines provided under the National Immunisation Program (NIP) from 1 September 2016.56 The department has indicated that ACIR will be expanded to collect data on all vaccinations available under the NIP, with the exception of those provided under school based vaccination programs.57

Existing exemptions from being immunised

1.16 As noted, currently eligibility requirements for some Australian Government family assistance payments include that a child must be fully immunised or have an approved exemption noted on the Register.58 Table 1.2 outlines the existing approved immunisation exemptions.

Table 1.2: Existing approved immunisation exemptions

Exemption type

Explanation of the exemption

How exemption is recorded in the ACIR

Conscientious objection

A written declaration from a parent stating they have discussed the benefits and risks of immunisation with a provider and based on a personal, philosophical, religious or medical belief do not want their child immunised. The provider must co-sign this form acknowledging the benefits and risks of immunisation have been explained.

Recorded as a conscientious objection.

Member of Church of Christ, Scientist A

A letter from the Church has been provided stating that the parent is a practising member of the Church. The letter must be provided on Church letterhead and signed and dated. The parent must also provide a letter acknowledging the benefits and risks of immunisation and stating they do not want their child immunised due to a religious belief.

Recorded as a conscientious objection.

Medical contraindication

An immunisation provider has certified that the child is unable to be vaccinated or unable to receive certain vaccines due to a medical reason.

Recorded as a medical contraindication.

Natural immunity

A medical practitioner has certified that the child does not require a particular vaccine because they acquired natural immunity as a result of contracting the disease.

Recorded as having natural immunity.

Special exemption

These can be applied in exceptional circumstances such as: situations where there is no safe or effective vaccine available or a child is in a remote location or overseas and could not reasonably be expected to meet the requirements. Special exemptions are assessed on a case-by-case basis.

Recording is dependent on the type of special exemption.

Source: Human Services.

Note A: Religious objections to immunisation are recorded as conscientious objections on the Register. There is currently only one group that has registered an exemption with the Australian Government based on religious grounds. The Government announced in April 2015 that this exemption will end from 1 January 2016.59

1.17 As mentioned in Table 1.2, at present a parent can apply for the Register to record a conscientious objection against the immunisation of their child. Table 1.3 illustrates the number and percentage of children with a conscientious objection to immunisation recorded on the Register.60

Table 1.3: Children with a conscientious objection recorded on the RegisterA

As at 31 December

Total children recorded in ACIR

Number of children with conscientious objection recorded

Percentage of children with conscientious objection recordedB

1999

1 863 427

4 271

0.23

2000

1 846 431

7 624

0.41

2001

1 808 231

9 987

0.55

2002

1 790 992

12 042

0.67

2003

1 785 336

13 790

0.77

2004

1 790 014

15 479

0.86

2005

1 808 420

16 922

0.94

2006

1 842 829

18 899

1.03

2007

1 885 004

20 737

1.10

2008

1 933 014

23 123

1.20

2009

1 976 134

25 706

1.30

2010

2 082 263

28 306

1.36

2011

2 127 489

29 968

1.41

2012

2 176 279

31 800

1.46

2013

2 215 825

35 698

1.61

2014

2 231 205

39 523

1.77

Source: Department of Health Immunise Australia website.

Note A: Conscientious objection statistics are for a point in time, as new children are continually being added to ACIR, and records on the Register for children over the age of seven become inactive.

Note B: As a percentage of all children recorded on the Register.

1.18 In summary, the number of children with a conscientious objection to immunisation recorded on the Register has increased steadily over time, with the number more than doubling in the past 10 years and the percentage rising from 0.23 per cent in 1999 to 1.77 per cent in 2014.

1.19 Figure 1.2 shows the 17 postcodes in Australia that have the highest number of conscientious objections recorded on the Register as at 9 September 2014.

Figure 1.2: Top 17 postcodes with the highest number of conscientious objections recorded on the Register

Source: ANAO analysis.

Note: The top three postcodes each contain more than 200 registered conscientious objections.

The Australian Childhood Immunisation Register (ACIR)

1.20 ACIR is a national register that records the immunisation details of children under the age of seven.61 62 It was established on a trial basis in January 1996 and included as an ongoing program in the 1997–98 Budget as a means of measuring, monitoring and targeting achievements in childhood immunisation coverage in accordance with the NIP Schedule.

1.21 The major functions of ACIR are to:

  • provide an accurate measure of the immunisation coverage of children in Australia under seven years of age;
  • provide an effective management tool for monitoring immunisation coverage—at national, state and local levels to improve service delivery; and
  • inform recognised immunisation providers (providers) 63 and parents of a child’s immunisation status.

1.22 Information from ACIR is also used to:

  • inform parents and providers of a child’s immunisation status;
  • populate the Immunisation History Statement (IHS)64 that is sent to parents at milestone ages and on request;
  • confirm eligibility for certain family assistance payments65;
  • provide Australian, state and territory health departments with data, including statistical and management reports, to assist with immunisation policy, planning and program delivery; and
  • assist with monitoring vaccine safety, including the appropriate administration of vaccines to certain age groups.

Legislative framework for ACIR

1.23 Section 46B of the Health Insurance Act 1973 (the Act) requires the Chief Executive Medicare to establish and keep ACIR.66 Under the Act, the Chief Executive Medicare is also required to make payments to providers who notify ACIR of the completion of a schedule of immunisations under the NIP. The Act also allows for the Chief Executive Medicare to provide both identified and de-identified information to recognised providers and other specified agencies in accordance with Section 46E.

1.24 Financial Management and Accountability Determination 2006/57 provides for the creation of the Australian Childhood Immunisation Register Special Account67, which holds funds from the Commonwealth and states to pay providers for childhood immunisations following notification to ACIR.

1.25 The Department of Health (Health) is responsible for the administration of the ACIR Special Account, while the management of ACIR—including making notification payments—is the responsibility of the Chief Executive Medicare. Funds are drawn from the ACIR Special Account on a monthly basis to make relevant payments.

Administration of ACIR

1.26 Responsibility for delivery of the ACIR program is shared between two branches within Human Services’ Health Support and Business Services Group:

  • The Health Support Programs Branch in National Office is responsible for national program management and relationship management with the Health.68
  • The Medicare Providers Branch is responsible for ACIR program delivery through its Specialised Provider Services area. Two teams, located in Human Services’ Hobart and Perth Smart Centres, provide telephony and data processing services.

1.27 The ACIR budget for 2013–14 was approximately $6.7 million. The budget breakdown and staffing levels are shown in Table 1.4.

Table 1.4: Human Services’ budget and staffing levels for the ACIR program in 2013-14

 

ACIR Management/ Medicare Providers branch staffing costs

Postage

Overheads

TOTAL

Budget

$5 798 661

$85 587

$803 000

$6 687 248

Actual Expenditure

$4 811 209

$85 587

$803 000

$5 699 796

Staffing (Full Time Equivalent)

62.07

 

 

 

Source: Department of Human Services.

1.28 In addition to its appropriated budget, in 2013–14 the ACIR program received $476 775 from Health for additional projects for the ACIR program.

Information flows to and from ACIR

1.29 ACIR exchanges information with a number of data systems, both internal and external to Human Services, to: enrol children on the Register; update personal and immunisation related information; and release immunisation related information to authorised stakeholders. Figure 1.3 illustrates the information flows to and from ACIR.

Figure 1.3: ACIR information flows

Source: ANAO analysis.

Enrolment on ACIR

1.30 When children under the age of seven are enrolled in Medicare, their details are automatically included on ACIR. As at 28 February 2015 there were some 2 263 857 children under the age of seven registered on the ACIR.

1.31 Where children are not enrolled (or not eligible) for Medicare, their details are included on the Register once ACIR receives information of their first immunisation from a provider.

Updating ACIR

1.32 The ACIR is updated continuously. Providers are able to submit immunisation information through a number of different channels, including:

  • electronic transfers such as medical Practice Management Software (PMS), Medicare’s Health Professional Online Services (HPOS)69, ACIR’s secure website, or email;
  • ACIR telephone lines; or
  • paper based forms.

1.33 The Queensland and Northern Territory Governments also maintain whole-of-life immunisation registers. For providers in Queensland, immunisation information can only be submitted via PMS or via paper based forms sent to Queensland Health, which updates the state register and ACIR directly. Providers in the Northern Territory are able to submit information via PMS, HPOS, or by paper based forms to ACIR or directly to the Northern Territory Health Department, which forwards the information to ACIR.

Audit objective, criteria, scope and methodology

Audit objective

1.34 The audit objective was to examine the effectiveness of the Department of Human Services’ (Human Services) administration of the Australian Childhood Immunisation Register (ACIR).

Audit criteria

1.35 To form a conclusion against the objective, the ANAO adopted the following high-level criteria:

  • Human Services has established effective policies and procedures to support the administration of ACIR;
  • Human Services has adequate procedures and controls in place for the collection, use and management of ACIR information, including to maintain the integrity of data in ACIR; and
  • Human Services has sound reporting processes which support the timely, accurate and authorised dissemination of ACIR information.

Audit scope

1.36 The audit focused on Human Services’ administration of ACIR and did not include an assessment of the broader National Immunisation Program or its overall administration by the Department of Health. ACIR is largely populated using data from the Medicare customer database, which was the subject of a previous ANAO performance audit.70 The integrity of the Medicare database has not been examined again as part of the current audit. However, where relevant, the findings of the previous audit are noted in this report.

Audit methodology

1.37 The audit methodology included:

  • examining relevant documentation and guidance that supports Human Services’ administration of ACIR;
  • reviewing ICT system controls and documentation relating to the capture, updating and dissemination of data and other information received through various sources;
  • assessing the adequacy of security and privacy measures implemented in respect to the transfer of information to external users;
  • interviews with key Human Services officials, including staff at the two processing centres. Interviews were also conducted with Health officials, as well as a number of external stakeholders; and
  • the review of information received via the ANAO’s Citizen Input Facility.

1.38 The audit was conducted in accordance with ANAO auditing standards at a cost to the ANAO of approximately $589 063.

Structure of chapters

1.39 The structure of the remaining chapters is set out in Figure 1.4.

Figure 1.4: Report structure

Chapter 2

Australian Childhood Immunisation Register Governance and Stakeholder Engagement

Examines the governance framework for Human Services’ management of ACIR, including implementation of the Business Agreement with Health, and stakeholder engagement.

Chapter 3

Management of the Australian Childhood Immunisation Register

Examines Human Services’ management of ACIR, including the operation of controls to maintain the integrity of Registry data.

Chapter 4

Use of Australian Childhood Immunisation Register Information

Examines the arrangements in place for the use of data and information held on ACIR by stakeholders. It also examines the controls and processes around the release of information from the Register.

2. Australian Childhood Immunisation Register Governance and Stakeholder Engagement

This chapter examines the governance framework for Human Services’ management of ACIR, including implementation of the Business Agreement with Health, and stakeholder engagement.

Introduction

2.1 Collaboration between government entities is often necessary to effectively deliver government programs. Collaborative arrangements are often formalised to facilitate productive cross-entity relationships and establish a foundation for a working relationship. Such agreements can provide entities with a clear understanding of their respective roles, responsibilities and accountabilities, and a basis for performance reporting. They can also provide government with additional assurance that the delivery of services is efficient, effective and coordinated.71

2.2 Effective stakeholder engagement and communication facilitates a shared understanding of government policy, its desired objectives, and the contribution each party can make to achieving these objectives. Considering and responding to stakeholder feedback also provides an opportunity for entities to improve their performance and delivery of services.

2.3 To consider whether Human Services has established an effective governance and stakeholder engagement framework for the management of ACIR, the ANAO examined:

  • Human Services’ implementation of relevant parts of its 2012–15 Business Agreement with Health72;
  • risk management, performance monitoring and reporting arrangements; and
  • mechanisms for engaging with stakeholders and considering stakeholder feedback on the ACIR program.

Business agreement

2.4 Health and Human Services have established a formal agreement—the 2012–15 Business Agreement relating to the National Registers Program (the Agreement)—setting out their respective roles, responsibilities and accountabilities for the administration of ACIR.73 74 Figure 2.1 outlines the main components of the Agreement.

Figure 2.1: Health and Human Services bilateral agreement

Source: ANAO analysis.

2.5 Schedule A to the Agreement relates specifically to ACIR and outlines the detailed business arrangements for managing this part of the Agreement. Table 2.1 describes the responsibilities of Health and Human Services in relation to ACIR.75

Table 2.1: Departmental responsibilities for ACIR under the Business Agreement

Health

  • providing immunisation policy advice to Human Services in a timely manner;
  • providing clearly defined policy requirements and specifications to Human Services as early as possible on proposed changes to existing policy;
  • notifying Human Services of any proposed changes to the Health Insurance Regulations 1975;
  • promotional and communication activities relating to all components of the Immunise Australia Program, including ACIR; and
  • preparing briefings in relation to policy aspects of ACIR.

Human Services

  • collecting and recording of immunisation information from Recognised Immunisation Providers;
  • providing information in accordance with Part IVA of the Health Insurance Act 1973A;
  • calculating payments and administering a statement system to Recognised Immunisation Providers;
  • providing Immunisation History Statements to parents;
  • operating a telephone hotline (free call);
  • providing all information, reports, financial statements and data, as specified and within agreed timeframesB;
  • promotional and communications activities relating to the delivery of ACIR functions and services;
  • maintaining a risk management plan relating to ACIR; and
  • preparing briefings in relation to the service delivery aspects of ACIR.

Shared

  • consulting regularly and responding within agreed timeframes in relation to policy and operational matters associated with ACIR;
  • sharing information;
  • ongoing budget forecasting; and
  • documenting all new or additional services to be performed in administering ACIR to deliver the NIP.

Source: ANAO analysis of the Agreement.

Note A: Section 46E of the Act requires that immunisation information be provided to a range of stakeholders including: registered immunisation providers; parents and guardians; persons engaged in research; and states.

Note B: The provision of information includes: immunisation coverage reports to Health and states; statistical reports to members of the National Immunisation Committee (NIC); financial reports to Health; raw de-identified data to the National Centre for Immunisation Research and Surveillance, and Health; payment statements to immunisation providers; and performance information to Health. NIC is the peak group responsible for overseeing the development, implementation and delivery of the National Immunisation Program. The NIC is chaired by an Assistant Secretary from Health, with Human Services having an observer role.

2.6 Human Services has additional responsibilities for the day-to-day management of ACIR, including: maintaining a computer system for recording immunisation information; maintaining a computer system to make notification payments and recover any overpayments as necessary; investigating and finalising any complaints concerning data provided from ACIR to parents or providers; and maintaining the ACIR secure site.

2.7 As outlined in Table 2.2, the department is complying with its expected responsibilities described in the Agreement, including through: the timely provision of specified reports to stakeholders, including Health; the provision of IHS to parents; timely payments to providers; and maintenance of required systems.

Table 2.2: Human Services’ compliance with the Agreement in 2013–14

Human Services responsibility

ANAO assessment

Collecting and recording of Immunisation Encounter information from Recognised Immunisation Providers.

Met

Providing information in accordance with Part IVA of the Health Insurance Act 1973.

(Section 46E of the Health Insurance Act 1973 requires that immunisation information is provided to a range of stakeholders.)

Met

Calculating payments and administering a statement system to Recognised Immunisation Providers.

Met

Providing Immunisation History Statements to parents and guardians.

Met

Operating a telephone hotline (free call).

Met

Providing all required information, reports, financial statements and data within specified timeframes.

(Includes immunisation coverage reports provided to Health, states and territories; statistical reports to members of the NIC; financial reports to Health; raw de-identified data to the National Centre for Immunisation Research and Surveillance, and Health; payment statements to immunisation providers; and performance information to Health.)

Met

Promotional and communications activities which relate specifically to the delivery of ACIR functions and services.

Met

Maintaining a risk management plan relating to ACIR.

Met

Preparing briefings in relation to the service delivery aspects of ACIR.

Met

Source: ANAO analysis.

Note: The effectiveness of the department’s implementation of these functions is assessed throughout this audit report.

Performance measurement and reporting

2.8 Performance monitoring and reporting provides the opportunity for stakeholders to measure performance against planned targets and can contribute to improvements in the delivery of programs and services.76 In defining performance requirements, entities should take care that measures are achievable and that it is possible to collect and report on the data necessary to meet the agreed performance requirements.77

2.9 Human Services’ monitoring and reporting on its administration of ACIR includes reporting to Health under the Agreement, as well as internal reporting to management and external (public) reporting.

ACIR performance framework

2.10 Under the Agreement, Human Services provides an annual report (on a financial year basis) to Health of its achievement against a set of performance indicators for its key deliverables.78

2.11 Table 2.3 summarises Human Services’ reported results against the ACIR performance indicators specified in the Agreement, for the period 2011–12 to 2013–14.79 80

Table 2.3: ACIR Agreement performance indicators and Human Services’ reported achievements 2011–12 to 2013–14

Performance Indicator

Target

Actual

2011–12

2012–13

2013–14

Immunisation records are processed within 10 working days of receipt by Human Services.

95%

98.6%

96.8%

92.5%

Monthly payments made to immunisation providers within seven days before the end of each month.

90%

100%

100%

100%

Records for children who cannot be matched against Medicare registered children (SINS). A

< 2.5% (for cohort 1) and

< 2.5% (for cohort 2) of records excluded from coverage calculation. B

2.7%

1.9%

2.8%

2.3%

1.9%

2.0%

Program Reports and data are provided as specified in Attachment 1.C

90%

100%

100%

100%

Financial Reports (as specified in Attachment 2) provided to stakeholders within five working days of the times specified. D

90%

100%

100%

100%

An acquittal of provider payment funds received and expended.

Financial report covering provider payment funds for the ACIR over the previous financial year.

Included in Annual Report

Included in Annual Report

Included in Annual Report

DHS will report against all performance indicators stated in Attachment 3 of this Agreement Schedule, within four weeks after the end of the financial year.

90%

100%

100%

100%

Customer Feedback Register Report.

A report listing all policy related feedback provided to DHS through the Customer Feedback Register.

Included in Annual Report

Included in Annual Report

Included in Annual Report

Summarised Data Quality Plan.

A summarised report outlining data quality measures relating to the delivery of policy.

Included in Annual Report

Included in Annual Report

Included in Annual Report

Source: ANAO analysis of the Agreement and Human Services’ annual reports to Health.

Notes to Table 2.3

Note A: Supplementary Identification Numbers (SINs) are allocated to children who are not identified as a Medicare-registered child. SIN percentile reports are produced quarterly and sent to Health and state/territory health departments.

Note B: Cohort 1 refers to children in the 12 to 15 month age group and cohort 2 to children in the 24 to 27 month age group.

Note C: Attachment 1 of Schedule A lists a range of reports to be provided periodically to different stakeholders. Immunisation Coverage Reports and State Management Reports are provided to state and territory health departments, and NIC Reports to members of the National Immunisation Committee.

Note D: Financial Reports relate to provider notification payments and are distributed monthly to Health and immunisation providers.

2.12 In summary, since the Agreement was established in 2012, Human Services reported it has generally met its ACIR performance targets, with the exception of: the SIN percentile results for cohort 1 in 2011–12 and 2012–13; and the immunisation records processing time for 2013–14. Human Services advised the ANAO that in these cases its performance was below specified targets because:

  • in respect to SIN reporting—the ACIR has no control over when a parent enrols a child on Medicare. Human Services has proposed that the KPI for SIN percentile results be amended for the next Agreement; and
  • in respect to 2013–14 processing times—the processing time for immunisation records in 2013–14 was affected by a significant increase in phone calls to the ACIR General Enquiry Line between January and March 2014, attributed to new legislation in New South Wales requiring parents to present immunisation evidence when enrolling children in child care from 1 January 2014. The need to respond to additional calls resulted in fewer Human Services staff being available to process claims data.

Other reporting on ACIR performance

2.13 Program reporting is intended to focus on the objectives of a program, its resourcing, the deliverables it produces and the KPIs that measure effectiveness.81 Program reporting includes: internal reporting such as reports to management; and external reporting, including through entity Annual Reports.

Internal reporting

2.14 To provide an overview of the ACIR program’s status and performance, internal reports are provided to senior management within Human Services each quarter. The primary internal reports on ACIR are the ACIR Quarterly Health Check Report and the Dashboard Report. The ACIR Quarterly Health Check Report provides information on:

  • progress on achieving KPIs as set out in the Business Agreement with Health over the quarter;
  • budget expenditure and resourcing;
  • stakeholder engagement information including media reports, customer complaints, requests for information from Ministers and the public;
  • IT issues; and
  • the status of ongoing projects.

2.15 The Dashboard report is a summary version of the ACIR Quarterly Health Check Report, with particular focus on the achievement of KPIs, as well as current issues affecting the program.

2.16 A number of operational reports are also provided to the program team, including weekly work-on-hand reports and regular telephony reports to assist in monitoring progress against KPIs.

2.17 Overall, the department’s internal reporting arrangements provide a useful and regular set of reports to senior management on program trends and developments, progress against key areas of performance, and operational matters.

External reporting

2.18 As the entity with overall policy responsibility for the ACIR program, Health, rather than Human Services, is responsible for public reporting on the program’s achievements. While Human Services does not have any publicly reportable KPIs for the program, the department reports externally on ACIR in its Annual Report. The Annual Report contains high level information on the ACIR program over the financial year, including: the number of immunisations recorded; the number of children on the Register; the total amount paid to providers for immunisation notifications; and high level immunisation coverage statistics.

2.19 In its Annual Report, Health reports against the NIP objectives for childhood immunisation coverage rates in more depth, including achievement against KPIs for the percentage of children fully immunised by cohort group82, and the level of funds in Human Services’ ACIR Special Account used to pay immunisation providers.

Evaluations of the ACIR program

2.20 Program evaluation aids accountability and transparency, and contributes to improvements in program administration. It should also measure a program’s progress towards meeting its policy objectives.83

2.21 Health has undertaken three external evaluations of the ACIR program, in 1997, 2000, and 2003. The 2003 program evaluation concluded that ACIR was a highly effective program and made 21 recommendations aimed at improving its operation.84

2.22 Health advised the ANAO that initial discussions have recently taken place with Human Services and the National Immunisation Committee (NIC)85 on a further evaluation of the ACIR program. Health further advised that it would await the outcome of the current ANAO audit before proceeding with any evaluation.

Stakeholder engagement

2.23 Human Services’ ACIR Communication Implementation Plan 2014–15 outlines the department’s communication activities for ACIR and identifies the primary target audiences as:

  • parents and guardians with children under the age of seven years living in Australia86;
  • third parties such as health care providers and recognised immunisation providers;
  • the Department of Health and state and territory health departments; and
  • Human Services staff..

2.24 The ACIR Communication Implementation Plan covers the use of various communication channels including telephony lines, the department’s website, social media, media releases and departmental and community publications. In April 2015, the Minister for Health also announced that the 2015–16 Budget would include an extra $26 million for NIP incentives, including a community awareness campaign to promote the importance of vaccinating, and tools to assist providers to have discussions with vaccine hesitant parents.87

Engagement with parents and providers

2.25 The department maintains several dedicated telephony lines on ACIR matters.88 However, its primary method for communicating with parents and guardians is through online channels89, principally through the Human Services’ website, which includes:

  • background information such as: why immunisation is important; exemptions to immunisation; the NIP schedules; and the benefits of ACIR;
  • information on how to enrol a child on ACIR; and
  • more specific information on ACIR, such as: how a child’s immunisation information is updated; how parents may access a child’s immunisation history90; information on IHS; how to record immunisations received overseas; and how to update or correct information.

2.26 IHS are automatically sent to the parents of all children recorded in ACIR at 18 months and five years of age. IHS provide details of all immunisations given as at the date of the statement to help parents keep track of their children’s immunisations, and for use as proof of immunisation for school entry or childcare purposes, as needed. From December 2014, it is also planned to commence a routine mailout to parents of children who turn ten, 21 and 54 months of age who are not up to date with their immunisations.

2.27 Communication with providers is also conducted principally through the department’s website, which outlines:

  • how providers can register for ACIR;
  • advice on submitting immunisation information and immunisation exemptions; and
  • payment information, including on provider payments.

2.28 Third parties and providers also receive or are able to request a number of reports relating to information from ACIR91, and may contact the department via the ACIR telephone line.

Engagement with Indigenous and multicultural stakeholders

2.29 Aboriginal and Torres Strait Islander children are recognised as a key target group for the NIP. ACIR is used to collect, record and report on the immunisation history of Indigenous children.

2.30 The department’s approach to providing services and programs to Aboriginal and Torres Strait Islander peoples is set out in its 2012 Indigenous Servicing Strategy92, which aims to bring a greater focus across the entity on effective service delivery for Indigenous customers.

2.31 The ANAO’s 2013–14 performance audit of the department’s service delivery initiatives for Indigenous Australians, concluded that:

Overall, [Human Services] has developed a reasonable approach to improving its focus on supporting the delivery of service to Indigenous Australians, although there is scope to apply key elements of the approach more consistently across the department. 93

2.32 The department has established a network of officers across its operations—comprising Indigenous Servicing Specialists, Indigenous Specialist Officers and Indigenous Service Officers94—to assist in providing culturally appropriate services across its broad range of program responsibilities. However, these officers have no specific role in relation to advising on ACIR.

2.33 Human Services also maintains a network of Multicultural Service Officers (MSO) throughout Australia95, to provide services to culturally and linguistically diverse communities.96

2.34 Human Services advised that during 2013–14, MSOs provided a range of relevant support services to culturally and linguistically diverse communities, including:

  • information sessions to newly arrived families and migrant new mothers’ groups (through local hospitals) that includes information on the importance of ACIR; and
  • information sessions to international AUSAID students97 about Child Care Benefit and the requirement for up to date immunisations as part of eligibility for Child Care Benefit.

2.35 The department further advised that MSOs have provided support to departmental staff in local Medicare offices.

Engagement with Health

2.36 Other key stakeholders include the Department of Health, as the policy agency responsible for the NIP, and the NIC. Health advised that it has a good working relationship with Human Services, with regular contact occurring between the departments which is not limited to the formal requirements of the Agreement and NIC process.

2.37 The NIC is chaired by Health and provides advice on implementation and service delivery issues relating to the NIP.98 Its membership comprises representatives from state and territory governments, health care providers including Indigenous service providers, researchers, consumers, and other key interest groups.

2.38 While Human Services is not a member of the NIC principal body, it is a member of the NIC Data Subcommittee, which provides expert advice to the NIC on priorities and opportunities for vaccination data collection, analysis and reporting. Human Services also provides a range of ACIR reports to NIC on a regular basis, and may observe committee meetings, as necessary.

Customer and stakeholder feedback on the ACIR program

2.39 Human Services has developed a Service Commitments99 document which encourages customers to provide feedback and assist the department in improving services. The department also uses surveys, websites and phone lines, to facilitate feedback from customers.

Customer feedback

2.40 In its annual report to Health under the Agreement, Human Services incorporates information on all policy-related complaints and compliments for the ACIR program. The ANAO examined the feedback received from customers for the ACIR program for the period 2010–11 to 2013–14, as summarised in Table 2.4.

Table 2.4: ACIR customer satisfaction and complaints data

Year

Complaint

Compliment

Suggestion

Total

2010–11

51

7

4

62

2011–12

63

14

5

82

2012–13

89

13

3

105

2013–14

153

14

5

172

Source: ANAO analysis of Human Services’ data.

2.41 Overall, the number of complaints and compliments is very low, compared to ACIR’s customer population of around 2.2 million. The ANAO’s analysis of the complaints data indicated that100:

  • Approximately one third of complaints in 2013–14 related to ‘access to call centres’ and to ‘mistakes/complaint handling’; with complaints in these categories increasing significantly between 2012–13 and 2013–14.
  • A significant area of customer concern was ‘self-managed services’, accounting for approximately one fifth of complaints in 2013–14, with related complaints increasing between 2012–13 and 2013–14.

2.42 The annual Customer Satisfaction Survey conducted by Human Services targets customers who have recently interacted with the department, and captures some limited feedback on the ACIR program. Survey results indicate that in 2012–13, 65.7 per cent of respondents were satisfied with the information received about their child’s immunisation history, while in 2013–14, 76.4 per cent were satisfied with the information provided.101

2.43 Human Services advised the ANAO that since 2011 there has been one enquiry, and six requests from the Minister in relation to the management of ACIR.

Stakeholder feedback

2.44 The ANAO interviewed a range of stakeholder groups regarding the department’s administration of ACIR and the Register’s operation.102 The stakeholders reported general satisfaction with Human Services’ management of ACIR. Positive comments included:

  • reports required under the Agreement are received in a timely manner;
  • ACIR provides a comprehensive record of immunisation for all children under the age of seven years;
  • the ACIR management team is responsive to issues raised by stakeholders; and
  • stakeholders have good access to members of the ACIR team.

2.45 Other stakeholder comments provided to the ANAO related to:

  • a forum outside of the NIC to discuss issues related to ACIR;
  • increased consultation on departmental decisions which impact on the operation of ACIR;
  • reduced ACIR-specific support to providers in recent years potentially leading to data quality issues; and
  • a national whole-of-life immunisation register.

2.46 While some opportunities currently exist for providers to provide feedback via the ACIR telephone lines and the department’s occasional participation in NIC meetings, there is limited information available for the department to assess providers’ satisfaction with the ACIR program.103

2.47 The ANAO’s review of recent meeting minutes for the department’s broader Stakeholder Consultative Group104 (SCG) did not identify any issues raised in regards to the ACIR program.

Risk management

2.48 Systematic risk management practices enable an entity to be confident that policy and program implementation, and its ongoing administration, have been designed to achieve government outcomes and objectives most effectively.105

2.49 Human Services’ approach to risk management is set out in its Enterprise Risk Management Policy, Enterprise Risk Management Strategy and Enterprise Risk Management Framework.106 The Enterprise Risk Management Policy states that all groups, business-as-usual programs, divisions and branches in Human Services that have a business plan must have a risk management plan. The risks identified in these plans are consolidated into risk registers and reported regularly to the department’s Executive Committee, and to the Risk, Business Continuity and Security Committee.

2.50 In accordance with Human Services’ policy and the department’s responsibilities under the Agreement, an ACIR Risk Management Plan (RMP) is prepared annually.

2.51 Table 2.5 compares key aspects of ACIR RMPs for the years 2010–11 to 2014–15.

Table 2.5: Key risks in ACIR Risk Management Plans 2010–11 to 2014–15

Risk area

2010–11 and 2011–12

2012–13

2013–14 and 2014–15

Stakeholders

Fail(ure) to manage external and internal stakeholders.

Fail(ure) to deliver program changes as requested by external stakeholders.

Program changes are not delivered.

Budget

Fail(ure) to manage budget.

Fail(ure) to manage business as usual and project budgets.

The ACIR budget does not balance.

Privacy

Inappropriate access and/or breach of privacy.

Inappropriate access and/or breach of privacy.

 

Health Insurance Act

 

Fail(ure) to comply with the provisions of Health Insurance Act 1973, Section 46B.

Provisions in Section 46 of the Health Insurance Act 1973 are not met.

Payments

Fail(ure) to make correct payments.

 

Payments and payment statements are not released to providers within agreed timeframes.

Accurate payments to providers are not made.

Payments are not made to the correct providers.

Business Agreement

Fail(ure) to manage/ meet BPA and KPIs.

 

 

Data Quality

Fail(ure) to provide data quality.

 

 

Business Continuity

Fail(ure) to manage business continuity.

 

 

Source: ANAO analysis of Human Services ACIR RMPs.

2.52 Overall, the RMPs prepared from 2010–11 to 2011–12 identified the majority of key ACIR risks. Human Services advised that, in response to a change to the departmental template in November 2012, the new ACIR RMP for 2012–13 resulted in a reduced number of program risks being listed, in particular risks related to: ACIR payments; meeting Agreement requirements; data quality; and business continuity. However, there was no evidence that the ACIR program environment had changed significantly at this time (or subsequently) to justify eliminating these risks from the ACIR RMP.

2.53 Subsequently, in July 2013, an internal audit conducted by the department on health program payment risks indicated that the ACIR RMP was compliant with the Human Services Risk Management Policy and the risk management requirements of the Agreement. This audit report also recommended, however, that the program would benefit from a systematic and comprehensive analysis of payment risks. As a consequence, in the 2013–14 and 2014–15 ACIR RMP, risks associated with ACIR payments were again identified, with all residual risk levels (after treatment) rated as ‘Low’.

2.54 There remains scope to further strengthen the ACIR RMP. While payment integrity is a relevant risk to the ACIR program, and is included in the RMP, Chapter 3 of this audit report indicates that risks to data quality and integrity also merit inclusion on the ACIR RMP.107

Conclusion

2.55 The day-to-day administration of ACIR is underpinned by a formal Business Agreement between the departments of Health and Human Services. In the period 2011–12 to 2013–14, the ANAO’s analysis of Human Services’ documentation indicated that the department has generally met or exceeded the ACIR performance targets set out in the Business Agreement. Both departments also advised that they have established a constructive working relationship with regular contact between officials which is not limited to the formal consultative arrangements set out in the Agreement.

2.56 Maintaining data integrity is an ongoing business risk to be managed by Human Services, and underpins the integrity of the Register. While Human Services’ Risk Management Plan (RMP) for ACIR has recently been strengthened to address risks related to the integrity of provider payments, it no longer directly addresses broader data integrity risks, and there remains scope to further strengthen the RMP.

2.57 The Register is a key public health information resource, which informs immunisation policy and planning, and is used day-to-day to record the immunisation status of individual children. Human Services has established a number of useful communication channels for conveying information about ACIR to stakeholders. These channels include: an ACIR website (the department’s principal communication vehicle); dedicated ACIR telephone lines; and generalist outreach officers for Indigenous and multicultural customers. These communication channels facilitate parental access to their child’s IHS and enable immunisation providers to interrogate ACIR regarding their patients’ immunisation status.

2.58 Human Services provides high level public reporting on ACIR program achievements through its Annual Report, with a useful set of regular internal reports provided to senior managers.

3. Management of the Australian Childhood Immunisation Register

This chapter examines the Human Services’ management of ACIR, including the operation of controls to maintain the integrity of Registry data.

Introduction

3.1 ACIR records the immunisation details for over 2.25 million children under the age of seven. The Register is a key public health resource used to measure and monitor immunisation coverage rates for policy and planning purposes, and to inform parents and immunisation providers of a child’s immunisation status. Information from the Register is also used to confirm a parent’s eligibility for certain family assistance payments as part of an Australian Government policy to encourage childhood immunisation108, as well as for authorised research purposes. The effective operation of the ACIR program relies on the integrity of data held on the Register and the quality of administrative processes used to capture data. Sound data integrity controls combined with timely and accurate administrative activities can assist in providing confidence to: parents that their child’s personal and immunisation information is correct and secure109; health professionals checking a patient’s immunisation status and immunisation coverage levels; governments accessing data for policy and planning purposes; and researchers.

3.2 Within Human Services, the Health Support and Business Services Division110 has overall responsibility for the ACIR program. Within this group, the Health Support Programs Branch administers the overall ACIR program; while the Medicare Providers Branch provides ACIR telephony services and forms processing, via Service Officers (SOs)111 based in Perth and Hobart. SOs also exercise key roles in helping to maintain the integrity of Registry data by undertaking daily data cleansing activities as a supplement to ACIR system controls.

3.3 To assess the adequacy of the processes and controls Human Services has in place to manage ACIR, the ANAO examined:

  • the process for enrolling children on the Register, including transfers of data from the Medicare Consumer Directory (MCD) to the Register;
  • controls for updating immunisation information;
  • telephone and immunisation processing services for ACIR customers;
  • training and support provided to SOs and immunisation providers;
  • quality control procedures for the Register; and
  • arrangements to support the integrity of immunisation provider payments.

Enrolling children

3.4 There are two mechanisms for enrolling a child on the Register:

  • When children under the age of seven are enrolled in Medicare, they are automatically added to the Register using the information recorded in MCD.112 As part of the Medicare enrolment process, customers (including children) are allocated a unique Personal Identification Number (PIN). This PIN is then used to link the customer to their Medicare card.113
  • Children not enrolled in or not eligible for Medicare, are enrolled on the Register using details supplied by a recognised immunisation provider.114 For this type of enrolment, the child is allocated a Supplementary Identification Number (SIN).

Synchronisation between Medicare Consumer Directory and the Register

3.5 As most child enrolment information on the Register is sourced from the Medicare (MCD) database, a daily (overnight) process aims to synchronise common data holdings between the MCD and ACIR. To test the integrity of the data exchange process—including its completeness, accuracy and validity—the ANAO examined extracts of Medicare enrolment records and ACIR records with identical parameters.115

Completeness testing

3.6 To fulfill its intended function as a complete national register of childhood immunisations, ACIR should contain a record for every child less than seven years of age who is enrolled in Medicare, or has received an immunisation at some time (for example, children with a SIN).

3.7 To test how completely the Register captured this target population, the ANAO compared the same populations in the MCD and ACIR. The results of this analysis are shown in Table 3.1.

Table 3.1: Completeness: records in ACIR and the Medicare Consumer Directory

Test details

Results

ACIR records not found in MCD.

15 351

MCD records not found in ACIR.

1 671

Records active in ACIR but not active in MCD.

589

Source: ANAO analysis.

3.8 Over 15 000 ACIR records were not held in the MCD. The ANAO’s analysis indicated that these records were all ‘SIN’ records. That is, the records related to children without a Medicare entitlement. While these children are not entitled to Medicare, the department’s documentation states that this type of ACIR record should still be included on the MCD.

3.9 The discrepancies identified in the course of the ANAO’s testing were generally attributable to the department’s business rules116 either not being implemented as defined, or limitations in the business rules which meant that they did not capture all the scenarios that could occur during the data synchronisation process.

Accuracy testing

3.10 The integrity of ACIR also relies on the accurate exchange of information between MCD and the Register so that new child registrations and relevant updates to MCD, such as changes to personal details, are accurately reflected in ACIR.

3.11 The ANAO tested the accuracy of the personal data transfers from MCD to ACIR using the following fields: surname; given name; initial of middle name; gender; and date of birth. Differences in these fields between ACIR and MCD are shown in Table 3.2.

Table 3.2: Accuracy: personal details in the Medicare Consumer Directory and ACIR

Fields used to test the accuracy of personal information transfer between MCD and ACIR

Number of records that differed between MCD and ACIR

Surname

833

Given name

8 681

Initial of middle name

337

Gender

3 836

Date of birth

64

Source: ANAO analysis.

3.12 Human Services advised that the accuracy of personal details in the MCD and ACIR can be affected by a number of factors. These factors include:

  • Some ACIR data fields have different business rules to MCD. For example, the ‘surname’ field in each system is of a different length (up to 40 characters in MCD and 30 characters in ACIR). In addition, MCD has a free text box for very long surnames (over 40 characters). During the synchronisation process, the system business rules provide that the free text box for surnames is truncated to just 18 characters in the transfer to ACIR, which can affect the completeness of the recorded name.
  • In September 2014, a broader departmental system ‘fix’—intended to rectify errors stemming from synchronisation processes for other Human Services systems—affected ACIR’s ability to correctly identify MCD updates to a child’s record. For example, where there have been multiple updates to a child’s record on the same day, the Register was only able to identify some (but not all) of the changes to the record. In addition, there remain a number of pre-‘fix’ errors that have not been rectified.
  • Other known flaws in the synchronisation process (these are discussed from paragraph 3.19).
  • Data entry errors.
Validity testing

3.13 In a valid data collection, each record should be unique and identifiable. In addition, there should be no duplicate records, as duplicate records can fragment data across more than one record. For ACIR, invalid (including duplicate) records can affect the completeness and accuracy of a child’s immunisation history, and the registry’s value as a reliable source of information.

3.14 To test the validity of ACIR, the ANAO tested active records to check whether each record was unique, identifiable and that no duplicate records exist. The ANAO’s testing found 814 duplicate records, where the child’s surname, given name, initial of middle name, gender, date of birth and postcode matched, but the duplicate record had a different PIN or SIN.

3.15 Some of these duplicate records may have been inherited from the MCD117, while others resulted from ACIR’s inability to recognise the records as potential matches, as discussed below.

Daily resolution process for SIN records

3.16 As noted earlier, children who are not enrolled (or not eligible) for Medicare will be allocated a SIN in ACIR. Should that child subsequently be enrolled in Medicare, they will be allocated a PIN and the child’s Medicare record is then added to the Register through the daily synchronisation process. In some situations, this process results in the child having two records on the Register—the earlier SIN-related record and the new PIN-related record.

3.17 The department has established an automated daily process to match ACIR SIN records with new ACIR enrolments generated by Medicare, as well as match new and existing SIN records. Where the system identifies a potential match, these records will be merged automatically or will be referred to a SO for investigation. If the SO determines that the records match, they are then merged manually. However, this manual reconciliation process is not subject to any of Human Services’ quality control procedures.

3.18 The ANAO’s review of operational reports for the period 21 August 2014 to 21 October 2014 identified 4 908 records that required manual resolution to determine potential matches between records. The ANAO’s testing highlighted the benefit of the department’s manual data matching processes, such as the manual reconciliation process, as a means of overcoming the problem of automated systems not fully resolving certain records.

Overall assessment of the completeness, accuracy and validity of ACIR enrolment data

3.19 In summary, the number of data discrepancies identified by the ANAO—relating to the completeness, accuracy and validity of ACIR enrolment—was small relative to the overall size of the ACIR population. However, a number of persistent data synchronisation errors were identified, arising primarily from limitations in the interoperability of the relevant departmental ICT systems.118

3.20 Human Services advised that some of the discrepancies identified by the ANAO related to the design of the system’s business rules. The department further advised that such discrepancies arose from ‘known issues’.

3.21 While the number of errors is relatively small and the reasons for errors arising may be known, the need to manually reconcile certain records on a daily basis represents an ongoing administrative overhead. Further, errors in ACIR can inconvenience customers. For example:

  • an incorrect date of birth can affect the accuracy of a child’s recorded immunisation status, with possible implications for the receipt of family assistance payments by parents; and
  • an incorrect name (or incorrect data) recorded on an Immunisation History Statement (IHS)119 may cause difficulty for a parent when enrolling their child in school or childcare.

3.22 Incorrect recording of date of birth and postcodes can also affect the reporting of immunisation coverage statistics used for public health purposes.

Updating immunisation information

3.23 The department has established several channels to enable immunisation providers to directly submit immunisation information and other updates to ACIR. Providers can use:

  • their own practice management software (PMS);
  • hardcopy forms which are manually entered into ACIR by SOs120;
  • the secure ACIR on-line portal;
  • Medicare’s Health Professionals Online System (HPOS);
  • emails to the designated ACIR inbox; and
  • the ACIR provider telephone line.

3.24 Table 3.3 shows the high volumes of information received from providers through various channels, relating to almost 2.5 million immunisation ‘encounters’ in 2013–14.121

Table 3.3: Information on immunisation encounters, received during 2013–14, by channel

Channel through which information was submitted to the ACIR

Number of encounters

Percentage of total encounters B (%)

Practice Management Software (PMS)

1 424 653

57

Hardcopy form A

442 946

17.7

ACIR secure portal – WebC

405 642

16.2

HPOS - Internet Data InterchangeC

224 778

9

Total

2 498 019

100

Source: Human Services.

Note A: Encounter information provided by phone or email is included in the figures for hardcopy forms.

Note B: Percentages do not add to 100 per cent due to rounding.

Note C: These are both functions within Medicare’s Health Professional Online System (HPOS).

Quality controls for incoming data

3.25 To help maintain the quality of incoming data to ACIR, Human Services has implemented a two-step process to identify potential errors before they are accepted into the Register:

  • for information on immunisation encounters submitted electronically, a system validation process checks and verifies incoming information before it is accepted into the Register; and
  • where incoming data fails the validation process, and is not automatically accepted by the Register, it is put in a ‘Pend’ (pending) queue for manual resolution by a SO.

3.26 Common reasons for information being put into the Pend queue include:

  • the information received duplicates data previously supplied by a provider;
  • a different provider has submitted the same information; or
  • an incorrect vaccination dose number has been submitted.122

3.27 The resolution of pending records is undertaken by experienced SOs in the ACIR processing teams, and departmental procedures have been established to assist them in this task. SOs interviewed by the ANAO indicated that there were regular surges in the number of Pend records, and that one common reason for surges is a system upgrade to the provider’s PMS. At the completion of a system upgrade, the PMS may send all records in the PMS to the Register—not just new records.

3.28 Figure 3.1 indicates that the majority of records in the Pend queue are received through the PMS channel, which is also the most frequently used provider channel for submitting information to ACIR. Given the administrative workload involved in processing the Pend queue and the high prevalence of Pend records stemming from PMS inputs, there would be benefit in the department working with PMS suppliers to identify options for reducing the number of data errors, so as to improve the quality of automatic synchronisation and reduce the overheads arising from manual reconciliation processes.

Figure 3.1: ACIR Pend records counts, by channel, for the period 21 August 2014 to 21 October 2014

Source: ANAO analysis of Human Services information.

3.29 Human Services advised the ANAO that Pend records are counted cumulatively by submission channel, and daily operational reports are produced showing the cumulative number of unresolved Pend records for each channel.123 The reports include the date that the record was originally received by the Register, not the date the record was put into Pend; an approach which reduces the department’s ability to accurately identify how long a record has been in Pend until it has been manually resolved.124

3.30 The Pend process is an input control which helps mitigate the risk of inaccurate information being accepted into the Register. However, there is currently no quality control process in place to provide assurance to the department of the accuracy of these manual reconciliation activities. The ANAO’s review125 also indicates that the process involves a significant additional workload for departmental staff, and that timely processing of the Pend queue is necessary, as delays in this information being accepted into the Register may affect a child’s immunisation status and a parent’s eligibility for family assistance payments, where the delay coincides with key milestone and payment timeframes.

3.31 In summary, limited interoperability between Human Services’ ICT systems (ACIR, MCD, ISIS)126 and external providers’ PMS requires the department to supplement automated data exchange processes with daily manual data cleansing and matching activities—an essential but resource intensive exercise. Human Services should establish a pathway for the resolution of persistent and known data synchronisation issues between ACIR and other departmental systems, incorporating a planned process and timetable. As mentioned in paragraph 3.28, there would also be benefit in the department working with PMS suppliers to identify options for addressing errors arising during data exchanges between ACIR and provider systems.

Recommendation No.1

3.32 To contribute to ACIR data integrity and improve the efficiency of information processing, Human Services should establish a pathway for the resolution of persistent and known data synchronisation issues between ACIR and other departmental ICT systems, incorporating a planned process and timetable.

Human Services’ response:

3.33 The department agrees to the recommendation with qualifications.

3.34 The department has in place a number of arrangements to maintain the accuracy of the data of the register, including an ACIR working group to drive data accuracy.127 The accuracy of matching ACIR data with welfare system data was 99.5% in November 2014. The majority of the items that did not match were as a result of complexities in the particular customer records which did not allow for automatic synchronisation. The accuracy of matching ACIR data with the Medicare system achieved about 98.6% accuracy in the same period. Many of the small number of data discrepancies are at a point in time and the result of timing differences in the processing of information within the systems. The department notes that the ANAO found the number of data errors detected in the audit to be small. A plan and timetable will be in place by July 2015 to address issues as opportunities arise and where it is cost effective.

Immunisation information from state based registers

3.35 The Queensland and Northern Territory governments each maintain whole-of-life immunisation registers, and have established different administrative arrangements for submitting information to ACIR. Providers in those states have the option of submitting information to their respective state registers (which then transmit the information to ACIR), or directly submitting their information electronically to ACIR.

3.36 In respect to data submitted from the Queensland register on immunisations received by children, Human Services undertakes a daily manual reconciliation, as requested by the Queensland Government. No manual reconciliation process is undertaken for information received from the Northern Territory register.

Stakeholders role in confirming the completeness and accuracy of ACIR data

3.37 As discussed, the ANAO identified a number of data integrity issues associated with ACIR and its control systems. In this context, Human Services advised the ANAO that the ACIR program is a ‘self-auditing program’—that is, the department expects that a parent will check the accuracy of their child’s personal and immunisation information and notify the department if amendments are required. Similarly, the department relies on providers to check their monthly payment summaries to ensure that immunisations they have administered have been accurately recorded in ACIR and that they have been paid correctly.

3.38 The ACIR website includes a departmental request that parents check the accuracy of their child’s IHS and advise the department if changes are needed. However, some further steps would be necessary before the department can take comfort from parental checks as an assurance mechanism. In particular, the department would need to clearly and consistently communicate to stakeholders its expectations and the level of reliance it places on them to share responsibility for ACIR accuracy. The inclusion of an appropriate statement in existing communications such as the IHS summary sent to parents and the monthly statement sent to providers would clearly communicate the department’s expectations regarding the role played by parents and providers in maintaining the integrity of ACIR data holdings.

Recommendation No.2

3.39 To clearly convey the department’s expectation that parents and immunisation providers will play a role in maintaining the accuracy and integrity of ACIR records, the ANAO recommends that Human Services include an appropriate statement to that effect in relevant communications with parents and providers.

Human Services response:

3.40 The department agrees with the recommendation and notes that it is continuously improving its communications with parents and providers.

3.41 The department responded to this audit finding before the audit was completed by including some additional information on its website in January 2015. This information is being further reviewed and will be updated by the end of June 2015. Amended versions of key documents will be progressively implemented in our systems from July to September 2015.

ACIR processing and telephony services

3.42 In addition to electronic channels such as the Human Services website, the department supports the ACIR program with a range of processing and telephony services, performed by SOs within the Medicare Providers Branch.128

ACIR telephony services

3.43 The department operates three telephony lines for ACIR:

  • the ACIR general line – with three sub-lines, for:
    • providers to submit immunisation information or to check the immunisation details of a child;
    • parents seeking their child’s Immunisation History Statement; and
    • general enquiries;
  • the ACIR Internet line – for providers with queries regarding the ACIR secure site; and
  • the ACIR Ward of the State line – for case workers who require immunisation information for children in State care.

3.44 Table 3.4 illustrates ACIR call volumes and performance for the period 2011–12 to 2013–14. Key developments during this period included:

  • a 13 per cent increase in the total number of calls to ACIR telephone lines;
  • a significant increase in waiting times for ACIR customers to talk to a SO;
  • a significant increase in the number of calls abandoned by customers after entering a queue and prior to talking to a SO; and
  • an increase in Average Speed of Answer for the ACIR General Line from 27 seconds to 3 minutes 13 seconds.129

    Table 3.4: Call volumes for the ACIR telephony lines 2011–12 to 2013-14

 

Calls answeredA

Calls abandonedB

Average speed of answerC (min:sec)

Average handle timeD (min:sec)

Service levelE

2011–12

General line

325 252

15 986

0:27

3:04

79.1%

Internet line

10 510

252

0:12

4:15

92%

Ward of State line

177

7

0:14

2:54

84.4%

GPII line

7 054

135

0:11

2:58

94%

Total

342 993

16 380

 

 

 

2012–13

General line

310 626

39 520

1:31

3:11

76.5%

Internet line

9 262

234

0:10

4:01

94.5%

Ward of State line

982

19

0:10

2:38

93.9%

GPII line

6 923

177

0:10

2:42

94.9%

Total

327 793

39 950

 

 

 

2013–14

General line

260 659

55 182

3:13

3:30

n/a

Provider lineF

47 819

3 149

0:50

4:00

n/a

IHS lineF

61 979

18 057

4:37

3:15

n/a

Internet line

10 771

722

0:30

4:05

n/a

Ward of State line

1 036

89

0:32

3:00

n/a

GPII lineG

6 720

586

0:43

3:07

n/a

Total

388 984

77 785

 

 

 

Source: ANAO analysis of Human Services’ data.

Note A: Number of calls answered by all ACIR team SOs, after passing through the Interactive Voice Recognition (IVR) facility and entering the call queue.

Note B: Number of calls (after proceeding through IVR) abandoned by customers after entering a queue and prior to reaching a SO.

Note C: Average time a caller spends in a queue before being answered by a SO.

Note D: Average time a SO spends handling an individual call. This includes speaking to the customer, on hold, in conference mode with another SO/agent, and completing any after call work.

Note E: Service level refers to the number of calls answered within a specified KPI target. For the general line and the IHS line this target is 150 seconds; for all other lines, the KPI target is 30 seconds. In October 2014, Human Services advised that due to a change in telephony platform, service level data was not available for 2013–14. Human Services further advised that this KPI data gap was addressed by changing the performance measure to Average Speed of Answer (ASA). The service level target is now 30 seconds ASA for all lines other than the general and IHS lines which have a ASA target of seven minutes.

Note F: Prior to February 2014, these calls were answered as part of the general line.

Note G: The GPII program was closed in April 2013, however the GPII line was not closed until June 2014. Human Services advised that the majority of calls received after April 2013 were general provider enquires.

3.45 The ANAO observed a number of SOs taking calls at the two ACIR centres. For the observed calls, staff consistently completed the appropriate security checks for providers or parents. However, there were some inconsistent practices in SOs’ promotion of electronic means of accessing an IHS, and in asking if a parent had given consent for a provider to access their child’s information.130

Other ACIR processing activities

3.46 In addition to providing telephony services, SOs in the Medicare Providers Branch are responsible for processing immunisation information received via hard copy form, email or fax, including:

  • applications from immunisation providers for ACIR registration;
  • provider bank account details;
  • immunisation encounter information; and
  • requests for an IHS.

3.47 Table 3.5 shows the time spent on ACIR-related processing activities from 2011–12 to 2013–2014.

Table 3.5: Number of minutes spent on ACIR processing activities 2011–12 to 2013–14

 

2011–12

2012–13

2013–14

Number of minutes spent on ACIR processing activities

3 468 709

(7 708 working days)A

2 482 966

(5 517 working days)A

3 328 084

(7 395 working days)A

Source: ANAO analysis of Human Services’ data.

Note A: Based on a 7.5 hour working day.

Processing delays

3.48 As discussed in Chapter 2, under the Business Agreement with the Department of Health, the key Performance Target for processing immunisation records is ‘95 per cent processed within 10 working days of receipt’ by Human Services.

3.49 Processing delays can arise if providers do not submit details of immunisation services to ACIR in a timely manner. Table 3.6 shows the time taken for the department to receive immunisation encounter advices between 2010–11 and 2013–14.

Table 3.6: Time taken to receive immunisation service advices 2010–11 to 2013–14

Time taken to report immunisation services to ACIR

2010–11

2011–12

2012–13

2013–14

 

Percentage received

Within 5 working days

63.2

64.3

59.0

60.1

Within 10 working days

75.5

76.2

77.5

75.6

Within 20 calendar days

80.6

81.1

81.3

79.15

Source: ANAO analysis of Human Services information.

3.50 Since 2010–11, the department has received over 75 per cent of immunisation service advices within 10 working days, while the remaining one quarter of advices have persistently taken 20 days or more to be received. While the department is not directly responsible for such delays, there would be merit in Human Services periodically reminding providers of the need to submit immunisation information in a timely manner, drawing attention to the potential impacts of any late submissions on parents and public health reporting of immunisation outcomes. The impacts include:

  • For parents receiving CCB and/or CCR, their payment may be cancelled if their child is deemed overdue for a milestone immunisation 63 days after the due date, when they may have already been immunised.
  • Reporting of immunisation coverage statistics may be affected where children are falsely reported as overdue.

3.51 Human Services advised the ANAO in February 2015 that it has commenced work on including information to providers on the timely submission of immunisation information in its monthly provider payment statements.

Training and guidance for providers and SOs

3.52 ACIR operators—providers and SOs—need relevant skills and knowledge, as well as accurate guidance and support to accurately maintain and update the Register. Appropriate training and guidance for providers and SOs helps mitigate the risk of Registry errors and reduces the need for costly manual corrections by the department.

3.53 The ANAO examined the training, support and guidance available to providers and SOs.

Support for immunisation providers

3.54 Immunisation providers have direct data entry access to the Register, and as noted, over 50 per cent of Pend records requiring manual resolution by SOs are sourced from providers’ inputs via their practice management software.

3.55 Human Services has established a designated telephony line for providers. Currently, the department does not provide immunisation providers with any ACIR-specific training on data entry or other matters.131 Departmental support is available through Business Development Officers (BDOs), whose role is to educate and assist health care providers to use electronic means to conduct their business, in particular on-line claiming, so as to reduce the amount of manual processing and telephone contact. This broad-banded approach primarily targets medical practices which have a high volume of claims, to assist them to submit their immunisation information electronically.132

3.56 Human Services advised that where a specific provider or practice is identified as needing additional assistance in submitting their information electronically, BDOs are notified to provide follow-up support on a risk basis.133

Support for ACIR staff

3.57 For new SOs, ACIR-related training is chiefly provided through on-the-job training.134 New SOs are briefed on the program, and assigned a mentor.135 Mentors review (and correct, where required) processed forms, and provide support during phone calls through call listening.136 New SOs initially process less complex forms, before undertaking more complex work including phone calls. For new SOs, 100 per cent of their work is quality checked for a defined period137, and SOs also receive monthly coaching on their quality control results, and learning and development needs.

3.58 The ANAO examined the quality checking of new SOs, and observed a different approach in place between the two ACIR service centres. In one centre, new SOs required an accuracy rate of 100 per cent for two to three weeks before gradually transitioning into the standard quality control process. In the other service centre, new SOs graduated to the standard quality control process when they received a 97 per cent accuracy rate for three to five days in a row. Human Services advised the ANAO that its e-Reference procedures do not currently specify the accuracy rate a new SO must attain, and that it is currently updating these procedures to include a specific target.

3.59 Staff are also supported by ACIR Technical Program Advisors138 (TPAs), who provide program advice and perform quality checking of processing activities. TPAs distribute staff bulletins outlining changes to the ACIR program, policy or procedural updates and reminders on procedures, and conduct monthly technical sessions to provide refreshers on certain procedures—particularly where there are re-occurring errors.

3.60 Human Services has also established a suite of useful ACIR procedures and guidance materials for staff, relating to processing, telephony services, reporting and data cleansing activities.

Quality control

3.61 Human Services has established a Quality Framework to help maintain the accuracy and reliability of information collected by the department. Overarching guidance relating to quality control for all sub-programs (such as ACIR) in the Medicare Program is also supplemented by program specific procedures.

Quality control procedures

3.62 The ACIR Quality Control Procedures provide that a random sample of each SO’s work will be quality checked each month. Table 3.7 outlines the minimum work sample for each SO that is quality checked per month.139

Table 3.7: Minimum SO work sample quality checked per month

Processing team

Number of complex formsA

Number of simple formsB

Total per SO per month

Hobart

3

4

7

Perth

8

1

9

Source: Human Services.

Note A: Complex forms include: Immunisation Encounter forms; Medical Contraindication forms; Payment Account Details forms; Immunisation History forms; and Provider Registration forms.

Note B: Simple forms are: Conscientious Objection forms; Verbal Update forms; Header forms; General forms; and Natural Immunity notifications.

3.63 After a work sample has been quality checked, feedback is provided to the SO and any necessary re-work is completed. The results are then entered into the ACIR Online Quality Control Reporting Tool, which also captures any identified errors and the reasons for the errors through an Error Explanation Sheet.140

3.64 In addition, a quality control process for telephone calls, known as quality call listening, applies to new SOs. However, quality call listening does not apply to the many telephone calls fielded by other ACIR staff.141 Immunisation information can be collected and released over the phone by SOs, and there would be merit in Human Services applying standard quality call listening processes to ACIR-related telephone calls.

3.65 As mentioned earlier in this Chapter, there is currently no systematic quality control process in place to periodically assess the accuracy of the daily manual review and reconciliation of data exchanged between ACIR and other ICT systems.142 Given the frequency of these manual review activities and their essential role in maintaining the integrity of the Register, Human Services should also include these activities in its ACIR Quality Control Procedures. In May 2015, the department advised the ANAO that it had taken steps to progress this work.

Recommendation No.3

3.66 To provide additional assurance regarding the integrity of ACIR data entry and revision, the ANAO recommends that Human Services:

  1. apply quality call listening procedures to ACIR telephony services; and
  2. include manual ACIR data reconciliation activities in the ACIR Quality Control Procedures.

Human Services response:

3.67 The department agrees with this recommendation.

3.68 The department commenced the deployment of its national quality framework to ACIR in April 2015 before the audit was completed. The framework will cover all ACIR administration and processing, including telephony and data reconciliation by 30 September 2015.

Accuracy of Processing

3.69 Information collected from the ACIR quality control process is used for the collation of Accuracy of Processing reports on a monthly and yearly basis.143 The department’s overall Accuracy of Processing performance for the ACIR program in 2012–13 was 95.8 per cent—a little below the KPI of 97 per cent; while the 2013–14 Accuracy of Processing result was 98.1 per cent, exceeding the KPI target.

Analysis of a sample of processed forms

3.70 To assess the effectiveness of quality control processes for the ACIR program, the ANAO: reviewed a sample of 385 processed forms for the period 31 March 2014 to 29 August 2014 to determine if the information had been accurately processed into the Register; and compared these findings with the department’s quality control results for 2013–14. The ANAO’s analysis is set out in Table 3.8.

Table 3.8: Results of ANAO sample testing of ACIR data entry

Form type

Number of forms in ANAO sample

Number of errors identified

Overall accuracy rate in ANAO sampleA (%)

Overall accuracy rate in departmental sample (%)

Immunisation History Form

35

1

97.1

97.7

ODDS

36

0

100

98.5

Conscientious Objection

30

1

96.7

100

Medical Contra indication

107

0

100

92.2

Natural Immunity notification

30

1

96.7

98

Bank Registration

87

0

100

94.2

Provider Registration

12

0

100

83.3

Manual Encounter

18

1

94.4

100

Verbal Update

30

0

100

99.5

Source: ANAO analysis and Human Services 2013–14 ACIR Quality Assurance Processing Report.

Note A: Given the time period over which the ANAO collected the sampled forms, it is possible that additional errors existed but were subsequently corrected after notification from a provider or parent.

3.71 Overall, the number of processing errors identified in the ANAO’s sample was small. Three (of four) errors identified stemmed from key information not entered into the Register accurately, with the remaining processing error (natural immunity notification) relating to an incorrect vaccine entered. The processing errors in the ANAO’s sample were sourced from the same ACIR processing centre. All errors identified in the ANAO’s sample testing would have affected the recording of a child’s immunisation status, and potentially eligibility for family assistance payments.

Aim for Accuracy process

3.72 To provide confidence in the integrity of its quality checking arrangements, Human Services has established The Aim for Accuracy Health Programmes Policy. Under the policy, a representative sample of previously quality checked work will be independently re-checked at least annually, to assess whether the quality checking procedures have been followed correctly. Human Services advised that the most recent ACIR Aim for Accuracy process was conducted in March 2013, and resulted in one ACIR processing centre achieving a result below the required KPI, while the other processing centre achieved 100 per cent accuracy. Human Services further advised that while the ACIR Aim for Accuracy process was not undertaken in 2014 due to a review conducted in July 2013, it would be re-introduced for ACIR in June 2015.

Controls to support the integrity of provider payments

3.73 Recognised immunisation providers receive a payment of up to $6144 after notifying Human Services that they have completed one of the age-based immunisation schedules for a patient under the National Immunisation Program (NIP). Table 3.9 summarises total payments to immunisation providers for the period 2010–11 to 2013–14.

Table 3.9: Immunisation provider payments 2010–11 to 2013–14

 

2010–11

2011–12

2012–13

2013–14

Total number of notificationsA paid

1 170 385

1 725 733

1 724 444

1 743 953

Total number of payments

202 739

209 357

214 278

235 495

Total payments to providers

$9 137 916

$9 183 258

$9 172 638

$9 306 123

Source: ANAO analysis of Human Services information.

Note A: A notification refers to advice from a provider that a child has received a vaccination/s. A provider is only paid when they notify ACIR that a child has completed an age-based schedule under the NIP.

Payment process and controls

3.74 The process for making payments to providers for selected immunisation notifications is described in the department’s guide on ACIR Information Payments and Statements. Figure 3.2 illustrates the payment process for information payments to providers.

Figure 3.2: Payment process for information payments to providers

Source: ANAO analysis of Human Services’ documentation.

3.75 The ANAO observed a payment process conducted on 19 August 2014. The process was completed in accordance with the procedure outlined above.

3.76 The ANAO also observed the system controls in place for the accurate calculation of information payments to providers. These controls include:

  • payments for providers are calculated and distributed through an automated process within ACIR;
  • payments for providers are assessed at the antigen level, that is, providers are only eligible for payment if they complete an immunisation milestone/age schedule under the NIP; and
  • a process to identify providers in the Northern Territory and make the payment to the Northern Territory Department of Health.145

3.77 The payment system controls, in conjunction with the manual reconciliation process undertaken during the payment process, support the accurate calculation and payment of information payments to providers.

Detection of incorrect provider payments

3.78 Human Services relies on three mechanisms to detect incorrect provider payments:

  • a validation check during the payment process;
  • business rules within the Register to assess whether a child has received all the required vaccinations for that NIP milestone; and
  • providers’ vigilance in checking their statement.

3.79 For the validation process, program staff check that monthly provider payments are within the projected expenditure range, including in comparison to the previous year. Any significant discrepancies are referred for further investigation.146

3.80 Providers are also sent a monthly payment summary.147 Human Services advised the ANAO that it relies on a provider’s attentiveness to confirm they have been paid for the correct number of vaccinations. However, as mentioned, this expectation is not explicitly communicated to providers in the payment summary or on the department’s website.148

Conclusion

3.81 The effective operation of the ACIR program relies on the integrity of data held in the Register and the quality of administrative processes used to capture, record and update data. Sound data integrity controls can assist in providing confidence to: parents that their child’s personal and immunisation information is correct and secure, and that immunisation-related eligibility checks for certain family assistance payments are accurate; health professionals checking a patient’s immunisation status; and government entities monitoring immunisation coverage levels.

3.82 Children are generally registered on ACIR automatically once they are enrolled in Medicare. Relevant information on the Medicare database, known as the Medicare Consumer Directory (MCD), is synchronised daily with information kept on the Register. The ANAO’s testing of the completeness, accuracy and validity of these automated daily information exchange processes indicated that the number of data discrepancies is small relative to the total ACIR population. However, a number of persistent data synchronisation errors were identified, arising primarily from limitations in the interoperability of the relevant departmental ICT systems. Further data synchronisation errors arise from known system-to-system issues, such as misalignment of the business rules between systems. Data synchronisation errors between ACIR and MCD are managed through daily manual reviews undertaken by departmental staff—an essential but resource-intensive exercise which does not incorporate a quality control process. To help maintain ACIR data integrity and improve the efficiency of information processing, Human Services should establish a pathway for the resolution of data synchronisation issues, incorporating a planned process and timetable.

3.83 Further, the department should introduce a quality control process for the daily manual review and reconciliation of data exchanged between ACIR and other ICT systems, as there is currently no systematic quality control process in place to provide departmental management with additional assurance regarding the accuracy of these processes.

3.84 Human Services receives information from immunisation service providers electronically, over the telephone, and in paper form. The department has established system controls to validate electronic data received from immunisation providers before it is accepted into ACIR. However, departmental staff are also required to manually resolve large numbers of these records each month, to address errors largely introduced by immunisation providers’ practice management software (PMS). There would be benefit in the department working with PMS suppliers to identify options for addressing errors arising during data exchanges between ACIR and provider systems, so as to reduce the need for manual reconciliation processes and related administrative overheads.

3.85 Human Services has implemented quality control processes to check the accuracy of information entered manually by its SOs from paper-based sources. Further, the department has put in place system controls, supported by a manual reconciliation process, to support the accurate calculation of payments to service providers. However, no quality control process applies to ACIR telephone calls. The department provides a range of ACIR-related telephone lines for its customers, including immunisation providers, to enable them to obtain and supply immunisation information. Given the large number of calls involving ACIR updates, and consistent with many other services provided by Human Services, the department should apply quality call listening processes to ACIR-related telephone calls.

3.86 Human Services advised that in addition to its own quality control processes, it relies on parents and immunisation providers to assist in maintaining the accuracy of the Register. The department expects that parents will check that details recorded on their child’s IHS are correct, and will advise the department of any errors. Similarly, the department expects that providers will review their monthly payment summaries to check that vaccines administered by them have been accurately recorded, and that payments are correct. However, the department’s expectations in this regard are not clearly and consistently communicated to parents and providers, and the department should include an appropriate statement in relevant communication materials, including the IHS sent to parents and the monthly payment summaries sent to providers.

4. Use of Australian Childhood Immunisation Register information

This chapter examines the arrangements in place for the use of data and information held on ACIR by stakeholders. It also examines the controls and processes around the release of information from ACIR.

Introduction

4.1 ACIR contains information intended to assist parents and immunisation providers in the management of a child’s immunisation status, as well as information to enable researchers and other health professionals to measure and track immunisation levels in Australia. In providing information from ACIR to relevant stakeholders, suitable controls and practices should be in place to protect the privacy of individuals and to ensure information is only released to authorised entities and individuals.

4.2 To assess the effectiveness of Human Services’ management of the use and release of ACIR information to stakeholders, including measures to maintain individuals’ privacy and the confidentiality of information, the ANAO examined:

  • the department’s privacy policy and practices, and communications to parents on privacy;
  • use of ACIR information by the department’s Centrelink program; and
  • release of ACIR information to parents, immunisation providers, and other interested parties.

Privacy and release of information

4.3 The Health Insurance Act 1973 (the Act) establishes ACIR and enables the Chief Executive Medicare to: use the database of Medicare enrolments to establish and update the Register; send information about a child’s immunisation status to parents; and provide both identified and de-identified information from ACIR to recognised providers and other specified agencies.

4.4 In practice, ACIR is considered to be an ‘opt-out’ program; that is, enrolment on the Register, and consent for a child’s immunisation information to be used, is assumed unless the parent advises the department otherwise.149

4.5 In administering ACIR, Human Services is subject to the Privacy Act 1988 (the Privacy Act) and the 13 Australian Privacy Principles (APPs), which regulate how entities collect, store, provide access to, use and disclose personal (and sensitive) information.150 The Privacy Act also recognises that the protection of individual privacy needs to be balanced against the interests of entities in carrying out their functions or activities.

4.6 In light of the ANAO’s recent examination of privacy in the Medicare context151, analysis of privacy issues in the current audit focuses on how Human Services communicates the ACIR-specific aspects of its privacy policy to parents and how the department manages the controlled release of information from ACIR to authorised parties.

Human Services’ Privacy Policy

4.7 As required under Australian Privacy Principle 1, Human Services has a publicly available Privacy Policy (the Policy) that outlines the department’s approach to privacy and how it handles personal information in relation to the payments and services it delivers. The Policy provides for the collection, use and disclosure of personal information for Medicare-related purposes, including ACIR. The Policy refers to ACIR, and keeping records of children up to the age of seven. The Policy also states that ‘When no longer required, personal information is destroyed in a secure manner, or archived or deleted in accordance with our obligations under the Privacy Act and Archives Act 1983.’152 Human Services advised that hard copy forms are archived and destroyed in accordance with the Archives Act, while information placed on the Register is currently retained indefinitely to allow parents to access their child’s immunisation history after the age of seven153, and to provide opportunities for longitudinal statistical research.

4.8 During the course of the audit, Human Services revised its Privacy Policy to include an explicit reference to ACIR collecting information from Medicare for enrolment and claiming purposes. The department also removed references to ACIR information being shared with the Centrelink program for determining eligibility for family assistance payments—although this practice remains in place.154 The department advised the ANAO that this information was removed as it is otherwise covered under the relevant (family assistance payments) legislation and is also contained in an information booklet available to parents.

Staff training on privacy

4.9 While there is no ACIR-specific training, the ANAO noted that privacy training and awareness are core components of Human Services’ entity-wide induction training for all new staff. Additionally all departmental staff are required to complete mandatory re-fresher privacy training annually.155

Informing parents of privacy arrangements

4.10 Human Services communicates its privacy practices to parents through a number of channels, summarised in Table 4.1.

Table 4.1: Human Services’ communication on ACIR privacy issues to parents

Use of information

Method of communication to parents

Enrolment on ACIR once a child is enrolled in Medicare.

  • Human Services website.
  • Human Services Privacy Policy.
  • Notes to the Newborn Child Claim for Paid Parental Leave, Family Assistance and Medicare form.A

For children not enrolled in Medicare, enrolment on ACIR when a child is immunised.

  • Human Services website.

Use of ACIR information to check eligibility for certain family assistance payments.

  • Human Services website.
  • Human Services Privacy Policy notes Centrelink information will be passed to ACIR, but not the reverse.
  • Forms used for claiming Family Tax Benefit and Child Care Benefit.

The ability to ‘opt out’ of receiving correspondence from ACIR.B

(as per section 46 of the Health Insurance Act 1973.)

  • No advice from Human Services.

The ability to ‘withdraw consent’ for their child to be identified in information released from ACIR.B

(as per section 46 of the Health Insurance Act 1973.)

  • Limited information available on the Human Services website.

Use of a child’s immunisation information by providers.

(as per section 46 of the Health Insurance Act 1973.)

  • Human Services Privacy Policy.

Use of a child’s immunisation information for immunisation related research.

(as per section 46 of the Health Insurance Act 1973.)

  • Human Services Privacy Policy.

Source: ANAO analysis of Human Services information.

Note A: A child may also be enrolled using the Medicare enrolment application and the Aboriginal and Torres Strait Islander Medicare enrolment and amendment form. While both forms contain general privacy information and links to the department’s privacy policy, neither refers to enrolment in ACIR.

Note B: Due to system design, the child’s record will physically remain on ACIR.

4.11 The department’s current approach to advising parents of its policy relating to the collection and use of personal information relies on an interested parent accessing the department’s website, Privacy Policy, and other claim forms and booklets. A shortcoming of this approach is that parents have no single source of ACIR privacy information, and they are also not clearly advised of the two-way exchange of information between ACIR and Centrelink for the purpose of determining family assistance payments, and that ACIR continues to retain and use their personal information after a child turns seven.156 There would be benefit in Human Services considering how best to inform parents of these aspects of the ACIR program.

Limits to the use and disclosure of ACIR information

4.12 The Health Insurance Act 1973 (the Act) provides that parents may limit the disclosure of their child’s information.157 Under the Act, if a parent advises the Chief Executive Medicare that they do not wish to be notified when their child needs to be immunised, information about that child may not be disclosed to a provider, the department or a prescribed body.

4.13 While this option is not clearly communicated to parents in the department’s publicly available material (see Table 4.1), internal ACIR procedures advise departmental staff on handling requests from parents to limit the use of information held on the Register. In summary, parents may:

  • ‘opt out’ of receiving correspondence, such as IHS, from ACIR; and/or
  • ‘withdraw consent’ for their child to be identified in information released from the Register.

4.14 As at 30 June 2014, 177 ‘opt outs’ were noted in ACIR, and there were 20 instances recorded of consent having been withdrawn. In these cases the department advised that, based on current family assistance payment policy, it does not delete a child’s records from ACIR, and continues to update the Register until the child turns seven. The department further advised that, consistent with current policy for family assistance payments, ACIR continues to transmit information regarding the child’s immunisation status to Centrelink to determine, where relevant, if the child’s parent is eligible for family assistance payments.

Managing the release of information from ACIR

4.15 Public sector entities are responsible for managing access to sensitive information, and ensuring that information is only released to authorised parties. Human Services uses a mix of system controls and operational guidance, supported by staff training, to control access and manage the release of ACIR information.

4.16 A variety of stakeholders may seek access to ACIR information:

  • The department’s Centrelink program seeks information on immunisation status to confirm parents’ eligibility for certain family assistance payments;
  • ACIR program staff require access to ACIR to interrogate and update immunisation records, and to provide relevant information including to parents and providers;
  • parents can access their child’s immunisation history by phone or through the myGov secure portal;
  • providers can access information about one or more children by phone or via the ACIR secure portal;
  • researchers and other third parties may seek access to ACIR information for public health, research, and other purposes; and
  • government entities may access information for policy and planning purposes.

Release and use of ACIR information by the Centrelink program

4.17 ACIR records are used by the department’s Centrelink program to confirm a parent’s eligibility for some family assistance payments.158 The department uses a mix of IT system controls, supplemented by manual checking, to verify relevant eligibility criteria for family assistance payments.

4.18 The department has established a data exchange process between ACIR and the Centrelink payment system (ISIS) to ‘link’ children that are mutual clients of both programs, so as to regularly update the immunisation status of children within ISIS. An automated daily data matching process attempts to synchronise relevant ISIS and ACIR records and transmit the relevant child’s immunisation status to ISIS. If the Register cannot automatically determine whether to match a record to the ISIS request159 the match attempt is either returned to ISIS or assigned to an SO to manually check ACIR. The ANAO examined relevant ACIR operational reports for the period 12 October 2014 to 24 October 2014 and noted that, for this 12-day period, 1 420 records required manual checking.160

4.19 To help address shortcomings in the daily automated process, Human Services undertakes a supplementary bi-annual data integrity exercise to identify and rectify discrepancies between ISIS and ACIR. This exercise was first conducted in May 2014, with a subsequent exercise conducted in November 2014.161 Human Services advised that for the November 2014 exercise, 99.54 per cent of records were able to be matched. While the biannual exercise assists in maintaining the integrity of information exchanged between the systems and provides opportunities for the analysis of the underlying causes, it is not a means to overcome persistent data synchronisation issues and related overheads. As previously discussed, the department should establish a pathway for the resolution of data synchronisation issues, incorporating a planned process and timetable, and introduce a quality control process for the manual review of data exchanged between ACIR and other departmental ICT systems.

Release of ACIR information by staff via telephony services

4.20 ACIR internal procedures set out, for the benefit of SOs, steps to verify a caller’s identity prior to releasing any ACIR information. The procedures also detail the information which may be disclosed. For example, the procedures state that the following is ‘information not to be divulged’: the child’s address, provider name or location, and Medicare number.

4.21 For information disclosed over the telephone to a provider, ACIR procedures note that, before releasing the information, the SO must obtain confirmation from the provider that they have parental consent to obtain immunisation information for the child. The ANAO observed inconsistent practices by SOs when asking providers for parental consent over the telephone and there is scope for the department to further reinforce information security procedures for ACIR telephony staff. The department advised the ANAO in February 2015 that this inconsistency would be included in its regular review of eReference and training procedures.

Release of information to parents (Immunisation History Statements)

4.22 An IHS is a statement available to parents that contains a record of their child’s immunisation history. An IHS can be used to assist in keeping track of their child’s immunisation or as evidence of their child’s immunisation status for school or childcare enrolment. Parents are able to access their child’s IHS online—via the myGov website—or in hard copy. The IHS sets out:

  • the child’s personal details;
  • the child’s current immunisation status;
  • the immunisations received to date, including the date given, the brand name of the vaccine used, and the type of provider who administered the immunisation; and
  • when the next immunisation/s (where relevant) are due.

4.23 To access their child’s immunisation history through the myGov website, parents must create their own user account and password. While the ACIR program does not administer myGov, the department has established appropriate controls that permit a valid user of myGov to access their child’s ACIR record until the child turns 14 years of age.

4.24 Human Services also automatically sends a ‘milestone’ IHS to parents when their child reaches a designated age or immunisation milestone.162 These milestones are: five days before the child turns 18 months of age; once a child has completed their four year immunisation schedule (or five days after the child’s fifth birthday if they have not yet received the scheduled immunisations for four year olds); and when a child is linked to another Medicare card.

4.25 Parents can obtain a copy of their child’s IHS via a number of channels. Table 4.2 outlines these channels and the number of IHS accessed.

Table 4.2: Channels through which an IHS was viewed or requested from 2010–11 to 2013–14

 

Statement requested via 1800 number

Statement requested via Medicare Website

Statement viewed online

Statement requested in a Medicare office

Milestone statements

2010–11

164 191

9 943

181 197

95 136

663 242

2011–12

166 759

9 748

216 369

105 747

678 168

2012–13

166 937

26 119

310 053

115 203

664 196

2013–14

220 976

35 135

607 238

156 855

692 786

Source: ANAO analysis of Human Services data.

4.26 The use of electronic channels for accessing an IHS has grown strongly in recent years, with the number of statements viewed ‘online’ via the myGov portal growing three-fold between 2010–11 and 2013–14. However, the more traditional means of communication—face-to-face at a Medicare office, phone and hardcopy ‘milestone’ statements—continue to dominate how parents are obtaining an IHS.

4.27 The timing of the first milestone statement—five days before the child turns 18 months of age—means that it is likely that a large proportion of these children will not yet have received their scheduled 18 month immunisations at the time the statement is created. In consequence, parents may need to request another statement, soon after the 18 month vaccinations are then administered, if they require a more current and complete record. While acknowledging that the current practice of automatically issuing the IHS at this time may prompt parents to arrange relevant vaccinations, there is also the potential for duplication of work, and there may be merit in Human Services and Health reviewing the timing of these statements to ensure they provide the most benefit to parents.

Release of information to providers

4.28 Providers are also able to obtain ACIR-related information, subject to certain qualifications set out in the Health Insurance Act 1973. In summary, the provider: will only use the information for the purpose it is given; will not give the information to any other person; and will take appropriate precautions to safeguard the information.163

4.29 Once registered with Medicare, providers are able to electronically access ACIR through a number of channels, including: via PMS; the ACIR secure portal; and the Health Professional Online Service (HPOS).

4.30 The ANAO reviewed the controls Human Services has in place to manage the release of information to providers. The department applies: user ID, password and access controls; and providers must give undertakings related to the use and disclosure of ACIR information, consistent with the legislative requirements mentioned in paragraph 4.28. The ANAO also reviewed the user group list for external providers and noted that no duplicate users were listed.

4.31 When accessing ACIR electronically, providers are required to accept certain terms and conditions which include responsibility for the appropriate use and disclosure of information, even should they cease to be a provider. System controls are also in place to verify that information submitted to ACIR is from an authorised user, and to encrypt information transmitted to ACIR to protect its integrity.164 However, unlike the ACIR provider telephone line, there are no system controls (for example, an on-line declaration or other mechanism) to verify that providers have obtained parental consent to access a child’s immunisation information electronically. There would be benefit in Human Services considering how best to align its practices for telephone and electronic access.

4.32 Functionality exists within ACIR to limit access to information for providers who no longer require it.165 Departmental staff may also manually revoke a provider’s access. As an additional security control, an online statement is automatically produced for providers who accessed the ACIR secure portal in the past month which outlines the date, time and activity undertaken. Providers are encouraged to review this statement to identify any unauthorised use made under their user identification.

4.33 ACIR produces a range of both de-identified and identified reports for providers registered to use the ACIR secure site.166 These reports can be provided on request, and are also available from the ACIR secure site. Human Services advised the ANAO that by June 2015, providers should have access to a number of additional reports on children overdue for immunisation.

Release of ACIR information to third parties

4.34 External stakeholders—including state and territory governments and researchers—seeking to obtain Medicare information and ACIR data must first apply to Human Services. The department’s External Request Evaluation Committee (EREC) assesses these requests and has established a set of guidelines, the External Request Evaluation Committee Guidelines (the Guidelines), to govern its consideration of these requests.167

4.35 The Guidelines outline a number of tests that need to be satisfied, including relevant legislative and policy requirements, before any information is approved for release.168 The release of sensitive data held by Human Services must also meet requirements set out in the bilateral agreement between Human Services and Health.169

4.36 Human Services advised that between July 2013 and September 2014, five requests for the release of ACIR data were referred to EREC for assessment. The ANAO’s review of relevant EREC documentation170 indicated that while the Committee’s decisions were clearly documented, the EREC Minutes did not always specify which of the tests set out in the Guidelines were considered relevant.171 To improve the transparency of decision making and maintain the integrity of its EREC assessments, there would be benefit in Human Services clearly documenting the tests applied for each request.

4.37 The guidance for applicants172 does not indicate the expected timeframes for assessing requests, although it does note that data requests should be submitted as soon as possible to allow sufficient time for review, clarification, privacy clearance and information retrieval as these can be lengthy processes.173 Stakeholders interviewed by the ANAO commented that ad hoc data requests were not always finalised in a timely manner and could also be costly.174 For the requests reviewed by the ANAO, the time from the request being submitted to the requestor being advised of the decision ranged from two weeks to four months. The department advised that expected timeframes for delivering data in approved requests can vary significantly depending on the scope and complexity of the data sought, and whether the consent of participants is required.

Access controls to ACIR systems

4.38 Relevant ACIR program staff require access to the ACIR ICT systems—mainframe and secure portal—based on the need established by their particular duties. To provide visibility of user access to these systems, each staff member should have their own user ID. In addition, as a security measure, ACIR users’ access and relevant permissions are controlled separately by the department’s IT Security area.

4.39 The ANAO reviewed the ACIR user group list and identified that all users had a unique identifier.

4.40 In preparation for this audit, in June and August 2014, Human Services reviewed all internal users’ access to the ACIR mainframe and secure site175, resulting in a large number of redundant users being removed from access to the ACIR systems. While this review was timely, it was not evident that there was a process in place to effectively monitor staff access to ACIR.176 Human Services advised the ANAO in February 2015 that the department had implemented a bi-annual review of internal staff access to ACIR, to strengthen access controls over the ACIR database.

Conclusion

4.41 ACIR contains private and sensitive information used to: assist parents and providers in managing childhood immunisations; and inform public health policy and planning. To manage the use of ACIR information and promote the consistent application of applicable legislative obligations and departmental processes, Human Services has established relevant system controls, as well as internal policies, guidance materials and training for ACIR staff.

4.42 The department’s current approach to advising parents of its policy relating to the collection and use of personal information relies on an interested parent accessing the department’s website and Privacy Policy. The ANAO’s review of privacy information appearing on the Human Services website indicated that parents are not clearly advised of: the two-way exchange of information between ACIR and Centrelink for the purpose of determining family assistance payments; and that ACIR retains and uses information after a child turns seven. There would be benefit in Human Services considering how best to inform parents of these specific aspects of the ACIR program.

4.43 While controls are in place to manage access to information by authorised immunisation providers, the ANAO’s review of key access controls indicated that there was not a process in place to effectively monitor staff access to ACIR. To strengthen access controls over the ACIR database, there would be merit in Human Services establishing a process to review internal user access privileges at appropriate intervals, so that only those staff with a job requirement to access the ACIR system and secure portal are able to do so. The ANAO also observed inconsistent practice in the implementation of some information security procedures—in particular, staff satisfying themselves that an immunisation provider had secured parental consent prior to the department releasing ACIR information by telephone. There is scope to further reinforce information security procedures for ACIR telephony staff.

4.44 Eligibility for some Centrelink payments is dependent on a child’s immunisation status, and ACIR data is accessed for this purpose. The department has established an automated daily process to detect mutual clients of the ACIR and Centrelink programs, so as to update ISIS with a child’s current immunisation status. To overcome known shortcomings with the automated process, Human Services conducts a daily manual reconciliation process supplemented by a bi-annual data integrity exercise to identify and rectify discrepancies in information held on the two systems. While the biannual exercise assists in maintaining the integrity of information exchanged between the systems and provides opportunities for the analysis of the underlying causes, it is not a means to overcome persistent data synchronisation issues and related overheads. As previously discussed, the department should establish a pathway for the resolution of data synchronisation issues, incorporating a planned process and timetable, and introduce a quality control process for the manual review of data exchanged between ACIR and other departmental ICT systems.

4.45 Human Services has established a process for external parties to request access to personal and sensitive information, including ACIR data. The ANAO’s review of relevant ACIR data requests from 2013–2014 indicated that the department had not consistently recorded which assessment criteria were applied when granting access to ACIR data. To maintain the integrity of access procedures, there is scope to refine the current approach to recording departmental assessments and decisions relating to data requests from third parties.

Appendices

Appendices

Please refer to the attached PDF for the Appendices:

  • Appendix 1: Entity Responses
  • Appendix 2: International Immunisation Registers
  • Appendix 3: 2014 Revised ACIR KPIs in the Agreement

 

Abbreviations

ACIR

Australian Childhood Immunisation Register

ANAO

Australian National Audit Office

CCB

Child Care Benefit

CCR

Child Care Rebate

EREC

External Request Evaluation Committee

Health

Department of Health

Human Services

Department of Human Services

IHS

Immunisation History Statement

ISIS

Income Security Integrated System

MCD

Medicare Consumer Directory

NIC

National Immunisation Committee

NIP

National Immunisation Program

PMS

Practice Management Software

SO

Service Officer

Glossary

ACIR (or the Register)

A national register that records the details of immunisations given to children under the age of seven.

Encounter

The provision of one or more episodes (actual vaccines) by an immunisation provider.

Episode

An episode is an immunisation given to a child by an immunisation provider. Each encounter will have at least one episode.

Immunisation History Statement

A statement outlining a child’s immunisation history and current immunisation status.

Immunisation

The process whereby a person is made immune or resistant to an infectious disease, typically by the administration of a vaccine.

Medicare Consumer Directory

The database which is the main repository for Medicare customer data.

Monthly payment summary

A summary sent to providers that outlines the vaccination details administered to each child under the provider’s care for that month, as well as the vaccinations for which the provider received payment. Human Services also refers to these documents as an Information Payment Summary.

National Immunisation Program (NIP) schedule

Specifies particular vaccinations and the ages at which they should be given.

Pend queue

Immunisation encounter information that is submitted by a provider electronically, and cannot be automatically validated by the Register, is placed in a Pend queue for manual reconciliation by a Service Officer (SO).

Footnotes

1 Immunisation is the process whereby a person is made immune or resistant to an infectious disease, typically by the administration of a vaccine. Source: World Health Organisation, Health topics: Immunization, available from http://www.who.int/topics/immunization/en/ [accessed 1 April 2015].

2 In this report, a reference to ‘parents’ also includes legal guardians.

3 An Immunisation History Statement (IHS) is provided to parents at various age milestones or on request. A range of reports is also available for immunisation providers.

4 At present, eligibility requirements for claiming Child Care Benefit, Child Care Rebate and Family Tax Benefit Part A supplement provide that a parent’s child must be fully immunised or have an approved exemption in place. Revised arrangements applying from 1 January 2016 are outlined in paragraph 6.

5 On 1 July 2011, Centrelink and Medicare Australia were integrated into the Department of Human Services. The statutory functions of the Chief Executive Centrelink and the Chief Executive Medicare are now undertaken by appointed Deputy Secretaries of the Department of Human Services.

6 The delivery of the NIP is a shared responsibility between the Australian, state and territory governments. The National Partnership Agreement for Essential Vaccines (NPAEV) sets out the roles for each party, as well as funding and reporting arrangements for ACIR.

7 This is sometimes referred to as ‘herd immunity’.

8 For information on regional immunisation coverage rates in Australia for 2014, see http://www.ncirs.edu.au/immunisation/coverage/maps/index.php#24months [accessed 23 April 2015].

9 Media Release, Prime Minister of Australia, the Hon Tony Abbott MP, available from http://www.pm.gov.au/media/2015-04-12/no-jab-no-play-and-no-pay-child-care [accessed 20 April 2015]. See also Media Release, Minister for Social Services, The Hon Scott Morrison MP, available from http://scottmorrison.dss.gov.au/media-releases/no-jab-no-play-and-no-pay-for-child-care [accessed 20 April 2015]. These initiatives also formed part of the 2015–16 Budget, see Australian Government, Budget Measures, Budget Paper No. 2 2015–16, No Jab No Pay, p. 167.

10 Currently immunisation status is only checked at ages one, two and five.

11 See Table 1.2 for a more detailed explanation of the existing exemptions to immunisation.

12 Religious objections to immunisation are recorded as conscientious objections on the Register. There is currently only one group that has registered an exemption with the Australian Government based on religious grounds. The Government announced in April 2015 that this exemption will end from 1 January 2016. See Media Release, Minister for Social Services, the Hon Scott Morrison MP, available from http://scottmorrison.dss.gov.au/media-releases/government-ends-religious-no-jab-no-pay [accessed 20 April 2015].

13 See Figure 1.2 for detail on the regions within Australia with the highest numbers of conscientious objections recorded on the Register.

14 Media Release, Minister for Health, the Hon Sussan Ley MP, available from http://sussanley.com/26m-booster-to-immunise-australia/ [accessed 20 April 2015]. The Minister also announced that the Government would explore options to capture adult immunisation records. See Australian Government, Budget Measures, Budget Paper No. 2 2015–16, Improving Immunisation Coverage Rates, p. 101 and p.106.

15 The Department of Health subsequently announced that the National Human Papillomavirus Vaccination (HPV) Program Register will be expanded to become the Australian School Vaccination Register, with a view to capturing all adolescent vaccines given through school-based programs. The expanded register is expected to provide a basis for introducing recall and reminder systems to improve adolescent coverage. See Department of Health, Fact Sheet, available from http://www.immunise.health.gov.au/internet/immunise/publishing.nsf/Content/improving-immunisation-coverage-rates [accessed 23 April 2015]. At present, the HPV Program Register is operated by the Victorian Cytology Service Incorporated, a health promotion charity. See www.vcs.org.au/about [accessed 23 April 2015].

16 See ANAO Audit Report No.27 2013–14 Integrity of Medicare Customer Data.

17 In some jurisdictions, confirmation of a child’s immunisation status is also required for enrolment in child care and school.

18 The proposed Register is a component of a $26 million 2015–16 Budget measure foreshadowed by the Australian Government in April 2015. See also paragraph 7.

19 The number of children with a conscientious objection to immunisation registered on ACIR has increased steadily over time, with the number more than doubling over the past 10 years. See Figure S.2 of this audit report.

20 Most immunisation ‘encounter’ information is received by the department via providers’ practice management software (PMS) systems. Advice from providers can also be received by phone, email, fax or hard copy forms.

21 Children under the age of seven are automatically entered on ACIR once they are enrolled in Medicare. This is achieved by an exchange of data between the MCD and ACIR. There is a further exchange of data between ACIR and ISIS for the purpose of making family assistance payments.

22 Human Services advised the ANAO that in January 2014, the New South Wales Government announced changes to the process for enrolment in child care, requiring a parent to provide an Immunisation History Statement (IHS) prior to enrolling their child. The department further advised that the changes resulted in a spike of calls to the ACIR telephony lines, and the need to respond to these additional calls resulted in fewer staff being available for processing work.

23 The various ICT systems were designed at different times and for different purposes, rather than as an integrated network.

24 The period was 21 August to 21 October 2014.

25 The ANAO’s testing of the completeness, accuracy and validity of automated daily information exchange processes between MCD and ACIR indicated that while the number of data discrepancies is small relative to the total ACIR population, errors arise persistently. ANAO testing identified a number of discrepancies in data exchanged, including: a number of records appearing in one database but not the other (15 351 ACIR records not found in MCD, and 1 671 MCD records not found in ACIR); 8 681 records where the first name of the child differed; and 814 duplicate records.

26 These are known as ‘Pend transactions’. During the two month period examined by the ANAO (21 August to 21 October 2014), the number of Pend transactions requiring investigation ranged from 3 106 to 17 060 on a given day.

27 See paragraph 7 of this audit report.

28 See paragraph 14. Table 2.3 contains further information on performance against targets in the Agreement.

29 In particular, the RMP could usefully address a number of risks identified in Chapter 3 of this audit, relating to data synchronisation and the manual reconciliation of Registry data.

30 The MCD is the main repository for Medicare customer data.

31 Chapter 3 of this audit report focuses on data provided to ACIR from MCD. There is a further exchange of data with Centrelink’s ICT system (ISIS) for the purposes of making family assistance payments. Issues relating to the provision of data from ACIR to ISIS are discussed in Chapter 4.

32 These legacy systems have operated for many years. ACIR was originally established in 1996 as part of a trial, while MCD was established in 2005. Centrelink’s ISIS system was originally established in 1983.

33 For example the surname field in MCD is 40 characters, while in ACIR it is 30 characters. As a consequence, a name may be truncated in ACIR and an automatic match between the same child’s records may not be recognised.

34 As with the MCD-ACIR daily manual reviews, there is no quality control process in place for these manual reconciliation activities.

35 The ANAO examined a sample of 385 manually-entered forms, and identified four processing errors. Three of these errors related to key information not being entered into the Register, while one error related to the wrong vaccine being recorded.

36 Human Services advised the ANAO that, prior to a review of internal users in preparation for this audit in June/August 2014, the ACIR program did not have a formal process to routinely review ACIR internal user access privileges. Some ad hoc reviews had been previously undertaken as an internal governance measure.

37 As necessary, records are referred to a SO for review and possible manual matching. As with the MCD-ACIR manual review exercises discussed in Chapter 3, there is no quality control process in place for the manual reconciliation of ACIR-ISIS information.

38 This is sometimes referred to as ‘herd immunity’.

39 Immunisation is the process whereby a person is made immune or resistant to an infectious disease, typically by the administration of a vaccine. Source: World Health Organisation, Health topics: Immunization, available from http://www.who.int/topics/immunization/en/ [accessed 1 April 2015].

40

4140 These areas are: Queensland, Northern Territory, Western Australia and South Australia.

 If a child does not receive a vaccination/s at the prescribed age, the child’s immunisation provider (who may be a general practitioner or state and territory provider) will determine a clinically appropriate catch-up schedule for the child. Catch-up schedules for vaccines under the NIP are provided by most states and territories for children up to the age of seven.

42 For information on regional immunisation coverage rates in Australia for 2014, see http://www.ncirs.edu.au/immunisation/coverage/maps/index.php#24months [accessed 23 April 2015].

43 Reasons for children not being immunised or fully immunised include: conscientious objection; exemptions for medical reasons; and delays in receiving scheduled immunisations.

44 The NPAEV commenced on 1 July 2009. From 2009–10 to 2013–14, combined Commonwealth and state expenditure under the NPAEV totalled some $1.76 billion.

45 In this report, a reference to ‘parents’ also includes legal guardians.

46 As part of the 2015–16 Budget, the Government announced that Child Care Benefit and Child Care Rebate payments would be streamlined into a single Child Care Subsidy (CCS) to commence on 1 July 2017. See Australian Government, Budget Measures, Budget Paper No. 2 2015–16, Families Package—child care—Workforce Participation Stream, pp. 154-5.

47 This initiative replaced the $129 Maternity Immunisation Allowance which was provided to eligible parents when their child was fully immunised between 18-24 months of age, and 4-5 years of age.

48 The payment is funded by the Australian and state governments. Providers in Queensland receive $3 as the Queensland Government does not contribute funding for notification payments to providers as it maintains its own register.

49 Previously, additional incentives for providers were available under the General Practice Immunisation Incentives (GPII) Program. This program was closed in April 2013.

50 Currently immunisation status is only checked at ages one, two and five.

51 Media Release, Prime Minister of Australia, the Hon Tony Abbott MP, available from http://www.pm.gov. au/media/2015-04-12/no-jab-no-play-and-no-pay-child-care [accessed 20 April 2015]. See also Media Release, Minister for Social Services, The Hon Scott Morrison MP, available from http://scottmorrison.dss.gov.au/media-releases/no-jab-no-play-and-no-pay-for-child-care [accessed 20 April 2015].

52 See Table 1.2 for a more detailed explanation of the existing exemptions to immunisation.

53 Media Release, Minister for Health, the Hon Sussan Ley MP, available from http://sussanley.com/26m-booster-to-immunise-australia/ [accessed 20 April 2015].

54 See Department of Health Fact Sheet, available from http://www.immunise.health.gov.au/internet/ immunise/publishing.nsf/Content/improving-immunisation-coverage-rates [accessed 23 April 2015].

55 At present the HPV Program Register is operated by the Victorian Cytology Service Incorporated, a health promotion charity. See www.vcs.org.au/about [accessed 23 April 2015].

56 See Australian Government, Budget Measures, Budget Paper No. 2 2015–16, National Immunisation Programme – new and amended listings, p. 106.

58 From January 2016 a conscientious objection to immunisation will be removed as an approved exemption to immunisation requirements for some family assistance payments.

59 See Media Release, Minister for Social Services, the Hon Scott Morrison MP, available from http://scottmorrison.dss.gov.au/media-releases/government-ends-religious-no-jab-no-pay [accessed 20 April 2015].

60 For information on the proportion of total conscientious objectors to immunisation across Australia for the cohort born January 2010 to December 2010 see http://www.health.gov.au/internet/main/publishing.nsf/ Content/cda-cdi3803-pdf-cnt.htm/$FILE/cdi3803e.pdf [accessed 23 April 2015].

61 No additional information is recorded after a child turns seven years of age, however information on the register is retained.

62 Immunisation registers are used in a number of countries. Appendix 2 compares a selection of national registers, including ACIR.

63 Recognised immunisation providers include: general practitioners; public and private hospitals; community health centres; state health departments; and Aboriginal Health Services.

64 An IHS records the vaccines a child has received and the type of provider who administered them.

65 In some jurisdictions, confirmation of a child’s immunisation status is also required for enrolment in child care and school.

66 On 1 July 2011, Centrelink and Medicare Australia were integrated into the Department of Human Services. The Chief Executive Centrelink and the Chief Executive Medicare are statutory appointments held by Deputy Secretaries of the Department of Human Services.

67 The Financial Management and Accountability (FMA) Determination 2006/57 – Australian Childhood Immunisation Register Special Account was originally made under subsection 20(1) of the Financial Management and Accountability Act 1997 and from 1 July 2014 is taken to have been made under subsection 78(1) of the Public Governance, Performance and Accountability Act 2013.

68 Human Services has entered into a Business Agreement with Health for the administration of ACIR.

69 Health Professional Online Services (HPOS) provides secure access to online services for health professionals through a single entry point. To access HPOS, providers require a Department of Human Services Public Key Infrastructure (PKI) certificate.

70 See ANAO Audit Report No.27 2013–14 Integrity of Medicare Customer Data.

71 ANAO Report No.4 2008–09, The Business Partnership Agreement between the Department of Education, Employment and Workplace Relations and Centrelink, p. 45.

72Business Agreement relating to the National Registers Program: 2012–15 Agreement between the Secretary of the Department of Human Services and the Secretary of the Department of Health and Ageing.

73 Schedule A of this Business Agreement deals with ACIR.

74 Part IVA of the Health Insurance Act 1973 (the Act) sets out the powers and responsibilities for the Chief Executive Medicare (now a senior officer within Human Services) for ACIR, including to establish and keep ACIR.

75 Schedule A, Part B – Business Arrangements, pp. 4–7.

76 ANAO Better Practice Guide—Public Sector Governance, June 2014, p. 33.

77 ANAO, Audit Report No.41 2009–10, Effective Cross Agency Agreements, p. 70.

78 Schedule A clause 6.9, and Attachment 3 clause 1.1.

79 Similar indicators and targets were set out in the Business Practice Agreement which preceded the current Agreement.

80 In February 2013, the Bilateral Head Agreement Management Committee commissioned a review of Key Performance Indicators (KPIs) under the Agreement, including the ACIR indicators, to: streamline the KPIs; remove out-dated KPIs; and introduce new KPIs to reflect new business requirements. In May 2014, a revised set of five ACIR KPIs replaced the previous indicators. The revised 2014 ACIR KPIs, performance targets and reporting frequencies are set out in Appendix 3.

81 ANAO Audit Report No.28 2012–13 The Australian Government Performance Measurement and Reporting Framework: Pilot Project to Audit Key Performance Indicators, Canberra, April 2013, p. 43.

82 These cohorts are: children 12-15 months of age; children 24-27 months of age; and children 60–63 months of age.

83 Also see ANAO Better Practice Guide—Successful Implementation of Policy Initiatives, October 2014, Canberra, p. 62.

84 The 2003 evaluation focused primarily on performance indicators, governance and the role of ACIR Field Officers.

85 See Note B of Table 2.1 for a summary of the NIC’s role and membership.

86 The primary target audience also includes parents and guardians of children up to the age of 14 as they are still able to request Immunisation History Statements (IHS).

87 See: Media Release, Minister for Health, the Hon Sussan Ley MP, available from http://sussanley.com/26m-booster-to-immunise-australia/ [accessed 20 April 2015]; and Department of Health Fact Sheet http://www.immunise.health.gov.au/internet/immunise/publishing.nsf/Content/ improving-immunisation-coverage-rates [accessed 23 April 2015].

88 See Table 3.4 for details of call volumes to ACIR telephony lines from 2011–12 to 2013–14.

89 The ACIR Communication Implementation Plan notes that the average age of parents with children under the age of seven is between 25 and 34 years of age and, based on age and research, assumes these parents will have a high level of online awareness.

90 An IHS is generated from the child’s relevant ACIR record and can be viewed via the department’s Medicare online site or its Medicare Express App.

91 Reports available from ACIR are discussed in more detail in Chapter 4.

92 Department of Human Services Indigenous Servicing Strategy 2012–2015.

93 ANAO, Audit Report No.45 2013–14, Initiatives to Support the Delivery of Services to Indigenous Australians, p. 15.

94 Department of Human Services 2013–14 Annual Report, p. 96.

95 See also ANAO Audit Report No.42 2011–12, Management of the Multicultural Servicing Strategy for the Delivery of Centrelink Services.

96 Department of Human Services 2013–14 Annual Report, p. 96.

97 Sponsored under Australia’s overseas aid program.

98 The NIC reports to the Australian Health Ministers Advisory Council through the Australian Health Protection Principal Committee and Communicable Disease Network Australia. As noted in paragraph 1.6, roles and responsibilities including for implementation of the NIP are set out in the National Partnership Agreement on Essential Vaccines.

99 Human Services’ Service Commitments sets out a range of principles—respect, easy access to services, quality information, fair and transparent services, genuine consultation, and efficiency—which guide its service delivery arrangements.

100 Over the period 2010–11 to 2013–14, Human Services has changed its complaint categories, which has made it more difficult to assess trends over time.

101 Human Services advised the ANAO that the methodology for this survey changed for the 2012–13 survey, so it is not possible to compare results from earlier surveys.

102 Stakeholder groups interviewed by the ANAO included: representatives from Health; other Australian Government agencies; state and territory government officials; health consumers; immunisation providers including ‘front line’ support workers to health care providers; and researchers.

103 Human Services advised the ANAO in February 2015, that the department would consider options to potentially include collecting feedback from ACIR providers as part of the broader departmental Health Provider Survey.

104 The terms of reference for the SCG are to: provide strategic advice on key issues impacting health care service delivery as they relate to the department; and provide advice and feedback to the department regarding implementation of Australian Government health programs. SCG membership includes staff and health sector representatives.

105 ANAO Better Practice Guide—Successful Implementation of Policy Initiatives, October 2014, p. 31.

106 These documents are supported by a range of risk management tools and templates for the guidance of staff in the preparation of risk assessments.

107 Human Services advised the ANAO in February 2015 that risks to data integrity and data quality will be explicitly identified for future versions of the ACIR RMP.

108 In some jurisdictions, confirmation of a child’s immunisation status is also required for enrolment in child care and school.

109 Security and privacy of data is discussed further in Chapter 4.

110 Part of the Health, Compliance and Information Group.

111 There are four ACIR teams, each comprising approximately 18 staff.

112 Approximately 97 per cent of child enrolments on the Register are sourced from the Medicare database.

113 A child may be listed on up to three Medicare cards (for example, a parent’s), but should only have one PIN.

114 Only recognised immunisation providers can submit immunisation information to the Register. General Practitioners registered with Medicare are automatically recognised as immunisation providers and are authorised to send or receive immunisation information from the Register. Other types of immunisation providers, such as maternal and child health nurses, can also apply to be an ACIR-recognised provider.

115 Both datasets were extracted on the same day, 12 October 2014, using the following parameters: children with a date of birth between 10 September 2007 and 10 September 2014. The data extracts contained 2 445 846 ACIR records and 2 442 886 Medicare Consumer Directory records.

116 Human Services has in place a number of system ‘business rules’ that are designed to account for, and address, the different data scenarios that may occur during the synchronisation process.

117 As identified in ANAO Audit Report No.27 2013–14 Integrity of Medicare Customer Data.

118 Human Services advised the ANAO that an ACIR working group on data accuracy was formally established during the course of the audit. As this working group was established after audit fieldwork was completed, the group’s activities have not been examined as part of the audit.

119 An IHS can be used as evidence of a child’s immunisation status.

120 All medical contraindication forms and conscientious objection forms are submitted as hard copy forms as they require signed declarations from providers and parents.

121 An immunisation ‘encounter’ refers to a child receiving a vaccination from a provider.

122 In September 2014, the department identified over 80 ACIR errors that resulted in a record entering the Pend queue.

123 Human Services advised that each child is assessed in the system overnight, which may cause records that have previously been accepted by the system to be put back into Pend. The department further advised that potential reasons for this occurring may include the child being re-assessed by the system against the due/overdue rules, or the postcode for the child’s address being re-classified.

124 As noted in Chapter 2, Human Services has a KPI for processing 95 per cent of immunisation information within 10 working days. A separate report that calculates the time taken to process Pend records is however available for both the operational and ACIR program area to access as required to assist in monitoring progress against this KPI.

125 The ANAO examined Pend queue records received by ACIR for the period 21 August 2014 to 21 October 2014.

126 The department’s various ICT systems were designed at different times and for different purposes, rather than as an integrated network—with ACIR originally established in 1996; MCD established in 2005; and Centrelink’s ISIS system established in 1983. Chapter 3 of this audit report focuses on the data provided to ACIR from MCD. Chapter 4 examines the exchange of data between ACIR and the Centrelink program’s ISIS system for the purpose of determining immunisation requirements for some family assistance payments.

127 ANAO comment: see footnote 118.

128 Based in Perth and Hobart.

129 Increases in Average Speed of Answer were also experienced by customers on other ACIR lines between 2011–12 and 2013–14. Human Services advised the ANAO that, among other factors, in January 2014, the New South Wales Government announced changes to the process for enrolment in child care, requiring parents to provide an IHS prior to enrolling their children. This development resulted in a spike of calls to the ACIR telephony lines, which increased call wait times (average speed of answer) and the number of abandoned calls.

130 Section 46E(1)(b) of the Health Insurance Act 1973 requires a parent to consent to the provision of information to a provider. ACIR procedural documentation notes that before releasing information over the phone, the SO must obtain confirmation from the provider that they have parental consent to obtain immunisation information for the child.

131 From 2001 to 2012, departmental ACIR Field Officers supported immunisation providers (including state and territory health departments, divisions of general practice, and local government immunisation providers). Their role also involved educating stakeholders on the ACIR secure site and reporting tools as well as conducting data cleansing activities, including identifying and amending duplicate and erroneous records. A review of ACIR Field Officers in 2012 recommended they be incorporated into the Business Development Officers’ (BDOs) servicing model to provide a wider range of services to providers. A number of stakeholders interviewed by the ANAO commented that following the withdrawal of ACIR Field Officers there has been a reduction in the support and education available to providers for ACIR specific issues, in particular, assistance with interpreting ACIR reports and data cleansing.

132 In some areas, Medicare Locals provide some ACIR support to providers, subject to the regional priorities identified by each Medicare Local. From July 2015, funding for Medicare Locals will cease. The role of Medicare Locals will then be delivered by ‘Primary Health Networks’. During fieldwork for the audit, the Department of Health advised that it had not yet been determined if immunisation support will be provided under the new model.

133 Human Services also advised the ANAO that it has undertaken a review of health provider education services available to providers, which includes the establishment of an annual work plan to enable BDOs to better plan their activities. While ACIR is not currently included in the 2014–15 work plan, it may be included in the 2015–16 plan.

134 All new on-going Human Services employees undertake a departmental induction program upon commencement with the department.

135 The buddy/mentor can either be the Technical Program Advisor (TPA) or an experienced staff member.

136 Call listening involves an experienced SO or TPA listening into telephone calls to check that SOs are following procedures.

137 This quality review is additional to the quality assurance process described in paragraph 3.62.

138 There are two TPAs located in Perth and one in Hobart.

139 The procedures note that the sample is calculated based on a two per cent error rate (plus or minus 0.5 per cent) and a 95 per cent confidence interval. Quality control checks on the manual entry of ACIR forms are conducted daily by the TPAs. The difference in the number of forms quality checked for Perth and Hobart reflects the volume and complexity of work performed by each processing centre.

140 Errors identified in the Quality Control process are categorised as either a critical error or a non-critical error. A critical error is defined as an error where there is a potential risk to the business process affecting the accuracy of payments, registrations or information to Human Services or its customers, or a risk to Human Services’ reputation. A non-critical error is defined as an error where there is no identifiable risk to a business process or Human Services’ reputation. Non-critical errors are recorded as part of the quality control process, however only critical errors are used to calculate the accuracy of processing result.

141 The department fielded almost 390 000 telephone calls related to the ACIR in 2013–14. Approximately 342 000 calls were answered in 2011–12 and 327 000 calls were answered in 2012–13.

142 As discussed in paragraphs 3.17 and 3.30, manual processes are used to overcome shortcomings resulting from the limited interoperability of ICT systems used to exchange information with the Register.

143 These reports provide the quality control results for the program by form type at a national level, as well as a comparison of the performance of all Medicare programs.

144 As part of the Australian Government’s immunisation policy announcement in April 2015, providers will be able to receive an additional incentive payment when they identify and catch up a child who is more than two months overdue for a vaccination.

145 Due to an existing arrangement, some community providers in the Northern Territory are paid quarterly through the Northern Territory Department of Health, rather than to individual providers. Human Services has established procedures to assist staff when undertaking this process.

146 The department advised that for the period 2010–11 to 2013–14, a total of $90 was returned by providers who identified they had been overpaid. No payments were recovered by the department.

147 Information Payment Statements are produced in hardcopy, and the last monthly statement is available on the ACIR secure site for providers with approved access to the site. These statements outline: each child in their care who received an immunisation service; the date the service was performed; the vaccines given and the dose number; which vaccines the provider was paid for; and an explanation code for any vaccines for which the provider did not receive payment. The statement may also contain information that the provider needs to clarify before the immunisation can be processed in ACIR.

148 See paragraphs 3.37 to 3.38 and Recommendation 2 of this audit report.

149 As noted in Chapter 3, registration on ACIR is automatic once a child under seven years is enrolled in Medicare or once ACIR receives immunisation information from a provider.

150 Personal information is information or an opinion about an identified individual or an individual who is reasonably identifiable. Sensitive information is a type of personal information and includes health information. The APPs place more stringent obligations on handling ‘sensitive information’.

151 The ANAO’s performance audit of the Integrity of Medicare Customer Data, tabled in April 2014, included an examination of Human Services’ management of the privacy of Medicare customer data including: the department’s privacy policies and procedures; compliance with legislative and policy requirements; and privacy training and awareness activities. The audit concluded that overall, Human Services has a comprehensive framework for managing Medicare customer privacy. See ANAO Audit Report No.27 2013–14, Integrity of Medicare Customer Data, p. 89.

152 Human Services Privacy Policy p. 9 at http://www.humanservices.gov.au/corporate/publications-and-resources/privacypolicy [accessed 16 October 2014].

153 Human Services advises parents that they are able to access their child’s IHS until the child turns 14; alternatively, they may contact ACIR if they require a statement for a child over 14 years of age. The retention of information on ACIR after a child turns 14 is implicit in information on the website about IHS. http://www.humanservices.gov.au/customer/services/medicare/australian-childhood-immunisation-register [accessed 5 November 2014].

154 The Privacy Policy does note that Centrelink information will be disclosed to ACIR.

155 Human Services advised the ANAO that the majority of staff working on the ACIR program had recently completed this training, with the exception of some staff absent due to leave arrangements, which will be addressed as the individuals return from leave.

156 An IHS can still be accessed electronically or on request after a child turns seven, as the information remains on the system. Once a child turns 14 years of age, the IHS can only be obtained by contacting ACIR. Human Services advised the ANAO that providers are unable to access reports for children over the age of seven; requests for statistical data for children over the age of seven are managed in accordance with the External Request Evaluation Committee process—see paragraphs 4.34 to 4.37.

157 Part IVA, s46A in definition of ‘information relating to a child’s Australian immunisation encounter’, and in ss46E(1)(d) and (e).

158 For example: currently, a child must be fully immunised (or have an approved exemption) to satisfy one of the eligibility requirements for Child Care Benefit and Child Care Rebate; in addition, for a parent to be eligible for the Family Tax Benefit Part A supplement, their child must be fully immunised (or have an approved exemption) for the financial years in which the child turns one, two and five.

159 Based on a set of data matching criteria.

160 As noted in Chapter 3, there are currently no quality control processes in place for ACIR-MCD and Pend manual reconciliation activities.

161 Human Services advised the ANAO that this is a multi-step process which involves a systems’ data matching exercise to confirm the ACIR/ISIS link for each record and to confirm that individuals’ immunisation status is consistent between the two systems. Once this process has been undertaken, for records that are not linked or have an inconsistent immunisation status, a further systems process is undertaken to refresh the ISIS database to rectify these potentially anomalous records and try to re-establish the link. To reduce the risk that a customer’s payment may be affected, once a mismatch is identified, Human Services advises the customer to contact the department in order to confirm the accuracy of a child’s information, including their immunisation status.

162 If a child has a medical contraindication recorded in ACIR, this is also included on the IHS. At the time of the audit, for children that have a conscientious objection recorded, milestone statements are not automatically generated, however if the child has received one or more immunisations, a statement can be requested.

163Health Insurance Act 1973, clauses 46E(1)(b) and 46E(1)(e). These legal requirements continue after the individual ceases to be a ‘provider’.

164 This is done using a Public Key Infrastructure (PKI) certificate.

165 For providers who are de-registered with Medicare (for example in the case of retirement of a provider), their ‘end-date’ in Medicare will be updated in ACIR and the provider will no longer have access to ACIR from that date.

166 The range of de-identified statistical reports providers can access is based on their provider type.

167 Human Services may also conduct mailouts on behalf of external organisations that utilise ACIR data. For example, an ongoing monthly mailout commenced in January 2014, undertaken on behalf of a state health department, where information is sent to parents of newborns in that jurisdiction each month communicating the risks of whooping cough and measures to reduce the risk of contracting the disease. Human Services advised that this type of request does not require EREC approval, as the department had already obtained approval from Health and the department’s relevant privacy area.

168 These tests include: a purpose test; an anonymity test; a consent test; a secrecy provisions test; and a Privacy Act test.

169 The bilateral agreement contains an Information Management and Release Protocol, signed on 1 November 2012. This Protocol introduced the requirement for Health to be a standing member on EREC and to give final approval for the public release of information or data, based on a recommendation from EREC.

170 Human Services advised the ANAO that EREC Minutes and Determinations are the primary form of documenting EREC decisions.

171 The EREC Terms of Reference require the committee to examine each request and assess the extent of compliance with relevant legislation and other internal guidelines; however the EREC Minutes examined by the ANAO did not specify which of the tests in the Guidelines were considered relevant to each request nor did the Minutes demonstrate an assessment of each request against the relevant tests.

172 External stakeholders are provided with the department’s guide, Understanding the Department of Human Services Statistical Information, as well as sample documents. The guidance document outlines: the type of information that may be requested and any limitations; privacy considerations; potential costs for data that is not publicly available; and the request process.

173 Department of Human Services, Understanding the Department of Human Services Statistical Information, March 2013, p. 5.

174 The EREC Guidelines note that there may be a cost to applicants to produce data that is not publicly available. Human Services advised the ANAO that costs to applicants are recovered in line with Australian Government Cost Recovery Guidelines. The amount charged to applicants is based on three components: 1) administration - a flat fee for the assessment and processing of an application; 2) extraction – includes a fee for time and materials for data request clarification, extraction of data and quality assurance; and 3) clearance – a flat fee for approval to release data and invoicing activities.

175 Human Services advised the ANAO that prior to the department’s 2014 review, the ACIR program did not have a formal process to routinely review ACIR internal access privileges, although some ad hoc reviews had been undertaken as an internal governance measure.

176 Requirements for Australian Government entities to protect the security and privacy of sensitive and personal information are set out in the Australian Government Information Security Manual (ISM) and the Privacy Act 1988.