Three out of a group of four health services whose disaster recovery preparations have been assessed by the Queensland Audit Office have only basic DR measures in place.
Only Metro South Health in South-East Queensland’s DR maturity was assessed as ‘Established’, which means the audit office considers it to have a comprehensive disaster recovery plan covering all its critical processes and that its DR plan is reviewed and tested annually.
Cairns and Hinterland Health and Hospital Service, Mackay Hospital and Health Services, and South West Hospital and Health Service only achieved a score of 1 (‘Basic’) on the capability maturity model used by QAO.
The audit found that the three health services “did not conduct business impact assessments to identify how long it would take to recover their systems, where they will do this, and what is an acceptable period for sustaining an outage”.
The audit office also found inadequate IT documentation and a lack of annual testing (or documentation of testing) of DR plans. In addition, agreements between the health services and the Department of Health were not updated to reflect IT systems supported by the department.
“These deficiencies mean that there is an increased risk that HHSs [hospital and health services] may not be able to recover critical IT systems within an acceptable time frame in the event of a disaster,” the report warned.
“While our review only sampled four of the 16 HHSs, we recommend that all HHSs assess the maturity of their IT disaster recovery capabilities, identifying areas for improvement, and initiate plans to implement these improvements.”
The report is based in an audit of the 2015-16 financial statements of the state’s hospital and health services. The report was tabled on 31 January.
Outdated financial system
The report also notes that the health services’ financial system, which is provided by the Department of Health, is no longer supported by SAP.
The department’s Finance and Materials Management Information System (FAMMIS) is based on a 19-year-old SAP offering — which hasn’t been supported for 10 years and is “experiencing performance and stability issues”.
“The database and operating system, which are critical components for operating the finance system, have also reached end of life and do not have vendor support,” the report notes. “DoH cannot upgrade these critical components because the finance system may not be compatible with newer versions.”
An attempt to replace the system in 2014-15 failed, costing around $37.56 million.
Funding for an updated SAP-based system was included in the 2016-17 state budget, with the project set to receive $105 million over three years.