Zyra Kombëtare e Auditimit - Nacionalna Kancelarija Revizije

Kosovo National Audit Office

Pharmaceutical Stock Information Management System

2024 KS2024pharmaceuticalSIMS
SCALE
  • - The Pharmaceutical Stock Management System enables the management of the supply process of medicines and medicinal materials, starting from central level institutions to health institutions and up to distribution to the patient.
  • - Through this System, a total of 2 228 contracts for the supply of medicines and medical materials from both the essential and non-essential list, as well as donations, were managed between 2018 and 2023. The total value of contracts registered in PSMS exceedes 215 million euros.
  • - Over 6 million euros have been invested in expanding and improving hardware infrastructure across the territory of Kosovo, including healthcare systems and the Pharmaceutical Stock Management System.
COMPLIANCE FOCUS
  • - health laws
  • - data protection laws
  • - ministry regulations on organization
  • - electronic databases
  • - administrative instructions on health information systems
  • - the University Hospital statute
  • - feasibility studies for eHealth
  • - health ministry information circulars
  • - The criteria used in this audit are derived from the EUROSAI ITWG Active IT Audit Handbook, based on the IDI-WGITA IT Audit Handbook, standard operating procedures and MH informative circulars.
PERFORMANCE ASPECT
  • - management of the Pharmaceutical Stock System and security of information related to this system at the Ministry of Health, as well as the system’s utilization by public healthcare institutions in Kosovo;
  • - IT governance,
  • - information security
  • - application controls.
1. Responsibility - Tools

The Ministry of Health lacks adequate mechanisms for IT governance despite significant investments in expanding systems. Full implementation of the system has not been achieved by all pharmacies at various healthcare levels, up to the distribution of medicines to patients. There is a lack of clear responsibilities for managing the system , as well as IT policies and procedures. These shortcomings not only jeopardize the proper allocation of resources in investments, but also compromise the security of strategically important data for the Ministry.

2. Data - Recovery - Protection

The Ministry of Health has not taken appropriate actions regarding the information security of the Pharmaceutical Stock Management System. There is a lack of a risk management plan for information systems and inadequate controls for information security. Additionally, the ministry has not properly managed logical access to the system, implemented a confidentiality statement, or established a dual hardware infrastructure for data recovery in case of system interruptions. These deficiencies increase the risk to patient privacy protection, data integrity, and pose a threat of data loss and service disruption for patients.

The Pharmaceutical Stock Management System has deficiencies in data registration and report generation. The lack of connection with central systems increases the risk of inaccurate data placement, while the failure to set expiration date limits for accepted items and not adjusting report generation according to officials’ requests create extra work for officials and jeopardize the efficiency of medication use. Furthermore, the lack of technical measures in the system jeopardizes the protection of patients’ personal data.

Code (gexf) to continue analysis with GephiTerminology graph
svg
The items above were selected and named by the e-Government Subgroup of the EUROSAI IT Working Group on the basis of publicly available report of the author Supreme Audit Institutions (SAI). In the same way, the Subgroup prepared the analytical assumptions and headings. All readers are encouraged to consult the original texts by the author SAIs (linked).