This article has been migrated from an earlier version of the site and may display formatting inconsistencies.
Name and Constituency of Member of Parliament
Mr Chia Shi-Lu
MP for Tanjong Pagar GRC
Question No. 2682
To ask the Minister for Health in light of the recent incident concerning mistakes in computation for Community Health Assist Scheme (CHAS) subsidies (a) how often are audits conducted for individual clinics' CHAS-related accounts; (b) whether subsidy computations can be computed onsite so that patients can verify the amounts themselves; and (c) whether the Ministry will consider building in-house computation capabilities so that this task need not be outsourced.
Name and Constituency of Member of Parliament
Assoc Prof Walter Theseira
Nominated MP
Question No. 2683
To ask the Minister for Health in light of the IT error in the provision of CHAS subsidies (a) how frequently are checks for accuracy and reliability performed on such IT systems and how are these checks performed; (b) to what extent will the costs of incorrectly providing higher subsidy tiers be recoverable from the system vendor; (c) what are the principles determining which healthcare IT systems are outsourced; and (d) whether the outsourcing of means-testing IT systems will be reviewed so as to build key competencies within Government.
Name and Constituency of Member of Parliament
Assoc Prof Daniel Goh Pei Siong
Non-Constituency MP
Question No. 2684
To ask the Minister for Health concerning the computer system error resulting in inaccurate CHAS subsidies being given to 7,700 recipients (a) whether there was feedback by the recipients about the errors; (b) if so, how was the feedback responded to; (c) how was the computer system error discovered; and (d) what was the cost of the error to the Ministry.
Oral Reply
Background to Means Testing Error
1 The error occurred in the computerised means-test system that calculates the healthcare subsidy tiers which individuals are eligible for, based on their income information. This central system is owned by MOH and managed by our vendor NCS Pte Ltd.
2 On 16 Sep 2018, the system was migrated to a new Government data centre, due to the Government’s planned decommissioning of the old data centre where the system was originally located. One of the files uploaded by NCS to one of the servers during the migration was of a wrong version. As a result, healthcare subsidy tiers of some individuals were computed without the corresponding full income information.
3 The first run of CHAS means-tests after the system migration took place on 18 Sep. The first discrepancy in means-test results was identified by the CHAS processing team on 24 Sep, and NCS was immediately alerted. The team then subsequently identified five more cases between 9 Oct and 2 Nov, and alerted NCS on each occasion. Three of the six cases were applications that required some manual verification from the CHAS processing team, who detected the discrepancies. The other three cases were appeals from CHAS applicants. Two were assessed to be legitimate appeals for higher subsidies and were approved.
4 The majority of the affected individuals received higher subsidies and they do not need to return the subsidies disbursed. We estimate the amount to be about $2 million, and we are in discussions with NCS to recover the amount from them. Those who received lower subsidies will have the shortfall reimbursed, and their subsidies set to the correct levels going forward.
Checks on Means Testing System
5 Dr Chia Shi Lu and Assoc Prof Walter Theseira asked about the checks and audits on the system and means-test results.
6 To ensure the means-test status and healthcare subsidy levels are updated, a refresh of an individual’s data is automatically triggered every 2 years, or sooner should an individual requests for an updated means-test or makes an appeal. We agree with Dr Chia Shi Lu that it is useful to inform CHAS beneficiaries of their subsidies at each deduction so that they can also verify their subsidy levels and balances are accurate and updated. We plan to look into this during future rounds of system enhancements.
7 As for the means-test system, the regime of checks and audits are in line with overall Government IT Policies. These cover areas including software development, test management, systems resiliency and cybersecurity. Audits are conducted regularly. Recent audits on the means-test system include one by GovTech on IT management process compliance from Jul to Oct 2018, and another initiated by MOH on cybersecurity in Aug 2018.
8 Where changes or enhancements are made to the system, MOH adheres to the quality assurance process stipulated for Government agencies. This would include requirements on software component testing, end-to-end system integration testing, user acceptance testing, performance test, security test and production environment shakedown tests. For some systems, a set of transactions may also be performed at launch or migration to verify accuracy before going “live”. Additional monitoring may be undertaken during the initial period of time after going “live”.
9 The extent of testing in each case would depend on the assessed risk. The means-test system concerned is a mature system that has been running since 2012. Based on the scope of this migration, the tests and validations were scoped and performed accordingly. Thereafter, the means-test system was migrated to the new data center. Unfortunately, NCS deployed a wrong version of a software file to one of the servers in the new data centre. In other words, the scope of test and post production validation was appropriate in accordance to the project’s assessed risk but NCS deployed the wrong version of the file, instead of the one which had been tested, to one of the servers.
Outsourcing or In-House Development
10 Dr Chia Shi Lu and Assoc Prof Walter Theseira also raised questions on outsourcing versus in-house development.
11 To deliver digital solutions and deploy IT systems effectively, the Government adopts a mix of IT development approaches, including outsourcing, co-sourcing and in-sourcing. If the solution is commercially mature, Government agencies are more likely to outsource, so as to better manage cost and leverage on the capacity, competency and scale available in the market. Increasingly, the Government is also co-sourcing the development of critical systems with key vendors, to ensure high systems quality and reliability, as well as inter-operability across Government. Finally, full in-house development is done to develop capability which would enable us to develop software to better respond to our evolving policies and requirements.
12 In public healthcare, we take a similar approach. This allows us to move at the pace needed to support the volume of IT system requirements across the healthcare system, while ensuring that core capabilities continue to be developed internally.
13 As we tap on technological solutions to raise productivity and improve the provision of healthcare services and support to Singaporeans, we are keenly aware that system vulnerabilities and risk exist and have to be carefully managed. Where IT systems are outsourced to vendors, we also have to closely supervise their work, monitor their performance and manage vendor risks.
14 We constantly seek to improve our quality assurance frameworks and review IT processes and outsourcing. Following this incident, MOH has started a review of our testing and deployment processes to identify areas that can be further strengthened. For example, we will be implementing an independent Quality Assurance review for every major system change henceforth. We will also look into automating some parts of our testing and deployment processes, including the detection of anomalous transaction outcomes. We will continue to learn from our experiences to build a stronger and more robust system.