State of New YorkOffice of the State ComptrollerDivision of Management Auditand State Financial Services

H. Carl McCall

Comptroller

NEW YORK CITY DEPARTMENT OFHEALTH

CONTROLS OVER VITAL RECORDS

REPORT 99-N-6

State of New YorkOffice of the State Comptroller

OSC Management Audit reports can be accessed via the OSC Web Page : http://www.osc.state.ny.us.If you wish your name to be deleted from our mailing list or if your address has changed, contact the Management Audit Group

at (518) 474-3271 or at the Office of the State Comptroller, Alfred E. Smith State Office Building, 13th Floor, Albany, NY 12236.

Division of Management Audit andState Financial Services

Report 99-N-6

Neal L. Cohen, M.D.CommissionerNew York City Department of Health125 Worth StreetNew York, NY 10013

Dear Dr. Cohen:

The following is our audit report on the evaluation of internal controls overvital records at the Office of Vital Records of the Department of Health.

This audit was performed pursuant to the State Comptroller’s authority asset forth in Article V, Section 1 of the State Constitution; Article II,Section 8 of the State Finance Law; and Article III of the GeneralMunicipal Law. Major contributors to this report are listed in AppendixA.

May 25, 2000

Scope of Audit

Executive Summary

New York City Department of HealthControls Over Vital Records

The New York State Department of Health is responsible for the registra-tion of all vital events that occur in the State, outside of New York City(City). The Office of Vital Records (OVR) within the New York CityDepartment of Health (DOH) is responsible for the registration, issuance,archival and maintenance of the birth and death certificates for the City.DOH reported total expenditures of $465 million for the fiscal year endedJune 30, 1999, with an employee headcount of 2,915.

Original birth and death documents are generally prepared by authorizedagents (e.g., physicians, hospital staff, funeral directors) and filed with theOffice of Vital Records, where they are indexed, recorded and stored.OVR provides certified copies of vital records at a cost of $15 each tothose who request them in person, by mail or via telephone. For the fiscalyear ended June 30, 1999, OVR reported revenues of $10.9 million fromthe issuance of birth and death certificates. As of August 1999, OVR’sstaff consisted of 115 employees. For the 19 months that ended on July 31,1999, OVR officials reported that they had registered 195,162 births and97,974 deaths. For the same period, OVR reported that certified copiesof 508,402 birth certificates and 623,164 death certificates were issued.

For the period of January 1, 1998 to July 31, 1999, we evaluated theinternal controls over vital records, namely birth and death certificates,administered by OVR. Our performance audit addressed the followingquestions:

! Has the Office of Vital Records established an adequate system ofinternal controls over the reporting, registration, processing andsafeguarding of the vital records for which it is responsible?

!! Does the Office of Vital Records register and process all vitalrecords accurately and properly?

This audit was suspended in 1997 when our staff was asked to leave theaudit site by DOH management. At that time, the City of New Yorkchallenged the Comptroller’s legal authority to conduct non-financial auditsof City agencies. The Comptroller’s authority to conduct these audits wasconfirmed by the New York Court of Appeals in a decision rendered April1, 1999.

Audit Observationsand Conclusions

Effective controls over vital records are important in society to provide alegal record of births and deaths, to collect medical and demographicinformation in support of health programs, and to guard against the misuseof vital records to perpetrate identity fraud. However, we found severalweaknesses in DOH’s controls over the reporting, registering andprocessing of vital records that increase the risk that the reported numberof the City’s birth and death records may not be accurate or complete. Inaddition, we found that the vital records at the Brooklyn and Queens sitesmay not be adequately safeguarded.

For one month that we sampled (April 1998), hospitals and birthing centersreported 239 fewer births than DOH reported as registered. As a result,DOH could not be reasonably assured that the number of registered birthsit reported for that month is accurate and reliable.

Also, our analysis of the birth registration database revealed that in the firstseven months of 1999, DOH reported 70,910 registered births, while thedatabase showed 70,872 births, a difference of 38 births. According toDOH officials, these differences will be corrected once “the 1999 file isclosed in June 2000.” However, until that time, the 1999 database may notbe totally accurate or reliable.

Birth certificate numbers are supposed to be assigned in sequential orderand entered onto DOH’s birth registration database. We found that forbirths occurring late in the year and filed in the subsequent year, the birthcertificate numbers were assigned out of sequence; and that gaps in thenumbering sequence are created when birth records are rejected beforethey are inputted onto the system. This increases the risk that DOH maynot have full accountability over all the birth certificate numbers.

We also found that 36,365 (18.6 percent) of the 195,036 registered birthsduring our audit period had been registered more than 10 days after theactual births, which exceeds the maximum of 5 business days required bylaw. Of these, 115 of the births had been registered more than 100 daysafter the child was born. The long delays in registering births make itdifficult for the public to obtain certified copies of birth certificates on atimely basis. (See pp. 7-10)

We found a lack of documentation supporting OVR’s issuance of certifiedcopies of birth certificates, which increases the risk that unauthorizedindividuals can obtain copies of vital records. For example, 8 of the 27applications for vital records that we sampled were missing, and there wasno evidence that applicants provided the required evidence of identity forthe other 19 applications. (See p. 12)

We also found that OVR does not keep a log of voided death certificates;nor does it maintain adequate records for the voided birth certificates. Inaddition, we found that 93 (23 percent) of 407 death certificates voided inFebruary 1999 had not been voided properly, increasing the risk that suchcertificates could have been used for illegal purposes. (See pp. 14-15)

Comments of DOHOfficials

We also found poor fire prevention controls at DOH’s storage locations inBrooklyn and Queens, where certain vital records are kept. As a result,there is a significant risk that original copies of vital records stored at theselocations could be destroyed by fire, causing great inconvenience to thepublic. (See pp. 15-16)

We made 11 recommendations to DOH officials to address the weaknesseswe identified in our report.

In response to our draft report, DOH officials generally agreed with therecommendations made in this report and indicated that they have eitherimplemented or are in the process of implementing them. However, theydisagreed with the audit’s conclusions concerning “potential risks to theaccuracy and completeness of birth and death records.” A complete copyof DOH’s response is included as Appendix B to this report.

Introduction

Controls Over VitalRecords

Appendix A

Appendix B

Contents

Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1Audit Scope, Objectives and Methodology . . . . . . . . . . . . . . . . . 2Response of DOH Officials to Audit . . . . . . . . . . . . . . . . . . . . 4

Birth Registration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11Processing of Birth Certificates . . . . . . . . . . . . . . . . . . . . . . 12Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13Death Registration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13Controls Over Voided Certificates . . . . . . . . . . . . . . . . . . . . . 14Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15Physical Controls at DOH Storage Sites . . . . . . . . . . . . . . . . . 15Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16Procedures Manual . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16Recommendation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

Major Contributors to This Report

Response of New York City Department of Health Officials

Background

Introduction

New York’s Vital Records Registration System (System) began in 1880 whenthe State Legislature created the State Board of Health. The System wasestablished out of a need to provide a legal record of births and deaths andto collect medical and demographic information in support of public healthprograms. Article 41 of the New York State Public Health Law providesthat the New York State Department of Health is responsible for theregistration of all vital events that occur in the State, outside of New YorkCity (City). Title V of the New York City Health Code contains provisionsfor the reporting of specified vital events — that is, births, fetal deaths andother deaths — in the City. Pursuant to the New York City AdministrativeCode, the Office of Vital Records (OVR) within the New York CityDepartment of Health (DOH) is responsible for the processing, registration,issuance, archival and maintenance of the City’s birth and death certificates.For the fiscal year ended June 30, 1999, DOH reported total expenditures of$465 million, with an employee head count of 2,915.

OVR comprises four primary work units: Registration, Public ServiceOperations, Records Management and Corrections. For the fiscal yearended June 30, 1999, OVR reported revenues of $10.9 million from theissuance of birth and death certificates. As of August 1999, its staffconsisted of 115 employees. For the 19 months that ended on July 31, 1999,OVR reported registering 195,162 births and 97,974 deaths. For the sameperiod, OVR reported that certified copies of 508,402 birth certificates and623,164 death certificates had been issued.

To register births, DOH uses the Electronic Birth Certificate (EBC) system,which allows hospitals and birthing centers to create an original birthcertificate and to transmit the required birth information electronically toDOH. Information on each birth is recorded by the hospital on a diskette,which is sent to OVR’s Registration Unit along with the original birthcertificates.

Individuals seeking copies of birth certificates can obtain them by makingrequests in person or by mail, telephone or fax machine. In January 1997, inan effort to provide better management and greater accountability, DOHimplemented its own computer application system, known as the CashManagement System (CMS), which interfaces with the City’s mainframecomputer system. CMS is used to print certified copies of the birthcertificates, issue receipts, sort the number of certificates issued daily bycashier ID number and workstation, and reconcile the cash received.

2

Audit Scope,Objectives andMethodology

The registration and issuance of death certificates is a completely manualoperation, and is handled by the Registration Unit. Death certificates areprepared by hospital staff members and funeral directors, who bring theoriginal death certificate to the Unit for registration. Unit personnel assigna number to each death, then register and record the death in a log book.Certified copies of the original death certificate are made on special pre-numbered blank paper with raised seals, which is pre-loaded into a photocopymachine.

The audit scope covered the period of January 1, 1998 to July 31, 1999. Thepurpose of this performance audit was to evaluate the internal controls overvital records — birth and death certificates — maintained by the New YorkCity Department of Health’s Office of Vital Records. We sought todetermine whether OVR maintains adequate controls over its handling of vitalrecords, and whether the records are being registered and processedaccurately and properly.

To accomplish these objectives, we selected a random sample of 25 out ofa population of 190,927 birth certificate numbers registered during our auditperiod and sought to verify that the original certificates, which have raisedseals, existed with the required information indicated, and that informationhad been recorded accurately in DOH’s Cash Management System (CMS).In addition, we selected a random month from that period (April 1998), andverified the accuracy of the number of registered births DOH had reportedthat month by comparing it with the number of births the hospitals andbirthing centers had reported on their transmittal sheets to the RegistrationUnit.

For another random month in our audit period (June 1999), we selected arandom sample of certified copies of 27 out of a population of 20,184 birthcertificates issued from the CMS system. We then sought to determinewhether the original certificates existed and whether the information on thecertified copies matched that on the original certificates. We also sought toverify that the required information was indicated on the applications filed forthe 27 certified copies and that the applicants had been authorized individuals.For the same month, we reconciled the amount of blank birth certificatepaper used with the number of certified copies of birth certificates issuedfrom one of eight CMS work stations.

Using a random month selected from the seven months in 1999 (February1999), we selected a random sample of 25 death certificate numbersregistered during that month and sought to verify that the original deathcertificates existed and that the required information was indicated on theoriginal certificates. We also sought to determine whether the deathcertificates voided during the month had been recorded and voided properly.

3

We also performed a limited general and application control review of theElectronic Birth Registration System, Cash Management System andCorrection Tracking System to determine the accuracy and reliability of thesesystems’ data.

As part of our audit, we performed an analytical review of the birthregistration database covering our audit period, using a computer-assistedaudit technique called Audit Command Language (ACL). In addition, weinterviewed agency officials and reviewed applicable laws, rules, regulations,policies and procedures.

Except as discussed in the following paragraph, we conducted our audit inaccordance with generally accepted government auditing standards. Suchstandards require that we plan and perform our audit to adequately assessthose operations of DOH which are included in the audit scope. Further,these standards require that we understand DOH’s internal control structureand compliance with those laws, rules and regulations that are relevant to theoperations which are included in our audit scope. An audit includesexamining, on a test basis, evidence supporting transactions recorded in theaccounting and operating records and applying such other auditing proceduresas we consider necessary in the circumstances. An audit also includesassessing the estimates, judgments and decisions made by management. Webelieve that our audit provides a reasonable basis for our findings, conclu-sions and recommendations.

As is our practice, we notified DOH officials at the outset of the audit thatwe would request a representation letter in which management providesassurances, to the best of their knowledge, concerning the relevance,accuracy and competence of the evidence provided to the auditors during thecourse of the audit. The representation letter is intended to confirm oralrepresentations made to the auditors and to reduce the likelihood ofmisunderstandings. Agency officials normally use the representation letterto assert that, to the best of their knowledge, all relevant financial andprogrammatic records and related data have been provided to the auditors.They affirm either that the agency has complied with all laws, rules andregulations applicable to its operations that would have a significant effect onthe operating practices being audited, or that any exceptions have beendisclosed to the auditors.

However, officials at the New York City Mayor’s Office of Operations haveinformed us that, as a matter of policy, Mayoral agency officials do notprovide representation letters in connection with our audits. As a result, welack assurance from DOH officials that all relevant information was providedto us during this audit. We consider this refusal to provide a representationletter to be a scope limitation on our audit. Therefore, readers of this report

4

Response of DOHOfficials to Audit

should consider the potential effect of this scope limitation on the findings andconclusions presented in the report.

We use a risk-based approach to select activities to audit. We focus ouraudit efforts on those activities we have identified through a preliminarysurvey as having the greatest probability for needing improvement.Consequently, by design, we use finite audit resources to identify where andhow improvements can be made. We devote little audit effort reviewingoperations that may be relatively efficient or effective. As a result, weprepare our audit reports on an “exception basis.” This report, therefore,highlights those areas needing improvement and generally does not addressactivities that may be functioning properly.

A draft copy of this report was provided to DOH officials for their reviewand comment. Their comments were considered in preparing this report andare included as Appendix B.

In response to our draft report, DOH officials stated that the audit identifiedsome operational findings and that they already implemented the recommen-dations. Department officials disagreed with the audit’s broad conclusionsconcerning “potential risks to the accuracy and completeness of birth anddeath records.” DOH officials also asserted that the audit report did not takeinto account how large data systems are created, modified and controlled.They stated that the audit’s use of discrepancies between preliminary andfinal numbers were not evidence of problems, but evidence of the normalprocess of reviewing and modifying the file.

As a result of our review of DOH’s response to the draft report and asubsequent meeting with DOH officials, we agreed with DOH’s position onseveral issues and made certain revisions to our report. For example, wedeleted our finding concerning differences between the number of birthsreported as registered in 1998 versus the number of births shown on thedatabase, because the DOH Vital Statistics book we used for comparativepurposes represented birth occurrences instead of birth registrations. Wemodified recommendation 2 regarding the accuracy of the birth registrationdatabase, by clarifying that our concern is with the timeliness of update ofdata. We deleted our finding related to OVR’s accountability over blankbirth certificate paper and the related recommendation 7. We also modifiedrecommendation 11 regarding the tracking of birth documents at the Queenslocation.

Notwithstanding the revisions we made to the draft report, the findings andrecommendations contained within this final report are valid and were agreedto by DOH officials. For example, we noted discrepancies between thenumber of birth certificates submitted for filing by hospitals and the number

5

of births registered by DOH for the month of April 1998. DOH officialsacknowledged that discrepancies existed between these records and statedthat OVR will consistently notate the disposition of each birth record on thehospital transmittal sheets. We also noted differences in the number ofregistered births reported by DOH and the number of births reflected on thedatabase in calendar year 1999. DOH officials acknowledged that the datado not match because of the process followed to close and cleanse thedatabase, including removal of duplicate entries. DOH officials stated thatthey will revise their procedures to identify duplicate entries quarterly,instead of once a year. For these and other reasons, such as the lack ofdocumentation supporting the issuance of copies of birth certificates,inadequate record keeping and lack of accountability over voided birth anddeath certificates, and poor physical controls over vital records at DOHstorage sites, we believe there is sufficient justification to conclude there arerisks that the reported number of City birth and death records may not beaccurate or complete, and that the vital records at the Brooklyn and Queensstorage sites may not be adequately safeguarded.

Within 90 days after the release of the final report, we request that theCommissioner of the New York City Department of Health report to theState Comptroller, advising what steps were taken to implement therecommendations contained in the report, and, where recommendations werenot implemented, the reasons therefor.

6

7

Birth Registration

Controls Over Vital RecordsThe responsibility for safeguarding vital records, namely birth and deathcertificates, is very important. Information contained in these records isnecessary for performing many functions in society, such as obtaining adriver’s license or applying for Social Security benefits; but when the wrongperson gains control of it, the result can be financially and emotionallydevastating. For example, fraudulently-obtained birth certificates can be usedto obtain Social Security cards or other documents with which to create afalse identity.

Thus, responsible government agencies must exercise adequate controls overvital records, so that they will be able to provide a legal record of births anddeaths, collect medical and demographic information in support of healthprograms, and guard against the misuse of vital records for identity fraud.However, we found weaknesses in DOH’s internal controls over thereporting, registering and processing of vital records that increase the riskthat the reported number of City birth and death records may not be accurateor complete. We also found that the vital records at the Brooklyn andQueens sites may not be adequately safeguarded.

The New York City Health Code requires that all live births occurring inNew York City on or after January 1, 1997, at facilities reporting 100 ormore live births per year, shall be reported to DOH electronically by meansof a computer program specified and provided or otherwise authorized foruse by DOH. At their election and upon approval by DOH, all facilitiesreporting a smaller number of live births per year may choose either toimplement an electronic birth certificate reporting system or to continuereporting births on approved paper forms. The New York City Health Codestates that births occurring in New York City shall be reported to DOH andfiled within five business days after birth.

DOH uses the Electronic Birth Certificate System (EBC) to register birthsin New York City. As of August 1999, there were 48 New York Cityhospitals, including 2 birthing centers that use the system. EBC was designedto improve the method of reporting births, reduce the number of birthcertificate errors, decrease the workload and improve OVR staff productiv-ity.

The hospital records information about each birth on a diskette that is sent toOVR’s Registration Unit along with the original birth certificate. Each timeOVR receives the diskette and certificates along with a transmittal sheet, anemployee is supposed to record in a log book the total number of birthcertificates received in the transaction. The number of original birth

8

certificates is then verified by comparison with amounts listed on theaccompanying transmittal sheet. If the birth information on the disketteagrees with that on the original birth certificate, the birth is then registeredand downloaded on to DOH’s computer system. If there is a discrepancy,DOH contacts the hospital to resolve the matter. Each birth is assigned abirth certificate number in numerical sequence. Subsequently, the birthregistration database is uploaded to the City’s mainframe computer systemlocated in Brooklyn.

Sample Review

We selected a random sample of 25 birth certificate numbers registeredduring our audit period and sought to determine whether the original birthcertificates existed and whether the information on the original certificateshad been recorded accurately in the CMS. Our review found no exceptions.

Reconciliation of Birth Certificate Registration

OVR is required to keep accurate records on all of the births it registers inNew York City. We selected a random month (April 1998) and sought todetermine whether the number of registered births DOH had reported forthat month was accurate. We found that, although DOH had reported 10,358registered births for that month, the supporting documentation did not agreewith that number. Rather, the hospitals and birthing centers’ transmittalsheets for that period showed 10,119 registered births, a difference of 239births. As a result, DOH could not be reasonably assured that the numberof registered births it reported for that month is accurate and reliable.

Analysis of the Birth Registration Database

We obtained a download of the birth registration database of all birthsregistered by OVR during the period of January 1, 1998 to July 31, 1999.When we analyzed the database comprising of 195,036 registered births usingthe Audit Command Language (ACL) program, we found the following:

! For the seven months in 1999, OVR reported 70,910 registeredbirths, compared to only 70,872 registered births recorded in thedatabase, a difference of 38 births.

In response to our draft report, DOH officials stated that until the1999 file is “closed,” the data are continually cleaned including theremoval of duplicates and the addition of late-filed certificates. Theyalso indicated that DOH has revised its procedures as of February14, 2000 and will identify duplicates quarterly, rather than once ayear.

9

! Although birth certificate numbers are supposed to be assignedsequentially for each birth registered, we found 57 gaps in thenumbering sequence for births registered during our audit period.

In response to our draft report, DOH officials indicated that 18 ofthese instances were due to births that occurred in 1997 but wereregistered late in 1998, and that this created the appearance of a gapof missing certificate numbers. However, upon our review, theyacknowledged that even though the certificate numbers wereaccounted for, they were assigned out of sequence.

DOH officials further stated that most of the other 39 gaps were dueto the expunging of a duplicate record or rejection of records pendingtheir replacement on the database system. They explained that thecertificate numbers for these records remain on their on-linedatabase system but were excluded from the database that wasprovided to us for our analytical review. However, they acknowl-edged that there were other instances where the birth records wererejected before they were data entered and that in these instances,the certificate numbers already assigned would not be on the databasesystem, thus creating a gap of missing numbers.

! Despite the City’s Health Code provision that requires hospitals andbirthing centers to file or register births with DOH within 5 businessdays after the baby is born, we found that 36,365 of the 195,036births (18.6 percent) had been registered more than 10 days after thebirth. Specifically, 115 of the births had been registered more than100 days after birth; 1 of these had been registered 3 years after thechild was born; and another had been recorded as being registered18 years after birth.

In response to our draft report, OVR officials stated that 31 of the115 births (29 home births and 2 foundlings {abandoned babies})were not filed through a hospital. They also indicated that the 18year-late birth registration was filed on time, but that a data entryerror occurred when the record was corrected and the file date wasinadvertently changed. They further stated that this error would havebeen corrected before the “1999 file was closed.”

According to DOH officials, OVR will increase the frequency ofreview of hospital filing time to monthly, and contact hospitals thatfile late with phone calls and letters.

10

! We found an invalid transaction for one birth. The database showeda registration date (6/29/99), which was 27 days before the date ofbirth (7/26/99).

In response to our draft report, OVR officials replied that there wasa key entry error in the birth date and that the original birth recordwas filed three days after the date of birth (6/26/99). They also statedthat this error would have been corrected before the “1999 file wasclosed.”

! There were 126 instances of individuals listed with the same name,birth date and registration date, but with different birth certificatenumbers and, in some instances, different institution codes.

In response to our draft report, OVR officials indicated that only 7of the 126 were duplicate entries; the remaining 119 comprisedunique records and multiple births (e.g., twins, triplets). Theyfurther stated that the seven duplicates were filed in 1999 (first sevenmonths) and that they would be removed from the 1999 database byJune 2000.

As a result, DOH does not have complete assurance that all City births arebeing registered and reported accurately. In addition, the long delays inregistering births have an adverse affect on the public because they make itdifficult to obtain certified copies of birth certificates on a timely basis.

11

Recommendations

1. Take appropriate steps to maintain accurate statistics regardingbirth registrations. On a test basis, verify the accuracy of birthregistration totals by comparing them with data reported on thetransmittal sheets submitted by hospitals and birthing centers.

(DOH officials replied that the notations made by OVR staff on thehospitals’ transmittal sheets indicating rejected certificates have notalways been consistently notated by staff. They further stated thatthey will train staff to accurately and consistently notate thedisposition of each birth record on the transmittal sheet as of April3, 2000.)

2. Update the birth registration database on a more timely basis.DOH should also ensure that all birth certificate numbers beaccounted for on their database system and be used in numericalsequence.

(DOH officials replied that the exceptions noted in 1999 will becorrected once “the 1999 file is closed in June 2000.” They furtherstated that new procedures were put in place on February 14, 2000to review and identify duplicates quarterly, instead of yearly.)

3. DOH should develop computer edit checks to prevent the inputtingof invalid transactions.

(DOH officials replied that full computer edit checks are built intoall vital records processing systems except the CorrectionsTracking System, which is a separate system that is scheduled to bereplaced.)

4. Enforce the requirement that births are to be registered within fivebusiness days after birth. Instruct the hospitals and birthing centersto submit birth documents on a timely basis.

(DOH officials replied that OVR will increase the frequency ofreview of hospital filing time to monthly. They also stated that “todate, OVR has visited 12 hospitals and anticipates improvement inhospital performance.”)

12

Processing of BirthCertificates

Individuals seeking copies of birth certificates can obtain them by makingrequests to OVR in person or by mail, telephone or fax machine. Eachcustomer is assigned a receipt number; and receipt-specific transactions arerecorded in CMS, which is used to print certified copies of the birthcertificates, issue receipts, sort the number of certificates issued daily byindividual work station and reconcile the cash received.

OVR’s Public Service Operations Unit (PSO) is responsible for issuingcertified copies of birth certificates to the public. It uses eight CMS workstations to handle customer requests.

Sample Review

For a randomly-selected month during our audit period (June 1999), weselected a random sample of certified copies of 27 birth certificates issuedfrom CMS. We determined that the original birth certificates did exist, andcompared the information on the originals with that recorded on CMS. Wefound no exceptions.

Applications for Certified Copies of Birth Certificates

OVR’s procedures generally state that, in addition to applying for a certifiedcopy of one’s own birth certificate, parents or guardians can apply for acertified copy of their child’s birth certificate. Applicants are required topresent a valid photo-identification, or two utility bills that show proof ofmailing address. In addition, OVR is required to retain for six months theapplications that were used to request such certified copies. We found thatOVR did not maintain adequate documentation to support the issuance of thecopies.

Our review of the applications pertaining to our random sample of 27 birthcertificates issued from CMS in June 1999 revealed the following:

! Eight (30 percent) of the 27 sampled applications could not be found.Therefore, we were unable to determine whether only authorizedindividuals had received certified copies of certain birth certificates.

! None of the 19 applications we found indicated that the applicant hadprovided the required identification (e.g., driver’s license). Withoutevidence that proper identification had been provided, DOH could notbe assured that the applicants had been entitled to receive certifiedcopies of the birth certificates.

13

Recommendations

5. Verify that applications for certified copies of birth certificates arebeing filled out and maintained properly.

(DOH officials replied that effective January 21, 2000, OVR beganusing a three-part form which ensures the proper filing of allapplications. They also stated that incomplete application formswill not be cashiered and that copies of applications will be retainedfor one year, an increase in the current retention period of sixmonths.)

6. Document the type of documents the applicant must provide whenrequesting a certified copy of a birth certificate.

(DOH officials replied that effective March 16, 2000, cashiers willindicate on the application the type of identification presented toreceive a copy of a birth or death certificate.)

7. Recommendation deleted.

Death Registration OVR is responsible for registering and issuing certified copies of deathcertificates, as well as permits for burial, cremation and disinterment. It isalso responsible for the archival and maintenance of death certificates.

Operating with three shifts of employees who provide the service 24 hoursa day, 7 days a week, the Registration Unit is responsible for registering andissuing certified copies of death certificates to individuals who request them.During the period of January 1, 1998 to July 31, 1999, OVR reported 97,974registered deaths.

Death certificates are prepared by the hospitals and funeral directors, andare registered by OVR upon receipt. A death is registered when a funeraldirector brings in the death certificate, along with a burial permit to beregistered with the Registration Unit. The Unit maintains a log of all of thedeath certificates that have been registered, and assigns a certificate numberto each death certificate. The certificate is then forwarded to OVR’sRecords Management Unit for microfilming, after which it is placed in abinder for storage in DOH’s vault area. Death certificates from 1988 to thepresent are stored at DOH’s Central Office in Manhattan, while deathcertificates prior to 1988 are stored at a DOH facility located in Brooklyn.

14

Controls OverVoided Certificates

When a request for a certified copy is made, Unit staff conduct a physicalsearch for the original death certificate on file. Once found, the certificateis photocopied on pre-numbered blank death certificate paper that carries araised seal and is pre-loaded on to a photocopy machine.

Sample Review

Using a random month selected from the seven months in 1999 (February1999), we examined a random sample of 25 death certificate numbersregistered in an effort to determine whether the original death certificatesexisted and whether they contained all the required information. Our reviewfound no exceptions.

On occasion, a certified copy of a birth or death certificate may beunacceptable because the copy is damaged or is unclear. In such instances,the document is voided. OVR’s procedures require that a log be maintainedof such voided certificates and that voided certificates be clearly marked“void” and have their seals torn.

Voided Birth Certificates

OVR’s procedures require that data identifying the voided birth certificatesbe entered in a log book each day by the supervisor of the Public ServiceOperations Unit. The entry should contain the date of issue, date of voiding,date of birth, birth certificate number, blank certificate number and reasonfor the void.

Our review found that the log book maintained by the PSO Unit had not beenfilled out properly. We found that all of the voided birth certificates had notbeen recorded in the log book, and that some of these certificates had notbeen marked “VOID.” Nor were Unit personnel recording the actual datethe void occurred or the reason for the void. The only date recorded was thedate the certificate was issued. As a result, OVR could not be assured thatall voided birth certificates were accounted for; and there was a greater riskof impropriety because some of the certificates had not been voided properly.

Voided Death Certificates

We found that, because the Registration Unit does not maintain a log forvoided death certificates, OVR is unable to account for all death certificatesthat have been voided.

Also, our review of 407 voided death certificates for our sampled month(February 1999) found that 93 certificates (23 percent) had not been voidedproperly. In all of these 93 cases, either the certificate was stamped

15

Recommendations

8. Maintain proper and accurate records for voided birth and deathcertificates.

(DOH officials replied that effective January 31, 2000, OVRstandardized the recording of voided birth and death certificates inlogs that list the certificate number, the reason for the void, the datevoided and the date recorded. They also stated that PSO staff arealso recording the voids in certificate number order, which willmake it easier to locate voided certificates.)

9. Void all birth and death certificates properly.

(DOH officials replied that effective January 31, 2000, OVRstandardized the method to void documents as follows: the seals aretorn and both the body of the document and the seal are stamped“void.”)

Physical Controls atDOH Storage Sites

“VOID” or the seal was torn or mutilated, but not both. As a result, therisk increases that the certificates could be used for illegal purposes.

Original birth and death documents are stored primarily at three DOHlocations — the Central Office in Manhattan, and other offices in Queens andBrooklyn. We found that physical controls were adequate at the CentralOffice, where birth certificates dating from 1935 to the present and deathcertificates dating from 1988 to the present are stored in a vault area.However, we found weaknesses in controls at the Queens and Brooklynlocations.

The Queens location is used to store sealed birth documents. These recordsare kept in a two-level vault area where neither a sprinkler system nor a fireextinguisher had been installed. Just one smoke detector had been installedon one level.

We found that information on the retrieval and return of birth documents isrecorded on loose sheets of paper that are kept in a file. If these sheets arelost or misplaced, then accountability over these birth documents would becompromised.

Birth certificates dating from 1910 to 1934 and death certificates dating fromyears prior to 1988 are stored in a vault at the Brooklyn location. At this

16

Recommendations

10. Safeguard the vital records by installing adequate fire preventionmeasures at the Queens and Brooklyn locations.

(DOH officials replied that fire prevention measures wereenhanced on January 11, 2000, in that four additional fireextinguishers were installed for a total of eight at the Brooklyn site,and six fire extinguishers were placed at the Queens site in additionto a smoke detector already there.)

11. Record the retrieval and return of the sealed birth documents storedat the Queens location in a log book for better accountability.

Procedures Manual

location there were four fire extinguishers, however; we found no sprinklersystem or smoke detector in the storage area of the vault.

As a result of the poor fire prevention measures at the Queens and Brooklynlocations, there is a significant risk that the original vital records stored therecould be destroyed, causing great inconvenience to the public.

In response to our preliminary audit findings, OVR officials agreed that thesedeficiencies existed and expressed serious concerns regarding the inadequatefire detection measures at these locations.

Even though OVR comprises four units: Registration, Public ServiceOperations, Records Management and Corrections, it has not yet prepareda procedures manual for each one. It has procedures only for the PSO Unit,issued in August 1998. Such a manual would provide increased assurancethat all of OVR’s procedures are being applied consistently and implementedeffectively.

17

Recommendation

12. Prepare and issue written procedures that would cover all fourOVR units.

(DOH officials replied that procedures manuals for all of the OVRunits should be completed by April 2001.)

Appendix A

Major Contributors to This ReportKevin McCluneWalter MendelsonHoward FeigenbaumAlbert KeeCharles JohnsonArthur LebowitzSheila JonesRobert TabiDebra WolrichMarticia Madory

Appendix B

B-2

B-3

B-4

B-5

B-6

B-7

B-8

B-9

B-10