Health Articles

 

An audit report on pain management clinic registration at the texas medical board

John Keel, CPA
State Auditor
An Audit Report on Pain Management Clinic
Registration at the
Texas Medical Board
June 2013
Report No. 13-037
An Audit Report on
Pain Management Clinic Registration at
the Texas Medical Board
SAO Report No. 13-037 Overall Conclusion
The Texas Medical Board (Board) has designed and implemented processes for registering pain Background Information
management clinics since it was given responsibility for that function in fiscal year Texas Occupations Code, Chapter 167, (later recodified to Chapter 168) 2011. However, it should make improvements established certification and regulation to ensure that it registers pain management requirements for pain management clinics clinics in accordance with statutes, rules, effective September 1, 2010. According to Texas Occupations Code, policies, and procedures. Section 168.001, a pain management clinic is a publicly or privately owned facility for The Board should verify compliance with all
which a majority of patients are issued on a eligibility requirements prior to registering
monthly basis a prescription for opioids, benzodiazepines, barbiturates, or pain management clinics. The Board performs
carisoprodol, but not including suboxone. required background checks on the owners of Texas Occupations Code, Section 168.002, exempts certain medical practices—such as pain management clinics. However, it does not medical schools, hospitals, state and perform the required background checks on federally operated facilities, and clinics employees or persons with whom a clinic owned by medical practitioners who issue other forms of treatment including contracts who may prescribe, dispense, surgery—from pain management clinic administer, supply, or sell a controlled certification and regulation requirements. The Texas Medical Board (Board) issues certificates to physicians who apply for pain management clinic certificates and In addition, according to Texas Occupations meet the requirements. As of January 31, Code, Section 168.102, a pain management 2013, the Board had issued 445 pain clinic may not operate in Texas unless it is management clinic certificates; 330 of those clinics were still registered as of that owned and operated by a medical director who date. (See the map in Appendix 2 for the is a physician who practices in Texas. pain management clinics in each Texas However, the Board did not verify ownership for 41 (68 percent) of 60 pain management clinics that auditors tested. Title 22, Texas Administrative Code, Section 195.2, also requires that the Board's executive director either review an application for a pain management clinic certificate or refer the application to a committee of the Board for approval. However, 54 (90 percent) of 60 pain management clinic applications auditors tested had the required approvals, and the remainder did not. The Board should identify clinics that should be registered as pain management
clinics. The Board identifies potential pain management clinics that have not been
registered only if it receives a complaint. The Board should conduct other activities to enable it to identify pain management clinics that should be registered. For example, the Board should determine how data in the Department of Public Safety's prescription tracking system could be analyzed to determine This audit was conducted in accordance with Texas Government Code, Section 321.0132. For more information regarding this report, please contact Nicole Guerrero, Audit Manager, or John Keel, State Auditor, at (512) 936- An Audit Report on Pain Management Clinic Registration at the Texas Medical Board SAO Report No. 13-037 whether an unregistered clinic appears to be operating as a pain management The Board should ensure that pain management clinics whose certificates have
expired discontinue operating until their certificates are renewed. Texas
Occupations Code, Section 168.151, specifies that a pain management clinic may not operate until its certificate is renewed. As of January 31, 2013, 111 pain management clinics' certificates were delinquent, which means that their certificates had expired. The Board does not have information regarding whether those 111 pain management clinics are still operating. The Board should monitor compliance with personnel and patient care
requirements for pain management clinics it has registered. The Board does not
have a process to ensure that pain management clinics comply with certain personnel and patient care requirements for (1) the percent of time a medical director is on site, (2) the percent of patient file reviews medical directors should perform, and (3) the establishment of protocols and quality assurance procedures for pain management. Not monitoring compliance with those requirements increases the risk that pain management clinic owners may not be appropriately supervising staff and overseeing patient care. The Board should monitor the transfer or reassignment of pain management
clinic ownership. Auditors reviewed ownership information on the certificate
applications for a sample of 60 pain management clinics and could not validate that ownership had not changed for 22 (37 percent) of them. That increases the risk that a practitioner who has not been approved by the Board could be operating a pain management clinic. The Board should strengthen certain information technology controls. The
Board's general information technology controls generally ensure the reliability of the data in the systems that support the registration of pain management clinics; however, the Board should improve certain controls over access management, change management for the system the Board uses to track physician and staff data, and password management for all of its systems. Auditors communicated other, less significant issues to the Board separately in Summary of Management's Response
The Board agreed with the recommendations in this report. Summary of Information Technology Review
The audit work included a review of general controls for key information technology systems related to the registration of pain management clinics. As An Audit Report on Pain Management Clinic Registration at the Texas Medical Board SAO Report No. 13-037 discussed above, auditors identified weaknesses in access management, change management for the system the Board uses to track physician and staff data, and password management for all of the Board's systems. Summary of Objective, Scope, and Methodology
The objective of this audit was to determine whether the Board has designed and implemented effective processes and related controls to help ensure that it registers pain management clinics in accordance with applicable statutes, administrative rules, and Board policies and procedures. The scope of this audit included all pain management clinic certificates issued as of January 31, 2013. (Legislation requiring pain management clinics to be registered became effective September 1, 2010; however, the Board began registering pain management clinics in February 2010.) The scope also covered all of the Board's clinic training compliance audits completed as of March 19, 2013. The audit methodology included collecting and reviewing information that the Board used to register pain management clinics, reviewing clinic training documentation for compliance with personnel requirements, reviewing the Board's policies and procedures and applicable state laws and regulations, conducting interviews with Board management and staff, reviewing general controls over the Board's key systems, and performing selected tests and procedures related to the registration of pain management clinics. Auditors assessed the reliability of the data the Board used to approve pain management clinics for certification, which included spreadsheets, imaged clinic application records, as well as physician and midlevel data. Auditors determined that the data was sufficiently reliable for the purposes of this audit by (1) performing various data analysis techniques such as reviewing for missing data, reviewing for duplicate transactions, and comparing record totals; (2) reviewing supporting records in the Board's imaging system; and (3) reviewing query language used to extract data from the Board's licensing system.
Detailed Results
The Board Should Strengthen Controls Over Pain Management Clinic Registration . 1 The Board Should Monitor Pain Management Clinics' Compliance with Certain Requirements . 6 The Board Should Strengthen Certain Information Technology Controls . 10 Objective, Scope, and Methodology . 14 Map Showing the Number of Registered Pain Management Clinics in Each Texas County . 17 Texas Medical Board Organizational Chart . 18 Excerpts from the Texas Occupations Code and the Texas Administrative Code . 19 Detailed Results
Chapter 1 The Board Should Strengthen Controls Over Pain Management Clinic
The Texas Medical Board (Board) has designed and implemented processes for registering pain management clinics since it was given responsibility for that function in fiscal year 2011. However, the Board has not consistently ensured that it has registered pain management clinics in accordance with statutes, rules, policies, and procedures. Specifically, the Board should verify compliance with all eligibility requirements (through activities such as performing background checks on pain management clinic owners and staff and verifying pain management clinic ownership) prior to registering pain management clinics. The Board also should ensure that it reviews and approves applications for pain management clinic certificates in accordance with the Texas Administrative Code. In addition, the Board should develop a process to identify clinics that should be registered as pain management clinics. The Board should verify that pain management clinic owners and staff comply
with all eligibility requirements.
The Board does not consistently ensure that clinic owners and staff meet all eligibility requirements prior to issuing a pain management clinic certificate, as required by the Texas Occupations Code and the Texas Administrative Code. Owner Eligibility. Texas Occupations Code, Section168.102, requires that a pain
management clinic be owned and operated by a medical director who is a
physician who practices in Texas under an unrestricted medical license. In
addition, Texas Occupations Code, Section 168.201, includes requirements for
the regulation of pain management clinic owners (see text box on the next
page for additional details). Auditors tested a sample of 60 registered pain
management clinics for compliance with those requirements and Background Checks for
determined the following: Owner Eligibility
The background checks that the Board  For all 60 pain management clinic registrations tested, the Board had performs on pain management clinic performed required background checks and ensured that the licenses owners include, but are not limited to, criminal background checks of the medical directors were not restricted (see text box for details through the Department of Public on the background checks). However, while the Board performs Safety, checks on practitioners' required background checks on the medical directors of pain medical license status, and checks on practitioners' U. S. Drug Enforcement management clinics, it did not perform required background checks Agency and Department of Public on other physicians with an ownership interest until September 2012. Safety controlled substance An Audit Report on Pain Management Clinic Registration at the Texas Medical Board SAO Report No. 13-037  The Board did not verify pain management clinic ownership for 41 (68 percent) of the 60 pain management clinic registrations tested. Prior to January 2011, the Board had pain management clinics self-certify on their applications that they met ownership requirements. The 41 registrations for which the Board did not verify ownership were issued prior to January 2011. Staff Eligibility. Texas Occupations Code, Section 168.201, specifies
requirements for pain management clinic staff and persons with whom pain
management clinics contract for services (see text box). Excerpt from
However, the Board does not perform background checks or Texas Occupations Code,
collect information on pain management clinic staff to verify that Section 168.201
they are not practicing with restricted medical licenses. In June (a) An owner or operator of a pain management clinic, employee of the 2012, the Board began verifying compliance with continuing clinic, or a person with whom a clinic medical education requirements for pain management clinic contracts for services may not: owners and staff (see Chapter 2 for additional details). As part of (1) have been denied, by any jurisdiction, a license under which that process, the Board receives a list of all staff working at the the person may prescribe, pain management clinics. dispense, administer, supply, or sell a controlled substance; (2) have held a license issued by The Board collects information on pain management clinic staff any jurisdiction, under which the who have "delegation of prescriptive authority," which means person may prescribe, dispense, administer, supply, or sell a that they can issue prescriptions under the supervision of a controlled substance, that has physician licensed by the Board. From that information, auditors been restricted; or were able to identify 283 non-physician staff who work at pain (3) have been subject to disciplinary action by any licensing management clinics. Auditors conducted criminal background entity for conduct that was a checks for those 283 staff and determined that 32 (11 percent) of result of inappropriately prescribing, dispensing, them had information on their criminal background checks that administering, supplying, or would require the Board to determine whether they should be selling a controlled substance. prohibited from working at a pain management clinic. (b) have been convicted of, pled nolo contendere to, or received deferred adjudication for: Without performing checks for eligibility requirements on pain (1) an offense that constitutes a management clinic staff, the Board cannot ensure that those individuals are eligible to work and issue prescriptions at pain (2) an offense that constitutes a misdemeanor, the facts of which management clinics. relate to the distribution of illegal prescription drugs or a controlled The Board should approve applications for pain management clinic
certificates in compliance with the Texas Administrative Code.
Title 22, Texas Administrative Code, Section 195.2, requires the Board's executive director to either (1) review an application for a pain management clinic certificate and determine eligibility or (2) refer the application to a committee of the Board for review. However, 54 (90 percent) of 60 pain management clinic applications auditors tested had the required approvals, and the remainder did not. According to the Board, if there are no eligibility 1 The 283 non-physician staff whom auditors identified do not comprise the entire population of all non-physician staff working at pain management clinics in Texas. An Audit Report on Pain Management Clinic Registration at the Texas Medical Board SAO Report No. 13-037 issues for an application, an analyst at the Board can review and approve the application. Without proper approval, the Board cannot ensure that applicants meet the eligibility requirements. The Board should identify clinics that have not registered as pain management
clinics but should be registered as pain management clinics.
The Board does not have a process to identify clinics that have not The Department of Public
registered as pain management clinics but should be registered as Safety's Prescription Access in
pain management clinics. The Board identifies potential pain (PAT) System
management clinics that have not been registered only if it receives a complaint. However, the Board should conduct other activities to The Prescription Access in Texas (PAT) system is a secured, online enable it to identify clinics that should be registered as pain prescription monitoring program management clinics. managed by the Department of Public Safety that assists Texas health care and law enforcement professionals in The Board could use the Department of Public Safety's Prescription quickly identifying potential Access in Texas (PAT) prescription tracking system to help identify prescription drug abuse. The PAT system provides controlled substance unregistered pain management clinics (see text box for additional prescription dispensing history to details on that system). The PAT system contains information on authorized medical practitioners, Texas Medical Board investigators, controlled substance prescriptions such as the prescriber, drug name and law enforcement professionals. and dosage, issuing pharmacy, patient name, and date a prescription Access to the PAT system is statutorily restricted and is available was issued. Texas Health and Safety Code, Section 481.076, allows to practitioners and pharmacists who investigators for the Board to access the PAT system. The Board are inquiring about their patients and to various regulatory and law should determine how data in the PAT system, such as practitioners' enforcement personnel. prescribing history, could be analyzed to determine whether a clinic Authorized users can search the last 365 days worth of prescription may appear to be operating as a pain management clinic. dispensing history for schedule II–V controlled substances, 24 hours a day, Without a process to identify unregistered pain management clinics, 7 days a week, including patient prescription history and a physician's there is an increased risk that clinics could operate as pain own prescribing information. management clinics without being registered and monitored by the Source: Department of Public Safety. The Board should:  Ensure that clinics that apply for pain management clinic certificates meet all eligibility requirements in statute and the Texas Administrative Code.  Ensure that it approves applications for pain management clinic certificates in accordance with all requirements.  Develop and implement a process to identify clinics that should be registered as pain management clinics. This could include: An Audit Report on Pain Management Clinic Registration at the Texas Medical Board SAO Report No. 13-037  Having the Board's investigators analyze data in the Department of Public Safety's PAT system to determine whether that analysis could help the Board identify clinics that should be registered as pain management clinics.  Notifying new physicians of registration requirements and requesting that the physicians specify whether they intend to operate a pain management clinic. Management's Response
RECOMMENDATION 1:
The board should ensure that clinics that apply for pain management clinic certificates meet all eligibility requirements in statute and the Texas Administrative Code. Management Response:
Owner Eligibility
TMB agrees with the recommendation and has had a process in place to accomplish this since January 2011. TMB will continue its current process of performing required background checks on medical directors of pain management clinics as well as other physicians with an ownership interest in a clinic, at both initial certification and at renewal. TMB will also continue to verify clinic ownership at both initial certification and at renewal. Staff Eligibility
Related to the eligibility of staff who are licensed medical providers, TMB already receives criminal background information on the Physician Assistants from DPS and takes appropriate action related to that information and will continue to do so. Additionally, TMB will coordinate with other licensing boards to obtain available information on other licensed medical providers who are in a staff role, prior to issuance of a clinic's initial certificate for registration as well as renewal. The managers responsible for implementation are: Manager of Pre-Licensure, Registration, & Consumer Services (PRC) and Manager of Licensure. The estimated timeline for completion for the new processes is 9 to 12 months. RECOMMENDATION 2:
The board should ensure that it approves applications for pain management clinic certificates in accordance with all requirements. An Audit Report on Pain Management Clinic Registration at the Texas Medical Board SAO Report No. 13-037 Management Response:
TMB agrees with the recommendation and will return to a process of Executive Director approval for every clinic as part of the weekly file review process regardless of the complexity level of the application. It is important to clarify that the process of staff approval for clinic applications was limited to clinics that had no identifiable issues that required high level consideration. This was instituted for efficiency as the Executive Director is available to review files only once a week. The manager responsible for implementation is the Manager of Licensure. The estimated timeline for completion is one week. RECOMMENDATION 3:
The board should develop and implement a process to identify clinics that should be registered as pain management clinics. This could include:  Having the Board's investigators analyze data in the DPS's prescription tracking system to determine whether that analysis could help the Board identify clinics that should be registered as pain management clinics.  Notifying new physicians of registration requirements and requesting that the physicians specify whether they intend to operate a pain management clinic. Management Response:
TMB agrees with the recommendation and will work with DPS to determine any additional analysis that could be performed on prescription tracking system data in order to identify clinics. If there is any additional way to utilize this data, TMB will begin doing so. Additionally, TMB will: 1) add questions pertaining to pain management clinic registration to its Jurisprudence Exam which all physician and physician assistant applicants must complete and pass in order to be licensed; and 2) work to integrate pain management clinic registration with other TMB registrations, including physician and physician assistants in order to ascertain whether the licensees intend to operate a pain management clinic. These two items will help notify new applicants about the pain management clinic laws, as well as ensure that they can register easily if they intend to operate a clinic. The managers responsible for implementation are: Manager of Licensure, Manager of Pre-Licensure, Registration, & Consumer Services (PRC), and the TMB General Counsel. The estimated timeline for completion is one year. An Audit Report on Pain Management Clinic Registration at the Texas Medical Board SAO Report No. 13-037 Chapter 2 The Board Should Monitor Pain Management Clinics' Compliance with
Certain Requirements
The Board does not have procedures for and does not monitor pain management clinics' compliance with certain requirements. Specifically, the Board does not monitor pain management clinics with expired certificates, does not ensure that pain management clinics meet certain personnel and patient care standards, and does not periodically confirm that there have been no changes in pain management clinic ownership. The Board should ensure that pain management clinics with expired certificates
do not continue to operate.
Texas Occupations Code, Section 168.151, specifies that the owner or operator of a pain management clinic for which a certificate has expired cannot continue to operate the pain management clinic until the certificate is renewed. A pain management clinic has a 180-day grace period during which it can renew its certificate; however, it cannot continue to operate during that grace period. The Board does not ensure that pain management clinics with expired certificates discontinue operating until their certificates are renewed. As of January 31, 2013, 111 pain management clinics' certificates had expired. The Board did not have information regarding whether those 111 pain management clinics were still operating. Board investigators have access to the Department of Public Safety's prescription tracking system. That could enable them to analyze the prescribing history for practitioners at pain management clinics whose certificates have expired to assist in identifying whether those pain management clinics continue operating. The Board should ensure that pain management clinics comply with certain
patient care and personnel standards.
Excerpts from Title 22,
The Board does not monitor pain management clinics' Texas Administrative Code,
compliance with certain patient care and personnel Section 195.4
requirements in the Texas Administrative Code (see text box for The medical director of a pain management excerpts from those requirements, and see Appendix 4 for the full requirements). However, it started verifying compliance  Ensure that all personnel are properly licensed, if applicable, and have 10 hours with continuing medical education requirements for pain of continuing medical education training management clinic owners and staff as of June 2012. related to pain management.  Be onsite at the clinic at least 33 percent Standards to Ensure Quality of Patient Care Requirements. The Board
of the clinic's total number of operating does not monitor pain management clinics' compliance with  Review at least 33 percent of the total patient care requirements in the Texas Administrative Code, number of patient files of the clinic. including requirements for (1) the percent of time a medical  Establish protocols and quality assurance director must be on site, (2) the percent of patient file reviews that medical directors should perform, and (3) the establishment An Audit Report on Pain Management Clinic Registration at the Texas Medical Board SAO Report No. 13-037 of protocols and quality assurance procedures for clinic staff and for measuring medical and procedural outcomes and complications from treatments for pain management. The Board has statutory authority to inspect pain management clinics; however, it reported that it does not have the resources to perform those inspections and will inspect a pain management clinic only if the Board has received a complaint that results in an investigation. Personnel Requirements. In June 2012, the Board began verifying compliance
with continuing medical education requirements for physicians and staff at
pain management clinics that had renewed their certificates. It had not
verified pain management clinics' compliance with continuing medical
education requirements prior to that date. As of March 19, 2013, 108 pain
management clinics had renewed their certificates, and the Board had verified
compliance with continuing medical education requirements for 17 (16
percent) of those 108 pain management clinics.
The Board should confirm there have been no changes in pain management
clinic ownership.
Texas Occupations Code, Section 168.101, states that a certificate issued to the owner of a pain management clinic is not transferable or assignable. While the Board verifies ownership for pain management clinics that renew their certificates, it does that because it did not verify ownership for those pain management clinics when they initially registered with the Board. The Board does not have procedures to periodically confirm that pain management clinic ownership has not changed. According to Board investigative staff, one of the leading fraudulent activities involving pain management clinics is falsifying or changing pain management clinics' ownership after the initial application has been submitted and approved by the Board. Auditors reviewed ownership information on the certificate applications for a sample of 60 pain management clinics and could not validate that ownership had not changed for 22 (37 percent) of them. Not confirming that ownership has not changed increases the risk that a practitioner could be operating a pain management clinic without Board approval. The Board should:  Develop and implement a process to ensure that pain management clinics whose certificates have expired discontinue operating until their certificates are renewed. This may include using the Department of Public Safety's prescription tracking system to identify trends in prescriptions An Audit Report on Pain Management Clinic Registration at the Texas Medical Board SAO Report No. 13-037 issued by practitioners at pain management clinics whose certificates have expired.  Develop and implement a risk-based approach to monitoring pain management clinics' compliance with personnel and patient care requirements.  Periodically review pain management clinic ownership to confirm that ownership has not changed. Management's Response
RECOMMENDATION 1:
The board should develop and implement a process to ensure that pain management clinics whose certificates have expired discontinue operating until their certificates are renewed. This may include using DPS's prescription tracking system to identify trends in prescriptions issued by practitioners at pain management clinics whose certificates have expired. Management Response:
TMB agrees with the recommendation and will implement a process to ensure that clinics whose certificates have expired discontinue operating until their certificates are renewed. It is important to note that the TMB cannot rely on the DPS database alone; as it does not contain all the information necessary to determine whether a clinic must be registered. The new database, while a very useful tool, does not contain information about the type of practice a physician may have, how many total patients they have, etc. Specifically, a clinic could be at the top level of prescribers in the database, and yet meet one of the exemptions from registration allowed by the law. As such, much of this work will need to be accomplished by in person inspections. In the Legislative Appropriations Request for FY 14-15, TMB requested funding for five additional FTEs to perform certain statutorily authorized inspections including inspections of pain management clinics. The 83rd Legislature approved the request. Consequently, these new resources will be used to assist in monitoring clinics with expired certificates, as well as reviewing clinics' compliance with all other statutorily required criteria. The managers responsible for implementation are the following: Manager of Investigations; Manager of Litigation; and Manager of Compliance. The estimated timeline for completion for the new processes is one year from the effective date of the additional resources which would be September 1, 2014. An Audit Report on Pain Management Clinic Registration at the Texas Medical Board SAO Report No. 13-037 RECOMMENDATION 2:
The board should develop and implement a risk-based approach to monitoring pain management clinics' compliance with personnel and patient care requirements. Management Response:
TMB agrees with the recommendation and will implement a risk-based approach to monitoring pain management clinics' compliance with personnel and patient care requirements. This will require in person inspections to be conducted by the board. As stated in the response above to Recommendation 1, TMB has received additional resources and FTEs to inspect pain management clinics' compliance with statutorily required criteria, including personnel and patient care requirements. The managers responsible for implementation are the following: Manager of Investigations; Manager of Litigation; and Manager of Compliance. The estimated timeline for completion for the new processes is one year from the time the additional resources become available which would be September 1, 2014. RECOMMENDATION 3:
Periodically review pain management clinic ownership to confirm that ownership has not changed. Management Response:
TMB agrees with the recommendation and does periodically review clinic ownership to confirm that it has not changed. Currently this occurs every two years during the renewal of clinic registration. Additionally, TMB will use the new resources discussed in recommendation 1 to assist in these reviews. The managers responsible for implementation are the following: Manager of Pre-Licensure, Registration, & Consumer Services (PRC) and Manager of Licensure. The estimated timeline for completion for the new processes is one year from the time the additional resources become available which would be September 1, 2014. An Audit Report on Pain Management Clinic Registration at the Texas Medical Board SAO Report No. 13-037 Chapter 3 The Board Should Strengthen Certain Information Technology Controls
The Board should improve general controls over its information technology systems to ensure the reliability of the data in the systems that support the registration of pain management clinics. Specifically, the Board should strengthen certain controls over access management, change management for the system the Board uses to track physician and staff data, and password management for all of its systems. The Board does not periodically review user access.
Summary of Information
Title 1, Texas Administrative Code, Section 202.25, requires agencies to Security Standards
modify or remove user access when users' employment or job responsibilities change. In addition, the Board's policy requires that user access be reviewed Administrative Code, on a regular basis, as well as when a user's job status changes (for example, in Chapter 202, specifies security standards for all the case of a transfer, promotion, demotion, or termination of employment). However, the Board does not periodically review user access to its key  The Board's security systems and their associated databases and servers. As a result, auditors policies specify standards for all authorized users of identified weaknesses related to administrative user accounts and other user the Board's information accounts. Specifically:  The Board has a large number of users with administrative access to its systems and network. Administrative access generally provides users with widespread capabilities to extensively modify data and applications and to establish or remove other user accounts; therefore, administrative access should be assigned to system administrators who are responsible for managing an application. Assigning unnecessary administrative access increases the risk of unauthorized access and modification to the Board's systems.  Active user accounts still exist for former employees of the Board, certain service accounts exist but are no longer in use, and other user accounts have not been accessed in at least one year.  All users with access to pain management clinic data have "read" and "write" access to that data. This increases the risk that data could intentionally or unintentionally be modified or deleted without detection. The Board's change management practices do not follow certain Board policies
and best practices.
The Board has formal change management policies for the system it uses to track physician and staff data; however, it does not have written procedures for change management, and it does not maintain documentation to ensure that it appropriately documents, authorizes, and tests application changes prior to implementing those changes. The Board also does not limit the ability to An Audit Report on Pain Management Clinic Registration at the Texas Medical Board SAO Report No. 13-037 migrate changes to the production environment to appropriate personnel. Specifically:  The Board's change management policies and procedures do not include a detailed description of the process the Board will follow to review and approve an application change request. In addition, the Board does not maintain supporting documentation to show how application changes are requested, tested, and formally approved prior to implementation.  The Board documents application change requests on a spreadsheet; however, that spreadsheet does not record (1) the date on which a change request was submitted, (2) whether the test of the change was successful, and (3) the name of the individual who migrated the change to the production environment.  The Board does not appropriately restrict its programmers' access to production servers and databases to ensure that it protects information resources from improper modification. The Board's password settings do not comply with Board policies and best
practices.
Application, database, and Web password settings for key systems and the Board's licensure shared drive do not comply with Board policies and best practices. Specifically:  The Board has not configured controls that would enforce requirements for password complexity.  Password length and password history do not comply with best practices.  The Board does not enforce password setting requirements for Web access to one of its systems. The Board should:  Perform and document user access reviews at least annually to help ensure that it appropriately restricts access to its systems, databases, servers, and network drives.  Remove administrative access to the production server for employees who do not require that access to perform their job duties.  Document the process it will follow to review and approve application change requests. An Audit Report on Pain Management Clinic Registration at the Texas Medical Board SAO Report No. 13-037  Retain documentation for all changes to applications to record (1) the date on which change requests were submitted, (2) testing results for those changes, and (3) management's approval of those changes prior to migrating those changes to the production environment. The Board also should document the name of the individual who migrates a change to the production environment.  Implement segregation of duties so that programmers cannot both develop or change code and migrate that code to the production environment.  Implement password requirements that comply with the Board's policy and best practices for complexity, length, history, and requirements for Web access. Management's Response
RECOMMENDATION 1:
Perform and document user access reviews at least annually to help ensure that it appropriately restricts access to its systems, databases, servers, and network drives. Management Response:
TMB agrees with and will implement the recommendation to perform and document annual user access reviews. The estimated completion date is the 4th quarter of FY2013. The Manager of Information Technologies (IT) is responsible for implementation. RECOMMENDATION 2:
Remove administrative access to the production server for employees who do not require that access to perform their job duties. Management Response:
TMB agrees with and will implement the recommendation to remove administrative access to production servers. The estimated completion date is the 4th quarter of FY2013. The Manager of Information Technologies (IT) is responsible for implementation. RECOMMENDATION 3:
Document the process it will follow to review and approve application change requests. An Audit Report on Pain Management Clinic Registration at the Texas Medical Board SAO Report No. 13-037 Management Response:
TMB agrees with and will implement the recommendation to document the application change request process. The estimated timeframe for completion is 9 to 12 months. This recommendation will be completed in conjunction with recommendations 4 and 5. The Manager of Information Technologies (IT) is responsible for implementation. RECOMMENDATION 4:
Retain documentation for all changes to applications to record; the date on which change requests were submitted, testing results for those changes, and management's approval of those changes prior to migrating those changes to the production environment. The Board also should document the name of the individual who migrates a change to the production environment. Management Response:
TMB agrees with and will implement the recommendation to retain application change records. The estimated timeframe for completion is 9 to 12 months. This recommendation will be completed in conjunction with recommendations 3 and 5. The Manager of Information Technologies (IT) is responsible for implementation. RECOMMENDATION 5:
Implement segregation of duties so that programmers cannot both develop or change code and migrate that code to the production environment. Management Response:
TMB agrees with and will implement the recommendation to segregate development and production release functions. The estimated time frame for completion is 9 to 12 months. This recommendation will be completed in conjunction with recommendations 3 and 4. The Manager of Information Technologies (IT) is responsible for implementation. RECOMMENDATION 6:
Implement password requirements that comply with the Board's policy and best practices for complexity, length, history, and requirements for Web access. Management Response:
TMB agrees with and will implement the recommendation to ensure password requirements comply with agency policy and best practices. The estimated completion date is the 4th quarter of FY2013. The Manager of Information Technologies (IT) is responsible for implementation. An Audit Report on Pain Management Clinic Registration at the Texas Medical Board SAO Report No. 13-037 Appendix 1 Objective, Scope, and Methodology
Objective
The objective of this audit was to determine whether the Texas Medical Board (Board) has designed and implemented effective processes and related controls to help ensure that it registers pain management clinics in accordance with applicable statutes, administrative rules, and Board policies and procedures. The scope of this audit included all pain management clinic certificates issued as of January 31, 2013. (Legislation requiring pain management clinics to be registered became effective September 1, 2010; however, the Board began registering pain management clinics in February 2010.) The scope also covered all of the Board's pain management clinic training compliance audits completed as of March 19, 2013. Methodology
The audit methodology included collecting and reviewing information that the Board used to register pain management clinics, reviewing clinic training documentation for compliance with personnel requirements, reviewing the Board's policies and procedures and applicable state laws and regulations, conducting interviews with Board management and staff, reviewing general controls over the Board's key systems, and performing selected tests and procedures related to the registration of pain management clinics. Auditors selected a random sample from all pain management clinic certificates issued to test pain management clinic eligibility. The population of certificates was stratified by certificate status, and auditors randomly selected the sample by status type to ensure equitable coverage of each certificate status type (for example, active, delinquent, canceled, or suspended). Auditors also selected a random sample of active and delinquent certificates issued to test pain management clinic ownership. Auditors used non-statistical sampling methods to select the samples. The results from the samples selected cannot be projected to the entire population. Auditors assessed the reliability of the data the Board used to approve pain management clinics for certification, which included spreadsheets, imaged clinic application records, and physician and clinic staff with prescriptive delegation authority data. Auditors determined that the data was sufficiently An Audit Report on Pain Management Clinic Registration at the Texas Medical Board SAO Report No. 13-037 reliable for the purposes of this audit by (1) performing various data analysis techniques, such as reviewing for missing data, reviewing for duplicate transactions, and comparing record totals; (2) reviewing records in the Board's imaging system; and (3) reviewing query language used to extract data from the Board's licensing system. Information collected and reviewed included the following:  Pain management clinic certificates issued as of January 31, 2013.  Documentation in the Board's electronic imaging system that supported the applications for and registration of pain management clinics.  Information on clinic staff with prescriptive delegation authority from the Board's licensing system.  Examples of data in the Department of Public Safety's Prescription Access in Texas (PAT) system.  Documentation regarding pain management clinic ownership from the Office of the Secretary of State and the Office of the Comptroller of Public Accounts.  Documentation in the Board's electronic imaging system that supported the Board's monitoring of continuing medical education requirements for owners and staff at pain management clinics. Procedures and tests conducted included the following:  Interviewed management and key personnel at the Board.  Tested a sample of pain management clinics that had received certificates as of January 31, 2013, to determine whether those certificates were issued in compliance with applicable laws, statutes, and Board policies and procedures.  Analyzed licensing data to identify clinic staff with prescriptive delegation authority and who were associated with a pain management clinic.  Performed criminal background checks on clinic staff practitioners associated with pain management clinics.  Interviewed Department of Public Safety personnel regarding data captured in its PAT system.  Tested a sample of pain management clinics to determine whether ownership had been transferred or reassigned. An Audit Report on Pain Management Clinic Registration at the Texas Medical Board SAO Report No. 13-037  Reviewed Board processes for monitoring pain management clinic compliance with requirements for personnel and standards of patient care.  Reviewed general controls for the Board's key systems, which included reviewing controls related to user access, change management, passwords, backup, disaster recovery, and physical security over the Board's systems. Criteria used included the following:  Board policies and procedures for registering and monitoring pain management clinics.  Board security policies.  Texas Occupations Code, Chapter 168.  Title 22, Texas Administrative Code, Chapter 195.  Title 1, Texas Administrative Code, Chapter 202. Project Information
Audit fieldwork was conducted from February 2013 through April 2013. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. The following members of the State Auditor's staff performed the audit:  Kristyn H. Scoggins, CGAP (Project Manager)  Stacey Williams, CGAP (Assistant Project Manager)  Courtney Ambres-Wade, CGAP  W. Chris Ferguson, MBA, CIDA  Marlen Randy Kraemer, MBA, CISA, CGAP  Namita Pai, CPA  J. Scott Killingsworth, CIA, CGAP, CGFM (Quality Control Reviewer)  Nicole M. Guerrero, MBA, CIA, CGAP, CICA (Audit Manager) An Audit Report on Pain Management Clinic Registration at the Texas Medical Board SAO Report No. 13-037

Appendix 2 Map Showing the Number of Registered Pain Management Clinics in
Each Texas County
Figure 1 shows the number of registered pain management clinics in each Texas county as of January 31, 2013. Five counties—Harris, Dallas, Tarrant, Bexar, and Travis counties—had 62 percent of the registered pain management clinics in the state. Harris County had 121 pain management clinics or 37 percent of the registered pain management clinics in the state. Registered Pain Management Clinics in Each Texas County as of January 31, 2013
Source: Prepared for the State Auditor's Office by the Texas Legislative Council based on information from the Texas An Audit Report on Pain Management Clinic Registration at the Texas Medical Board SAO Report No. 13-037

Appendix 3 Texas Medical Board Organizational Chart
Figure 2 presents the Texas Medical Board's organizational chart. Texas Medical Board Organizational Chart
Source: Texas Medical Board. An Audit Report on Pain Management Clinic Registration at the Texas Medical Board SAO Report No. 13-037 Appendix 4 Excerpts from the Texas Occupations Code and the Texas
Administrative Code
Table 1 presents excerpts from the Texas Occupations Code and the Texas Administrative Code. Excerpts from the Texas Occupations Code and the Texas Administrative Code
Citation
Certificate Application Texas Occupations Code, (a) A physician who owns or operates a pain management clinic shall apply for a certificate for the clinic under this chapter. A pain management clinic must be owned and operated by a medical director who is a physician who practices in this state under an unrestricted license. (b) An applicant for a certificate under this chapter must submit an application to the board on a form prescribed by the board. (c) The board shall issue a certificate if the board finds that the pain management clinic meets the requirements of this chapter and the standards adopted by the board under this chapter. Regulation of Person Texas Occupations Code, (a) The owner or operator of a pain management clinic, an Affiliated with Clinic employee of the clinic, or a person with whom a clinic contracts for services may not: (1) have been denied, by any jurisdiction, a license issued by the Drug Enforcement Agency or a state public safety agency under which the person may prescribe, dispense, administer, supply, or sell a controlled substance; (2) have held a license issued by the Drug Enforcement Agency or a state public safety agency in any jurisdiction, under which the person may prescribe, dispense, administer, supply, or sell a controlled substance, that has been restricted; or (3) have been subject to disciplinary action by any licensing entity for conduct that was a result of inappropriately prescribing, dispensing, administering, supplying, or selling a controlled substance. (b) A pain management clinic may not be owned wholly or partly by a person who has been convicted of, pled nolo contendere to, or received deferred adjudication for: (1) an offense that constitutes a felony; or (2) an offense that constitutes a misdemeanor, the facts of which relate to the distribution of illegal prescription drugs or a controlled substance as defined by Texas Occupations Code §551.003(11). (a) Application for Certification. Administrative Code, (2) Determination of Eligibility by the Executive Director. The executive director shall review applications for certification and may determine whether an applicant is eligible for certification or refer an application to a committee of the board for review. An Audit Report on Pain Management Clinic Registration at the Texas Medical Board SAO Report No. 13-037 Excerpts from the Texas Occupations Code and the Texas Administrative Code
Citation
Operation of Pain (e) Personnel Requirements. The medical director of a pain
Management Clinics Administrative Code, management clinic must, on an annual basis, ensure that all personnel are properly licensed, if applicable, trained to include 10 hours of continuing medical education related to pain management, and qualified for employment consistent with §195.2(b)(1) of this title.
(f) Standards to Ensure Quality of Patient Care. The medical
director of a pain management clinic shall: (1) be on-site at the clinic at least 33 percent of the clinic's total number of operating hours; (2) review at least 33 percent of the total number of patient files of the clinic, including the patient files of a clinic employee or contractor to whom authority for patient care has been delegated by the clinic; (3) establish protocols consistent with Chapter 170 of this title (relating to Pain Management); and (4) establish quality assurance procedures to include at a (A) a practice quality plan that requires the medical director to complete at least 10 hours of continuing medical education in the area of pain management; (B) documentation of the background, training, and certifications for all clinical staff; (C) a written drug screening policy and compliance plan for patients receiving chronic opioids; (D) performance of periodic quality measures of medical and procedural outcomes and complications that may include questionnaires or surveys for activities of daily living scores, pain scores, and standardized scales. An Audit Report on Pain Management Clinic Registration at the Texas Medical Board SAO Report No. 13-037 Copies of this report have been distributed to the fol owing: Legislative Audit Committee
The Honorable David Dewhurst, Lieutenant Governor, Joint Chair
The Honorable Joe Straus III, Speaker of the House, Joint Chair
The Honorable Thomas "Tommy" Williams, Senate Finance Committee
The Honorable Jim Pitts, House Appropriations Committee
The Honorable Harvey Hilderbran, House Ways and Means Committee
Office of the Governor
The Honorable Rick Perry, Governor
Texas Medical Board
Members of the Texas Medical Board
Dr. Irvin E. Zeitler, Jr., President
Dr. Michael Arambula
Ms. Julie K. Attebury
Mr. David Baucom
Dr. Devinder Bhatia
Mr. Frank Denton
Mr. John D. Ellis, Jr.
Mr. Carlos L. Gallardo
Dr. Manuel G. Guajardo
Dr. Scott Holliday
Dr. Margaret McNeese
Dr. Allan N. Shulkin
Dr. Robert Simonson
Dr. Wynne M. Snoots
Ms. Paulette Barker Southard
Dr. Karl Swann
Dr. Stanley Wang
Mr. Timothy Webb
Dr. George Willeford III
Ms. Mari Robinson, Executive Director
This document is not copyrighted. Readers may make additional copies of this report as needed. In addition, most State Auditor's Office reports may be downloaded from our Web site: www.sao.state.tx.us. In compliance with the Americans with Disabilities Act, this document may also be requested in alternative formats. To do so, contact our report request line at (512) 936-9500 (Voice), (512) 936-9400 (FAX), 1-800-RELAY-TX (TDD), or visit the Robert E. Johnson Building, 1501 North Congress Avenue, Suite 4.224, Austin, Texas 78701. The State Auditor's Office is an equal opportunity employer and does not discriminate on the basis of race, color, religion, sex, national origin, age, or disability in employment or in the provision of services, programs, or activities. To report waste, fraud, or abuse in state government call the SAO Hotline: 1-800-TX-AUDIT.

Source: http://www.sao.state.tx.us/reports/main/13-037.pdf