OIG review uncovers myriad deficiencies, including apparently improper charges, at Demographic Registry

A review by the Office of the Inspector General established that improper charges issued by the Demographic Registry commenced in November 2015, when the Registry sought an emergency amendment to Regulation 5961 that was never submitted to the island Department of State, as mandated by law.

By THE STAR STAFF

An investigation by the Puerto Rico Office of the Inspector General (OIG) has revealed serious deficiencies in the digital platform utilized by the Department of Health’s Demographic Registry for handling requests for vital event certifications. Most alarmingly, the review released on Monday indicates potential improper charges levied against citizens.

The review established that the improper charges commenced in November 2015, when the Registry sought an emergency amendment to Regulation 5961 that was never submitted to the Department of State, as mandated by the Uniform Administrative Procedure Act (LPAU). Despite that failure, the fees outlined in the unsubmitted amendment were improperly enforced until the examination date.

The audit highlights that during the assessment period, the Vital Statistics Registry collected over $2.9 million in additional fees beyond what was sanctioned in Regulation 5961, processing 487,559 certifications. Citizens were charged for certificates -- including those for births, marriages, and deaths -- at rates that blatantly violated the established procedures set forth in the LPAU, the OIG noted.

The OIG audit scrutinized how vital statistics requests were managed from July 1, 2022, to Feb. 28 of this year, in conjunction with internal controls of the digital information system and the processes for delivering certificates post-payment.

The findings pointed to severe deficiencies in certificate issuance, as well as glaring flaws in access controls for the digital records system. As of June 30, 2024, there were 4,589 applications left unprocessed since 2022, indicating a complete failure in updates. The agency acknowledged that the Demographic Registry lacks essential procedures for canceling applications and determining their duration in the system.

Furthermore, critical weaknesses in platform access controls and user management have been highlighted, exposing the agency’s operations to significant security and confidentiality risks. The review also drew attention to delays and errors in certificate delivery, significantly affecting legal proceedings, immigration processes and insurance claims. The oversight agency underscored the absence of a risk analysis, outdated technology inventories, and the absence of cybersecurity training for staff. A robust strategic technology and business continuity plan is urgently needed, the OIG said.

Moreover, the report identified contracts that were not filed in a timely manner with relevant agencies, as well as outdated regulations that failed to comply with LPAU requirements. Specifically, Regulations 318 and 5961 have not been reviewed for 67 and 25 years, respectively, contravening the requirement for all regulations to be reevaluated every five years to ensure their efficacy in supporting the agency’s public policy. The OIG also identified more than 12 additional regulations requiring immediate review by the Vital Statistics Registry.

In light of the significant findings, the OIG has mandated compliance with its recommendations to rectify the identified deficiencies. Among those directives, the Vital Statistics Registry is required to complete the submission of an updated Regulation 5961 in accordance with Law 38-2017 to amend the improper charges.

The report further recommends the establishment of a rigorous quality control protocol and time metrics for issuing certificates, alongside the implementation of stringent technological controls such as multi-factor authentication and periodic access reviews. Immediate action is imperative to address the systemic issues, the OIG said.