The state is facing yet another information technology headache. Progress on a data management system for sensitive information about children and families has been halted since June amid concerns about inadequate security provisions.
The VFACTS project, undertaken by the state’s Department of Children and Families, aims to create an online database, in which service providers and state officials can access sensitive information about children, including medical information and their status regarding government benefits. VFACTS stands for the Vermont Family and Child Tracking System.
But the Georgia firm doing the work, Yahasoft, failed to put in place adequate security provisions that would safeguard private information, according to state officials.
“Once you get into that kind of arena, putting into a Web space some very privileged and sensitive information, you’ve got to be careful about security around that information,” explained Angela Rouelle, the chief information officer who oversees IT at the Agency of Human Services, the agency DCF falls under.
The information isn’t at risk of inappropriate disclosure, since system development is still ongoing and hasn’t gone live yet.
“They [Yahasoft] started on the project, and they were not creating a secure solution,” said Rouelle. “Frankly, it would appear that the vendor did not fully understand the contract language.”
Rouelle described Yahasoft as a “mom-and-pop shop,” and not a particularly well-known technology firm. The state chose Yahasoft partly for its low bid offer, and also because it had completed similar projects in Kentucky and Tennessee. The state checked the firm’s references in advance and received positive feedback.
In June, the state stopped payments to Yahasoft for the remainder of its $830,000 contract. It has paid the firm $400,000 to date since the project was started in April 2011.
The state’s chief information officer, Richard Boes, said total project costs, including staff time and resources spent formulating system requirements, were initially projected at $4 million. Boes doesn’t know how much of that larger projected total has been spent to date, aside from the $400,000 spent on the vendor.
VFACTS didn’t undergo a Department of Information and Innovation supervised independent review to assess risks, costs and benefits, a statutory requirement for all state IT projects costing more than $500,000, according to Boes. That’s because it was a “Challenges for Change” project, initiated under the Douglas administration, and it fell under an initiative aimed at cutting bureaucratic red tape.
DII stepped in to oversee the project in July, thanks to enhanced authority bestowed on the department by legislation passed earlier this year.
In pursuit of real-time information
DCF Commissioner David Yacovone said that the current “paper and pencil” system now place is “really something out of the 1970s. From that standpoint, it’s very disappointing that this project is struggling. As you can imagine, a paper and pencil system doesn’t allow you to do any analysis.”
The lack of a functional computer system makes it harder to spot children at risk of developmental delays or other learning obstacles in particular areas of the state Yacovone explained.
“As far as the impact on children and families, it’s the difference between knowing in real-time where you need to respond, and once a year doing a report [on needs],” said Yacovone. “Real-time information is the key to better serving families, an important key.”
“We were hopeful,” said Rouelle. “Their references panned out very well, as I said. It’s unfortunate that we are where we are with this vendor.” One lesson Rouelle takes away: “The lowest bidder is not always the best.”
Boes took a more optimistic stance. “It [VFACTS] is multiple steps closer to a successful implementation, regardless of whether it’s with this vendor or another vendor. … After the meeting on the 21st [of December], we will have a clear path, as to what are the options in front of us at that point, and what the cost of those options may be.”
The system should have been in place by now, based on the original timelines for the project, according to Laurie Sabens, DCF’s IT manager. She said problems with inadequate information security features, which fall short of federal health information privacy standards, were first noticed in August 2011.
“I don’t know how we could’ve anticipated this until it started staring us in the face,” Sabens said.
The state has paid about $100,000 since May to an external expert, Pete Walker of Williston-based Desai Management Consulting, to help manage the project, since DCF lacked sufficient internal expertise at the time.
An initial contract with another firm, BerryDunn, lapsed without renewal at an earlier stage of the project, Sabens said, because the company couldn’t balance the two conflicting roles the state first assigned to it — independent oversight of the project and managing daily progress.
Boes, Rouelle, Yacovone and Sabens all said the state’s contract language was clear about what the state required from Yahasoft. The firm, they said, failed to understand the state’s security needs, for reasons yet to be clearly determined.
“The vendor has been given multiple chances to deliver the specifications that were laid out in the contract, and they were not delivered,” Boes said. “That put the success of this project in jeopardy. … All I can speak to are the facts. The vendor has not been able to deliver a satisfactory product. As to why, I can’t answer that.”
According to Rouelle and Boes, the state is currently negotiating with the company. Options on the table include continuing with Yahasoft but refraining from payment until the state’s concerns can be met, cancelling the project and switching vendors.
Rouelle said the possibility of negotiating for a refund from Yahasoft remains open. The state recently reached a deal with Hewlett-Packard for a $8.3 million refund for a failed $18 million project at the Department of Motor Vehicles.
Yahasoft didn’t immediately return a request for comment.
A committee will meet Dec. 21 to decide on next steps for VFACTS.
