Issues Raised in the Audit and Before the Committee

The Auditor's follow-up to the 2013 value-for-money audit (presented in her 2015 Annual Report) found that ServiceOntario has made progress on implementing most of the recommendations made in the 2013 Annual Report, which were aimed at improving the delivery of cost-effective services to Ontarians.

In particular, to lower costs, ServiceOntario has reduced its number of in-person service centres and implemented more efficient full-time/part-time staffing mixes at the remaining publicly run in-person service centres. As well, it has expanded privately run in-person service centres, which cost less to operate than publicly run in-person service centres. ServiceOntario implemented measures to monitor customer wait times better during peak hours at both publicly run and privately run in-person service centres, and to monitor and reduce transaction processing errors.

The Committee would like to recognize the progress made by the Ministry of Government and Consumer Services and ServiceOntario over the last decade in working to improve the levels of service Ontarians receive.

While a number of issues were raised in the audit and before the Committee, those discussed below are considered to be particularly important.

Online Services

The services provided by ServiceOntario, such as registering an individual for the Ontario Health Insurance Plan, registering a vehicle, and issuing a health card, a birth certificate, a driver's licence, provincial photo identification, or an accessible parking permit, are often of vital importance to Ontarians. Ensuring that these services are as accessible as possible is critical.

Several of the Auditor's recommendations centred on having ServiceOntario examine how to increase use of online services as a way to reduce service delivery costs, as online delivery is often less expensive than in-person delivery.

As noted earlier, of the 35 million transactions handled by ServiceOntario in 2012/13, 70% of these were conducted in-person, while 30% were conducted online.

During the hearing, government officials noted the following:

· Ms. Coke testified that ServiceOntario considered pricing strategy to be a method to shift people to online services, but it is not being pursued at this time.

· ServiceOntario believes it is important to ensure services are broadly accessible and that no segments of the population are unduly disadvantaged. For example, not all areas of Ontario are served with high-speed Internet access.

· While online services are well suited for routine transactions, more complex cases often require human judgement or case management. A higher fee for accessing in-person delivery for such cases would be unfair.

· Ms. Coke noted that ServiceOntario has been using a number of different methods to promote greater use of online transactions, including

· improving promotional activity to raise awareness of online options;

· redesigning forms to make them faster and easier to use;

· bundling services so people can complete multiple transactions at one time; and,

· developing common design standards for digital services that put the customer first.

· Ms. Hawton testified that in the past year online usage has risen from 30% to 30.9% and the actual number of online transactions has grown as the overall transaction volume increased. This represents a 7.7% annual growth rate and an additional 700,000 online transactions, compared to the previous year.

Committee Recommendation(s)

The Standing Committee on Public Accounts recommends that:

1. ServiceOntario continue to examine ways to improve uptake of online services while balancing the accessibility of services for Ontarians, and provide the Committee with an update on online service usage.

ServiceOntario should provide the Committee with a three-year plan detailing further changes it plans to make to increase the public's use of online transactions and new targets for online transactions, while maintaining equity of access to services for those without Internet access or who require in-person assistance.  ServiceOntario should report back to the Committee at the end of the three-year period.

Modernization and Service Improvements

Since the Auditor's 2013 audit, ServiceOntario has worked to modernize several of the services it provides. In 2013 the Auditor noted that ServiceOntario needed to continue to strengthen systems and procedures to reduce service delivery costs, as well as reduce risks in issuing and managing licences, certifications, registrations, and permits.

Birth Certificates

In accordance with the Auditor's recommendations:

· Ms. Coke stated that in the spring of 2015, ServiceOntario introduced a more secure and durable polymer for birth certificates, which helps reduce fraud and identity theft.

· Mr. Mathew noted that ServiceOntario will continue its existing detailed authentication process to verify the eligibility of applicants seeking to obtain birth certificates.

Farm Vehicle Licensing

· Ms. Coke stated that ServiceOntario, in partnership with the Ministry of Transportation, implemented changes to improve verification requirements to ensure that those registering farm vehicles are eligible to do so.

Health Cards

In February 2015, ServiceOntario received government approval for a conversion strategy to convert all remaining red-and-white health cards to new photo health cards by the end of 2018. The Auditor recommended that ServiceOntario complete this conversion as quickly as possible to reduce the risk of fraudulent medical claims.

· Ms. Coke noted that as of January 2016, 90% of Ontarians have a more secure photo health card.

· Ms. Hawton stated that ServiceOntario has significantly increased efforts to convert to the more secure photo card and, as of January 2016, 1.6 million red-and-white cards remained in circulation compared to 3.2 million in March 2013.

Accessible Parking Permits

The Committee notes that ServiceOntario has taken steps to address the Auditor's recommendations related to improving processes for issuing accessible parking permits and identifying abusers of the accessible parking permit system.

· Ms. Coke stated that in January 2016 ServiceOntario introduced a new policy and has improved permit design and implemented processes for issuing accessible parking permits.

· Mr. Mathew stated the new enhanced permits are more secure and tamper-resistant, with many security features, including a serial number. The latter allows ServiceOntario to maintain a controlled stock of the permits. The new permits also have an embossment and micro-text printing that makes them harder to photocopy.

· Mr. Mathew also noted that the re-designed permits have new accessibility enhancements, with larger letters and a raised wheelchair symbol to assist visually impaired clients.

Committee Recommendation(s)

The Standing Committee on Public Accounts recommends that:

2. ServiceOntario provide an update on what impact the new accessible parking permit policy and permit design have had on improving the permit issuing process and identifying abusers of the permit system.

Integrated Smart Card

Moving beyond individual cards for health or driver's licensing, the Auditor had recommended that ServiceOntario examine the benefits and costs savings of creating a smart card that would combine more than one government identification card.

ServiceOntario engaged a focus group that consulted with the Ministries of Transportation, Health and Long-Term Care, and Natural Resources and Forestry. The focus group concluded that the business case for implementing a single card was not feasible based solely on the savings represented by manufacturing only one type of card. The group determined that it would also need to quantify and include the benefits and savings that would incur to ministries' programs by having more efficient operations from using a common smart card.

Research into the feasibility of a single digital identity is ongoing, with officials providing the following information:

· Ms. Coke noted that as part of its strategic plan, ServiceOntario is exploring a broader, longer-term approach to smart cards. Research has indicated that card integration, smart card technology, and the ability to promote greater electronic access to government services should be considered as part of an integrated strategy.

· Ms. Coke also noted that ServiceOntario is examining the feasibility of a single digital identity and possible card strategy, and that privacy-friendly design, cost-effectiveness, and the potential for use across government programs are key themes being explored.

· Mr. Ward stated that the Auditor's recommendation relating to smart cards provided impetus for ServiceOntario to examine the issue further. Beyond just integrating cards, ServiceOntario is investigating an identity authentication scheme that might include a card or other means that would facilitate improved security and privacy, and a larger suite of online services.

The Committee is concerned with ServiceOntario's slow progress and lack of commitment to moving forward with a comprehensive business case to identify the benefits and savings that would result from using an integrated smart card.  The Committee notes that smart cards are used successfully in other jurisdictions.

Committee Recommendation(s)

The Standing Committee on Public Accounts recommends that:

3. ServiceOntario provide the Committee with a timetable for preparing a comprehensive business case for an integrated smart card (or similar alternative), that includes implementation costs; the ministries and services that could participate in an integrated smart card; operational and cost savings that ministries would achieve; strategies to mitigate privacy concerns; and an implementation plan.

The business case should also include research on lessons learned by other jurisdictions that have already implemented an integrated smart card. ServiceOntario should provide the Committee with this business case when it is completed.

Privacy and Security of Information

Several of the Auditor's recommendations related to the privacy and security of information used by ServiceOntario, including registration and licensing databases. How information is shared between ministries was also raised as an issue, especially as it relates to the sharing of addresses across databases to mitigate risks posed by erroneous and inconsistent information.

On March 9, 2016 the Committee sought input from the Information and Privacy Commissioner of Ontario on the sharing of address change information. In response, the Commissioner stated that:

· ServiceOntario consulted the Commissioner in the fall of 2015 regarding ways to address the problem of erroneous and duplicate identity documents.

· The Commissioner understands that the issues involved with the need to share address change information are being addressed as part of a larger initiative relating to identity documents and a wide range of options is being considered.

· Further, the Commissioner believes the privacy and security issues that arise from the options under consideration are not an obstacle to progress and remains committed to working with ServiceOntario to ensure that any new program or change in practice is implemented in a way that protects privacy. The Commissioner also believes that ServiceOntario is equally committed to working with the Commission towards the same goals.

Information Management

As ServiceOntario moves forward with the integration of products and delivery of services to improve the customer experience, officials indicated that privacy and the protection of information remains an important focus.

· Ms. Coke stated that ServiceOntario is very mindful of the need to balance the integration of products and delivery of services with privacy protection. The sharing of address change information between multiple programs requires broader policy and legal review, and consultation with the Information and Privacy Commissioner.

ServiceOntario is reviewing this in the context of the potential for a single digital identity solution, as well as a policy and legislative framework that enables further integration and provides greater authority for data sharing.

· Mr. Ward noted that ServiceOntario has data-sharing agreements with ministry partners. Information is encrypted, and is shared electronically with partners. There are also data-sharing agreements with the federal government.

· Mr. Ward stated that ServiceOntario uses a system called the National Registration Database system, which is a secure system. Federal departments, such as Citizenship and Immigration and Service Canada, can access that information.

· Ms. McMillan spoke to privacy breaches, noting that breaches are classified into two different categories: minor or low-impact breaches, and more high-risk breaches. A low-impact breach is something a staff member might make, such as a mistake on a driver's licence, or cancelling something in error. There are processes in place for dealing with these. A high-level breach occurs when an employee accesses privileged information that has nothing to do with their particular job.  In such situations, ServiceOntario is always in contact with the Privacy Commissioner.

· Ms. McMillan noted that instances of high-risk breaches are very low: Of the approximately 49 million interactions at ServiceOntario last year, there were seven high-risk breaches.

The Committee was concerned with ServiceOntario's lack of commitment to the sharing of address change information between multiple programs. ServiceOntario cited the need for broader policy and legal review, and consultation with the Information and Privacy Commissioner, but no timetable was provided to indicate when this would occur.

The Committee also made note of the Information and Privacy Commissioner's comment that options under consideration are not an obstacle to progress and the Commissioner is willing to work with ServiceOntario to ensure any new program or change in practice is implemented in a way that protects privacy. The Committee felt that the introduction of an integrated smart card would be unlikely to occur for several years. In the interim, sharing of information would be a good first step towards data integration, as well as improving program delivery and customer service. 

Committee Recommendation(s)

The Standing Committee on Public Accounts recommends that:

4. ServiceOntario should provide the Committee with a summary of the number and types of privacy breaches that have occurred with respect to ServiceOntario operations over the last three years, the action(s) taken as a result of breaches considered to be high-risk, and any initiatives planned to mitigate future privacy breaches.

5. As an interim measure until an integrated smart card initiative is further developed, ServiceOntario should provide the Committee with an action plan and timetable for introducing new measures that would permit the sharing of address change information between multiple programs.

Consolidated List of Committee Recommendations

The Standing Committee on Public Accounts recommends that:

1. ServiceOntario continue to examine ways to improve uptake of online services while balancing the accessibility of services for Ontarians, and provide the Committee with an update on online service usage.

ServiceOntario should provide the Committee with a three-year plan detailing further changes it plans to make to increase the public's use of online transactions and new targets for online transactions, while maintaining equity of access to services for those without Internet access or who require in-person assistance.  ServiceOntario should report back to the Committee at the end of the three-year period.

2. ServiceOntario provide an update on what impact the new accessible parking permit policy and permit design have had on improving the permit issuing process and identifying abusers of the permit system.

3. ServiceOntario provide the Committee with a timetable for preparing a comprehensive business case for an integrated smart card (or similar alternative), that includes implementation costs; the ministries and services that could participate in an integrated smart card; operational and cost savings that ministries would achieve; strategies to mitigate privacy concerns; and an implementation plan.

The business case should also include research on lessons learned by other jurisdictions that have already implemented an integrated smart card.  ServiceOntario should provide the Committee with this business case when it is completed.

4. ServiceOntario should provide the Committee with a summary of the number and types of privacy breaches that have occurred with respect to ServiceOntario operations over the last three years, the action(s) taken as a result of breaches considered to be high-risk, and any initiatives planned to mitigate future privacy breaches.

5. As an interim measure until an integrated smart card initiative is further developed, ServiceOntario should provide the Committee with an action plan and timetable for introducing new measures that would permit the sharing of address change information between multiple programs.