Located in central Florida’s Brevard County, Health First is a not-for-profit health system that includes three
hospitals, several outpatient centers, a trauma center, home care services, specialized programs, a medical group,
three fitness centers and three health plans. It supports about 1,000 physicians and serves nearly 75,000 members
in its health plans. Nearly 63,000 patients use Health First’s facilities, and about 30,000 surgeries are performed
there each year. Health First is devoted to integrating quality healthcare services with state-of-the-art technology.
For three straight years, it was named one of the nation’s top 100 “Most Wired” health systems by Hospitals &
Health Networks magazine.
During an audit of Health First’s financial statements, the company’s auditors noted deficiencies in the design of
internal control. This control was related to inappropriate access of developers to both the development and
production environments in the PeopleSoft applications for HRMS and Financials. Furthermore, its existing tools
gave administrators little control over the PeopleSoft change process.
The Challenge
The internal control deficiencies were first identified during an audit of Health First financial statements.
Even though Health First is a not-for-profit healthcare system, its auditors are very familiar with Sarbanes-Oxley
requirements—and expect many of the same types of controls and best practices to be in place that exist in a forprofit
corporation.
“The auditors found that, because of the small staff that we have supporting our ERP system, we weren’t able to
enforce separation of duties for our developers,” said Rich Rogers, Health First vice president and chief information
officer. “As a result, we couldn’t be sure that the folks who had access to our development environment didn’t also
have access to the production environment.”
The auditors recommended that Health First enforce separation of duties for their programmers and implement
workflow and approvals that would enable the IT team to have visibility and control in any changes that are made.
Unfortunately, the audit features in PeopleSoft could only be implemented at the field level, record level or the
database level. Record-level auditing only tracks PeopleSoft object changes, while database-level tools use Oracle
just to track field and record changes to PeopleSoft objects, as well as third-party objects (e.g., SQL Server, SQR).
Worse yet, the process of setting up and maintaining an extensive auditing and reporting function for the
PeopleSoft environment would have required an estimated 1,000 hours—and native PeopleSoft auditing does
not provide any version control or enforce workflow approval.
The Quest Solution
To remedy the situation, Health First selected Quest Software’s Stat for PeopleSoft, a robust PeopleSoft change
management system.
“As we started evaluating products, we were looking for a tool that had version control and workflows that would
allow us to track all object changes from our development environment into production,” explained Desmond
Almarales, PeopleSoft workflow administrator for Health First. “We also wanted the ability to roll back to a previous
version if necessary.”
If a faulty change happens to make its way into production, Stat allows changes in the production environment to
be rolled back to prior versions, ensuring a higher level of availability and service.
“With our existing applications, if someone was to make a change in production and a problem arose, our only
option was to go back to the database administrator and restore the files,” said Almarales. “And with PeopleSoft
alone, we really didn’t have any audit features in place.”

Stat automatically tracks all changes to PeopleSoft objects and third-party flat files (e.g., SQL, SQRs, Java), then
provides the detailed audit trail that Health First needed. This means that no changes are made to the PeopleSoft
production environment without the proper approvals.
Besides these desired features, Health First was also impressed with the improvements Stat made in the overall
workflow process.
Prior to implementation, Health First had to initiate development requests via its help desk system. A ticket was
assigned and development was then completed and tested, with code eventually migrated to production.
Needless to say, this was an intensive manual process.
With Stat, Health First has streamlined its change management process through automation. Users can still initiate
a development request via the help desk system but can now track the request with Stat’s automated workflow, all
while still referencing the original help desk ticket. They can also get an automatic approval for the request; initiate
and complete the development; have a functional user test and accept the code; automatically migrate the code
into production; and gain final acceptance by the user – all within a controlled and audited environment.
The Bottom Line
“Today, our auditors can look at any development code and see that it has been approved and tested by the user,”
said Almarales. “Stat also lets us track undocumented changes made directly in production. This feature allows us
to quickly identify these changes to ensure that they were authorized and then allows us to add them to the
Stat database.”
Health First also acknowledges that without Stat’s roll-back capability, there was a potential risk for significant
business disruption. The time savings associated with maintaining this level of service is critical to the bottom line.
“Essentially, all of the purchasing for our medical supplies depends on the PeopleSoft system, so if our system
goes down for any extended period of time, it could have a dramatic impact on our ability to deliver patient care
and to our core business,” added Rogers. “In fact, we often quantify our downtime as costing us $100,000 for an
eight-hour shift.”
Added Rogers: “Our auditors helped us recognize that we had a business issue, and Stat emerged as the best
solution to meet our needs and to resolve them quickly.”
Health First also leveraged Quest’s Professional Services—including training—to help with product installation,
integration and rapid deployment. “We needed to make this happen pretty quickly and Quest made us very
happy,” explains Almarales. “The implementation went very smoothly and the Quest consultants provided us with
sample workflows and on-site training. The thing I liked most about it was that Quest provided training using a
Health First Stat database which enabled our users to get up to speed fairly quickly.”
About Health First
Health First, a not-for-profit health system in Brevard County, Florida, was formed in 1995 with the joining of three
hospitals: Cape Canaveral Community Hospital, Holmes Regional Medical Center and Palm Bay Community
Hospital. Today, the Health First system includes the hospitals, outpatient centers; the county’s only trauma center;
home care; specialized programs for cancer, diabetes, heart, stroke, and rehabilitative services; the areas largest
medical group; three fitness centers; and Medicare Advantage, commercial POS, and commercial HMO health
plans. Health First’s mission is to positively change the health and well-being of community members through
excellent and compassionate health care. Learn more at www.health-first.org.
About Quest Software, Inc.
Quest Software, Inc. delivers innovative products that help organizations get more performance and productivity
from their applications, databases and Windows infrastructure. Through a deep expertise in IT operations and a
continued focus on what works best, Quest helps more than 50,000 customers worldwide meet higher
expectations for enterprise IT. Quest Software can be found in offices around the globe and at www.quest.com.