Close Close
Popular Financial Topics Discover relevant content from across the suite of ALM legal publications From the Industry More content from ThinkAdvisor and select sponsors Investment Advisor Issue Gallery Read digital editions of Investment Advisor Magazine Tax Facts Get clear, current, and reliable answers to pressing tax questions
Luminaries Awards

Retirement Planning > Social Security

Data security office has bad data security

Your article was successfully shared with the contacts you provided.

The federal agency that enforces health data security regulations did a poor job of protecting the data it was using in its own investigations.

Officials at the Office of Inspector General at the U.S. Department of Health and Human Services announced that conclusion in this latest report.

Thomas Salmon and other HHS OIG staffers were looking at the efforts of the HHS Office for Civil Rights to enforce the Health Insurance Portability and Accountability Act health data Security Rule.

The HIPAA Security Rule exposes any covered entity or associate that uses personal health information — including brokers — to the prospect of having to pay big fines for violations.

The office did develop guidance for implementing the rule, and it set up an investigation process for responding to reports of violations, HHS OIG officials said.

But the office hasn’t come up with a process for auditing covered entities regularly to make sure they’re actually complying with the requirements, officials said. 

Federal statutes require HHS to run a health data security audit program. 

Moreover, even when office investigators did look into complaints, they failed to meet investigation documentation standards. 

In addition, the office failed to comply with federal requirements for the three computer systems it used to support its investigations, and it failed to go through a formal risk management process for two of the three systems, officials said.

The office “focused on system operability to the detriment of system and data security,” officials said.

“Exploitation of system vulnerabilities, normally identified through the risk management process, could impair OCR’s ability to perform functions vital to its mission,” officials said.


© 2024 ALM Global, LLC, All Rights Reserved. Request academic re-use from All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.