The federal agency that enforces health data security regulations did a poor job of protecting the data it was using in its own investigations.
Officials at the Office of Inspector General at the U.S. Department of Health and Human Services announced that conclusion in this latest report.
Thomas Salmon and other HHS OIG staffers were looking at the efforts of the HHS Office for Civil Rights to enforce the Health Insurance Portability and Accountability Act health data Security Rule.
The HIPAA Security Rule exposes any covered entity or associate that uses personal health information — including brokers — to the prospect of having to pay big fines for violations.
The office did develop guidance for implementing the rule, and it set up an investigation process for responding to reports of violations, HHS OIG officials said.
But the office hasn’t come up with a process for auditing covered entities regularly to make sure they’re actually complying with the requirements, officials said.
Federal statutes require HHS to run a health data security audit program.
Moreover, even when office investigators did look into complaints, they failed to meet investigation documentation standards.
In addition, the office failed to comply with federal requirements for the three computer systems it used to support its investigations, and it failed to go through a formal risk management process for two of the three systems, officials said.
The office “focused on system operability to the detriment of system and data security,” officials said.
“Exploitation of system vulnerabilities, normally identified through the risk management process, could impair OCR’s ability to perform functions vital to its mission,” officials said.