Data security office has bad data securityNews added by Benefits Pro on December 5, 2013

Benefits Pro

Joined: September 07, 2011

My Company

By Allison Bell

The federal agency that enforces health data security regulations did a poor job of protecting the data it was using in its own investigations.

Officials at the Office of Inspector General at the U.S. Department of Health and Human Services announced that conclusion in this latest report.

Thomas Salmon and other HHS OIG staffers were looking at the efforts of the HHS Office for Civil Rights to enforce the Health Insurance Portability and Accountability Act health data Security Rule.

The HIPAA Security Rule exposes any covered entity or associate that uses personal health information — including brokers — to the prospect of having to pay big fines for violations.

The office did develop guidance for implementing the rule, and it set up an investigation process for responding to reports of violations, HHS OIG officials said.

But the office hasn’t come up with a process for auditing covered entities regularly to make sure they’re actually complying with the requirements, officials said.

Federal statutes require HHS to run a health data security audit program.

Moreover, even when office investigators did look into complaints, they failed to meet investigation documentation standards.

In addition, the office failed to comply with federal requirements for the three computer systems it used to support its investigations, and it failed to go through a formal risk management process for two of the three systems, officials said.

The office "focused on system operability to the detriment of system and data security," officials said.

"Exploitation of system vulnerabilities, normally identified through the risk management process, could impair OCR's ability to perform functions vital to its mission," officials said.

Originally published on
The views expressed here are those of the author and not necessarily those of ProducersWEB.
Reprinting or reposting this article without prior consent of is strictly prohibited.
If you have questions, please visit our terms and conditions
Post Press Release