The U.S. Government Accountability Office identified “significant weaknesses” in how HHS and CMS protect sensitive medical and financial information, according to a GAO report released yesterday. The report, Information Security: Department of Health and Human Services Needs to Fully Implement Its Program, states that vulnerabilities in the HHS computer systems pertain to “network management, user accounts and passwords, user rights and file permissions, and auditing and monitoring of security-related events.” The report says that HHS has policies and procedures for information protection, but has not fully implemented them. HHS responded (to a draft version of the report) that the GAO’s evaluation “does not provide an accurate or complete appraisal of the HHS enterprisewide information security program…. HHS is proud of its information security program and the progress it has made….” Click here to download the report.
