HHS neglected some IT security standards, IG says
The Health and Human Services Department might have failed to protect patient health data when setting rules for distributing $20 billion in economic stimulus law funds for providers to buy electronic health record systems, according to a report from HHS' Office of the Inspector General.
When officials at the agency’s Office of the National Coordinator for Health IT made recommendations for regulations to accompany the stimulus funds, they included standards for protecting patient data when it is shared. However, the office made no recommendations for ensuring that hospitals, doctors and health care agencies have general IT security controls — such as encryption, patching and two-factor authentication — on their own systems, the May 16 report states.
The national coordinator’s office “did not have [health IT] standards that included general IT security controls,” wrote HHS Inspector General Daniel Levinson, the report’s author. “Lack of any of these or other IT security controls can expose [health IT] systems to a host of problems."
HHS names new health IT national coordinator
HHS' new strategic plan emphasizes health IT
The national coordinator's office had previously justified its hands-off
approach on general IT security by asserting that the requirements were
covered under earlier laws, especially the Health Insurance Portability
and Accountability Act (HIPAA), the report states.
However, IG audits have shown that HIPAA is ineffective in policing
information security for doctors, hospitals and Medicaid agencies,
Levinson wrote. Many facilities inspected in recent years had
unprotected networks, outdated or missing antivirus software, no
encryption, shared user accounts, and inappropriate user access rights.
“Our experience with HIPAA implementation in hospitals does not support
[the] position that HIPAA provides adequate general IT security,” the
Levinson listed no specific corrective actions for HHS and instead recommended that the national coordinator’s office:
- Broaden its focus to include general IT security controls.
- Use its leadership to provide guidance on industry best practices and general IT security standards.
- Emphasize the importance of IT security to the medical community.
- Coordinate with the Centers for Medicare and Medicaid Services and
HHS’ Office for Civil Rights to add general IT security controls where
HHS officials agreed with the recommendations.
Alice Lipowicz is a staff writer covering government 2.0, homeland security and other IT policies for Federal Computer Week.