HHS neglected some IT security standards, IG says

The Health and Human Services Department might have failed to protect patient health data when setting rules for distributing $20 billion in economic stimulus law funds for providers to buy electronic health record systems, according to a report from HHS' Office of the Inspector General.

When officials at the agency’s Office of the National Coordinator for Health IT made recommendations for regulations to accompany the stimulus funds, they included standards for protecting patient data when it is shared. However, the office made no recommendations for ensuring that hospitals, doctors and health care agencies have general IT security controls — such as encryption, patching and two-factor authentication — on their own systems, the May 16 report states.

The national coordinator’s office “did not have [health IT] standards that included general IT security controls,” wrote HHS Inspector General Daniel Levinson, the report’s author. “Lack of any of these or other IT security controls can expose [health IT] systems to a host of problems."

Related stories:

HHS names new health IT national coordinator

HHS' new strategic plan emphasizes health IT

The national coordinator's office had previously justified its hands-off approach on general IT security by asserting that the requirements were covered under earlier laws, especially the Health Insurance Portability and Accountability Act (HIPAA), the report states.

However, IG audits have shown that HIPAA is ineffective in policing information security for doctors, hospitals and Medicaid agencies, Levinson wrote. Many facilities inspected in recent years had unprotected networks, outdated or missing antivirus software, no encryption, shared user accounts, and inappropriate user access rights.

“Our experience with HIPAA implementation in hospitals does not support [the] position that HIPAA provides adequate general IT security,” the report states.

Levinson listed no specific corrective actions for HHS and instead recommended that the national coordinator’s office:

  • Broaden its focus to include general IT security controls.
  • Use its leadership to provide guidance on industry best practices and general IT security standards.
  • Emphasize the importance of IT security to the medical community.
  • Coordinate with the Centers for Medicare and Medicaid Services and HHS’ Office for Civil Rights to add general IT security controls where applicable.

HHS officials agreed with the recommendations.

About the Author

Alice Lipowicz is a staff writer covering government 2.0, homeland security and other IT policies for Federal Computer Week.


  • IT Modernization
    shutterstock image By enzozo; photo ID: 319763930

    OMB provides key guidance for TMF proposals amid surge in submissions

    Deputy Federal CIO Maria Roat details what makes for a winning Technology Modernization Fund proposal as agencies continue to submit major IT projects for potential funding.

  • gears and money (zaozaa19/Shutterstock.com)

    Worries from a Democrat about the Biden administration and federal procurement

    Steve Kelman is concerned that the push for more spending with small disadvantaged businesses will detract from the goal of getting the best deal for agencies and taxpayers.

Stay Connected