HHS neglected some IT security standards, IG says

The Health and Human Services Department might have failed to protect patient health data when setting rules for distributing $20 billion in economic stimulus law funds for providers to buy electronic health record systems, according to a report from HHS' Office of the Inspector General.

When officials at the agency’s Office of the National Coordinator for Health IT made recommendations for regulations to accompany the stimulus funds, they included standards for protecting patient data when it is shared. However, the office made no recommendations for ensuring that hospitals, doctors and health care agencies have general IT security controls — such as encryption, patching and two-factor authentication — on their own systems, the May 16 report states.

The national coordinator’s office “did not have [health IT] standards that included general IT security controls,” wrote HHS Inspector General Daniel Levinson, the report’s author. “Lack of any of these or other IT security controls can expose [health IT] systems to a host of problems."

Related stories:

HHS names new health IT national coordinator

HHS' new strategic plan emphasizes health IT

The national coordinator's office had previously justified its hands-off approach on general IT security by asserting that the requirements were covered under earlier laws, especially the Health Insurance Portability and Accountability Act (HIPAA), the report states.

However, IG audits have shown that HIPAA is ineffective in policing information security for doctors, hospitals and Medicaid agencies, Levinson wrote. Many facilities inspected in recent years had unprotected networks, outdated or missing antivirus software, no encryption, shared user accounts, and inappropriate user access rights.

“Our experience with HIPAA implementation in hospitals does not support [the] position that HIPAA provides adequate general IT security,” the report states.

Levinson listed no specific corrective actions for HHS and instead recommended that the national coordinator’s office:

  • Broaden its focus to include general IT security controls.
  • Use its leadership to provide guidance on industry best practices and general IT security standards.
  • Emphasize the importance of IT security to the medical community.
  • Coordinate with the Centers for Medicare and Medicaid Services and HHS’ Office for Civil Rights to add general IT security controls where applicable.

HHS officials agreed with the recommendations.

About the Author

Alice Lipowicz is a staff writer covering government 2.0, homeland security and other IT policies for Federal Computer Week.


  • Defense
    Ryan D. McCarthy being sworn in as Army Secretary Oct. 10, 2019. (Photo credit: Sgt. Dana Clarke/U.S. Army)

    Army wants to spend nearly $1B on cloud, data by 2025

    Army Secretary Ryan McCarthy said lack of funding or a potential delay in the JEDI cloud bid "strikes to the heart of our concern."

  • Congress
    Rep. Jim Langevin (D-R.I.) at the Hack the Capitol conference Sept. 20, 2018

    Jim Langevin's view from the Hill

    As chairman of of the Intelligence and Emerging Threats and Capabilities subcommittee of the House Armed Services Committe and a member of the House Homeland Security Committee, Rhode Island Democrat Jim Langevin is one of the most influential voices on cybersecurity in Congress.

Stay Connected


Sign up for our newsletter.

I agree to this site's Privacy Policy.