en en id en en en en en en en en en en en en en en en en en en en en en en en en en en en en en en es en en en en en en en en en en en en en en en en en en en en
There was unfortunately some bleak news out of the Department of Health & Human Services, (HHS) Office of the Inspector General (OIG) recently. The OIG recently released the results of a performance audit of the HHS’ compliance with the Federal Information Security Modernization Act of 2014 (FISMA). The OIG Report states that FISMA requires that there be an annual independent evaluation of the information security program and practices of the agency to determine the effectiveness of such program and practices.
Although the report concluded that there were some improvements over previous years, the audit concluded that HHS’ information security program was ‘Not Effective.’
In the crucial area of data protection and privacy, the report outlined the following findings:
The Department did not document their review and updates for the guidance associated with the privacy based risk assessments to reflect the current environment.
One Operating Division’s guidance and requirements to address data protection and privacy controls was not updated within two years as required by HHS.
Security requirements outlined in privacy impact assessments were outdated or incomplete.
The findings also included comments in the Data Protection and Privacy section of the Report that indicated that there were weaknesses in the security controls for protecting personally identifiable information (PII) and other agency sensitive data throughout the data lifecycle. A final recommendation regarding data protection and security, which HHS concurred with, was that HHS must update relevant Department policies, procedures, and guidance and also work with the Operating Divisions to measure the effectiveness of privacy specific controls and trainings.
Given the enormous amount of personal information and health information that the federal government has in its possession, the risk and unfortunate likelihood of a data breach, and the value of that personal and health data, the federal government, and HHS in particular, must make necessary improvements to its data privacy and security measures.
Tags: Department of Health & Human Services, Federal Information Security Modernization Act of 2014, fisma, HHS, Office of the Inspector General, OIG
Email this postTweet this postLike this postShare this post on LinkedIn
The FCC Wants You to Delete TikTok
If Your Disclosure of a Data Breach Was  “Late,” You May Have to Litigate
Privacy Tip #301 - Can Your Co-Worker Guess Your Password? Probably!
Follow us on Twitter Follow us on Twitter
Follow Us on Facebook Follow Us on Facebook
View Our Linkedin Profile View Our Linkedin Profile
Data Privacy + Cybersecurity Insider
Follow us on Twitter Follow Us on Facebook View Our Linkedin Profile RSS
Robinson+Cole is a law firm serving regional, national and global clients from nine offices throughout the Northeast. Our Data Privacy + Security Team brings together lawyers from the firm’s Intellectual Property and Technology, Commercial Litigation, and E-Commerce Groups.
Topics Select Category Artificial Intelligence Autonomous Machines Autonomous Systems Autonomous Vehicles Blockchain Cannabis CCPA Children’s Privacy Coronavirus Cybersecurity Data Breach Data Privacy Data Security Digital Assets Drone Privacy Drones e-Discovery Enforcement + Litigation Events Geolocation Guest Posts Health Information Privacy HIPAA and Health Information Information Governance Insurance Coverage International Privacy Laws Internet of Things Mergers & Acquisitions New + Now Privacy Tips Public-Private Partnerships with Cyber Security Safe Harbor Social Media State Laws Relating to Data Telehealth Telephone Consumer Protection Act Uncategorized Virtual Currency Websites
Archives Select Month September 2022 August 2022 July 2022 June 2022 May 2022 April 2022 March 2022 February 2022 January 2022 December 2021 November 2021 October 2021 September 2021 August 2021 July 2021 June 2021 May 2021 April 2021 March 2021 February 2021 January 2021 December 2020 November 2020 October 2020 September 2020 August 2020 July 2020 June 2020 May 2020 April 2020 March 2020 February 2020 January 2020 December 2019 November 2019 October 2019 September 2019 August 2019 July 2019 June 2019 May 2019 April 2019 March 2019 February 2019 January 2019 December 2018 November 2018 October 2018 September 2018 August 2018 July 2018 June 2018 May 2018 April 2018 March 2018 February 2018 January 2018 December 2017 November 2017 October 2017 September 2017 August 2017 July 2017 June 2017 May 2017 April 2017 March 2017 February 2017 January 2017 December 2016 November 2016 October 2016 September 2016 August 2016 July 2016 June 2016 May 2016 April 2016 March 2016 February 2016 January 2016 December 2015 November 2015 October 2015 September 2015 August 2015 July 2015 June 2015 May 2015 April 2015 March 2015