The federal agency that enforces health data security regulations did a poor job of protecting the data it was using in its own investigations.
Officials at the Office of Inspector General at the U.S. Department of Health and Human Services announced that conclusion in this latest report.
Thomas Salmon and other HHS OIG staffers were looking at the efforts of the HHS Office for Civil Rights to enforce the Health Insurance Portability and Accountability Act health data Security Rule.
Recommended For You
The HIPAA Security Rule exposes any covered entity or associate that uses personal health information — including brokers — to the prospect of having to pay big fines for violations.
The office did develop guidance for implementing the rule, and it set up an investigation process for responding to reports of violations, HHS OIG officials said.
But the office hasn't come up with a process for auditing covered entities regularly to make sure they're actually complying with the requirements, officials said.
Federal statutes require HHS to run a health data security audit program.
Moreover, even when office investigators did look into complaints, they failed to meet investigation documentation standards.
In addition, the office failed to comply with federal requirements for the three computer systems it used to support its investigations, and it failed to go through a formal risk management process for two of the three systems, officials said.
The office "focused on system operability to the detriment of system and data security," officials said.
"Exploitation of system vulnerabilities, normally identified through the risk management process, could impair OCR's ability to perform functions vital to its mission," officials said.
© 2025 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
Allison Bell
Allison Bell, a senior reporter at ThinkAdvisor and BenefitsPRO, previously was an associate editor at National Underwriter Life & Health. She has a bachelor's degree in economics from Washington University in St. Louis and a master's degree in journalism from the Medill School of Journalism at Northwestern University. She can be reached through X at @Think_Allison.
