CMS Oversees the Medicare & Medicaid Programs

CMS, a component of HHS, is responsible for overseeing two major health  programs. It administers the Medicare program—the nation’s largest  health insurance program—which covers more than 42 million Americans. In particular, CMS relies on a contractor-owned and operated  network from which it purchases networking services to provide  connectivity to its business partners. Significant Network Weaknesses Place Medical Data at Risk

Although CMS has many information security controls in place that are  designed to safeguard the communication network, there were significant  weaknesses in electronic access controls and other controls designed to  protect the confidentiality, integrity, and availability of the sensitive,  personally identifiable medical information it transmits. A key reason for these weaknesses was that  CMS did not always ensure the effective implementation of its security  policies and standards. As a result, sensitive, personally identifiable,  medical data traversing this network are vulnerable to unauthorized  disclosure, and these weaknesses could lead to disruptions in CMS  operations. Organizations accomplish this objective by designing and implementing  electronic controls that are intended to prevent, limit, and detect  unauthorized access to computing resources, programs, and information. Electronic access controls include those related to  user identification and authentication, authorization, boundary protection,  cryptography, and auditing and monitoring of security-related events. In addition, certain  network devices used vulnerable operating system software. CMS did not always ensure that its contractor sufficiently segregate  incompatible responsibilities and duties. Security Policies Were Not Always Fully Implemented

Although CMS has developed and documented information security  policies, a key reason for the communication network weaknesses was  that CMS did not always ensure the effective implementation of its  security policies and standards. Conclusions

Although CMS had many information security controls designed to  safeguard the communication network, missing controls and ineffective  implementation of certain controls, when considered collectively, threaten  the confidentiality and availability of the sensitive, personally identifiable  medical information it transmits.
Why GAO Did This Study

The Centers for Medicare & Medicaid Services (CMS), a component within the Department of Health and Human Services (HHS), is responsible for overseeing the Medicare and Medicaid programs--the nation's largest health insurance programs--which benefit about one in every four Americans. CMS relies on a contractor-owned and operated network to facilitate communication and data transmission among CMS business related entities. Effective information security controls are essential to protecting the confidentiality, integrity, and availability of this sensitive information. At Congress's request, GAO assessed the effectiveness of information security controls over the communication network used by CMS by conducting a technical assessment of the information security controls that are currently in place.

What GAO Found

Although CMS had many key information security controls in place--which had been designed to safeguard the communication network--some were missing, and existing ones had not always been effectively implemented. Significant weaknesses in electronic access and other system controls threatened the confidentiality and availability of sensitive CMS financial and medical information when it was transmitted across the network. CMS did not always ensure that its contractor effectively implemented electronic access controls designed to prevent, limit, and detect unauthorized access to sensitive computing resources and devices used to support the communication network. GAO discovered numerous vulnerabilities in several areas: user identification and authentication, user authorization, system boundary protection, cryptography, and auditing and monitoring of security-related events. There were also weaknesses in controls that had been designed to ensure that secure configurations would be implemented on network devices and that incompatible duties would be sufficiently segregated. A key reason for these weaknesses is that CMS did not always ensure that its security policies and standards were implemented effectively. As a result, sensitive, personally identifiable medical data traversing the network is vulnerable to unauthorized disclosure and these weaknesses could lead to disruptions in CMS services.