HHS has 14 operating divisions (see app. Weak Controls and Incomplete Implementation Compromise Effectiveness of HHS’s Information Security Program

HHS and CMS in particular have significant weaknesses in electronic  access controls and other information system controls designed to protect  the confidentiality, integrity, and availability of information and  information systems. A key reason for these weaknesses is that the  department has not yet fully implemented a departmentwide information  security program. Electronic access controls include those related to network  management, user accounts and passwords, user rights and file  permissions, and auditing and monitoring of security-related events. These controls include policies,  procedures, and techniques to physically secure computer resources,  conduct appropriate background investigations, provide sufficient  segregation of duties, and prevent unauthorized changes to application  software. These  weaknesses increase the risk that unauthorized individuals can gain access  to HHS information systems and inadvertently or deliberately disclose,  modify, or destroy the sensitive medical and financial data that the  department relies on to deliver its vital services. Information Security Program Is Not Yet Fully Implemented

A key reason for the information security weaknesses identified at HHS  was that the department had not yet fully implemented its information  security program. Without such a program, security  controls may be inadequate; responsibilities may be unclear,  misunderstood, and improperly implemented; and controls may be  inconsistently applied. Such conditions may lead to insufficient protection  of sensitive or critical resources and disproportionately high expenditures  for controls over low-risk resources. FISMA requires each agency to develop, document, and implement an  information security program that includes the following key elements:  periodic assessments of the risk and the magnitude of harm that could  result from the unauthorized access, use, disclosure, disruption,  modification, or destruction of information and information systems;  policies and procedures that (1) are risk-based, (2) cost-effectively  reduce risks, (3) ensure that information security is addressed  throughout the life cycle of each system, and (4) ensure compliance  with applicable requirements;  plans for providing adequate information security for networks,  facilities, and systems;  security awareness training to inform personnel—including contractors  and other users of information systems—of information security risks  and of their responsibilities in complying with agency policies and  procedures;  at least annual testing and evaluation of the effectiveness of information  security policies, procedures, and practices relating to management,  operational, and technical controls of every information system  identified in the agency’s inventory;  a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies in its information security  policies, procedures, or practices;  procedures for detecting, reporting, and responding to security   plans and procedures to ensure continuity of operations for information  systems that support the operations and assets of the agency. These weaknesses limit HHS’s  ability to protect the confidentiality, integrity, and availability of its  information and information systems. Centers for Medicare & Medicaid Services—administers the Medicare  and Medicaid programs, which provide health care to about one in every  four Americans.
Why GAO Did This Study

The Department of Health and Human Services (HHS) is the nation's largest health insurer and the largest grant-making agency in the federal government. HHS programs impact all Americans, whether through direct services, scientific advances, or information that helps them choose medical care, medicine, or even food. For example, the Centers for Medicare & Medicaid Services (CMS), a major operating division within HHS, is responsible for the Medicare and Medicaid programs that provide care to about one in every four Americans. In carrying out their responsibilities, both HHS and CMS rely extensively on networked information systems containing sensitive medical and financial information. GAO was asked to assess the effectiveness of HHS's information security program, with emphasis on CMS, in protecting the confidentiality, integrity, and availability of its information and information systems.

What GAO Found

HHS and CMS have significant weaknesses in controls designed to protect the confidentiality, integrity, and availability of their sensitive information and information systems. HHS computer networks and systems have numerous electronic access control vulnerabilities related to network management, user accounts and passwords, user rights and file permissions, and auditing and monitoring of security-related events. In addition, weaknesses exist in other types of controls designed to physically secure computer resources, conduct suitable background investigations, segregate duties appropriately, and prevent unauthorized changes to application software. All of these weaknesses increase the risk that unauthorized individuals can gain access to HHS information systems and inadvertently or deliberately disclose, modify, or destroy the sensitive data that the department relies on to deliver its vital services. A key reason for these control weaknesses is that the department has not yet fully implemented a departmentwide information security program. While HHS has laid the foundation for such a program by developing and documenting policies and procedures, the department has not yet fully implemented key elements of its information security program at all of its operating divisions. Specifically, HHS and its operating divisions have not fully implemented elements related to (1) risk assessments, (2) policies and procedures, (3) security plans, (4) security awareness and training, (5) tests and evaluations of control effectiveness, (6) remedial actions, (7) incident handling, and (8) continuity of operations plans. Until HHS fully implements a comprehensive information security program, security controls may remain inadequate; responsibilities may be unclear, misunderstood, and improperly implemented; and controls may be inconsistently applied. Such conditions may lead to insufficient protection of sensitive or critical resources and disproportionately high expenditures for controls over low-risk resources.