HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

OIG Discovers Multiple Security Vulnerabilities in the Massachusetts’ Medicaid Management Information System

The Department of Health and Human Services’ Office of Inspector General has published the results of an audit of the Massachusetts’ Medicaid Management Information System (MMIS).

The MMIS is maintained by the Massachusetts’s Executive Office of Health and Human Services which administers the State Medicaid program (MassHealth). The MMIS supports 1.67 million beneficiaries and processed around $13.8 billion in fiscal year 2015. The MMIS is used for the processing of Medicaid claims and recovery of claims’ reimbursement from third parties, healthcare authorization services, managed care, and the provider self-service portal.

The auditors looked at MassHealth websites, databases and the supporting IT systems to determine whether data and associated systems had been safeguarded in accordance with National Institute of Standards and Technology guidelines and federal requirements.

Auditors assessed MassHealth’s system security plan, risk assessments, use of data encryption, web applications, vulnerability management processes, and database applications.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

The auditors discovered numerous information security failures that could potentially have been exploited to gain access to the sensitive information of Medicaid recipients and could have compromised the integrity of the MassHealth program.

According to the report, the auditors discovered vulnerabilities existed in security and configuration management, system software controls and website and database integrity scanning. While no evidence was uncovered to suggest any of the vulnerabilities had already been exploited, OIG said “the vulnerabilities were collectively and, in some cases, individually significant and could have potentially compromised the confidentiality, integrity, and availability of MassHealth’s MMIS.” Those vulnerabilities existed as a direct result of a lack of sufficient control measures to safeguard information systems and Medicaid data.

Details of the vulnerabilities were passed to MassHealth to allow action to be taken to correct the security failures and ensure information systems and data are appropriately secured. MassHealth did not explicitly agree or disagree with any of the eight recommendations issued by OIG, although details of actions that had been taken to remediate all of the discovered vulnerabilities were provided to OIG.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.