HHS I.G. Audit: 'Review of Medicare Administrative Contractor Information Security Program Evaluations for FY 2020'

WASHINGTON, July 15 -- The Health and Human Services Inspector General issued the following audit report (No. A-18-21-11300) entitled "Review of Medicare Administrative Contractor Information Security Program Evaluations for FY 2020" filed under the Centers for Medicare and Medicaid Services:

* * *

Report in Brief

Here are excerpts:

Why OIG Did This Review

The Social Security Act requires that each Medicare administrative contractor (MAC) have its information security program evaluated annually by an independent entity. The Centers for Medicare & Medicaid Services (CMS) contracted with Guidehouse, LLP (Guidehouse), to evaluate information security programs at the MACs, using a set of agreed-upon procedures (AUPs). HHS OIG must submit to Congress annual reports on the results of these evaluations, to include assessments of their scope and sufficiency. This report fulfills that responsibility for fiscal year 2020.

Our objectives were to assess the scope and sufficiency of MAC information security program evaluations and report the results of those evaluations.

How OIG Did This Review

We reviewed Guidehouse's working papers to determine whether Guidehouse sufficiently addressed all areas required by the AUPs. We also determined whether all security-related weaknesses were included in the Guidehouse reports by comparing supporting documentation with the reports. We determined whether all gaps in the Guidehouse reports were adequately supported by comparing the reports with the Guidehouse working papers.

What OIG Found

Guidehouse's evaluations of the contractor information security programs were adequate in scope and sufficiency. Guidehouse reported a total of 99 gaps at the 7 MACs for FY 2020, which was 21 percent less than the number of gaps for the same 7 MACs in FY 2019. Deficiencies remained in eight of the nine Federal Information Security Modernization Act of 2014 control areas that were tested. CMS should continue its oversight visits and ensure that the MACs remediate all gaps to improve the MACs' information technology security. Similar gaps from prior years should be considered repeat findings to highlight systemic problems and the existence of continued exposure to known weaknesses.

What OIG Recommends

This report contains no recommendations.

* * *

TABLE OF CONTENTS

INTRODUCTION ... 1

Why We Did This Audit ... 1

Objectives ... 1

Background ... 1

The Medicare Program ... 1

Medicare Prescription Drug, Improvement, and Modernization Act of 2003 ... 1

CMS Evaluation Process for Fiscal Year 2020 ... 2

How We Conducted This Audit ... 3

RESULTS ... 3

Assessment of Scope and Sufficiency ... 3

Results of Evaluations on Medicare Administrative Contractor Information Security Programs ... 3

Periodic Testing of Information Security Controls ... 5

Policies and Procedures To Reduce Risk ... 5

Incident Detection, Reporting, and Response ... 6

Oversight Reviews ... 7

CONCLUSION ... 7

A: Audit Scope and Methodology ... 8

B: Gaps by Federal Information Security Modernization Act of 2014 Control Area and Medicare Administrative Contractor in Fiscal Year 2020 ... 9

C: Change in Gaps per Medicare Administrative Contractor, Fiscal Years 2019 and 2020 ... 10

D: Results of Medicare Administrative Contractor Evaluations for Federal Information Security Modernization Act of 2014 Control Areas With the Greatest Number of Gaps ... 11

* * *

INTRODUCTION

WHY WE DID THIS AUDIT

The Department of Health and Human Services, Office of Inspector General, is required to report to Congress the results of annual independent evaluations of the information security programs of Medicare administrative contractors (MACs) as required by the Social Security Act (the Act), as modified by the Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (MMA). These evaluations must address the eight major requirements enumerated in the Federal Information Security Modernization Act of 2014 (FISMA). The Act also requires evaluations of the information security controls for a subset of systems but does not specify the criteria for these evaluations. This report fulfills that responsibility for fiscal year (FY) 2020.

* * *

OBJECTIVES

Our objectives were to assess the scope and sufficiency of MAC information security program evaluations and report the results of those evaluations.

* * *

BACKGROUND

The Medicare Program

The Centers for Medicare & Medicaid Services (CMS) administers Medicare. Medicare is a health insurance program for people age 65 or older, people under age 65 with certain disabilities, and people of all ages with end-stage renal disease. In FY 2020, Medicare paid approximately $668 billion on behalf of more than 63 million Medicare beneficiaries. CMS contracts with MACs to administer Medicare benefits paid on a fee-for-service basis. In FY 2020, seven distinct entities served as MACs for Medicare Parts A and B to process and pay Medicare fee-for-service claims.

Medicare Prescription Drug, Improvement, and Modernization Act of 2003

The MMA added information security requirements for MACs to section 1874A of the Act. (See 42 U.S.C. Sec. 1395kk-1.) Each MAC must have its information security program evaluated annually by an independent entity (the Act Sec. 1874A(e)(2)(A)). This section requires that these evaluations address the eight major requirements enumerated in FISMA. (See 44 U.S.C. Sec. 3544(b).) These requirements, referred to as "FISMA control areas" in this report, are:

1. periodic risk assessments;

2. policies and procedures to reduce risk;

3. system security plans;

4. security awareness training;

5. periodic testing of information security controls;

6. remedial actions;

7. incident detection, reporting, and response; and

8. continuity of operations for information technology (IT) systems.

CMS added a ninth area for testing starting in FY 2015:

9. privacy.

Section 1874A(e)(2)(A)(ii) of the Act requires that the effectiveness of information security controls be tested for an appropriate subset of MACs' information systems. However, this section does not specify the criteria for evaluating these security controls.

Additionally, section 1874A(e)(2)(C)(ii) of the Act requires us to submit to Congress annual reports on the results of such evaluations, including assessments of their scope and sufficiency.

CMS Evaluation Process for Fiscal Year 2020

CMS developed agreed-upon procedures (AUPs) for the program evaluation on the basis of the requirements of section 1874A(e)(1) of the Act, FISMA, information security policy and guidance from the Office of Management and Budget and the National Institute of Standards and Technology (NIST), and the Government Accountability Office's (GAO's) Federal Information Systems Controls Audit Manual (FISCAM). In FY 2020, the independent auditors, Guidehouse, LLP (Guidehouse), under contract with CMS, used the AUPs to evaluate the information security programs at the seven entities that served as MACs. Two of the entities had multiple contracts with CMS to fulfill their responsibilities as Medicare Parts A and B MACs and durable medical equipment MACs. As a result, Guidehouse issued nine separate reports.

To comply with the section 1874A(e)(2)(A)(ii) requirement to test the effectiveness of information security controls for an appropriate subset of contractors' information systems, CMS included in the scope of its AUP evaluations testing of segments of the Medicare claim processing systems hosted at the Medicare data centers, which support each of the MACs.

Medicare data centers are used for "front-end" preprocessing of claims received from providers and "back-end" issuing of payments to providers after claims have been adjudicated.

The results of the MAC information security program evaluations are presented in terms of gaps, which are defined as a MAC's incomplete implementation of FISMA or CMS core security requirements. Guidehouse categorized gaps into three categories: high, moderate, and low risk. The MACs are responsible for developing a corrective action plan for each high- and moderate-risk gap, and CMS is responsible for tracking all corrective action plans and ensuring that such gaps are remediated in a timely manner. CMS does not require corrective action plans for low-risk gaps involving a MAC's internal controls and its operations, but those gaps are reviewed with the MACs during oversight visits.

CMS conducted a virtual oversight visit at each MAC during the year to address all gaps identified by Guidehouse during the prior year's reviews.

* * *

RESULTS

Guidehouse's evaluations of the contractor information security programs were adequate in scope and sufficiency. At the 7 MACs evaluated in FY 2020, Guidehouse identified a total of 99 gaps, of which 12 were high-risk gaps, 29 were moderate-risk gaps, and 58 were low-risk gaps.

* * *

CONCLUSION

The scope of the work and sufficiency of documentation for all reported gaps were sufficient for the seven MACs reviewed by Guidehouse. The total number of gaps identified at the MACs had decreased significantly from FY 2019. Deficiencies remained in eight of the nine FISMA control areas tested. CMS should continue its oversight visits and ensure that the MACs remediate all gaps to improve the MACs' IT security. Similar gaps from prior years should be considered repeat findings to highlight systemic problems and the existence of continued exposure to known weaknesses.

This report contains no recommendations.

* * *

View full report at https://oig.hhs.gov/oas/reports/region18/182111300.pdf