HHS Watchdog Flags Medicaid IT Security Gaps in Some States

Penetration testing of 10 web-facing Medicaid management and enrollment systems found that while the nine states and one territory examined implemented “generally effective” security controls to prevent certain limited cyberattacks, improvements are needed to protect against more sophisticated attacks.

See Also: The Healthcare CISO’s Guide to Medical IoT Security

The findings come in a new report from the U.S. Department of Health and Human Services’ Office of Inspector General, which conducted the pen tests between 2020 and 2022 on a sample of nine states, plus Puerto Rico, for their Medicaid management information systems – or MMIS – and eligibility and enrollment systems, or E&E.

“In the healthcare sector, state MMIS and E&E systems are increasingly targeted by cybercriminals because of the valuable, sensitive information they contain,” HHS OIG wrote. “There has been a noticeable increase in ransomware, phishing and denial-of-service attacks that pose significant risks to critical healthcare systems and the data they manage,” the report said.

Overall, between 2012 and 2023, at least six states – South Carolina, Illinois, Maine, Utah, Iowa and Texas – have reported significant breaches involving Medicaid data, HHS OIG said. The largest, reported by Texas in 2021, affected 1.8 million people.

Jurisdictions pen tested for the report included Alabama, Illinois, Maryland, Massachusetts, Michigan, Minnesota, South Carolina, South Dakota, Utah and Puerto Rico.

“The 10 states effectively detected and responded to some of our simulated cyberattacks but they need to improve their detection and response to other types of cyberattacks,” HHS OIG said. “Cyber attackers would likely need a moderate to significant level of sophistication or complexity to compromise the state systems we audited,” HHS OIG said.

The tests were performed for HHS OIG by an outside contractor in accordance with generally accepted government auditing standards and agreed-upon rules of engagement between OIG, the auditing firm, and the sample states and territory, the report said.

HHS OIG assessed the states’ MMIS and E&E systems for several factors: That included compliance with applicable IT security control requirements; implementation and effectiveness of security controls; the existence of security vulnerabilities; and exploitability of identified weaknesses.

“We conducted penetration tests of MMIS and E&E systems’ public IP addresses and web application URLs to assess for vulnerabilities that can be used to exploit the systems,” HHS OIG said.

The auditors also conducted “simulated phishing campaigns against a subset of employees at each state MMIS & E&E organization to determine whether the employees were adequately trained to recognize and appropriately respond to malicious emails.”

HHS OIG testers found the most common weaknesses among the states involved four top National Institute of Standards and Technology SP 800-53, Revision 4, security controls that were not effectively implemented including:

• Transmission confidentiality and integrity controls in websites to ensure the protection of data transmitted;
• Remediation controls to properly identify, report and correct software flaws;
• Input validation controls to verify the validity or sanitize the information system input for public-facing systems;
• Error handling controls to prevent disclosure of information that could be used to facilitate a cyberattack by adversaries.

“Ineffective implementation of security controls in some state MMIS and E&E systems may lead to exploitation of vulnerabilities by malicious actors or insiders seeking to commit fraud, steal sensitive data and evade detection,” HHS OIG wrote.

“Lapses in security controls significantly increase the likelihood of successful cyberattacks and gaining unauthorized access to sensitive information.”

HHS OIG said it issued a total of 27 recommendations to the nine states and Puerto Rico.

Those included updating their MMIS and E&E systems and software, including patching outdated servers and web applications; assessing and enhancing tools for detecting vulnerabilities; enforcing secure coding practices; conducting testing and periodic evaluations to verify the effectiveness of security controls; updating cryptographic settings annually; and refining vulnerability management strategies.

HHS OIG said all nine states and Puerto Rico reported that they had either fixed the weaknesses identified or were working on resolving them at the time the individual reports were issued. As of May, nearly half of the 27 recommendations – 13 – were implemented by the various states, HHS OIG said.