A federal audit of the agency that oversees the Idaho Medicaid program turned up weaknesses in the program's data security, according to a recent report. The Idaho Department of Health and Welfare said it is in the process of making sure all the problems are fixed.
The auditors "did not find any evidence that the weaknesses had been exploited" but that if they were, it could disrupt Medicaid operations and result in sensitive information being disclosed.
Idaho Medicaid fell short in several areas, according to the audit by the U.S. Department of Health and Human Services Office of Inspector General. The weak points cited by the audit include:
Inadequate password settings.
Inadequate encryption of network passwords.
Failing to make sure physical access to the Medicaid management system is limited to the people who need it.
Failing to run background checks on employees.
Inadequate training for employees responsible for information security.
For example, the auditors chose 10 employees who had access to protected health data and found that three employees had not been through a background check. Idaho Medicaid officials told the investigators they had recruited from providers and contractors who worked with Idaho Medicaid before and that they were already familiar with them. Medicaid Administrator Paul J. Leary told the OIG that the state agreed and it had policies for background checks but would "implement additional internal checks to ensure compliance" with those policies.
The investigators also picked five employees and found that while all five had received security training within the previous year, one of them had not received any training in the 20 years before. Leary said the agency will "research available training to support" the requirement for security training.
"All the findings we agreed with have been corrected or are in the process of being rectified," said Health and Welfare spokesman Tom Shanahan. "These type of audits are important to the state because they show us areas where we can make improvements."
Idaho's Medicaid program spent more than $1.6 billion to provide services to more than 225,000 people in fiscal year 2012, the audit said.
Audrey Dutton: 377-6448, @IDS_Audrey