An Audit of Confidential Data Management at the Health and Human Services Commission
While the Health and Human Services Commission (Commission) implemented some processes and controls to secure its
confidential data, it should strengthen those processes and controls to help prevent unauthorized disclosure of its
To minimize security risks, auditors communicated details about the audit findings separately to the
Commission in a confidential report.
One chapter was rated Priority because of issues that could critically affect the Commission’s ability to effectively
administer its information security function. In addition, two chapters were rated High because of issues that could
substantially affect the Commission’s ability to effectively administer its information security function.
The Commission fully implemented two and substantially implemented one prior State Auditor’s Office recommendations
related to information technology.