Where To Report Waste

Fraud, Abuse, Or Retaliation

Maryland MMIS and E&E System Security Controls Were Partially Effective and Improvements Are Needed

Submitting OIG:

Department of Health & Human Services OIG

Date Issued:

Thursday, May 25, 2023

Agency Reviewed / Investigated:

Department of Health & Human Services

Submitting OIG-Specific Report Number:

A-18-21-09003

Component, if applicable:

Centers for Medicare & Medicaid Services

Centers for Medicare and Medicaid Services

External entity, if applicable:

Maryland Department of Health

Location(s):

MD,

United States

Type of Report:

Audit

Questioned Costs:

$0

Funds for Better Use:

$0

Number of Recommendations:

4

Report updated under NDAA 5274:

No

View Document:

Attachment	Size
182109003.pdf	756.72 KB

Related Open Recommendations

Recommendation Number	Recommendation Status	Significant Recommendation	Additional Details
23-A-18-078.01	Open	No
We recommend that the Maryland Department of Health remediate the seven control findings OIG identified.
23-A-18-078.02	Open	No
We recommend that the Maryland Department of Health assess the effectiveness of all required NIST SP 800-53 controls according to the organization's defined frequency.
23-A-18-078.03	Open	No
We recommend that the Maryland Department of Health assess at least annually and if necessary, adjust baseline configurations for its MMIS and E&E public servers.
23-A-18-078.04	Open	No
We recommend that the Maryland Department of Health perform periodic phishing exercises and enhance employee and contractor cybersecurity awareness training based on the results of the phishing exercises, if needed.