Stay Informed
of New Reports
Twitter
Where To Report Waste
Fraud, Abuse, Or Retaliation
Where To Report Waste Fraud, Abuse, Or Retaliation

Report of Investigation Regarding the 2019 Clearinghouse Data Breach

Related Open Recommendations

Recommendation Number Recommendation Status Significant Recommendation Additional Details
1 Open Yes
Reconvene the BRT to assess the full extent of the breach, and base its response on the totality of the breach.
2 Open No
Establish blanket purchase agreements for identity monitoring, credit monitoring, and other related services for data breach victims.
3 Open No
Complete and publish a document describing lessons learned after the BRT completes its work related to this breach.
4 Open No
Complete and document annual tabletop exercises. The tabletop exercises test the breach response plan and help ensure that members of the team are familiar with the plan and understand their specific roles. Tabletop exercises should be used to practice a coordinated response to a breach, to further refine and validate the breach response plan, and to identify potential weaknesses in the agency's response capabilities.
5 Open No
Conduct an annual Breach Response Policy plan review.
6 Open No
Establish and complete an annual schedule to review blanket purchase agreements for adequacy, complete and document the tabletop exercise, and publish the updated annual Breach Response Policy plan review.
12 Open Yes
Review all available data and establish an accurate identification of all data inadvertently released, internally and externally, from 2010 to 2019.
13 Open Yes
Obtain an independent review of a sample of Clearinghouse responses prior to 2010 to determine the need for an expanded scope of the review.
15 Open Yes
Establish a process for communicating and enforcing the implementation of recommendations previously agreed to by management, as required by law.
17 Open Yes
Implement a single data extraction tool to allow maximum functionality in searching multiple product codes while adequately blocking protected data from release. This tool should default to block ALL fields which may contain 6(b) information and PII data. This data tool must contain a standardized data dictionary to limit placement of restricted information to identified fields.

Pages

Displaying 10 of 21 Recommendations