Summary of Security Vulnerabilities Identified at Two Arizona Managed Care Organizations and Inconsistent Treatment of Medicaid Data Security at the State Agency and Managed Care Organizations

The HHS OIG's reviews of information system general controls at two Medicaid managed care organizations (MCOs) in Arizona identified numerous security vulnerabilities. The Arizona Health Care Cost Containment System administers Arizona's Medicaid program and is the State agency responsible for monitoring the operations of its contracted MCOs. The MCOs' systems depend on the effectiveness of information system general controls, which are critical to the confidentiality, integrity, and availability of Medicaid data.