Controls For Handling TVA Private Information - ActiveHealth Management

The OIG evaluated the (1) security controls for protecting TVA data transmitted to and handled by ActiveHealth and (2) adequacy of and compliance with TVA contract terms for security and data protection. In summary, we determined, (1) appropriate controls were in place to effectively protect personally identifiable information and protected health information transmitted to and handled by ActiveHealth, and (2) ActiveHealth complied with the security terms included in the TVA contract. However, we identified opportunities to improve (1) the ActiveHealth control environment, (2) TVA's contract terms for health services, and (3) TVA's communication of ActiveHealth's role in the health benefits package. Summary Only