Inadequate Security Management Practices Left Utah Department of Health Sensitive Medicaid Data at Risk of Unauthorized Disclosure 

The Utah Department of Technology Services' management had not established an effective enterprise security control structure to ensure that adequate information system general controls were implemented in conformance with Federal requirements over the systems used to support the Utah Department of Health's Medicaid eligibility determination and claims processing. These inadequate security management practices put Medicaid systems and data at risk.