Skip to main content
U.S. flag

An official website of the United States government

Dot gov

The .gov means it's official.
Federal government websites often end in .gov or .mil. Before sharing sensitive information, make sure you're on a federal government site.


The site is secure.
The https:// ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely.

Review of Medicare Administrative Contractor Information Security Program Evaluations for Fiscal Year 2020

Why OIG Did This Review

The Social Security Act requires that each Medicare administrative contractor (MAC) have its information security program evaluated annually by an independent entity. The Centers for Medicare & Medicaid Services (CMS) contracted with Guidehouse, LLP (Guidehouse), to evaluate information security programs at the MACs, using a set of agreed-upon procedures (AUPs). HHS OIG must submit to Congress annual reports on the results of these evaluations, to include assessments of their scope and sufficiency. This report fulfills that responsibility for fiscal year 2020.

Our objectives were to assess the scope and sufficiency of MAC information security program evaluations and report the results of those evaluations.

How OIG Did This Review

We reviewed Guidehouse's working papers to determine whether Guidehouse sufficiently addressed all areas required by the AUPs. We also determined whether all security-related weaknesses were included in the Guidehouse reports by comparing supporting documentation with the reports. We determined whether all gaps in the Guidehouse reports were adequately supported by comparing the reports with the Guidehouse working papers.

What OIG Found

Guidehouse's evaluations of the contractor information security programs were adequate in scope and sufficiency. Guidehouse reported a total of 99 gaps at the 7 MACs for FY 2020, which was 21 percent less than the number of gaps for the same 7 MACs in FY 2019. Deficiencies remained in eight of the nine Federal Information Security Modernization Act of 2014 control areas that were tested. CMS should continue its oversight visits and ensure that the MACs remediate all gaps to improve the MACs' information technology security. Similar gaps from prior years should be considered repeat findings to highlight systemic problems and the existence of continued exposure to known weaknesses.

What OIG Recommends

This report contains no recommendations.

Filed under: Centers for Medicare and Medicaid Services