Final Audit Report - United States Office of …

1 Office OF PERSONNEL MANAGEMENT. Office OF THE inspector general . Office OF AUDITS. Final Audit Report Subject: Audit OF INFORMATION SYSTEMS general AND APPLICATION CONTROLS AT PREMERA BLUE CROSS Report No. l A-10-70-14-007. Date: November 28, 2014. --CAUTION- . This Audit rtport has betn distributed to Ftdtral officials who ire responslblt for the 1dmloistr1tion of the audited prognm. ThU Audit Report may contain pro prlc11 ry data which iJ protected by Fedenl law (18 1905). Tbectforc, while this audlt Report is available under the Frttdom of Information Act and made available to the public on the OlG wcbpagc, caution needs to be tJerciaed before releasing the Report to the general public u It may contain proprietary information that was redacted from the publicly distribuled copy.

2 United States Office OF PERSONNEL MANAGEMENT Washington. DC 20415 Office of the inspector general Audit Report FEDERAL EMPLOYEES HEALTH BENEFITS PROGRAM CONTRACT 1039 PREMERA BLUE CROSS PLAN CODES 10/11 MOUNTLAKE TERRACE, WASHINGTON Report No. lA-10-70-14-007. Date: Novembe r 28 , 2014. Michael R. Esser Assistant inspector general for Audits --CAUTION- Tbis 1udlt Report bu been distributed to officWJ wbo ire responsible ror the administration of the audited program. This Audit Report may contain proprietary data wblcb ii protected by Federal law (18 1905).

3 Tbertlorc, wbllc tbls 1ucllt Report ii available under tbe Freedom of l oform1tion Ad ud made available to the public oo the OIG webpagc, caution needs to be cxcrcl1cd before relcasl og the Report to the ceoeral public aa It may contain proprietary infor mation tb1t was reucted from tbc publicly distributed copy. United States Office OF PERSONNEL MANAGEMENT Washing to n, DC 20415 Office of the ln~pector general Executive Summary FEDERAL EMPLOYEES HEALTH BENEFITS PROGRAM CONTRACT 1039 PREMERA BLUE CROSS PLAN CODES 10/11 MOUNTLAKE TERRACE, WASHINGTON Report No.

4 LA-10-70-14-007. Date: November 28 , 2014. Tills Final Report discusses the results of our Audit of general and application controls over the information systems at Premera Blue Cross (Premera or Plan). Our Audit focused on the claims processing applications used to adjudicate Federal Employees Health Benefits Program (FEHBP) claims for Premera, as well as the various processes and information technology systems used to support these applications. We documented the controls in place and opportunities for improvement in each of the areas below.

5 Security Management Nothing came to our attention to indicate that Premera does not have an adequate security management program. Access Controls Premera has implemented controls to grant or prevent physical access to its data center, as well as logical controls to protect sensitive information. However, Premera's data center did not contain controls we typically observe at similar facilities, such as multi-factor authentication and piggybacking prevention. Since the issuance of the draft Report Premera has installed multi- i wwl!

6 Factor authentication, but has yet to implement piggybacking prevention. We also noted a weakness related to the password history configuration settings. Network Security Premera has implemented a thorough incident response and network security program. However, we noted several areas of concern related to Premera' s network security controls: A patch management policy is in place, but current scans show that patches are not being implemented in a timely manner;. A methodology is not in place to ensure that unsupported or out-of-date software is not utiJized.

7 Insecure server configurations were identified in a vulnerability scan. Configuration Management Premera has developed formal policies and procedures that provide guidance to ensure that system software is appropriately configured, updated, and changes are controlled. However, Premera has not documented formal baseline configurations that detail the approved settings for its server operating systems, and therefore cannot effectively Audit its security configuration settings. Contingency Planning We reviewed Premera' s business continuity and disaster recovery plans and concluded that they contained the key elements suggested by relevant guidance and publications.

8 However, Premera does not perform a complete disaster recovery test for all information systems. Claims Adjudication Premera has implemented many controls in its claims adjudication process to ensure that FEHBP. claims are processed accurately. However, we noted several weaknesses in Premera's claims application controls. Health Insurance Portability and Accountability Act CHIPAA). Nothing came to our attention that caused us to believe that Premera is not in compliance with the HIPAA security, privacy, and national provider identifier regulations.

9 11. Contents Page Executive Summary .. i I. Introduction .. l Background .. l Objectives .. l Scope .. l Methodology .. 2 Compliance with Laws and Regulations .. 3 II. Audit Findings and Recommendations .. 4 A. Security Management .. 4 B. Access Controls .. 4 C. Network Security .. 6 D. Configuration Management .. 8 E. Contingency Planning .. 9 F. Claims Adjudication .. 11 G. Health Insurance Portability and Accountability Act .. 14 Contributors to This Report .. 15 Appendix: Premera Blue Cross's June 30, 2014 response to the draft Audit Report issued April 17, 2014 I.

10 Introduction This Final Report details the findings, conclusions, and recommendations resulting from the Audit of general and application controls over the information systems responsible for processi ng Federal Employees Health Benefits Program (FEHBP) claims by Premera Blue Cross (Premera or Plan). The Audit was conducted pursuant to FEHBP contract CS 1039; 5 Chapter 89; and 5 of Federal Regulations (CFR) Chapter I, Part 890. The Audit was performed by the Office of Personnel Management's (OPM) Office of the inspector general (OIG), as established by the inspector general Act of 1978, as amended.