[{"innerBlocks":[],"name":"core\/freeform","postId":1250,"blockType":{"name":"core\/freeform","keywords":[],"attributes":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"providesContext":[],"usesContext":[],"selectors":[],"supports":{"className":false,"customClassName":false,"reusable":false},"styles":[],"variations":[],"apiVersion":3,"title":"Classic","description":"Use the classic WordPress editor.","category":"text"},"originalContent":"The National Institutes of Health does not have adequate controls in place when it comes to permitting and monitoring access to the agency\u2019s sensitive data.

That\u2019s the finding of an audit by the Department of Health and Human Services\u2019 Office of Inspector General.

According to OIG, NIH is the largest public funder of biomedical research agency in the world. However, auditors have identified risks related to the sharing of the agency\u2019s sensitive data.

\u201cWe reviewed NIH\u2019s internal controls for monitoring and permitting access to sensitive data,\u201d OIG reported. \u201cNIH should improve its controls when permitting access to sensitive NIH data.\u201d

Also See:<\/b> NIH takes steps to safeguard participant data for PMI national cohort<\/a>

Among the OIG\u2019s overall recommendations are that NIH:

\u2022\tWork with an organization with expertise and knowledge in scientific data misuse.

\u2022\tStrengthen its controls by developing a security framework, conducting a risk assessment, and implementing additional appropriate security controls designed to safeguard sensitive data.

\u2022\tDevelop and implement mechanisms to ensure data security policies keep current with emerging threats.

\u2022\tMake security awareness training and security plans a requirement.

In written comments to the OIG, NIH concurred with auditors\u2019 recommendations to develop a security framework, conduct a risk assessment and implement additional controls for sensitive data. The agency also agreed with OIG\u2019s recommendations to ensure security policies keep current with emerging threats and to make training and security plans a requirement.

Nonetheless, NIH disagreed with the OIG\u2019s call for additional controls to ensure training and security plan requirements have been fulfilled. In addition, the agency also informed auditors that it recently established a working group to address and mitigate risk to intellectual property, as well as to protect the integrity of the peer-review process.

\u201cWe maintain that our findings and recommendations are valid,\u201d concluded OIG. \u201cWe recognize that NIH reported that it is already taking certain actions, such as the working group that was recently established, that may address our recommendations. We also provided NIH with other potential actions to address our findings and recommendations. If NIH determines that it does not need to strengthen its controls, it should document that determination consistent with applicable federal regulations and guidance.\u201d
","saveContent":"The National Institutes of Health does not have adequate controls in place when it comes to permitting and monitoring access to the agency\u2019s sensitive data.

That\u2019s the finding of an audit by the Department of Health and Human Services\u2019 Office of Inspector General.

According to OIG, NIH is the largest public funder of biomedical research agency in the world. However, auditors have identified risks related to the sharing of the agency\u2019s sensitive data.

\u201cWe reviewed NIH\u2019s internal controls for monitoring and permitting access to sensitive data,\u201d OIG reported. \u201cNIH should improve its controls when permitting access to sensitive NIH data.\u201d

Also See:<\/b> NIH takes steps to safeguard participant data for PMI national cohort<\/a>

Among the OIG\u2019s overall recommendations are that NIH:

\u2022\tWork with an organization with expertise and knowledge in scientific data misuse.

\u2022\tStrengthen its controls by developing a security framework, conducting a risk assessment, and implementing additional appropriate security controls designed to safeguard sensitive data.

\u2022\tDevelop and implement mechanisms to ensure data security policies keep current with emerging threats.

\u2022\tMake security awareness training and security plans a requirement.

In written comments to the OIG, NIH concurred with auditors\u2019 recommendations to develop a security framework, conduct a risk assessment and implement additional controls for sensitive data. The agency also agreed with OIG\u2019s recommendations to ensure security policies keep current with emerging threats and to make training and security plans a requirement.

Nonetheless, NIH disagreed with the OIG\u2019s call for additional controls to ensure training and security plan requirements have been fulfilled. In addition, the agency also informed auditors that it recently established a working group to address and mitigate risk to intellectual property, as well as to protect the integrity of the peer-review process.

\u201cWe maintain that our findings and recommendations are valid,\u201d concluded OIG. \u201cWe recognize that NIH reported that it is already taking certain actions, such as the working group that was recently established, that may address our recommendations. We also provided NIH with other potential actions to address our findings and recommendations. If NIH determines that it does not need to strengthen its controls, it should document that determination consistent with applicable federal regulations and guidance.\u201d
","order":0,"get_parent":{},"attributes":[],"attributesType":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"dynamicContent":""}]

OIG identifies risks related to NIH’s sharing of sensitive data

More for you