[{"innerBlocks":[],"name":"core\/freeform","postId":810,"blockType":{"name":"core\/freeform","keywords":[],"attributes":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"providesContext":[],"usesContext":[],"selectors":[],"supports":{"className":false,"customClassName":false,"reusable":false},"styles":[],"variations":[],"apiVersion":3,"title":"Classic","description":"Use the classic WordPress editor.","category":"text"},"originalContent":"Participant data from the National Institutes of Health\u2019s Precision Medicine Initiative could potentially be at risk, according to the Department of Health and Human Services\u2019 Office of the Inspector General.

The All of Us<\/i> Research Program, a major component of the NIH Precision Medicine Initiative, is trying to recruit one million Americans to contribute their physical, genomic and electronic health record data to help researchers achieve medical breakthroughs.

Participants are providing blood and urine samples, and granting access to their EHRs. In addition, information is being collected from program volunteers through fitness trackers, physical measurements and surveys.

However, an OIG audit of information system general controls at one of the seven components of the All of Us <\/i>program\u2014the Participant Technology Systems Center (PTSC) awarded to Vibrent Health\u2014found serious vulnerabilities; by contrast, none were found at the Data and Research Center, which had been awarded to Vanderbilt University Medical Center.

According to the OIG, the PTSC develops mobile apps and websites for participants to enroll in the All of Us program, provide data and receive updates, while also supporting ongoing testing and upgrades to improve the user experience, implements innovative participant tools, as well as ensure the security of participant-facing systems.

\u201cThe PTSC did not have adequate controls to protect All of Us<\/i> participants\u2019 sensitive data,\u201d states OIG\u2019s report<\/a>. \u201cNIH did not adequately monitor the PTSC to ensure that the PTSC had implemented adequate cybersecurity controls to protect the participants' sensitive data. Based on the results of our penetration testing at the PTSC, we identified vulnerabilities that could expose personally identifiable information, including personal health information of the All of Us<\/i> participants, and allow access to their data.\u201d

Also See<\/b>: Participant Center taking shape for PMI cohort<\/a>

\u201cThese vulnerabilities could have allowed an attacker with limited technical knowledge to exploit and compromise the PTSC\u2019s systems, as most of the vulnerabilities did not require significant technical knowledge to exploit,\u201d according to auditors. \u201cIn addition, the PTSC failed to enable encryption in the S3 buckets used for cloud storage. The PTSC did not have policies and procedures to address remediating source code vulnerabilities and timely disabling of network access. Finally, the PTSC did not adequately scan its network.\u201d

However, thanks to the audit, NIH and the PTSC addressed and remediated all of the vulnerabilities that the OIG identified.

The OIG\u2019s report recommended that NIH revise its All of Us<\/i> cooperative agreements\u2014and cooperative agreements with security and privacy requirements\u2014to include a detailed description of how the agency will monitor cybersecurity and ensure that future awardees adequately implement security controls to protect sensitive data.

\u201cIn written comments on our draft report, NIH requested that we revise our recommendation to limit the scope of applicability to \u2018appropriately focus on those cooperative agreement awards with security and privacy requirements,\u2019 which we have done,\u201d notes the OIG. \u201cNIH stated that, based on our recommendation, it is reviewing All of Us<\/i> Research Program awards. Specifically, NIH stated that it will make necessary updates to security and privacy terms and conditions.\u201d","saveContent":"Participant data from the National Institutes of Health\u2019s Precision Medicine Initiative could potentially be at risk, according to the Department of Health and Human Services\u2019 Office of the Inspector General.

The All of Us<\/i> Research Program, a major component of the NIH Precision Medicine Initiative, is trying to recruit one million Americans to contribute their physical, genomic and electronic health record data to help researchers achieve medical breakthroughs.

Participants are providing blood and urine samples, and granting access to their EHRs. In addition, information is being collected from program volunteers through fitness trackers, physical measurements and surveys.

However, an OIG audit of information system general controls at one of the seven components of the All of Us <\/i>program\u2014the Participant Technology Systems Center (PTSC) awarded to Vibrent Health\u2014found serious vulnerabilities; by contrast, none were found at the Data and Research Center, which had been awarded to Vanderbilt University Medical Center.

According to the OIG, the PTSC develops mobile apps and websites for participants to enroll in the All of Us program, provide data and receive updates, while also supporting ongoing testing and upgrades to improve the user experience, implements innovative participant tools, as well as ensure the security of participant-facing systems.

\u201cThe PTSC did not have adequate controls to protect All of Us<\/i> participants\u2019 sensitive data,\u201d states OIG\u2019s report<\/a>. \u201cNIH did not adequately monitor the PTSC to ensure that the PTSC had implemented adequate cybersecurity controls to protect the participants' sensitive data. Based on the results of our penetration testing at the PTSC, we identified vulnerabilities that could expose personally identifiable information, including personal health information of the All of Us<\/i> participants, and allow access to their data.\u201d

Also See<\/b>: Participant Center taking shape for PMI cohort<\/a>

\u201cThese vulnerabilities could have allowed an attacker with limited technical knowledge to exploit and compromise the PTSC\u2019s systems, as most of the vulnerabilities did not require significant technical knowledge to exploit,\u201d according to auditors. \u201cIn addition, the PTSC failed to enable encryption in the S3 buckets used for cloud storage. The PTSC did not have policies and procedures to address remediating source code vulnerabilities and timely disabling of network access. Finally, the PTSC did not adequately scan its network.\u201d

However, thanks to the audit, NIH and the PTSC addressed and remediated all of the vulnerabilities that the OIG identified.

The OIG\u2019s report recommended that NIH revise its All of Us<\/i> cooperative agreements\u2014and cooperative agreements with security and privacy requirements\u2014to include a detailed description of how the agency will monitor cybersecurity and ensure that future awardees adequately implement security controls to protect sensitive data.

\u201cIn written comments on our draft report, NIH requested that we revise our recommendation to limit the scope of applicability to \u2018appropriately focus on those cooperative agreement awards with security and privacy requirements,\u2019 which we have done,\u201d notes the OIG. \u201cNIH stated that, based on our recommendation, it is reviewing All of Us<\/i> Research Program awards. Specifically, NIH stated that it will make necessary updates to security and privacy terms and conditions.\u201d","order":0,"get_parent":{},"attributes":[],"attributesType":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"dynamicContent":""}]

OIG pushes NIH to improve security controls for All of Us program

More for you