Overview
During our audit period, MassHealth did not annually update its continuity of operations plan (COOP) for its mission-critical information technology (IT) system, the Medicaid Management Information System (MMIS). The last COOP MassHealth prepared was dated July 1, 2016. Further, MassHealth did not conduct any annual staff training or exercises to test the effectiveness of its COOP during a simulated emergency situation.
As a result, MassHealth’s COOP may not be sufficient to ensure that MassHealth can continue to provide all its services during an emergency situation.
Authoritative Guidance
Executive Order 490 states,
Section 4. [A] secretariat or agency shall regularly, and in no event less than once per calendar year, conduct trainings and exercises to put into practice its submitted . . . Continuity of Operations plans.
Section 5. These trainings and exercises shall be designed to simulate emergency situations which may arise, and shall be designed to test the effectiveness of the various components of the . . . Continuity of Operations plans. . . .
Section 6. Each . . . secretariat within the executive department shall incorporate findings from these trainings and exercises into its . . . Continuity of Operations plans, and based on these findings, shall regularly, and in no event less than once per calendar year, update these plans. . . . Likewise, each . . . agency within the executive department shall incorporate findings from these trainings and exercises into its Continuity of Operations plan, and based on these findings, shall regularly, and in no event less than once per calendar year, update its Continuity of Operations Plan.
Reasons for Issue
MassHealth officials stated that the agency had decided to delay updating its COOP until the 2019 coronavirus pandemic had substantially abated so that it could incorporate the lessons it learned from its pandemic response into an updated version of the COOP. Although MassHealth did have policies and procedures regarding the annual updating and testing of the COOP, it had not established monitoring controls to ensure that it properly adhered to them.
Recommendations
- MassHealth should establish monitoring controls to ensure that it properly adheres to the policies and procedures it has established for updating and testing its COOP.
- MassHealth should work with the Executive Office of Health and Human Services (EOHHS) to annually update its COOP and conduct staff training and exercises.
Auditee’s Response
As noted during the course of the audit, MassHealth was in the process of updating its COOP in early 2020 but suspended its efforts and redirected staff efforts in response to the [2019 coronavirus] pandemic. At a time that required immediate reprioritization, MassHealth focused its efforts on successfully maintaining critical operations during this global pandemic.
MassHealth agrees with the [Office of the State Auditor’s] recommendations listed above and has resumed its work to update the MassHealth COOP. MassHealth is also establishing monitoring controls to ensure adherence to COOP-related procedures.
Auditor’s Reply
Based on its response, MassHealth is taking measures to address our concerns on this matter.
| Date published: | July 15, 2022 |
|---|