Finding 1158250 (2024-003)

Material Weakness Repeat Finding
Requirement
P
Questioned Costs
-
Year
2024
Accepted
2025-09-30
Audit: 370126
Organization: Providence St. Joseph Health (WA)
Auditor: Kpmg LLP

AI Summary

  • Core Issue: The Health System lacks a written information security program that meets the requirements of the Gramm-Leach-Bliley Act (GLBA), specifically the eight minimum safeguards.
  • Impacted Requirements: Compliance with GLBA is not met, as existing policies do not adequately cover the information technology system used by the Nursing School.
  • Recommended Follow-Up: Management should update IT policies and procedures by December 31, 2025, to ensure compliance with GLBA guidelines, including risk assessments and safeguard documentation.

Finding Text

Federal Program: Student Financial Assistance Cluster, ALN No. 84.063 and 84.268 Federal Agency: U.S Department of Education Federal Award Year: July 1, 2023 – June 30, 2024 and July 1, 2024 - June 30, 2025 Criteria or Requirement: The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). Condition found, including facts that support the deficiency identified in the finding and information to provide proper perspective for judging the prevalence and consequences of the finding: While the Health System has policies in place, as it relates to the student system (Empower) used by the Nursing School, the Health System did not have a written information security program to address the eight minimum safeguards identified in 16.CFR 314.4(c)(1) – (8). Cause and possible asserted effect: The Health System did not have policies or procedures indicating its compliance with certain aspects of GLBA. As a result, the Health System did not comply with GLBA written requirements. Identification of questioned costs and how they were computed: None Whether the sampling was a statistically valid sample: The sample was not intended to be, and was not, a statistically valid sample. Identification of whether the audit finding is a repeat of a finding in the immediately prior audit and if so, the applicable prior year finding number: No. This finding was not a finding in the immediate prior year audit. Recommendations: We recommend that management update their information technology policies and procedures to address the guidelines outlined by the GLBA. Views of responsible officals: Management acknowledges the findings related to compliance with GLBA requirements. The missing elements were primarily due to existing policies and procedures not specifically covering the information technology system utilized by the School of Nursing. Management will update their information technology policies and procedures to ensure full compliance with the 7 required elements outlined by the GLBA. This will include updating risk assessment procedures, designing safeguards based on risk assessments procedures, monitoring these safeguards, and documenting the results. These policy and procedure updates will be implemented by December 31, 2025.

Corrective Action Plan

Management acknowledges the findings related to compliance with GLBA requirements. The missing elements were primarily due to existing policies and procedures not specifically covering the information technology system utilized by the School of Nursing. Management will update their information technology policies and procedures to ensure full compliance with the 7 required elements outlined by the GLBA. This will include updating risk assessment procedures, designing safeguards based on risk assessments procedures, monitoring these safeguards, and documenting the results. These policy and procedure updates will be implemented by December 31, 2025.

Categories

Subrecipient Monitoring

Other Findings in this Audit

  • 1158245 2024-001
    Material Weakness Repeat
  • 1158246 2024-001
    Material Weakness Repeat
  • 1158247 2024-002
    Material Weakness Repeat
  • 1158248 2024-002
    Material Weakness Repeat
  • 1158249 2024-003
    Material Weakness Repeat
  • 1158251 2024-004
    Material Weakness Repeat
  • 1158252 2024-004
    Material Weakness Repeat
  • 1158253 2024-005
    Material Weakness Repeat
  • 1158254 2024-005
    Material Weakness Repeat
  • 1158255 2024-005
    Material Weakness Repeat
  • 1158256 2024-005
    Material Weakness Repeat
  • 1158257 2024-005
    Material Weakness Repeat
  • 1158258 2024-005
    Material Weakness Repeat
  • 1158259 2024-005
    Material Weakness Repeat
  • 1158260 2024-005
    Material Weakness Repeat
  • 1158261 2024-005
    Material Weakness Repeat
  • 1158262 2024-005
    Material Weakness Repeat
  • 1158263 2024-005
    Material Weakness Repeat
  • 1158264 2024-005
    Material Weakness Repeat
  • 1158265 2024-005
    Material Weakness Repeat
  • 1158266 2024-005
    Material Weakness Repeat
  • 1158267 2024-005
    Material Weakness Repeat
  • 1158268 2024-005
    Material Weakness Repeat
  • 1158269 2024-005
    Material Weakness Repeat
  • 1158270 2024-005
    Material Weakness Repeat
  • 1158271 2024-005
    Material Weakness Repeat
  • 1158272 2024-005
    Material Weakness Repeat
  • 1158273 2024-005
    Material Weakness Repeat
  • 1158274 2024-005
    Material Weakness Repeat
  • 1158275 2024-005
    Material Weakness Repeat
  • 1158276 2024-005
    Material Weakness Repeat
  • 1158277 2024-005
    Material Weakness Repeat
  • 1158278 2024-005
    Material Weakness Repeat
  • 1158279 2024-005
    Material Weakness Repeat
  • 1158280 2024-005
    Material Weakness Repeat
  • 1158281 2024-005
    Material Weakness Repeat
  • 1158282 2024-005
    Material Weakness Repeat
  • 1158283 2024-005
    Material Weakness Repeat
  • 1158284 2024-005
    Material Weakness Repeat
  • 1158285 2024-005
    Material Weakness Repeat
  • 1158286 2024-005
    Material Weakness Repeat

Programs in Audit

ALN Program Name Expenditures
14.251 Economic Development Initiative, Community Project Funding, and Miscellaneous Grants $5.11M
84.268 Federal Direct Student Loans $1.69M
93.817 Hospital Preparedness Program (hpp) Ebola Preparedness and Response Activities $1.24M
84.063 Federal Pell Grant Program $1.04M
93.391 Activities to Support State, Tribal, Local and Territorial (stlt) Health Department Response to Public Health Or Healthcare Crises $965,406
14.867 Indian Housing Block Grants $805,338
93.493 Congressional Directives $731,821
93.052 National Family Caregiver Support, Title Iii, Part E $487,158
93.884 Primary Care Training and Enhancement $330,389
14.228 Community Development Block Grants/state's Program and Non-Entitlement Grants in Hawaii $250,000
93.558 Temporary Assistance for Needy Families $232,276
93.838 Lung Diseases Research $183,500
93.398 Cancer Research Manpower $181,359
16.053 Sexual Assault Forensic Examinations $173,948
16.758 Improving the Investigation and Prosecution of Child Abuse and the Regional and Local Children's Advocacy Centers $168,990
93.243 Substance Abuse and Mental Health Services Projects of Regional and National Significance $166,830
93.421 Strengthening Public Health Systems and Services Through National Partnerships to Improve and Protect the Nation’s Health $164,531
93.242 Mental Health Research Grants $151,755
16.560 National Institute of Justice Research, Evaluation, and Development Project Grants $150,503
93.083 Prevention of Disease, Disability, and Death Through Immunization and Control of Respiratory and Related Diseases $150,253
93.575 Child Care and Development Block Grant $135,414
93.350 National Center for Advancing Translational Sciences $129,088
16.738 Edward Byrne Memorial Justice Assistance Grant Program $119,013
93.394 Cancer Detection and Diagnosis Research $117,698
93.310 Trans-Nih Research Support $100,000
16.017 Sexual Assault Services Formula Program $99,151
14.275 Housing Trust Fund $97,703
93.279 Drug Use and Addiction Research Programs $87,792
93.732 Mental and Behavioral Health Education and Training Grants $73,787
93.226 Research on Healthcare Costs, Quality and Outcomes $65,946
93.825 National Ebola Training and Education Center (netec) $61,927
93.497 Family Violence Prevention and Services/ Sexual Assault/rape Crisis Services and Supports $58,780
16.588 Violence Against Women Formula Grants $51,688
93.959 Block Grants for Prevention and Treatment of Substance Abuse $50,001
93.RD1 None $49,722
93.847 Diabetes, Digestive, and Kidney Diseases Extramural Research $46,987
93.917 Hiv Care Formula Grants $46,387
10.561 State Administrative Matching Grants for the Supplemental Nutrition Assistance Program $46,361
10.557 Wic Special Supplemental Nutrition Program for Women, Infants, and Children $43,697
97.008 Non-Profit Security Program $40,365
20.703 Interagency Hazardous Materials Public Sector Training and Planning Grants $32,841
84.181 Special Education-Grants for Infants and Families $32,000
12.420 Military Medical Research and Development $30,428
93.080 Blood Disorder Program: Prevention, Surveillance, and Research $27,297
93.137 Community Programs to Improve Minority Health $25,498
93.395 Cancer Treatment Research $19,600
93.853 Extramural Research Programs in the Neurosciences and Neurological Disorders $15,723
93.353 21st Century Cures Act - Beau Biden Cancer Moonshot $13,753
93.U01 None $13,497
21.027 Coronavirus State and Local Fiscal Recovery Funds $13,490
93.889 National Bioterrorism Hospital Preparedness Program $10,028
93.946 Cooperative Agreements to Support State-Based Safe Motherhood and Infant Health Initiative Programs $8,811
93.855 Allergy and Infectious Diseases Research $8,248
93.839 Blood Diseases and Resources Research $8,000
10.331 Gus Schumacher Nutrition Incentive Program $7,708
93.866 Aging Research $7,150
93.301 Small Rural Hospital Improvement Grant Program $6,626
93.U02 None $5,000
16.575 Crime Victim Assistance $4,253
14.241 Housing Opportunities for Persons with Aids $3,600
93.865 Child Health and Human Development Extramural Research $3,400
93.399 Cancer Control $3,000
93.840 Translation and Implementation Science Research for Heart, Lung, Blood Diseases, and Sleep Disorders $2,000
93.307 Minority Health and Health Disparities Research $1,899
93.103 Food and Drug Administration Research $1,776
17.285 Registered Apprenticeship $1,489
10.217 Higher Education - Institution Challenge Grants Program $1,294
93.397 Cancer Centers Support Grants $1,238
93.110 Maternal and Child Health Federal Consolidated Programs $168
10.649 Pandemic Ebt Administrative Costs $-1,020