The Department of Health and Human Services has fulfilled fewer than half of its responsibilities under a federal law governing geospatial data, lacks a complete inventory of its own geographic data assets, and repeated a reporting deficiency it previously told auditors it would correct, according to a new inspector general audit.
The HHS Office of Inspector General found the department had fulfilled just six of 13 agency responsibilities established under the Geospatial Data Act of 2018. Seven remain unfulfilled.
Perhaps more notably, auditors found HHS had made no additional progress toward compliance since OIG last examined the department in fiscal year 2024.
That turns what might otherwise be an obscure fight over federal mapping standards into a considerably simpler problem: HHS was told what was wrong, agreed changes were necessary, and auditors returned to find many of the same problems still sitting there.
The new HHS OIG audit, released as report OAS-26-18-044, examined HHS compliance with the Geospatial Data Act, a 2018 law intended to improve how federal agencies collect, maintain, share and use geospatial information.
Geospatial data is information tied to a geographic location. Within HHS, it is not limited to drawing maps.
According to OIG, HHS uses geospatial information in systems including the National Environmental Public Health Tracking Network and GeoHealth, which supports situational awareness during emergencies, disasters and pandemics. The department also operates the emPOWER Map, which can help identify geographic concentrations of Medicare beneficiaries who rely on electricity-dependent medical equipment.
The Indian Health Service uses geographic information systems as well.
In other words, this is data with practical implications for public health, emergency response and government operations.
And HHS still does not have a complete inventory of it.
OIG found that HHS had failed to fulfill its statutory responsibility to maintain an inventory of all geospatial data assets associated with the department.
Auditors specifically connected that deficiency to cybersecurity.
Without a complete inventory, OIG warned, HHS may not properly account for all of its geospatial data when implementing cybersecurity controls or when reporting information to the Office of Management and Budget and Congress.
The audit did not identify an actual breach or conclude that sensitive geospatial information had been compromised. But the finding presents a familiar government information-security problem: protecting data becomes considerably more difficult when the agency does not have a complete accounting of what data it possesses.
That was only one of seven responsibilities OIG determined HHS had not fulfilled.
Auditors also found deficiencies involving resource allocation, application of geospatial data standards and metadata, coordination of partnerships, effective use of geospatial information, privacy and confidentiality protections, and procedures for checking existing data sources before spending federal money collecting additional information.
That last requirement is particularly notable.
The Geospatial Data Act requires agencies to search existing federal, state, local and private-sector sources of geospatial information, including the federal GeoPlatform, before using federal funds to collect new geospatial data.
OIG concluded HHS had not fulfilled that responsibility.
The audit does not calculate how much, if any, federal money was unnecessarily spent because of that deficiency. But the requirement exists precisely to prevent agencies from paying to recreate information the government or another source already possesses.
The more immediate accountability problem appears in HHS’s own annual compliance assessment.
During its fiscal year 2024 audit, OIG discovered that HHS staff divisions, in addition to the department’s operating divisions, collected, maintained, published, disseminated or preserved geospatial information.
HHS told auditors that its Office of the Chief Data Officer would survey both operating divisions and staff divisions in future assessments so that all HHS divisions would be represented.
Then came the department’s fiscal year 2025 assessment.
HHS surveyed only the operating divisions again.
As a result, OIG concluded the department’s FY2025 self-assessment did not provide a complete picture of HHS geospatial activities.
The department had effectively repeated the same problem auditors had previously identified and that HHS had said it intended to correct.
OIG also found what appears to be a broader management problem behind the department’s lack of progress.
According to the audit, HHS’s deficiencies resulted from limited department-wide oversight and coordination of its Geospatial Data Act activities. Auditors said HHS officials were also unaware they were supposed to document the department’s progress and compliance in its required annual report.
The result is an unusual disconnect between a statutory requirement that has existed since 2018 and the department responsible for carrying it out.
OIG warned that HHS’s continuing deficiencies increase the risk that the department will not realize one of the central purposes of the law: reducing the costs associated with acquiring, managing, sharing and using geospatial data, expertise, technology and services.
The watchdog issued four recommendations.
Among them, OIG called on HHS to develop policies and procedures for department-wide implementation of the law, develop and maintain a comprehensive inventory of geospatial data assets, establish procedures to ensure complete annual reporting, and address the remaining unfulfilled agency responsibilities.
HHS concurred with all four recommendations.
The department told auditors its Chief Information Officer and Chief Data Officer were developing the department’s Geospatial Data Act program, supporting publication of HHS geospatial data and its inventory through GeoPlatform, and identifying appropriate points of contact across the department.
HHS also said future assessments would include both operating and staff divisions.
That promise will sound familiar.
The department made a similar commitment after auditors identified the reporting deficiency during the previous audit.
The next assessment will show whether this one sticks.
