Press "Enter" to skip to content

DHSS increases WIC security following audit recommendations

  

Missouri’s health department has made changes to who can access the Supplemental Nutrition Program for Women, Infants, and Children (WIC) program system in an effort to increase security. 

The changes have come on the heels of a report from Auditor Nicole Galloway which gave Missouri WIC Information Network System (MOWINS), the state’s software program managing WIC, a rating of “good” but said improvements were needed when it came to data security. Specifically, the audit said some user accounts, including those at county health departments, were not removed in a timely fashion, leaving the system “vulnerable to the risk of unauthorized transactions being processed.” 

“Better data security of state programs such as this helps protect taxpayer dollars and the personal information of program participants,” Galloway said, adding she encouraged the health department officials to enact the audit’s recommendations

Lisa Cox, a spokesperson for the Department of Health and Senior Services (DHSS), said the department is removing access to MOWINS from users after 30 days of inactivity rather than the previous 90-day threshold. DHSS is also working on a strategy to communicate more frequently with local public health agencies to ensure it is notified when employees are terminated or transferred, she said. 

“At DHSS, we are committed to continuing our efforts to protect Missourians’ data with the findings from the State Auditor’s Office as there were no major or critical issues discovered,” Cox said. 

The audit reviewed authorized users to determine if anyone who had been terminated — meaning, someone who had left the organization and no longer needed to view the system — could still access it. On the state level, the audit did not find any terminated users with continued access. 

However, the audit did survey a sampling of users on the local level. There, it found only five former employees still had access to the system out of the 96 local agency user accounts reviewed. 

Cox said those individuals were still employed by WIC but were working at different local agencies. The department is also reviewing MOWINS user roles and will remove any “unnecessary” assignments of roles to users if found — another recommendation the audit made. 

In addition, Cox said DHSS plans to update its service level agreement with the Office of Administration’s Information Technology Services Division (ITSD). MOWINS is maintained by ITSD. The audit said there was not a current or comprehensive service level agreement between DHSS and the ITSD, leaving “the responsibilities and expectations between both parties not fully established or documented.” 

DHSS agreed with the audit’s recommendation and plans to have a new service level agreement in place by October 2022 that will be reviewed and updated yearly. 

An audit can give one of four ratings: excellent, good, fair, or poor. A designation of “good” is defined as: “The audit results indicate this entity is well managed. The report contains few findings, and the entity has indicated most or all recommendations have already been, or will be, implemented. In addition, if applicable, many of the prior recommendations have been implemented.”

Missouri had more than 92,200 participants in the WIC program, which is administered at the federal level, as of December 2020, according to the audit. The program is open to those who have a household income of less than 186 percent of the federal poverty income guidelines — so $42,025 for a four-person household as of April 1. It includes those who qualify for the supplemental nutrition assistance program (SNAP) or temporary assistance for needy families (TANF). 

MOWINS is part of SPIRIT software — which is used by nearly two dozen states. Missouri serves as the lead state for the SPIRIT system’s redevelopment project into a web-based system, according to the audit. The planned implementation for the new software is set for July 2022 although the audit said it is unknown when Missouri will implement it. 

Loader Loading...
EAD Logo Taking too long?
Reload Reload document
| Open Open in new tab