Press Releases

The Comptroller of Puerto Rico issued a qualified opinion on the operations of the Office of Information Technology and Technological Advances of the Department of Health. A qualified opinion is issued when noncompliance, individually or in the aggregate, is significant but not pervasive.

The Report reveals errors with the password policy in the profiles of the active access accounts. For example, the operating system did not allow, as provided by the regulations, changing the password at least every six months and did not require the password to be eight characters.

In addition, the Department had not defined an audit policy so that the system would produce records of, for example, the creation of an account, the restart and shutdown of the system, or the deactivation of an account or group of users. This situation prevents the Department from maintaining a record of the unusual events or problems occurring in the network in order to take corrective measures in time.

The two-finding audit also notes deficiencies with the process of deactivating the access accounts of former employees. From the examination performed, 87 access accounts of former employees were identified that, up to three years after their separation from employment, remained active, and 44% of them had been used.

The Department had also not deactivated 786 access accounts, some of which had gone up to 14 years without recording user login. In addition, the entity maintained 755 access accounts that had never been used. These situations prevent keeping the administration of access accounts under control and allow unauthorized persons to gain access to confidential information.
This second Report covers the period from October 1, 2019 to September 16, 2020.

See Audit Report T-21-16.

To see other published reports, visit our Audit Reports section.