Centene Corporation is a leading healthcare enterprise that provides access to healthcare services. The company focuses on government-sponsored healthcare programs, including Medicaid and Medicare, as well as individuals and families served by the Health Insurance Marketplace. Centene operates in all 50 states and serves over 28.6 million managed care members.
Health Net Federal Services, Inc. (HNFS) of Rancho Cordova, is a subsidiary of Centene Corporation. HNFS provides healthcare services to military service members, retirees, and their families through the TRICARE program. HNFS is responsible for managing the TRICARE West Region, which includes processing claims, providing customer service, and ensuring access to healthcare for beneficiaries.
HNFS and its corporate parent, Centene Corporation, have agreed to pay $11,253,400 to resolve claims that HNFS falsely certified compliance with federal contractor cybersecurity requirements, The cybersecurity requirements were contained in a contract between HNFS and the U.S. Department of Defense (DoD) to administer the Defense Health Agency’s (DHA) health insurance program TRICARE for servicemembers and their families.
The settlement resolves allegations that, between 2015 and 2018, HNFS failed to meet certain cybersecurity controls and falsely certified compliance with them in annual reports to DHA that were required under its contract. The United States alleged that HNFS failed to timely scan for known vulnerabilities and to remedy security flaws on its networks and systems, in accordance with its System Security Plan and the response times HNFS had established.
Furthermore, the United States alleged HNFS ignored reports from third-party security auditors and its internal audit department of cybersecurity risks on HNFS’s networks and systems related to asset management; access controls; configuration settings; firewalls; end-of-life hardware and software in use; patch management (i.e., installing critical security updates released by vendors to counter known threats); vulnerability scanning; and password policies. Nonetheless, the United States alleged, HNFS annually certified to DHA that it complied with controls that it violated and, for all of these reasons, its claims for payment were false.
The government’s pursuit of this matter is part of its ongoing efforts to hold accountable entities or individuals that put sensitive information at risk by knowingly providing deficient cybersecurity products or services, knowingly misrepresenting their cybersecurity practices or protocols or knowingly violating obligations to monitor and report cybersecurity incidents. Information on how to report cyberfraud can be found here.
The claims asserted against defendants are allegations only; there has been no determination of liability.