Health Net to Pay $11.2 Million for Cybersecurity Violations

Health Net Federal Services agreed to pay $11,253,400 to resolve claims that it falsely certified compliance with cybersecurity requirements in a contract with the Defense Department to administer the TRICARE health benefits program, the Justice Department announced Tuesday.

According to the DOJ, between 2015 and 2018, HNFS failed to meet certain cybersecurity controls and falsely certified compliance with them in annual reports to the Defense Health Agency, as required under its contract. HNFS failed to timely scan for known vulnerabilities, remedy security flaws on its networks and systems, and ignored reports from third-party security auditors and its internal audit ...