Audit of the Division of Insurance (March 19, 2024)

This is a state performance audit of the Massachusetts Division of Insurance covering July 1, 2021 through December 31, 2022.

“In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor has conducted a performance audit of the Division of Insurance (DOI) for the period July 1, 2021 through December 31, 2022.”

Auditors checked whether DOI’s website met accessibility rules and whether its technology policies covered continuity, disaster recovery, incident response, and cybersecurity training.

“In this performance audit, we determined the following:”

If DOI’s website or emergency technology plans do not work well, residents may have trouble getting insurance information or services, especially during disruptions or emergencies.

“Without an updated business continuity plan or a disaster recovery plan, DOI cannot ensure that it has procedures for protecting information assets or a plan to recover critical operations when an interruption or disaster occurs.”

For residents, this audit is about whether people can use DOI’s online services fairly and whether the agency is prepared to keep operating when technology problems happen.

“They can also limit some users from having equitable access to critical information and key online services offered by DOI (e.g., insurance-related complaint submission).”

The auditor found three main issues: DOI’s website was not fully accessible, its business continuity and disaster recovery planning was lacking, and its incident response plan was incomplete.

“DOI’s website is not fully accessible for all Massachusetts residents.”

DOI said it is working with state technology officials to update its plans and improve accessibility and language access.

“The DOI is working in conjunction with EOTSS to update its current business continuity plan in accordance with all applicable requirements and will issue it as soon as possible.”

Website accessibility is not a minor technical issue: many Massachusetts adults have disabilities, so broken links or language problems can affect real access to government services.

“The impact of these standards can be significant, as the federal Centers for Disease Control and Prevention estimates that 1,348,913 adults (23% of the adult population) in Massachusetts have a disability, as of 2021.”

IT governance means the rules and planning an agency uses to manage technology, including backup plans, disaster recovery, security incidents, and employee cybersecurity training.

“IT governance refers to the processes that state agencies use to manage their IT resources.”