Ousted HHS Cyber Leaders Have Met With Inspector General About A Reprisal Complaint

The Health and Human Services Department’s inspector general has interviewed the ousted leaders of the department’s fledgling cyber operations center as part of a reprisal complaint, the pair’s attorney told Nextgov Thursday.

It’s not clear, however, if that means the inspector general has launched a formal investigation into the September incident in which center director Maggie Amato and the department’s former Deputy Chief Information Security Officer Leo Scanlon were abruptly reassigned following an anonymous complaint alleging contracting improprieties.

“It is our understanding that [the inspector general’s office] take[s] whistleblower reprisal very seriously, and that they are actively looking into the allegations of retaliation made by Mr. Scanlon and Ms. Amato,” the pair’s attorney Chuck McCullough told Nextgov in a statement.

“We fully expect the truth to come out soon,” he added.

The revelation is the latest in a series of events that have upended top tech and cyber leadership at the department.

Department CISO Chris Wlaschin, who oversaw the reassignments and later led the Health Cybersecurity and Communications Integration Center, or HCCIC, announced his resignation earlier this month. He will be replaced by Janet Vogel, deputy chief information officer at the Center for Medicare and Medicaid Services.

Wlaschin told Nextgov in an interview Monday that his resignation is entirely for personal and family reasons and unrelated to disputes over the HCCIC.

Since their September reassignments, Amato has resigned and Scanlon has been on an involuntary leave for the past five months.

The HCCIC, which shares cyber threat information between government and the healthcare sector, was controversial from the beginning.

Some industry officials and lawmakers believed it duplicated work that was already being done by the Homeland Security Department and the healthcare industry.

HCCIC defenders said the center performed a vital function, ensuring that government cyber alerts were tailored and translated for the healthcare sector and that smaller healthcare companies and hospitals received cyber threat assistance that the free market wouldn’t otherwise provide.

Scanlon and Amato were initially told they were reassigned away from the HCCIC because of an inspector general investigation into contracting improprieties. The alleged improprieties included free dinners and winery tours offered by cybersecurity companies, according to an anonymous letter delivered to the Senate Homeland Security Committee in July and later provided to Nextgov.  

Inspector general investigators later told the pair that they were not, and had never been under IG investigation, according to a March 12 letter McCullough sent to Health and Human Services Secretary Alex Azar.

The inspector general’s office declined to confirm or deny any investigation to Nextgov.

The House Energy and Commerce Committee, which requested information about Scanlon and Amato’s reassignments in November, said the committee is “still reviewing the situation and, therefore, cannot provide any information at this time.”

Scanlon, meanwhile, has been on leave for more than 150 days.

“The net effect of all of this is that the HCCIC initiative, which played such an important and promising role during the WannaCry incident, has been derailed,” Scanlon told Nextgov, referencing one of the largest global ransomware campaigns in history, which hit hospitals particularly hard and which the U.S. government later attributed to North Korea.

In McCullough’s letter, Amato and Scanlon request a meeting with Health and Human Services Secretary Alex Azar to discuss their cases.

“After the hell they and their families have been through, they certainly deserve that much,” the letter states, adding, “I believe that, when you hear their story, you will feel as strongly about their situation as everyone else who hears it.”

If Azar declines to meet with the pair, McCullough “will seek resolution of this matter through several cognizant congressional committees, some of whose members have already expressed interest,” the letter states.

The letter also suggests “remedies available” through the inspector general and the Equal Employment Opportunity Commission.

The department has not yet responded to that letter, Scanlon said.