Holes in oversight and enforcement of the Health Insurance Portability and Accountability Act — or HIPAA — need to be addressed, the Department of Health and Human Services‘ inspector general has found.

In the report, the IG’s office expresses concern about the competence of the HHS Office for Civil Rights, which oversees and endorses the HIPAA Security Rule. The Security Rule describes the “administrative, physical and technical safeguards necessary to ensure the confidentiality, integrity and availability of ePHI” — or electronic protected health information, according to the report.