Introduction Data breaches have become an unfortunate reality for information systems, both government and private. When government agencies are faced with breaches, it leads to compromised citizen data. Any computer system is susceptible to cyber incidents that result in serious consequences and public backlash. Cyber threats and data breaches can vary significantly, being internal or external in origin (Lohrmann, 2012). Despite sophisticated control systems being in place, the industry is still developing protocols which would effectively prevent data breaches, which may require a radically different approach. This report seeks to examine a case of government data breach and evaluate the regulatory requirements meant to prevent such incidents. Data Breach A data breach in Utah’s Department of Health computer server in 2012 led to personal and health records of 780,000 people being stolen including 280,000 social security. By exploiting a weak password of a server technician, hackers downloaded 24,000 files to a server in Eastern Europe (Perlroth, 2012). Victims included participants of Medicaid and other health programs, such as one for low-income children. A variety of other personal data such as client demographics and addresses, provider identifiers, tax identification numbers, and procedure codes meant for the health condition and claims data billing was compromised. It is considered the largest healthcare data breach in history as reported under the HIPAA breach notification rule since it went into effect on 2009. Affected clients were notified and kept updated with many being offered free credit tracking afterward. Primary Causes The data was stored on a state server which was managed by a technology services department. A configuration error transpired during authentication which gave a hacker the ability to circumvent the security protocols. The breached server was not properly configured in this incident. The server was launched without an appropriate layer of security in place (Anderson, 2012). A primary problem as noted by security experts was the bulk storage of personal records on one server. Large aggregate databases are increasingly vulnerable, and a single data breach results in the loss of records for hundreds of thousands of people. Network penetration results in an all-or-nothing scenario (Perlroth, 2012). Prevention of Data Breach There are two primary federal regulatory guidelines applicable to this case. The Federal Information Security Modernization Act (FISMA) is a risk management framework meant to protect critical information infrastructure. It consists of key security guidelines for categorization, security requirements, controls, and monitoring of systems. The management of organizational risk is meant to prepare systems to prevent or potentially address data breaches. It focuses on conducting essential activities within information systems that focus on impact analysis of risk and continuous monitoring and assessment of security controls (Ross, Dempsey, Pillitteri, Jacobs, & Goren, 2019). Meanwhile, the Health Insurance Portability and Accountability Act (HIPAA) has aspects of information security, producing standards for