HHS’s Geospatial Score Stayed at Six—but the Responsibilities Passing the Audit Changed

A flat total is not an unchanged set of findings

HHS fulfilled six of 13 Geospatial Data Act responsibilities in both its 2024 and 2026 inspector-general audits. But a responsibility-by-responsibility comparison by What’s the Scoop With Broach finds that the passing categories were not identical: data sharing moved into the fulfilled group, while coordination and partnerships moved out.

The October 2, 2024 audit identified strategy, integration, partnerships, declassified data, data quality and a liaison as fulfilled. The October 2, 2026 audit’s Table 1 identifies strategy, sharing, integration, declassified data, data quality and a liaison. Five responsibilities passed both assessments; one changed in each direction. The unchanged six-of-13 count therefore conceals a classification swap rather than proving every underlying category remained static.

This does not independently establish that HHS’s actual partnership operations deteriorated. The audits assess different periods and evidence, and the 2026 report does not explain that cross-year change in detail. The accountability finding is about what the published evaluations establish: a single aggregate progress number cannot tell readers which responsibilities were met or what changed.

The agency’s own report uses a different scorecard

We also read HHS’s FY2025 annual self-assessment, dated March 27, 2026 and published by the Federal Geographic Data Committee. It assigns seven responsibilities a meets-expectations rating and six a made-progress rating, with none rated fails-to-meet. Its seven meets categories are strategy, sharing, integration, privacy, declassified data, data quality and liaison.

Comparing that meets group with the 2026 audit’s fulfilled group leaves one difference: privacy and confidentiality. HHS self-rated that responsibility as meeting expectations. The later audit marks it unfulfilled. The other six categories in the agency’s meets group match the six fulfilled categories in the 2026 audit.

The self-assessment’s privacy section answers yes to both whether privacy-assessment processes encompass all agency data and whether geospatial data are housed in systems with current authorizations to operate. Those answers are broad assurances. They are not a technical security test conducted by this publication, and the auditor’s unfulfilled designation is not proof that a particular patient’s data were exposed.

Progress, fulfillment and coverage must stay separate

A made-progress rating is not equivalent to a fulfilled responsibility. Six agency categories—records retention, resources, standards, partnerships, use of geospatial information and avoidance of duplication—were rated progress rather than meets in the annual report and unfulfilled in the 2026 audit. That is not, by itself, a contradiction: an agency can describe partial activity without having completed a statutory duty.

The privacy difference requires similar caution. The self-assessment covers fiscal year 2025, while the new audit’s fieldwork ran from March through September 2026. More importantly, the inspector general found that the annual report again used surveys of operating divisions without including staff divisions. These timing and coverage differences prevent treating the two ratings as measurements of precisely the same complete population at the same moment.

The self-assessment’s introduction also describes referenced datasets as those owned or managed by the Office of the Chief Data Officer that are or should be public. Other questionnaire instructions ask for agency-wide data. That makes the report’s coverage language consequential: broad answers about all agency data should not be assumed to be a verified departmentwide inventory.

A prior promise did not remove the repeated reporting omission

The 2024 audit found six staff divisions handling geospatial data that were absent from HHS’s FY2023 self-assessment. HHS concurred with all four recommendations and said it would survey both operating and staff divisions for future reporting. The 2026 audit says HHS again surveyed only operating divisions for the FY2025 report. It also again found no complete departmentwide geospatial asset inventory.

HHS’s new response is not silence or blanket rejection. It concurred with all four 2026 recommendations, said its information and data offices supported publication of a geospatial inventory and data on GeoPlatform, and described work to identify contacts at every component so staff and operating divisions would appear in upcoming reports.

The annual self-assessment likewise describes an enterprise data inventory published in July 2025 and a geospatial working group. Those statements document activity, but publication of an inventory is not the same as independently demonstrating that it contains every relevant geospatial asset. The inspector general’s continuing completeness finding and HHS’s claimed publication can coexist. Neither should be erased to simplify the account.

The stakes and what was not tested

HHS’s mapping-related work includes environmental public-health tracking, emergency planning for Medicare beneficiaries reliant on electricity-dependent equipment, emergency resource mapping and Indian Health Service geographic information. Complete asset knowledge and clear interagency coordination are therefore relevant to real public-health operations, not just an administrative score.

The 2026 review, however, did not test individual maps for clinical accuracy, determine the cost of duplicated procurement or find a specific breach. Under the coordinated inspector-general approach, it focused on covered-agency responsibilities, annual reporting and inventory. It did not evaluate compliance with finalized geospatial standards or restrictions on federal funding during the continuing implementation period. We attach no unsupported dollar-loss or data-leak claim to the scorecard.

Method and original contribution

This is original public-document comparison. We matched each of the 13 statutory responsibility numbers across the 2024 audit, HHS’s FY2025 self-assessment and the 2026 audit; counted the shared and changed fulfilled categories; read the survey-coverage findings and both agency responses; and separated partial progress from fulfillment. We did not conduct interviews, obtain private patient records or perform a cybersecurity assessment.

As of October 14, 2026, these records establish a flat total with changed classifications, a privacy assurance that the later audit did not certify as fulfilled, and a repeated reporting-coverage problem after a prior commitment. They do not establish motives or whether all newly promised changes have since been implemented. The next verifiable completion evidence would be a departmentwide inventory and assessment that actually includes the relevant staff divisions, not another unqualified aggregate score.