HealthCare.gov Security Gaps Identified in Contractor Documents

This story has been updated to include comment from HHS and Rep. Elijah Cummings, D-Md.

A congressional watchdog investigating the troubled launch of the Obama administration’s online health insurance marketplace HealthCare.gov released a handful of contractors’ statements on Tuesday showing they were concerned about security vulnerabilities before and soon after the site launched.

In response to the release from House Oversight and Government Reform Committee Chairman Rep. Darrell Issa, R-Calif., a Health and Human Services Department spokeswoman said all of the concerns noted by the contractors had been addressed or were being addressed and that the entire system met federal standards for information security. 

There have been no sucessful cyberattacks against HealthCare.gov to date and no one has maliciously gathered citizens' personal data, spokeswoman Joanne Peters said.

Contractors last week turned over a cache of HealthCare.gov documents to Issa in response to a subpoena. They released the documents over the objection of HHS officials who argued releasing the documents publicly could give hackers a roadmap to the site’s security vulnerabilities and endanger insurance seekers’ personal information.

Issa has said he does not intend to release information in a way that would endanger Americans’ security but feels compelled to warn Americans about security risks if they’re entering personal information into HealthCare.gov.

Issa is consulting with security experts to determine what information from the contractors is safe to release, he said in a letter on Tuesday to Health and Human Services Secretary Kathleen Sebelius. He also agreed to meet with Sebelius and said he would “welcome a page-by-page discussion of the [subpoenaed contractor] documents and [about] any concerns about the public release of any information.”

Seblius' office said it would respond to Issa directly. 

Issa quoted a handful of statements from the subpoenaed documents in a press release on Tuesday. The documents showed that the contractor MITRE Corp., which concluded a security assessment of HealthCare.gov about two weeks after its Oct. 1 launch, was concerned about gaps in the site’s security

The Oct. 11 assessment described 19 security threats that had not been addressed at that point. It’s not clear how many of MITRE’s concerns have been fixed in the roughly two months since the report was issued.

In describing one vulnerability, the report stated, “any malicious user having knowledge of this can perform unauthorized functions.” Regarding another vulnerability, the report stated, “The [cyber] attacker is able to see and edit [personally identifying information] of the [insurance seeker].”

Oversight's ranking member Rep. Elijah Cummings, D-Md., disputed the second claim in a letter to House Speaker John Boehner on Tuesday, saying Issa failed to disclose that the MITRE report noted the issue had been resolved. 

Cummings accused Issa of "cherry picking" half-sentences from the documents in "a reckless and transparent attempt to frighten Americans away from the Heathcare.gov website and deny them health insurance."

MITRE also omitted large parts of the HealthCare.gov system from its security assessment because those parts were not yet prepared to be tested, according to selections from the documents.

A rush before the launch date and limited testing were early suspects in the investigation into HealthCare.gov’s poor performance.

Issa and other oversight committee members were previously given redacted copies of the contractors’ documents and allowed to read, but not keep, unredacted copies. His subpoena was aimed at securing unredacted copies that he could keep and potentially release to the public.

Democratic committee members have accused Issa of grandstanding at the expense of Americans’ security and asked House leadership to intervene.

Since a self-imposed repair deadline of Nov. 30, officials say HealthCare.gov has been functioning smoothly with error rates lower than 1 percent and page response times of less than 1 second. It’s still unclear whether the upgraded site will draw in enough insurance seekers to make a key element of President Obama’s landmark health care reform law sustainable.

Under the terms of Obamacare, uninsured people must purchase insurance or pay a penalty beginning in 2014. If too many young and healthy people choose to pay the penalty rather than buy insurance, that could increase the risk in insurance pools, making older and sicker people’s premiums unsustainably costly.

Enthusiasm for the site may be further dampened by concerns about security vulnerabilities.