recommended reading

HealthCare.gov Security Gaps Identified in Contractor Documents

House Oversight Committee Chairman Rep. Darrell Issa, R-Calif.

House Oversight Committee Chairman Rep. Darrell Issa, R-Calif. // J. Scott Applewhite/AP

This story has been updated to include comment from HHS and Rep. Elijah Cummings, D-Md.

A congressional watchdog investigating the troubled launch of the Obama administration’s online health insurance marketplace HealthCare.gov released a handful of contractors’ statements on Tuesday showing they were concerned about security vulnerabilities before and soon after the site launched.

In response to the release from House Oversight and Government Reform Committee Chairman Rep. Darrell Issa, R-Calif., a Health and Human Services Department spokeswoman said all of the concerns noted by the contractors had been addressed or were being addressed and that the entire system met federal standards for information security. 

There have been no sucessful cyberattacks against HealthCare.gov to date and no one has maliciously gathered citizens' personal data, spokeswoman Joanne Peters said.

Contractors last week turned over a cache of HealthCare.gov documents to Issa in response to a subpoena. They released the documents over the objection of HHS officials who argued releasing the documents publicly could give hackers a roadmap to the site’s security vulnerabilities and endanger insurance seekers’ personal information.

Issa has said he does not intend to release information in a way that would endanger Americans’ security but feels compelled to warn Americans about security risks if they’re entering personal information into HealthCare.gov.

Issa is consulting with security experts to determine what information from the contractors is safe to release, he said in a letter on Tuesday to Health and Human Services Secretary Kathleen Sebelius. He also agreed to meet with Sebelius and said he would “welcome a page-by-page discussion of the [subpoenaed contractor] documents and [about] any concerns about the public release of any information.”

Seblius' office said it would respond to Issa directly. 

Issa quoted a handful of statements from the subpoenaed documents in a press release on Tuesday. The documents showed that the contractor MITRE Corp., which concluded a security assessment of HealthCare.gov about two weeks after its Oct. 1 launch, was concerned about gaps in the site’s security

The Oct. 11 assessment described 19 security threats that had not been addressed at that point. It’s not clear how many of MITRE’s concerns have been fixed in the roughly two months since the report was issued.

In describing one vulnerability, the report stated, “any malicious user having knowledge of this can perform unauthorized functions.” Regarding another vulnerability, the report stated, “The [cyber] attacker is able to see and edit [personally identifying information] of the [insurance seeker].”

Oversight's ranking member Rep. Elijah Cummings, D-Md., disputed the second claim in a letter to House Speaker John Boehner on Tuesday, saying Issa failed to disclose that the MITRE report noted the issue had been resolved. 

Cummings accused Issa of "cherry picking" half-sentences from the documents in "a reckless and transparent attempt to frighten Americans away from the Heathcare.gov website and deny them health insurance."

MITRE also omitted large parts of the HealthCare.gov system from its security assessment because those parts were not yet prepared to be tested, according to selections from the documents.

A rush before the launch date and limited testing were early suspects in the investigation into HealthCare.gov’s poor performance.

Issa and other oversight committee members were previously given redacted copies of the contractors’ documents and allowed to read, but not keep, unredacted copies. His subpoena was aimed at securing unredacted copies that he could keep and potentially release to the public.

Democratic committee members have accused Issa of grandstanding at the expense of Americans’ security and asked House leadership to intervene.

Since a self-imposed repair deadline of Nov. 30, officials say HealthCare.gov has been functioning smoothly with error rates lower than 1 percent and page response times of less than 1 second. It’s still unclear whether the upgraded site will draw in enough insurance seekers to make a key element of President Obama’s landmark health care reform law sustainable.

Under the terms of Obamacare, uninsured people must purchase insurance or pay a penalty beginning in 2014. If too many young and healthy people choose to pay the penalty rather than buy insurance, that could increase the risk in insurance pools, making older and sicker people’s premiums unsustainably costly.

Enthusiasm for the site may be further dampened by concerns about security vulnerabilities. 

Threatwatch Alert

Accidentally leaked credentials / Misplaced data

Hospital Breach Affects Thousands of Patients

See threatwatch report

JOIN THE DISCUSSION

Close [ x ] More from Nextgov
 
 

Thank you for subscribing to newsletters from Nextgov.com.
We think these reports might interest you:

  • It’s Time for the Federal Government to Embrace Wireless and Mobility

    The United States has turned a corner on the adoption of mobile phones, tablets and other smart devices, outpacing traditional desktop and laptop sales by a wide margin. This issue brief discusses the state of wireless and mobility in federal government and outlines why now is the time to embrace these technologies in government.

    Download
  • Featured Content from RSA Conference: Dissed by NIST

    Learn more about the latest draft of the U.S. National Institute of Standards and Technology guidance document on authentication and lifecycle management.

    Download
  • A New Security Architecture for Federal Networks

    Federal government networks are under constant attack, and the number of those attacks is increasing. This issue brief discusses today's threats and a new model for the future.

    Download
  • Going Agile:Revolutionizing Federal Digital Services Delivery

    Here’s one indication that times have changed: Harriet Tubman is going to be the next face of the twenty dollar bill. Another sign of change? The way in which the federal government arrived at that decision.

    Download
  • Software-Defined Networking

    So many demands are being placed on federal information technology networks, which must handle vast amounts of data, accommodate voice and video, and cope with a multitude of highly connected devices while keeping government information secure from cyber threats. This issue brief discusses the state of SDN in the federal government and the path forward.

    Download
  • The New IP: Moving Government Agencies Toward the Network of The Future

    Federal IT managers are looking to modernize legacy network infrastructures that are taxed by growing demands from mobile devices, video, vast amounts of data, and more. This issue brief discusses the federal government network landscape, as well as market, financial force drivers for network modernization.

    Download

When you download a report, your information may be shared with the underwriters of that document.