Risk
10/2/2013
10:41 AM
Connect Directly
RSS
E-Mail
50%
50%

Online Health Exchanges: How Secure?

Is the data hub created by Obamacare a hacker's dream?

Online health insurance exchanges debuted on Tuesday, and millions of Americans visited the sites to assess their eligibility for different plans and attempt to sign up. But the demand on the exchange portal sites apparently exceeded many state officials' expectations, leading to intermittent portal outages.

Fourteen states, plus the District of Columbia, are running their own health exchanges, as is the federal government, which is operating the HealthCare.gov exchange on behalf of more than 30 other states. One lingering question, however, concerns not just the long-term uptime and availability that consumers should expect from these exchanges, but whether they can handle people's personal data in a manner that maintains privacy while keeping it safe from hackers.

Already, systems being used to facilitate the Patient Protection and Affordable Care Act (ACA) -- aka Obamacare -- have been criticized as posing a large security risk because they're designed to handle numerous people's personal information. In the wrong hands, that data could prove lucrative for identity thieves or anyone who wanted to resell personal information on the underground market.

[ The closure of the federal government has broad implications on IT. Read more at Government Shutdown: What Are IT Systems Risks? ]

One particular concern is that the system's "data hub" -- a tool for routing a health exchange applicant's information to relevant government agencies, including the Internal Revenue Service -- will put people's personal information at risk.

"This data hub is a hacker's dream," alleged Rep. Kevin Brady (R-Texas) during an August House hearing involving top IRS and health department officials, reported the Houston Chronicle. "And I'm not sure who I most fear, someone from the outside or the government," he added, referring to the scandal that erupted earlier this year, when the IRS confirmed that a top official had been subjecting Tea Party groups to extra scrutiny when they applied for tax-exempt status.

Regardless of the politics at play, can the IRS be trusted with this information? To be sure, the agency has logged more than one data breach on its watch, and earlier this year, the Government Accountability Office reported that IT security holes in IRS networks were still putting taxpayer data at risk.

Furthermore, multiple government agencies will have access to some information as it gets routed through the data hub, said Christopher Rasmussen, a healthcare and privacy policy analyst for the Center for Democracy and Technology, in a July blog post. "For example, an individual's eligibility for a federal subsidy to purchase health insurance requires verification of income and family size from the Internal Revenue Service (IRS), immigration status from the Department of Homeland Security (DHS) and incarceration status from the Social Security Administration (SSA)," he said. Insurance companies will also use a single portal -- run by the Centers for Medicare & Medicaid Services (CMS) -- that gives them access to some of that information.

But CMS administrator Marilyn Tavenner emphasized to Congress in July that the data hub, which her agency administers, has been designed to keep people's personal information secure as well as private. Notably, she said, the hub will not store or retain any data used for vetting applications, but merely route it to its appropriate destination.

"The data hub is designed to query -- and pass along to insurance marketplaces -- only the minimum amount of information necessary from each government database to facilitate applicant enrollment," Rasmussen said.

Furthermore, after some delays, the CIO of CMS last month certified that the system is safe. Tavenner, meanwhile, has said that all CMS administrators have received thorough information security and privacy training.

Those preparations aside, states are really the ones on the security hook, given that they're running the health portals that comprise the Health Insurance Marketplace. Accordingly, the concern voiced by Rep. Brady of Texas -- over IRS involvement -- doesn't get to some of the larger security questions at play, such as whether states can be trusted to secure their residents' health exchange information.

Earlier this year, government technology journalist Alex Howard -- who's lauded Healthcare.gov for its clear design and use of open source technology -- singled out states as a potential weak point in the health exchange ecosystem. "My sense is that people are very nervous [about the potential for exploitable vulnerabilities -- and hack attacks -- against one or more of the exchanges being operated]," Howard told Slate.

Indeed, what if a group such as the Syrian Electronic Army managed to find and exploit some unforeseen vulnerability?

Then again, this isn't the first foray by the IRS, CMS, DHS, SSA and other agencies into handling people's personal information. Furthermore, should any one exchange suffer a hack attack, the data hub routing and multi-state exchange model means that it's extremely unlikely that the whole system would come crashing down.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Mathew
50%
50%
Mathew,
User Rank: Apprentice
10/3/2013 | 6:24:38 PM
re: Online Health Exchanges: How Secure?
Respectfully, what slant are you seeing? Are are you just trolling?
Mathew
50%
50%
Mathew,
User Rank: Apprentice
10/3/2013 | 6:22:39 PM
re: Online Health Exchanges: How Secure?
The federal portal was *just* certified by CMS last month. Also the fundamental design decisions -- as noted by Alex Howard -- appear to be sound. States, of course, have a mixed track record when it comes to protecting residents' personal data, whether for health purposes or otherwise.
VenkatS
50%
50%
VenkatS,
User Rank: Apprentice
10/2/2013 | 5:57:12 PM
re: Online Health Exchanges: How Secure?
slanted commentary, full of innuendos. Will look for a balanced reporting on this else where.
ANON1247858079649
50%
50%
ANON1247858079649,
User Rank: Apprentice
10/2/2013 | 4:52:37 PM
re: Online Health Exchanges: How Secure?
It's been 4 years since the inception of ACA. Why did the security issue not get any headline until now? Really?
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-3304
Published: 2014-10-30
Directory traversal vulnerability in Dell EqualLogic PS4000 with firmware 6.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the default URI.

CVE-2013-7409
Published: 2014-10-30
Buffer overflow in ALLPlayer 5.6.2 through 5.8.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in a .m3u (playlist) file.

CVE-2014-3446
Published: 2014-10-30
SQL injection vulnerability in wcm/system/pages/admin/getnode.aspx in BSS Continuity CMS 4.2.22640.0 allows remote attackers to execute arbitrary SQL commands via the nodeid parameter.

CVE-2014-3584
Published: 2014-10-30
The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before 3.0.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted SAML token in the authorization header of a request to a JAX-RS service.

CVE-2014-3623
Published: 2014-10-30
Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vect...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.