Security holes found in HealthCare.gov

WASHINGTON — Significant security vulnerabilities are still being uncovered in the Obama administration’s health-insurance website, nearly three months after the launch of HealthCare.gov.

Officials discovered two such vulnerabilities, known as “high findings,” within the past month, including one this week, Teresa Fryer, chief information security officer for the Center for Medicare and Medicaid Services, told the House Oversight Committee this week in an interview. Fryer said that both issues were being addressed.

The debate over the security of HealthCare.gov has raised questions about whether similar vulnerabilities exist in systems across the federal government. Because the Internal Revenue Service, the Social Security Administration and other agencies communicate with HealthCare.gov, security gaps in those agencies could, if discovered, allow hackers to penetrate their systems and indirectly compromise the functioning of the new health-care law, outside security experts say.

“It’s a standard technique,” said James Lewis, a cybersecurity scholar at the Center for Strategic and International Studies. “If the target is hard but it’s linked to an easy target, breaking into the easy target will get you into the hard target.”

While software vulnerabilities in Healthcare.gov have been documented, the potential risk stemming from the site’s interconnection with other federal systems has not. Officials from the White House, the Health and Human Services Department and others did not answer questions posed by The Washington Post about whether serious vulnerabilities exist in other federal IT systems linked to HealthCare.gov.

The strength of HealthCare.gov’s security has been the subject of ongoing rancor between Republicans and Democrats.

In recent weeks, House Oversight Committee Chairman Darrell Issa, R-Calif., has highlighted the site’s early vulnerabilities while accusing the White House of launching a premature product. Democrats, meanwhile, maintain that the bugs have been fixed and that the site is safe to use.

Of the two vulnerabilities identified by Fryer in her interview with Congress, one of them turned out to be false, said Patti Unruh, a spokeswoman for HHS. The contractor flagged the problem while performing an assessment in a test version of HealthCare.gov. But the real version contained safeguards that prevented the vulnerability from posing a security risk.

The other high finding involved a faulty piece of code that was successfully repaired, and there are no other significant security issues on the site, Unruh said.

Separately, Mitre, an independent contractor hired to test the security of HealthCare.gov, identified 28 security vulnerabilities in one of several tests it conducted in mid-October, according to the company.

Those tests also showed that hackers could have obtained people’s personal information, according to a letter written to HHS this week by Issa, who quoted information given to him by the company.

Administration officials said the issues identified by Mitre either did not pose a security risk or have since been fixed.

“There have been no successful security attacks on HealthCare.gov,” said HHS spokeswoman Joanne Peters, “and no person or group has maliciously accessed personally identifiable information from the site.”

Last month, Mitre agreed to send redacted copies of its test results to Issa in response to a subpoena. On Dec. 9, Issa requested the documents in an unredacted format.

In four letters to Issa, executives from Mitre warned that the unredacted documents could pose a risk to national security.

“In the wrong hands, this information could cause irreparable harm to the basic security architecture of HealthCare.gov,” Mitre chief executive Alfred Grasso wrote in a letter that accompanied the unredacted documents, “and potentially to the security of other CMS data networks that share attributes of this architecture.”

The Obama administration chimed in, with the White House counsel’s office urging Issa not to leak the documents for fear of endangering “other, similarly constructed federal IT system controls.”

HHS wrote in a letter to Issa: “Disclosure of these security documents could ⅛allow€ hackers to penetrate not only HealthCare.gov and the Federal Data Services Hub, but other Federal IT systems, some of which contain taxpayer information.”

A Republican aide for Issa would not rule out a release, but said that the lawmaker is working with outside analysts to determine the danger for himself.

House Democrats have demanded a classified meeting with Issa so that members of the IRS and the Department of Homeland Security could brief him on the danger of releasing the documents.

More in Local News

Car crashes near Everett after State Patrol pursuit

The driver and a second person in the car suffered injuries.

They chose the longshot candidate to fill a vacant seat

Sultan Mayor Carolyn Eslick will serve as representative for the 39th legislative district.

Definitely not Christmas in July for parched young trees

“I live in Washington. I should not have to water a Christmas tree,” says one grower. But they did.

Marysville babysitter faces jail time in infant’s death

Medical experts differed over whether it was head trauma or illness that caused the baby to die.

Whether cheers or jeers, DeVos appearance will rouse spirits

Trump’s secretary of education is coming to Bellevue to raise money for a pro-business think tank.

Superior Court judge admits DUI on freeway

Prosecutors recommend a “standard” penalty for Marybeth Dingledy, who “is terribly sorry.”

Self-defense or murder? Trial begins in shooting death

Explanations as to why a man was shot in the back on a Bothell cul-de-sac are starkly different.

Front Porch

EVENTS Chicken dinner time Seniors serve up a family-style chicken dinner from… Continue reading

Detectives seek suspect in woman’s homicide

Alisha Michelle Canales-McGuire was shot to death Wednesday at a home south of Paine Field.

Most Read