November 2013

HealthCare.gov website users should know that the issues with the website were not just a result of a very large amount of traffic pinging it in one go.

The security flaws in the website were quite primitive. Flaws you don’t really expect someone to have overlooked. For instance, the site relayed personal information without encryption and the e-mail verification could be easily bypassed – even if you did not have access to the e-mail account. Also, the amount of cookie data the site maintained was more than required and likely not tested under high loads. And these are only a few of the issues.

The site is a prime target for an account being hijacked. A malicious hacker has a vulnerable site where millions of victims are “coming” because the government mandated it. The holes in the website allow the hacker to compromise a very large amount of sensitive information about a lot of people, all in one shot.

There are certain precautions that website users can take…but the website has to be iron-clad to begin with. There are a lot of security tests, assessments, and penetration tests that the website, its servers, the supporting databases, and the entire infrastructure it was built on, need to undergo.

 Website users should take precautions to ensure they don’t become victims of identity theft. The Federal Trade Commission (FTC) offers some good guidelines –http://www.consumer.ftc.gov/features/feature-0014-identity-theft.

The public needs to demand the equivalent level of information security from the ACA infrastructure as the Government would expect from a large hospital or healthcare associate via the HIPAA regulations.

Thanks to Enterprise Risk Management, www.emrisk.com, for help with the blog. ERM performs Penetration Testing and Security Implementation to Protect Businesses. By simulating an attack on your computer system or network, you determine if your information infrastructure is strong enough to withstand a real data security breach from both external and internal threat.

Last week’s announcement the federal government is encouraging states to adopt a transitional rule which would allow insurance carriers to extend individual health insurance plans, which would otherwise be discontinued, into 2014, was only half the story. Only hours after the announcement the Centers for Medicare & Medicaid Services (CMS) released additional clarification on this announcement, advising that small groups are also included in the extension into 2014. By allowing members to remain in their current plans through 2014, they will have additional time to ascertain if they qualify for a subsidy and to find new plans for 2015 that meet the ACA requirements. Under the transitional policy, small group health insurance that is renewed for a policy year starting between January 1, 2014 and October 1, 2014 will not be considered to be out of compliance with certain key Affordable Care Act market reforms (originally scheduled to take effect for plan years starting on or after January 1, 2014), if certain conditions are satisfied. Requirements include:

• Covering essential health benefits
• Variations in premiums be limited to age, tobacco use, family size, and geography;
• Elimination of preexisting condition exclusions;

Where does each state stand? You can follow here.