The federal government warned Vermont officials nearly four months ago that if they failed to resolve security issues at Vermont Health Connect, they would be disconnected from the federal data hub.
The state received a letter June 10 from the Centers for Medicare and Medicaid Services noting “a significant number” of security issues that could “present risk to the security of the Hub.”
The letter notes that the center performs quarterly security audits of state-based exchanges. Security risks identified in its previous two quarterly audits had not been addressed when the letter was sent.
The letter gave Vermont 90 days, until Sept. 8, to resolve the issues.
That timeline may have been adjusted as part of negotiations between Vermont and CMS, but ultimately the security concerns could not be resolved to CMS’ satisfaction
Emails obtained by VTDigger as part of a public records request show that a CMS official thought Nov. 3 was a more reasonable date to complete the security upgrades, and asked another federal official to join a conference call to discuss extending the timeline further.
Lawrence Miller, chief of health care reform, said CMS higher-ups would not approve the extension, and Vermont had to disconnect from the federal hub.
Vermont Health Connect was disconnected from the hub the night of Sept. 15, the same time the Web portal was taken down.
State officials held a hastily arranged news conference the next morning, where Gov. Peter Shumlin said the site was being taken down to make improvements and bolster security.
Vermont could have left the Web portal up, and made subsidy eligibility determinations using state data such as Department of Labor statistics, but chose to take down the entire site.
That decision provided Optum, the newly hired primary contractor, a maintenance window to address usability issues.
The state’s progress addressing security issues and functional usability problems was hampered by the transition from CGI, its previous contractor, to Optum, Miller said.
Transitioning vendors is “inherently disruptive,” Miller said, and the state waited until after open enrollment to make the switch to Optum so that it wouldn’t affect the exchange during a high traffic period.
But making the transition while trying to address security problems and improve user experience proved too much, he said.
The state remains focused on relaunching the web portal and reconnecting to the federal hub to ensure a smooth open enrollment in November, Miller said.
However, Vermont is prepared to do paper enrollment should the site not be relaunched in time, and is also prepared to do subsidy eligibility determinations with state data from the labor department and elsewhere, he added.
The federal government’s unwillingness to provide Vermont with more time may have been affected by an internal revelation on Aug. 25 that the healthcare.gov exchange serving 36 states had been hacked.
Congress and the public were not informed of the breach until Sept. 4.
“(The security breach) definitely raised their anxiety level,” Miller said. “They shared their perspective on the changed threat environment, and that changed our perspective.”
The federal data hub is a joint project of the Internal Revenue Service and Health and Human Services that integrates data, including employment, income and entitlement history, from multiple federal sources.
The hub is being used to determine people’s eligibility for the Affordable Care Act’s tax credit premium subsidies, and contains a trove of consumers’ personal information.
