WASHINGTON, D.C. — Obama administration officials are facing mounting questions about whether they cut corners on security testing while rushing to meet a self-imposed deadline to launch online health insurance markets.
Documents show that the part of HealthCare.gov that consumers interact with directly received only a temporary six-month security certification because it had not been fully tested before Oct. 1, when the website went live. It’s also the part of the system that stores personal information.
The administration insists the trouble-prone website is secure, but technicians had to scramble to make a software fix earlier this week after learning that a North Carolina man tried to log on and got a South Carolina man’s personal information. A serious security breach would be an unwelcome game-changer for an administration striving to turn the corner on technical problems that have inconvenienced millions of consumers and embarrassed the White House.
Two computer security experts interviewed by The Associated Press said that clearly the better option would have been to complete testing.
“The best scenario is to have done end-to-end testing,” said Lisa Gallagher, vice president of technology solutions for the Healthcare Information and Management Systems Society, a medical technology nonprofit. That it wasn’t done “would cause me some mild concern,” she continued, adding she would advise a relative or close friend to wait until the website is stabilized before plunging in.
Asked former White House chief information officer Theresa Payton, “If you haven’t done end-to-end testing, how can we say with certainty how hard or easy it is for cybercriminals to attack at different points in the process?”
“It makes me shudder a little,” said Payton, a former bank security executive who now has her own company.
Payton served in the George W. Bush administration and has been consulted by congressional Republicans but says she has no partisan agenda on the health care law. “We need to help because we have to make this right,” she said.