Federal Data Services Hub

The data hub is a CMS system that acts as a single portal for exchanging  information between the federally facilitated marketplace and CMS’s  external partners, including other federal agencies, state-based  marketplaces, other state agencies, other CMS systems, and issuers of  qualified health plans. As a result, CMS does not consider the data hub to be a  repository of personally identifiable information. In September 2014, we reported  that while CMS had taken steps to protect the security and privacy of data  processed and maintained by the complex set of systems and  interconnections that support Healthcare.gov, weaknesses remained in  both the processes used for managing information security and privacy as  well as the technical implementation of IT security controls. In addition, CMS did not have an effective  process for resolving inconsistencies for individual applicants for the  federal Health Insurance Marketplace. None of the  incidents described in the data included any evidence that an attacker  had compromised sensitive data, including PII, from Healthcare.gov. While CMS has taken steps to secure the data hub, we identified  weaknesses in the technical controls protecting the data flowing through  the system. For example:
CMS did not appropriately restrict the use of administrative privileges  for data hub systems. In addition to the above weaknesses, we identified other security  weaknesses in controls related to boundary protection, identification and  authentication, authorization, encryption, audit and monitoring, and  software updates that limit the effectiveness of the security controls on  the data hub and unnecessarily place sensitive information at risk of  unauthorized disclosure, modification, or exfiltration. CMS Has Not Fully Implemented Security and Privacy Oversight of State-Based Marketplaces, Three of Which Had Significant Weaknesses

CMS has taken various actions to oversee the security and privacy  controls implemented at the state-based marketplaces, including  assigning roles and responsibilities for oversight entities, conducting  regular meetings with state officials to discuss pending issues, and  establishing a new reporting tool to monitor marketplace performance. While CMS has developed policies for overseeing security and privacy  controls at the state-based marketplaces, it has not defined specific  oversight procedures, the timing for when each activity should occur, or  what follow-up corrective actions should be performed if deficiencies are  identified. The three states generally agreed  with the potential mitigation activities and have plans to address them. Recommendations for Executive Action

To improve the oversight of privacy and security controls over the state- based marketplaces, we recommend that the Secretary of Health and  Human Services direct the Administrator of the Centers for Medicare &  Medicaid Services to take the following three actions: define procedures for overseeing state-based marketplaces, to  include day-to-day activities of the relevant offices and staff; develop and document procedures for reviewing the SMART tool,  including specific follow-up timelines and identifying corrective actions  to be performed if deficiencies are identified; and  require continuous monitoring of the privacy and security controls over  state-based marketplaces and the environments in which those  systems operate to more quickly identify and remediate vulnerabilities. In a separate report with limited distribution, we are also making 27  recommendations to resolve technical information security weaknesses  within the data hub related to boundary protection, identification and  authentication, authorization, encryption, audit and monitoring, and  software updates. HHS concurred with all of GAO’s  recommendations. Appendix I: Objectives, Scope, and Methodology

Our objectives were to (1) describe the extent to which security and  privacy incidents were reported for Healthcare.gov or key supporting  systems; (2) assess the effectiveness of the controls implemented by the  Centers for Medicare & Medicaid Services (CMS) to protect the Federal  Data Services Hub (data hub) and the information it transmits; (3) assess  the effectiveness of CMS’s oversight of key program elements and  controls implemented by state-based marketplaces and the effectiveness  of those elements at selected state-based marketplaces to protect the  information they contain. To address our first objective, we reviewed and analyzed data on  information security and privacy incidents reported by CMS that occurred  between October 6, 2013, and March 8, 2015, affecting Healthcare.gov  and its supporting systems. Lastly, we interviewed knowledgeable officials and  reviewed CMS policies and procedures for incident handling.
Why GAO Did This Study

The Patient Protection and Affordable Care Act required the establishment of health insurance marketplaces in each state to allow consumers to compare, select, and purchase health insurance plans. States establishing their own marketplaces are responsible for securing the supporting information systems to protect sensitive personal information they contain. CMS is responsible for overseeing states' efforts, as well as securing federal systems to which marketplaces connect, including its data hub.
GAO was asked to review security issues related to the data hub, and CMS oversight of state-based marketplaces. Its objectives were to (1) describe security and privacy incidents reported for Healthcare.gov and related systems, (2) assess the effectiveness of security controls for the data hub, and (3) assess CMS oversight of state-based marketplaces and the security of selected state-based marketplaces. GAO reviewed incident data, analyzed networks and controls, reviewed policies and procedures, and interviewed CMS and marketplace officials. This is a public version of a limited official use only report that GAO issued in March 2016. Sensitive information on technical issues has been omitted from this version.

What GAO Found

The Centers for Medicare & Medicaid Services (CMS) reported 316 security-related incidents, between October 2013 and March 2015, affecting Healthcare.gov—the web portal for the federal health insurance marketplace—and its supporting systems. According to GAO's review of CMS records for this period, the majority of these incidents involved such things as electronic probing of CMS systems by potential attackers, which did not lead to compromise of any systems, or the physical or electronic mailing of sensitive information to an incorrect recipient. None of the incidents included evidence that an outside attacker had successfully compromised sensitive data, such as personally identifiable information.
Consistent with federal guidance, CMS has taken steps to protect the security and privacy of data processed and maintained by the systems and connections supporting Healthcare.gov, including the Federal Data Services Hub (data hub). The data hub is a portal for exchanging information between the federal marketplace and CMS's external partners. To protect these systems, CMS assigned responsibilities to appropriate officials and documented information security policies and procedures.
However, GAO identified weaknesses in technical controls protecting the data flowing through the data hub. These included
insufficiently restricted administrator privileges for data hub systems,
inconsistent application of security patches, and
insecure configuration of an administrative network.
GAO also identified additional weaknesses in technical controls that could place sensitive information at risk of unauthorized disclosure, modification, or loss. In a separate report, with limited distribution, GAO recommended 27 actions to mitigate the identified weaknesses.
In addition, while CMS has taken steps to oversee the security and privacy of data processed and maintained by state-based marketplaces, improvements are needed. For example, CMS assigned roles and responsibilities to various oversight entities, met regularly with state officials, and developed a reporting tool to monitor performance. However, it has not defined specific oversight procedures, such as the timing for when each activity should occur, or what follow-up corrective actions should be performed if deficiencies are identified. Further, CMS does not require sufficiently frequent monitoring of the effectiveness of security controls for state-based marketplaces, only requiring testing once every 3 years.
GAO identified significant weaknesses in the controls at three selected state-based marketplaces. These included insufficient encryption and inadequately configured firewalls, among others. In September 2015, GAO reported these results to the three states, which generally agreed and have plans in place to address the weaknesses. Without well-defined oversight procedures and more frequent monitoring of security controls, CMS has less assurance that state-based marketplaces are adequately protected against risks to the sensitive data they collect, process, and maintain.

What GAO Recommends

GAO is recommending that CMS define procedures for overseeing the security of state-based marketplaces and require continuous monitoring of state marketplace security controls. HHS concurred with GAO's recommendations.