Committee looks into Cover Oregon security
PORTLAND — A congressional committee is looking into whether Oregon's troubled health-insurance exchange had done enough to protect sensitive personal information before trying to launch the Cover Oregon portal in October.
In a letter to Gov. John Kitzhaber, the U.S. House Committee on Oversight and Government Reform outlined data-security concerns at state-built exchanges that connected to the federal data hub before full review and security approval.
Oregon and five other states were questioned by the committee at a hearing Thursday.
According to The Oregonian, Cover Oregon says it still has not received final federal approval of its data safeguards. But exchange officials say they received preliminary approvals in September.
“Cover Oregon takes the security of our customer's personal information very seriously and has met or exceeded all applicable industry standards,” Cover Oregon communications director Amy Fauver said.
Documents previously provided to the Associated Press by the House committee showed that more than two-thirds of state systems that were supposed to tap into federal computers to verify personal information for coverage were initially rated as “high risk” for security problems.
Despite this, the federal Centers for Medicaid and Medicare Services allowed the states to connect to the hub by October 1.
A security contractor also warned federal officials that allowing states to connect without the appropriate review “introduces an unknown amount of risk” that could put the personal information of “potentially millions of users at risk of identity theft.”
The Obama administration said the security problems cited were either resolved or are being addressed through specific actions. No successful cyber -attacks have taken place, officials say.
In Oregon, a security assessment in September by Cover Oregon's quality-assurance contractor showed that part of the exchange's required security testing remained unfinished.
Cover Oregon says the site has also had no electronic security breaches. The full exchange portal has never launched to the general public.
Oregon is the only state where the general public still can't enroll online in health coverage in one sitting. The state is using a hybrid manual-online enrollment process.
Information from: The Oregonian, http://www.oregonlive.com