Skip to main content

Probe: HealthCare.gov website must boost security

By WTOP Staff

RICARDO ALONSO-ZALDIVAR
Associated Press

WASHINGTON (AP) — HealthCare.gov, the health insurance website serving more than 5 million Americans, has significant security flaws that put users’ personal information at risk, nonpartisan congressional investigators have concluded.

The Government Accountability Office said the Obama administration must resolve more than 20 specific security issues related to who can get into the system, who can make changes in it and what to do in case the complex network fails.

GAO, the investigative arm of Congress, found that the administration took a major risk going live with HealthCare.gov last fall when the system was still not fully tested. Some testing was incomplete as of June.

While the administration “has taken important steps to apply security and privacy safeguards to HealthCare.gov and its supporting systems, significant weaknesses remain that put these systems and the sensitive, personal information they contain at risk of compromise,” Gregory Wilshusen, GAO’s director of information security, said in testimony prepared for the House Oversight and Government Reform Committee.

The committee released his testimony Tuesday. GAO’s accompanying 78-page report was released later.

The website collects sensitive personal information including names, birth dates, Social Security numbers and family income.

Multiple federal and state agencies as well as many contractors have access. Yet the report found there’s no common understanding of security requirements among all the players.

The agency running HealthCare.gov “had not always required or enforced strong password controls, adequately restricted access to the Internet, consistently implemented software patches and properly configured an administrative network,” the report said.

Responding for the administration, Health and Human Services spokesman Aaron Albright said that the changing nature of threats makes website security an evolving process and that officials have already acted on many of the recommendations.

In its public assessment, the GAO outlined six broad areas where more work needs to done. They ranged from basics like following recommended best practices for government agencies, to a comprehensive test of all elements of the system, to establishing a backup site for the HealthCare.gov and its supporting networks.

In an accompanying report that was not publicly released, Wilshusen said the agency listed 22 specific technical recommendations to fix security flaws. He said the administration agreed with all the specific recommendations, although not with some of the broader suggestions.

One major disagreement is whether security testing should involve the entire system simultaneously — as GAO recommends– or whether each component can be tested and certified separately, as the administration has done.

HealthCare.gov was hacked this summer, but no consumer information was stolen. Instead, hackers installed malicious software that could have been used to launch an attack on other websites from the federal insurance portal.

Federal computer systems get hundreds of cyberattacks every day, but this was believed to be the first successful one involving HealthCare.gov.

The health care site had numerous technical problems when it was launched last fall and was initially unworkable for most consumers. Among the issues that concerned the administration’s own technical experts at the time was that security testing could not be completed because the system was undergoing so many last-minute changes.

The part of HealthCare.gov that serves as the entry way for consumers eventually passed security certification, but the GAO revealed that security testing continued well into this year on other important components that deal with health plan information and financial management. The administration said that’s because those components were still in stages of development.

The report also confirmed security problems in state computer systems linking to the federal network, reported earlier this year by The Associated Press.

Created by President Barack Obama’s law, HealthCare.gov is the online gateway to subsidized private insurance for people who don’t have access to a health plan on the job.

The site currently serves 36 states, and more may be added when open enrollment starts Nov. 15. The remaining states run their own insurance exchanges.

One of those states, Vermont, announced Tuesday that its technically troubled site has been taken down to fix numerous issues, including several security problems.

The Oversight and Government Reform Committee was scheduled to hold a hearing Thursday on the GAO report and the outlook for the second year of HealthCare.gov.

Copyright 2014 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.

Don’t Settle for Student Loans to Pay for Online Education

By WTOP Staff
Online college programs are becoming a more popular choice for prospective students, with one study finding that more than 6 million students enrolled in at least one online course in fall 2015. The popularity of these courses can be attributed in part to their flexibility with working adults' schedules, students' ability to progress more quickly through online programs and, oftentimes, cheaper tuition. [See 10 low-cost online bachelor's programs for out-of-state students.]Online degrees can be beneficial to many college students, but some studies have shown online learners complete their programs at lower rates than students at traditional brick-and-mortar campuses. Individuals with student loans but no degree comprise two-thirds of defaulted borrowers. Though these numbers are not encouraging, just like for traditional programs, there are ways to reduce how much you'll need to borrow for an online program to ensure you won't become one of these statistics. Don't just settle on borrowing student loans to cover the whole cost of your program and living expenses. Instead, start thinking about how to cut costs and cover your balance in different ways, such as the following. -- Grants and scholarships: Even though you are taking an online course, you can still apply and receive grants and scholarships. But your first step should be to complete the Free Application for Federal Student Aid, commonly referred to as the FAFSA, which will allow you to receive a Pell Grant if your expected family contribution is low enough. The EFC criteria and award amounts are adjusted annually, but the 2017-2018 academic year awards range from $606 to $5,920, which could significantly lower the amount you borrow annually. Your next step is to apply for scholarships. You can start by checking online scholarship search engines, such as the Salt Scholarship Search, College Board's BigFuture and Peterson's. But don't forget to take advantage of local organizations and your school's financial aid office. Both may offer scholarships that you can't find with a national scholarship search. [Review these 10 sites to kick off your scholarship search.]For instance, organizations like the Elks Club, Knights of Columbus or the Rotary Club typically offer scholarships annually to local students. Just because you're going to school online doesn't mean you're ineligible. Visit your local library for scholarship listings, and ask around town. You might be surprised how many local organizations offer scholarships. While these scholarships typically aren't large, every little bit counts. Each dollar you receive in a scholarship is a dollar you don't have to borrow and pay interest on. -- Work-study: Another option for online students may be work-study awards. Not all students enrolled in online programs are eligible, but students at some schools -- including, for example, SUNY Empire State College and Liberty University -- are. Work-study awards are not given upfront like scholarships and grants. In most cases, they are an offer to earn up to the awarded amount if you secure an eligible work-study job. While there is a misconception that all work-study jobs must be on campus, students can work for off-campus, nonprofit or public employers as long as the work is in the public's interest. You may be able to work for a for-profit employer if the job is relevant to your course of study. No matter who the outside employer is, it will need to have an established agreement with your college for you to receive work-study funds. Remember, to be eligible for federal financial aid, you must be enrolled and pursuing a degree or certificate. If you're not working toward a credential, Pell Grants and work-study won't be option, but you may still be able to take advantage of private scholarships -- just be sure to read the eligibility criteria carefully. [Explore what to know about financial aid in online programs.]-- Pay as you go: One of the great benefits to enrolling online is the flexible schedule, which can allow you to complete your college coursework around your responsibilities. But prospective students often overlook using their part- or full-time job earnings as an option for paying for college. Almost 80 percent of college students in 2015 worked at least part time while attending classes, according to the National Center for Education Statistics. By budgeting and thinking strategically about your college costs, you can likely reduce your dependence on student loans by paying a portion out of pocket. Many -- but not all -- online programs are less expensive than traditional programs and often have shorter payment periods. Six, eight or 10 weeks are common course durations. Because of the frequency of payments in an online setting, you may be well-placed to pay as you go and possibly avoid borrowing altogether. Attending college online and avoiding student loans may be challenging, but if you are willing to put in the effort, you can limit the amount you need to borrow. More from U.S. News Q&A: Understanding Student Loan Discharge Eligibility Student Loan Refinancing Isn't Right for All Borrowers
Read Next Story

Related News

Frustration grows in Venezuela as earthquake death toll reaches 1,430

Israel and Lebanon sign framework agreement with US in ‘first step’ toward peace, Rubio says

Trump-endorsed populist poised to become Colombia’s next president as rival challenges vote