As health insurance marketplaces—a signature aspect of the Affordable Care Act—got ready to open for business on October 1, one part of the system continued to raise hackles. The Federal Data Services Hub, a key component of helping consumers and small businesses secure insurance, will over time gain access to all manner of personal information.
It works like this: When people enroll in their state’s marketplace to search for insurance, they enter their Social Security numbers, demographic data, information about their finances, and more. The marketplace then verifies their information and checks whether they are eligible for subsidies, tax credits, or programs like Medicaid.
The federal Centers for Medicare and Medicaid Services stresses that the “hub” does not retain or store information.
Despite some halting glitches in enrollment, the process has already begun.
Using the hub, the system gathers information from other agencies, including the Department of Justice (criminal records), the IRS (income and employment), the Department of Homeland Security (citizenship), Social Security Administration (validating birth dates and Socials).
The federal Centers for Medicare and Medicaid Services stresses that the “hub” is not a database—meaning that it does not retain or store this information. Instead, it’s a routing tool that allows state marketplaces to obtain applicants’ information in an efficient, secure fashion. It also eliminates the need for all state and federal marketplaces to develop separate data connections to each database.
“The hub is critical to the operation of both the federally facilitated marketplace and state-based marketplaces, enabling them to provide accurate and timely eligibility determinations,” said Todd Park, U.S. chief technology officer, before the exchanges opened. “After more than two years of work, it is built and ready for operation, and we have completed security testing and certification to operate. This is an important step in being ready for open enrollment on October 1.”
However, these assurances don’t appease critics, who assert that too much of the security testing was done under wraps and at the last minute. In addition, the data hub “could be the largest consolidation of personal data in the history of the republic,” asserts Stephen Parente, a finance professor at the University of Minnesota who specializes in health economics, in USA Today.
To verify the hub’s ability to protect personal information, the House Subcommittee on Cybersecurity, Infrastructure Protection, and Security Technologies held a hearing in September. Health and Human Services officials sought to reassure representatives that it commissioned an independent audit, which found that the hub has the required safeguards to operate securely.
Parente, who testified at the hearing, says that despite these assurances, he still has concerns. It shouldn’t be that difficult to produce quickly who did the audit and to what level it was done to put people’s minds at ease,” he adds. “There is too much at stake.”
Critics assert that too much of the security testing was done under wraps and at the last minute.
Other points of worry: if applicants’ Social Security numbers don’t match their other information, the marketplace will need to do more verification. Then the hub can retain personal information for 10 years, which eventually becomes a rich trove of data for sophisticated hackers, Parente says.
In addition, there are varied state policies for protecting data and standards for navigators, who help people obtain insurance on the marketplace. In some states, Parente says, navigators could be certified brokers with experience protecting personal data while others might have nonprofit volunteers with limited training.
That concern became apparent this fall when an employee of Minnesota’s MNsure marketplace accidentally emailed an unencrypted spreadsheet with 2,400 insurance brokers’ Social Security numbers to a third party. The file easily could have fallen into the wrong hands, Parente says. “It’s situations like this that get people concerned, and at the same time it reveals how complex it is to put the whole system together.”
Meanwhile, the push is on to enroll people in the marketplaces. Enroll America, the national nonprofit, keeps its message focused on the insurance benefits and potential subsidies or tax credits, says Jessica Barba Brown, national communications director. If applicants express concerns about data privacy, “We are pointing people in the direction of approved, trusted sources for enrollment help so they can be sure their information will be protected,” she says.
If the hub works as planned, applicants will probably never know about the behind-the-scenes network that aggregates their information. If there is a data breach, though, it could seriously erode the public’s trust in the new marketplaces.