CMS responds to data breach affecting 75,000 in federal ACA portal

The files of an estimated 75,000 individuals were accessed in a breach of Healthcare.gov for Affordable Care Act enrollment, according to  the Centers for Medicare and Medicaid Services.

CMS said it detected anomalous activity in the federally facilitated exchanges, or direct enrollment pathway for agents and brokers. The direct enrollment pathway, launched in 2013, allows agents and brokers to assist consumers with applications for coverage.

IMPACT

While 75,000 represents a small fraction of consumer records, any breach of the system is unacceptable, CMS said.

The news was released less than two weeks before the start of open enrollment on Thursday, Nov. 1.

CMS began the initial investigation of anomalous system activity on October 13, and a breach was declared on October 16. The agent and broker accounts that were associated with the anomalous activity were deactivated, and – out of an abundance of caution – the direct enrollment pathway for agents and brokers was disabled.

CMS said it is working to address the issue, implement additional security measures, and restore the direct enrollment pathway for agents and brokers within the next seven days.

TREND

Healthcare information is an attractive target for cyber attackers, and the Department of Health and Human Services, Office of Civil Rights, holds organizations responsible for breaches of HIPAA-protected information.

Healthcare entities are expected to have strong password policies and to monitor and respond to security incidents in a timely fashion, said OCR Director Roger Severino, in reference to a breach at Anthem that exposed the social security numbers, addresses, dates of birth and other information of an estimated 79 million members.

Last week, Anthem agreed to pay $16 million to settle the violations.

Through a phishing email attack in 2015, Anthem information on HIV/AIDS prescription drugs and the names of members were exposed through transparent windows of envelopes.

CMS is in the beginning stages of the assessment of this breach, the agency said, calling it "an evolving situation."

ON THE RECORD 

"Our number one priority is the safety and security of the Americans we serve. We will continue to work around the clock to help those potentially impacted and ensure the protection of consumer information," said CMS Administrator Seema Verma. "I want to make clear to the public that Healthcare.gov and the marketplace call center are still available, and open enrollment will not be negatively impacted. We are working to identify the individuals potentially impacted as quickly as possible so that we can notify them and provide resources such as credit protection."   

WHAT ELSE YOU NEED TO KNOW        

CMS said it followed standard and appropriate security and risk protocols for researching and reporting the incident. Upon verification of the breach, CMS took immediate steps to secure the system and consumer information, further investigate the incident, and subsequently notify federal law enforcement. 

The tool through which the breach occurred is only available through the currently-disabled direct enrollment pathway for agents and brokers. As a result, the remaining enrollment channels, including Healthcare.gov and the marketplace call center, remain operational.

Twitter: @SusanJMorse
Email the writer: susan.morse@himssmedia.com