California, Kentucky, Vermont marketplaces identified as vulnerable to hackers

As cyberattacks of healthcare systems become more frequent and call attention to the question of whether sensitive data is secure, the Government Accountability Office has released a report identifying significant weaknesses at three selected state-based marketplaces: California, Kentucky and Vermont.

The weaknesses include insufficient encryption and inadequately configured firewalls that could allow hackers to gain access to consumer data, according to the March 23 GOA report.

The three states were not identified in the report, but the GAO confirmed them by request in response to a story reported by the Associated Press.

Vermont authorities would not discuss the findings, but officials in California and Kentucky said this week that there was no evidence hackers succeeded in stealing anything, AP reported.

The three states were selected for the study by the GOA.

[Also: Hospitals in California, Indiana hit with ransomware attack]

Weaknesses in all three states were identified in security and privacy controls as well as in technical controls related to access, cryptography, and configuration management, the report said.

For example, one state did not encrypt connections to the authentication servers supporting its system. They were configured to accept unencrypted connections, the GOA said.

As a result, an attacker on the network could observe the unencrypted transmission to gather usernames and password hashes, which could then be used to compromise those accounts, the GAO said.

One state did not filter uniform resource locator (URL) requests from the internet through a web application firewall to prevent hostile requests from reaching the marketplace website, it said.

As a result, hostile URL requests could potentially scan and exploit vulnerabilities of the portal and potentially gain access to remaining systems and databases of the marketplace, the report said.

One state did not enforce the use of high-level encryption on its Windows servers to require the use of compliant algorithms. As a result, the servers could employ weak encryption for protecting authentication and communication, increasing the risk that an attacker could compromise the confidentiality or integrity of the system, according to the report.

[Also: Experts: Data, devices, employees pose biggest challenges to hospital cybersecurity]

In total, the GOA identified 24 potential mitigation activities to address weaknesses in the three states' security and privacy programs and 66 potential mitigation activities to improve the effectiveness of their information security.

"The three states generally agreed with the potential mitigation activities and have plans to address them," the report said.

The GOA originally reported concerns to the three states in September 2015, it said.

The Centers for Medicare and Medicaid Services did not require sufficiently frequent monitoring of the effectiveness of security controls for state-based marketplaces, only requiring testing once every three years, the GOA said.

The GAO recommended that CMS define procedures for overseeing the security of state-based marketplaces and require continuous monitoring of state marketplace security controls.

The Department of Health and Human Services concurred with the  recommendations, the GAO said.

At the federal side, Healthcare.gov, CMS reported 316 security-related incidents between October 2013 and March 2015, the GOA report said.

The majority of these incidents involved such things as electronic probing of CMS systems by potential attackers, which did not lead to compromise of any systems, or the physical or electronic mailing of sensitive information to an incorrect recipient, the GOA said.

[Also: Methodist Hospital recovering from 5-day ransomware attack, claims it did not pay up]

There is no evidence that an outside attacker successfully compromised sensitive data, such as personally identifiable information, the GOA said.

CMS has taken steps to protect the security and privacy of data, the GOA said.

Over the past two years, the GAO has issued a number of reports highlighting challenges that CMS has faced in implementing and operating the health insurance marketplaces' IT systems.

In September 2014, the GOA noted that Healthcare.gov and the related systems had been deployed despite incomplete security plans and privacy documentation, incomplete security tests, and the lack of an alternate processing site to avoid major service disruptions, the GAO said.

As of December 2015, CMS had taken steps to address the problems, it said.

Twitter: @SusanJMorse