Audit finds slipshod cybersecurity at HealthCare.gov

WASHINGTON - The government stored sensitive personal information on millions of health insurance customers in a computer system with basic security flaws, according to an official audit that uncovered slipshod practices.

The Obama administration said it acted quickly to fix all the problems identified by the Health and Human Services inspector general's office. But the episode raises questions about the government's ability to protect a vast new database at a time when cyberattacks are growing bolder.

Known as MIDAS, the $110 million system is the central electronic storehouse for information collected under President Obama's health-care law.

It doesn't handle medical records. But according to a government privacy impact statement, it does include names, Social Security numbers, birth dates, addresses, phone numbers, passport numbers, employment status and financial account information of customers on HealthCare.gov and state insurance marketplaces.

"It sounds like a gold mine for ID thieves," said Jeremy Gillula, staff technologist for the Electronic Frontier Foundation, a civil liberties group focused on technology. "I'm kind of surprised that this information was never compromised."

The flaws uncovered by auditors included issues of security policy - where mistakes can have bigger consequences - as well as 135 database vulnerabilities, of which nearly two dozen were classified as potentially severe or catastrophic.

Among the policy mistakes: User sessions were not encrypted, contrary to standard practice on financial websites. "Not doing so is inexcusable for such sensitive data," said Michelle De Mooy, deputy director for consumer privacy at the Center for Democracy and Technology, an Internet rights group.

MIDAS is an internal system operated by the federal Centers for Medicare and Medicaid Services, the agency that administers the health-care law. The acronym stands for Multidimensional Insurance Data Analytics System. Officials say it's an electronic backbone, essential to the smooth operation of the health law's insurance markets.