Slashdot Mirror
HealthCare.gov Portal Suffers Data Breach Exposing 75,000 Customers (gizmodo.com)
An anonymous reader quotes a report from Gizmodo: Sensitive information belonging to roughly 75,000 individuals was exposed after a government healthcare sign-up system got hacked, the Centers for Medicare & Medicaid Services (CMS) said on Friday. The agency said that "anomalous system activity" was detected last week in the Direct Enrollment system, which Americans use to enroll in healthcare plans via the insurance exchange established under the Affordable Care Act -- also known as Obamacare. A breach was declared on Wednesday. It's unclear why the agency, which is part of the U.S. Department of Health and Human Services, chose to not announce the incident sooner. Officials said the hacked portal is used by insurance agents and brokers to help Americans sign up for coverage and that no other systems were involved. The affected system has been disabled. CMS said it hoped to restore it before the end of next week. "I want to make clear to the public that HealthCare.gov and the Marketplace Call Center are still available, and open enrollment will not be negatively impacted," CMS Administrator Seema Verma said in a statement. "We are working to identify the individuals potentially impacted as quickly as possible so that we can notify them and provide resources such as credit protection."
Seriously, I'd like to know who doesn't have my personal information at this point. Likely be a short list.
I must have missed the part where 'something fantastic' was proposed by the Republicans. When was that? Can you provide a link to the fantastic healthcare plan they proposed?
Also, seems like the GOP has a majority in both houses of Congress. Why did the support of the Democrats matter at all? Thx.
"Presumably this is just the world we live in. There doesn't seem much info in the article,..."
(Gasp) You read the article?
Vade retro Satanas!
> Trading across state lines won't help, it becomes a race to the bottom
Exactly. That's why each state has to have separate car companies, separate food companies, separate smartphone manufacturers - and separate insurance companies.
If you let people in Oregon buy a phone made in California, or a truck made in Texas, or fruit grown in Florida, you know it'll be garbage.
I say people should only be allowed to do business with companies in the same state, to avoid this race to the bottom. The fabulous success of this policy for health insurance demonstrates why we should do the same thing for all products and services.
There's no reason for it to be the world we live in. We make it cheaper for companies to be failures than successes, but that's a choice and not every country makes the same choices.
All we need are the well-regulated markets advocated by Adam Smith, where regulations protect personal information, mandate minimum standards of operation and require a warranty for fitness of purpose in software.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
That name was dreamt up to play on the fears of Republican voters, including the suggestion that it would have "death panels". A survey early last year showed 35% of respondents still didn't realize "Obamacare" was the same thing as the ACA. We need to make decisions rationally, not out of fear.
For instance, you're more likely to be killed by pollution (200,000 early deaths per year) than an undocumented immigrant (750 per year). However, our administration wants to spend money building a wall to protect you from the "dangerous" Mexicans, but doesn't mention anything about how many people die from pollution when announcing cuts to emissions standards.
(The 750 number is 456 arrests per year, plus an estimated correction factor due to cases not being solved.)
You do understand that whilst different cars have different performance characteristics making them suitable for different conditions, there's really only one treatment for a broken leg, one treatment for any given bacterial infection, one sort of x-ray, one design of ambulance.
Not really a situation that applies to cars, toothbrushes or music.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
The issue isn't a week. The issue is that there was a serious defect resulting in personally identifying information (PII) being exposed, showing inadequate testing, and that identification of the flaw took however many years the service has been online.
This is mission-critical software in which failures could potentially cause tens of millions of dollars damage. There are certain Federal requirements for such software, including ISO 900x. It is also running via the Federal government, which imposes FIPS, the NSA secure server guidelines, Common Criteria, and those elements of the Rainbow Series dealing with data not obsoleted by later NIST standards.
I know the sorts of contractors involved, I used to do contract work for the Federal government myself. I am not impressed. The maxim is that if builders built buildings the way programmers wrote programs, the first woodpecker th at came along would destroy civilization. In Federal circles, that's pretty accurate.
Sure, they're doing better than Yahoo! or Sony. So did Genghis Khan. It's not a difficult standard to reach. Given the Federal government mandates better, should we not be using the mandated standard as the one to judge by?
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
The bastards expose all your info in open files in paper documents. How unsafe is that ? Imagine being a jan who knows to make use of this !!
So what you're saying is that a vehicle that is optimum to drive up a snowy mountain in Colorado is different than one optimized for cruising Miami Beach, right? So to some extent, it kinda makes sense to have different cars for different states?
On the other hand, the treatment for a broken leg in Colorado is exactly the same as the treatment for a broken leg in Florida, so prohibiting people in Colorado from choosing health insurance from a company in Florida is utterly ridiculous on its face?
The Republicans almost voted to return health care to the states which would have been a fantastic solution. The reason why it didn't happen was because every single Democrat voted against it and 60 votes are required to get things done in the Senate.
should only be surprised that it took this long for this sort of steaming pile to be breached. Or in a way that left enough breadcrumbs for someone to notice, anyway.
"I want to make clear to the public that HealthCare.gov and the Marketplace Call Center are still available, and open enrollment will not be negatively impacted,"
Translation: "Please continue to put your personal information in our shitwagon."
We already have health insurance companies selling across state lines. I can start a health insurance company in Alaska, and sell health insurance in Florida.
The only caveat is that I have to comply to Florida law for the insurance policies I sell in that state.
What Republicans want to do is make it so I can set up shop in Alaska and sell insurance policies to Florida that comply with Alaskan law. And this is where we have already seen a race to the bottom in another field: Credit cards.
Until a few decades ago, most states capped interest rates. Along came the Supreme Court and said that for credit cards, the state law where the company is based applies, not the state law where the credit card holder is. This turned Sioux Falls into a major base of operation for credit card companies, since South Dakota, unlike most states at the time, did not have a limit on interest rates.
I see no reason why health insurance shouldn't expect to see a similar race to the bottom if they no longer have to follow the state law where the policy holders are based.
So, approximately all of them ...
That is a silly comparison. The real issue is how much of an entitlement people have to healthcare, and how much other people should pay to provide it.
Democrats generally support broadening the entitlement, and perhaps making it universal, but are not clear who will pay, how generous the system will be, or how we can transition from the bloated and expensive system that we have now.
Republicans generally support keeping Medicare (healthcare for old people), Medicaid (healthcare for poor people), and the VA (healthcare for veterans), but want to roll back the ACA, without any agreement on what will replace it.
I... think several of my past jobs qualify as working in security. And nobody works to be OSI compliant, at least not in any of the projects I've worked on. I doubt most people know any relevant OSI standards.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
I would agree with you, as far as you've gone, yes. There's nothing intrinsic about a Florida insurance company that means it can't handle a Colorado claim.
This whole in-State/out-of-State thing is, as you rightly point out, a red herring, a most scarlet fish of our times. That's not where the issues lie and there should be no constraints there.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
On initial release this system had an alarming number of security issues, but anyone publicly pointing them out (e.g. David Kennedy from TrustedSec) was generally marked as a conservative troll and not genuinely interested in the security of the system. I generated a shitload of 'anomalous activity' back in the day doing a little personal research and there was zero evidence of detection or responsive action. I'm sure security has improved over the years but I doubt this is the first incident.