Security Testing of ACA Data Hub Still Incomplete, OIG Report Finds

Although a data hub designed to connect federal agencies with state health insurance exchanges under the Affordable Care Act likely will be ready by Oct. 1, there will be limited time for security testing prior to its launch, according to a report released Friday by HHS' Office of Inspector General, LifeHealthPro reports.

Details of the Data Hub

The data hub is meant to verify exchange applicants' income information with the IRS and then transmit verifications back to the marketplace. It also aims to relay information between the exchanges and other federal agencies, such as Citizenship and Immigration Services and the Department of Homeland Security (Bell, LifeHealthPro, 8/5).

Details of Report

CMS has delayed due dates involved with preparing the data hub's launch by a month or more since March, according to the OIG report.

The OIG report found there are "several critical tasks" CMS still needs to complete, including:

• The final independent testing of the hub's security controls;
• Addressing security risks identified during testing; and
• Obtaining security authorization for the hub before the ACA's health insurance exchanges are launched.

The report noted that "CMS' current schedule is to complete all of its tasks by" Oct. 1 (Reichard, CQ HealthBeat, 8/5).

However, Gloria Jarmon -- deputy inspector general for audit services at OIG -- in a memo about the findings said, "If there are additional delays in completing the security assessment and testing, the CMS CIO may have limited information on the security risks and controls when granting the security authorization of the hub" (LifeHealthPro, 8/5).

CMS Response

In a response to the report, CMS Administrator Marilyn Tavenner said that "independent test dates have been adjusted to precisely align with each code delivery date" and that the agency is "conducting internal security testing reviews and fixing system weaknesses as part of the development process."

Tavenner added that she is confident the hub will be operational and secure by Oct. 1.

CMS spokesperson Brian Cook noted that the OIG study was conducted in May and that CMS has "made significant progress in the three months since then" (CQ HealthBeat, 8/5).