Vermont confirmed Friday that a security breach of the state’s health-care exchange Web site gave at least one user access to another resident’s Social Security number, a disclosure that has the exchange’s top official in hot water.
The Vermont Health Connect’s privacy watchdog reported the security breach in a letter to the federal Centers for Medicare & Medicaid Services. The Associated Press obtained the report under Vermont’s public records law.
According to that report, one consumer who had logged on to the exchange’s Web site received a copy of his application for insurance in the mail, from an unnamed sender. A note scrawled on the back of the envelope read: “VERMONT HEALTH CONNECT IS NOT A SECURE WEBSITE!”
Department of Vermont Health Access commissioner Mark Larson told the AP it was the only security breach to occur since the site launched Oct. 1. But he had told state legislators at a hearing on Nov. 5 that his department had only investigated one complaint about security breaches, and that the complaint was unfounded.
In a statement Monday, Gov. Peter Shumlin (D) said he had been briefed on the security breach, which investigators said was neither intentional nor malicious. Shumlin criticized Larson for the misleading testimony.
“I take this incident extremely seriously. It is unacceptable to be anything less than fully cooperative and transparent with Vermonters and their elected representatives in the Legislature. I am tremendously disappointed in Commissioner Larson’s lapse of judgment in this matter,” Shumlin said. “This incident was promptly identified and resolved, and I was disappointed to learn that Commissioner Larson did not adequately disclose the circumstances of it when asked about this topic in committee earlier this month.”
Vermont’s health exchange has been one of the more successful efforts to enroll those eligible for care. The state said that by Nov. 1o it had signed up 3,500 people, about 12 percent of those expected to enroll, according to a study by Avalere Health cited by NBC News.