Here are four key moments from Health and Human Services Secretary Kathleen Sebelius's testimony before the House Energy and Commerce Committee on Wednesday. (Sarah Parnass/The Washington Post)

The battle over the government’s problem-plagued health-care Web site escalated on Wednesday as Republicans attacked the Obama administration over an array of emerging issues involving the health law, including potential security vulnerabilities on the site and complaints from Americans facing cancellations of existing policies.

At a congressional hearing, Health and Human Services Secretary Kathleen Sebelius apologized for the flaws of, which was not functioning for most of the day. Conceding that navigating the health portal has been “a miserably frustrating experience for way too many Americans,” Sebelius told lawmakers: “Hold me accountable for the debacle. I’m responsible.”

President Obama, meanwhile, acknowledged for the first time that some Americans will have to switch health plans under the law. But he said these people now have “cut-rate plans” from “bad-apple insurers” — a situation the health-care law was designed to change. He urged consumers to “shop around” to “get a better deal” under the law.

The cancellations have become a big issue for Republicans, in part because Obama repeatedly had said that people would be able to keep their plans if they liked them.

Obama delivered his remarks Wednesday at Boston’s historic Faneuil Hall, where years ago his 2012 Republican opponent, Mitt Romney, signed the state law that became a model for the federal health-care overhaul.

A look at the consumer's route through the website and the potential failure points.

During the House Energy and Commerce Committee hearing, which featured Sebelius as the sole witness, critical Republicans seized on evidence that the administration knew that had security flaws days before it went live.

Rep. Mike Rogers (R-Mich.) quoted from a Sept. 27 memo to Medicare administrator Marilyn Tavenner from her staff that warned of “inherent security risks” stemming from inadequate testing.

“You accepted a risk on behalf of every user . . . that put their personal financial information at risk because you did not even have the most basic end-to-end test on security of this system,” Rogers said.

Sebelius acknowledged that launched with at least one security weakness that would allow hackers to obtain personal information entered into the site. But no breach occurred, she said, and the problem has since been corrected.

“It was a theoretical problem that was immediately fixed,” Se­belius said.

At a briefing later in the day, Julie Bataille, a spokeswoman for the Centers for Medicare and Medicaid Services, the HHS agency in charge of, said the site was still undergoing security testing. But she said consumer information is safe in the meantime.

Separate security testing for the Web site’s federal data hub, which helps determine eligibility for financial aid by verifying data with many federal agencies, has been completed and the hub has a permanent security certification, Bataille said. She could not immediately answer why one part of the system had completed security testing and another part had not.

Sebelius, in her testimony, also addressed what she said was a key flaw in the health-law technology: transmissions of inaccurate or ­incomplete enrollment data to health plans. Without accurate information, insurers will not know who has signed up for coverage and who should be billed.

“The system isn’t functioning, so we’re not getting that reliable data,” Sebelius said when pressed to provide enrollment numbers. “We have prioritized that specific fix.”

Republican lawmakers also asked Sebelius about an Oct. 11 slide presentation provided to lawmakers by the lead contractor on the Web site, CGI Federal. One slide showed that nearly half of the people applying for government subsidies were getting incorrect information about their eligibility. And in about a quarter of all applications, the system was duplicating certain records, leading to problems such as a person being recorded as having four spouses.

Some health plans have resorted to checking each enrollment file by hand rather than leaving it to automatic processing. One insurance industry source, who spoke on the condition of anonymity to describe internal decisions, said the plan has paid an offshore firm to help with this type of repetitive task.

Plan cancellations

Legislators also seized on the wave of cancellation notices that have begun arriving in hundreds of thousands of mailboxes across the country.

On Wednesday, several Republican lawmakers introduced legislation they dubbed the “If You Like Your Health Care Plan You Can Keep It Act.”

Members of the Energy and Commerce panel took turns telling stories about people from their districts who have received notices from their insurance companies stating that their plans are being canceled.

Rep. Cory Gardner (R-Colo.) told Sebelius that he and his family buy their health insurance on the private market and that he, like other people in his situation, got a notice saying his plan was being discontinued this year. He said he chose to reject his congressional insurance to be more like people in his district.

“Why aren’t you losing your insurance?” he demanded of Sebelius. “Why won’t you go into this exchange?”

Through midafternoon Wednesday, the Web site was still down because of a partial outage Tuesday night at the data center that hosts the Web site, said Bataille, the Medicare spokeswoman.

Tuesday night’s outage appeared to be related to an outage over the weekend, she said. Technical teams from the data center’s operator, Terremark, a unit of Verizon Communications, were working on repairs and to identify the root cause.

Obama fires back at GOP

In Boston, Obama said he drew lessons from the Massachusetts experience, noting that there were early problems and changes that had to be made to the law. In the first month of enrollment there, Obama said, just 100 people had signed up, but by the end of that year, 36,000 state residents had purchased coverage.

“By the way,” he said, “the parade of horribles, the worst predictions about health-care reform in Massachusetts, never came true.”

Obama shot back at his Republican critics on Capitol Hill, saying they are attacking the law instead of trying to make it work.

“It’s no surprise that some of the same folks trying to scare people now are the same folks who’ve been trying to sink the Affordable Care Act from the beginning,” Obama said.

Romney did not attend Wednesday’s ceremony — White House spokesman Josh Earnest said he did not think Romney was invited — but issued a statement seeking to differentiate his state law from the federal one.

Romney said that the Massachusetts law was designed to fit the “unique circumstances of a single state” and that it “should not be grafted onto the entire country.” Romney charged that if Obama had learned the lessons of Massachusetts, millions of Americans would not lose the insurance they were promised and the program’s launch would not have been “a frustrating embarrassment.”

“Health reform is best crafted by states with bipartisan support and input from its employers, as we did, without raising taxes, and by carefully phasing it in to avoid the type of disruptions we are seeing nationally,” Romney said.

Lena H. Sun contributed to this report.