GAO: Healthcare.gov: Actions Needed to Enhance Information Security and Privacy Controls

The Centers for Medicare & Medicaid Services (CMS) reported 316 security- related incidents, between October 2013 and March 2015, affecting Healthcare.gov—the web portal for the federal health insurance marketplace— and its supporting systems. According to GAO’s review of CMS records for this period, the majority of these incidents involved such things as electronic probing of CMS systems by potential attackers, which did not lead to compromise of any systems, or the physical or electronic mailing of sensitive information to an incorrect recipient. None of the incidents included evidence that an outside attacker had successfully compromised sensitive data, such as personally identifiable information.