Obamacare Web Contractor Cited for Not Protecting Consumer Info

A technology firm that helped build the data systems underlying the troubled HealthCare.gov website -- and which is now fixing it -- was slammed in June for lax security controls that jeopardized the personal data of more than 6 million Medicare beneficiaries.

Federal investigators found Quality Software Services, Inc. failed to stop its employees from connecting unauthorized USB devices -- like iPods -- to highly sensitive Medicare systems, The Hill reported Thursday.

In a June report by the Health and Human Services inspector general revealed the company's inaction let workers connect unsanctioned devices to 29 out of the 30 workstations reviewed.

All of the workstations, in turn, had access to millions of Medicare patients' personal data, The Hill reported.

The unfettered access to USB ports raised the possibility workers could have introduced malware to Medicare's systems or "inappropriately accessed" personally identifiable details, the report stated.

The information of more than 6 million Medicare beneficiaries was at "greater risk from malware, inappropriate access or theft" as a result, HHS assistant inspector general Kay Daily wrote in the report.

The revelation comes in the wake of trove of secret information made public from ex-National Security Agency leaker Edward Snowden and former Army soldier Chelsea Manning. The two allegedly used USB devices to obtain and distribute government secrets, The Hill reported.

The issue also relates to security concerns with the President Obama's signature healthcare law, with Republicans accusing the administration of failing to ensure the safety of consumers' personal data in the new system.

In addition, California Republican Rep. Darrell Issa on Tuesday issued a subpoena to QSSI; an official with the firm is a major donor and bundler for Obama's presidential campaign.

In her report, Daily noted that QSSI vowed to correct the security risks by revising its policies, implementing "read only" restrictions for its USB ports and scanning all portable devices to "detect malicious code."

The federal Health department did not respond to a request for comment from The Hill.

Quality Software Services is a Maryland-based company founded in 1997 by Indian-American Tony Singh, and nearly 90 percent of its work is for the government, the Economic Times has reported.

Among its clients in the U.S. government are the departments of education, housing and urban development, transportation and the postal service, the newspaper reported.
It also does some work for Treasury and the Department of Homeland Security, the newspaper reported.

Its involvement with Obamacare began when it won a contract to build a "data hub" for the HealthCare.gov website in 2011, the newspaper said.

The work involved building a data routing and channeling architecture that would send an applicant's information to relevant government databases to verify his or her citizenship, social security status or other information needed in deciding the state subsidy eligibility for medical insurance coverage.

That deal, worth about about $85 million made the company an attractive target, and in 2012, it was acquired U.S. insurance giant UnitedHealth Group for an undisclosed sum, the newspaper reported.

But the acquisition raised potential conflict of interest concerns among some Senators, who questioned if the work the company did for Obamacare may have given the insurer a leg up, the newspaper said.