In my recent WEEKLY STANDARD essay, “Privacy Be Damned,” I warned about the operational problems and privacy issues raised by the “health exchanges” that HHS will force tens of millions of Americans to use as of October 1 of this year. In that essay, I noted that “the HHS inspector general and the GAO have been snoozing on their watches.”
Just days after the article appeared, the HHS inspector general issued an “audit report” on the health exchanges, perhaps the shortest one his office has ever issued on a significant topic. In less than five pages of analysis the report did little except note more missed deadlines. Some of the hard-hitting “observations” included:
Because the documents were still drafts, we could not assess CMS’s efforts to identify security controls and systems risks… (p.4)
We could not assess planned testing or whether vulnerabilities identified by the testing would be mitigated because the SCA [security control assessment] test plan had not been provided and the SCA had not been completed at the time of our review. (p.5)
Although the report’s use of the passive voice mutes the force of “the SCA test plan had not been provided,” a truly independent inspector general would insist that HHS not obstruct its audits.
What’s worse, if you look at the methodology section, you can see the inspector general only conducted interviews and reviewed paperwork. No auditor actually tried to use the beta version of the system that tens of millions of Americans must use in less than two months. Concern about the system is hardly unfounded; earlier this year a senior HHS technology official explicitly lowered the quality bar with the statement, “Let’s just make sure it’s not a third-world experience.”
I don’t sleep well thinking about Americans being fined for not using systems that don’t work. I don’t sleep well thinking about domestic abusers who could use vulnerabilities in the system to find their victims. However, the HHS inspector general seems to have no difficulty snoozing night or day.
Michael Astrue served as HHS general counsel (1989-1992) and commissioner of Social Security (2007-2013).