Outgoing Congressional Staffer Warns On Security Issues Surrounding Healtcare.gov

Adam de Angeli is leaving  Congressman Kerry Bentivolio's office. EPJ has obtained an email he sent out to friends discussing his decision to leave. The email contained significant commentary and warning about the web site, Healthcare.gov. That part of his email is produced below:

With Healthcare dot gov, you have the government supervising the most colossal security failure imaginable, easy for any and every software engineer--let alone security expert--to discern.  And still this is categorically denied by everyone at the Center for Medicare and Medicaid Services that developed the website.

Funny, isn't it, that when it comes to protecting our privacy and security, the government is completely incompetent, yet when it comes to controlling and diminishing our lives, the government couldn't be more competent.

The entire issue is a home run for conservatives.  Here we have the undeniable fact that the Obamacare website is almost completely insecure, jeopardizing the personal information of every user.  Expert consensus is growing.

More ominously, the website threatens the security of every federal, state, and private system it connects with, and every security expert weighing in (outside those working for the Administration or dependent on it) agrees that this is a real concern. Unfortunately, only insiders can determine for certain what is really going on, but we have every reason to suspect the worst.

The worst case is that the medical records of every American can be stolen by hackers.

I asked a security expert, one who actually supports Obamacare in concept, whether it was hyperbolic to call this a national emergency. 

Her response:

No, I don't. Between the known weaknesses of healthcare dot gov, the known weaknesses of the rest of the healthcare industry (as evidenced by the recent CMS audits), and the unknown security of the HIE interfaces, I think that it is absolutely an emergency.

The healthcare industry as a whole does not take security seriously and healthcare dot gov, the worst example of all, is actually exempt from HIPAA, as an extension of CMS. It was poorly implemented at exorbitant cost to taxpayers and we're stuck with the bill of the cleanup, or worse – the cleanup costs of the inevitable breach.

Your data, my data, everyone's data – it's all out there. The letters and credit monitoring services given when a breach has occurred are going to be worthless when it's the entire nation.

The only responsible reaction is to take the website off-line and fix it.  (Actually, it would probably be easier to start over.) 

But that would be the political death of the President, so that will not happen.[...]

In the meantime, though, Republicans can freely beat the daylights out of the President and his loyal party for their delusional ignorance of what is actually going on at this website.  There will be no shortage of news stories in the coming months as the public realizes what is happening.