The dysfunctional, more than $70-million Vermont Health Connect website is down for maintenance for a period of what state officials expect will be weeks, not days. Gov. Peter Shumlin, D-Vt., yanked the portal, which is used by Vermonters who don't get health insurance through work to manage the plans federal law now requires them to have. "Nobody's more frustrated than me," Shumlin told reporters Tuesday.
While Health Connect is temporarily offline, Vermont will work with a new vendor, Optum, to upgrade site functions and security. The site still cannot fulfill all its intended goals, despite having launched nearly a year ago.
Vermont's health care reform chief, Lawrence Miller, said the move was not in response to any data breach, but acknowledged cyber security risks are real. "The threat conditions are constantly evolving," Miller said.
Officials said consumers need only look to recent headlines, such as the Home Depot hack that exposed credit card users to theft, to understand concerns over security. Miller would not discuss any possible Vermont Health Connect vulnerabilities, describing the step as precautionary. "Obviously, the security issues, we're not going to go into the kind of details we might on other sorts of things, because we don't want to help the people who want to hurt us," Miller said.
"If I was an attacker, these websites--these health exchanges--may be the one place I'm going to focus all of my time and effort on," said Jon Rajewski, the director of Champlain College's Leahy Center for Digital Investigation.
Rajewski called the very personal data on a health care exchange the "holy grail" for hackers, because information entered into that kind of site would contain everything they'd ever need to steal someone's identity. However, Rajewski said proactive protections, with several layers, are a smart idea and something any site like Vermont Health Connect needs to be looking at.
"If you're going to build one of these websites, it had better be secure," Rajewski told New England Cable News. "And you'd better be auditing that website on a regular basis to detect the evil that could be there."
Vermont
The latest news from around the state
Miller and Shumlin said the security of Vermont Health Connect is regularly evaluated, and the state and its contractors value the guidance of expert advisors in cyber security. They emphasized that no specific threat or attack motivated this, saying that the climate of cyber security today means they should always be looking for added protections.
The changes made to how the site works, including to the way users log onto Vermont Health Connect, should also improve a consumer's experience, Miller said. Making the site more user-friendly and to insure better and complete functionality were also goals of this shutdown. This is a good time to do it, Miller and Shumlin said, because this tends to be a quiet time of year for the site.
The improved Vermont Health Connect is promised in time for the November 15 open enrollment period. While the fixes are made, health care coverage continues. Consumers can also manage their insurance plans through the mail or through call centers. According to the message web users get when they log onto Vermont Health Connect, the customer support center can be reached toll-free at 855-899-9600 from 8 a.m. to 8 p.m. Monday through Friday. The hours are 8 a.m. to 1 p.m. on Saturdays, the site says.
The Republican who wants to take Gov. Shumlin's job in the November elections, businessman Scott Milne, said he hopes voters remember Vermont Health Connect's troubles at their polling place. "It keeps getting worse for Vermonters," Milne said in a statement. "The catastrophic failure of Vermont Health Connect is putting Vermonters at risk."
Gubernatorial candidate Dan Feliciano, a Libertarian whose website bio says extensive experience working in insurance and finance, also reacted to the shutdown. He said he hopes it stays down and that Vermont moves onto the federal exchange. Feliciano said shutting down the website was the right move to protect Vermonters' personal and financial information.
Sen. Patrick Leahy, D-Vt., praised the move by Gov. Shumlin. In a statement, Leahy said: "Vermont has been, and continues to be, a leader in the implementation of the Affordable Care Act. I am glad that Governor Shumlin is taking this critical step to fix Vermont Health Connect to ensure that it works as intended to help thousands of Vermonters gain access to quality health insurance. He is absolutely right that technology offers us benefits but also additional challenges when it comes to health care, and making these systems in Vermont and everywhere work as they should, and making them work well, must always be a high priority."
