Blog

Megan does a great job summarizing the recent decision to exempt those who had their policies cancelled in this post. Her conclusion reflects my sentiment.

I’d ask this: What do you do for an encore? Will the administration force these folks to buy insurance next year? Or will they keep allowing special exceptions rather than take the political heat for changing health insurance that people liked?

I’m not sure the administration is thinking that far ahead. The White House is focused on winning the news cycle, day by day, not the kind of detached technocratic policymaking that they, and the law’s other supporters, hoped this law would embody. Does your fix create problems later, cause costs to spiral or people to drop out of the insurance market, or lead to political pressure to expand the fixes in ways that critically undermine the law? Well, that’s preferable to sudden death right now.

However incoherent these fixes may seem, they send two messages, loud and clear. The first is that although liberal pundits may think that the law is a done deal, impossible to repeal, the administration does not believe that. The willingness to take large risks with the program’s stability indicates that the administration thinks it has a huge amount to lose — that the White House is in a battle for the program’s very existence, not a few marginal House and Senate seats.

And the second is that enrollment probably isn’t what the administration was hoping. I don’t know that we’ll start Jan. 1 with fewer people insured than we had a year ago, but this certainly shouldn’t make us optimistic. It’s not like people who lost their insurance due to Obamacare, and now can’t afford to replace their policy, are going to be happy that they’re exempted from the mandate; they’re still going to be pretty mad. This is at best, damage control. Which suggests that the administration is expecting a fair amount of damage.

This “improvisational government” is going day to day, and not thinking about what comes next. The death spiral is not limited to health insurance premiums.

When blogging about Obamacare on a daily basis, it is often difficult to keep perspective, as I juggle a million balls with every new development. But as I begin to think about the narrative for the sequel, Unraveled, I am starting to weave together different strands to tell the story of Healthcare.gov in a chronological fashion.

One of these threads focuses on the decision to launch the website even though people on the project knew it wasn’t ready–but in terms of operational capacity, and security. But, due to politics, the website went ahead anyway. Remarkably, all the brass from the President to Sebelius had plausible deniability, and claimed not to know about these problems. I find this implausible, but we can uncover that truth another day.

For now, my inquiry focuses on who actually approved these systems to launch. In a previous life, I worked in network security in the DOD. My knowledge is somewhat out of date, but I have a rough idea of the process by which federal information systems are approved for usage. It is a really strict process, that requires signatures from lots of government officials. I was involved in several projects, that were much lower priority, that were delayed many times because it could not get the proper certifications and accreditations. So what happened with HealthCare.gov?

Remember the CBS News Report about all of the slipped deadlines for security?

As HealthCare.gov was being developed, crucial tests to ensure the security and privacy of customer information fell behind schedule.

CBS News analysis found that the deadline for final security plans slipped three times from May 6 to July 16. Security assessments to be finished June 7 slid to August 16 and then August 23. The final, required top-to-bottom security tests never got done.

The House Oversight Committee released an Obama administration memo that shows four days before the launch, the government took an unusual step. It granted itself a waiver to launch the website with “a level of uncertainty … deemed as a high (security) risk.”

The AP reported on this memo:

An internal government memo obtained by The Associated Press shows administration officials were concerned that a lack of testing posed a “high” security risk for President Barack Obama’s new health insurance website.

The Sept. 27 memo to Medicare chief Marylin Tavenner said a website contractor wasn’t able to test all the security controls in one complete version of the system.

Insufficient testing “exposed a level of uncertainty that can be deemed as a high risk,” the memo said.

The memo recommended setting up a security team to address risks, conduct daily tests, and a full security test within two to three months of going live.

Trenkle, the guy who retired with no reason, wrote the memo. Despite this risk, Tavenner proceeded.

Agency head Marilyn Tavenner accepted the risk and “mitigation” measures like frequent testing and a dedicated security team. But three other officials signed a statement saying that “does not reduce the risk” of launching October 1.

The same Tavenner who had no idea the site wouldn’t work. And one of the risks could have disclosed account information through a password reset function. Another person logged in and saw someone else’s information.

Yet, Tavenner said:

“When consumers fill out the online application, they can trust that the information they’ve provided is protected by stringent security standards and that the technology underlying the application process has been tested and is secure,” Medicare administrator Marilyn Tavenner assured the Senate’s Health Committee on Tuesday.

But a short while later, Tavenner acknowledged the Carolinas security breach. “We actually were made aware of that” Monday, she said in response to a question from Sen. Johnny Isakson, R-Ga. “We implemented a software fix.”

It was not immediately clear how the North Carolina man was able to view the personal information of the man in South Carolina. However, a vulnerability that has afflicted websites for years is known as “horizontal privilege escalation,” in which a legitimate user of a website slightly alters the string of random-looking characters in the website’s address or inside downloaded data files known as “cookies,” causing the system to display information about the accounts of other users. It can be protected against by a well-designed website.

Further, Henry Chaio, the Chief Project Manager at CMS was also kept in the dark.

CBS News has learned that the project manager in charge of building the federal health care website was apparently kept in the dark about serious failures in the website’s security. Those failures could lead to identity theft among buying insurance. The project manager testified to congressional investigators behind closed doors, but CBS News has obtained the first look at a partial transcript of his testimony.

Henry Chao, HealthCare.gov’s chief project manager at the Centers for Medicare and Medicaid Services (CMS), gave nine hours of closed-door testimony to the House Oversight Committee in advance of this week’s hearing. In excerpts CBS News has obtained, Chao was asked about a memo that outlined important security risks discovered in the insurance system.

Chao said he was unaware of a Sept. 3 government memo written by another senior official at CMS. It found two high-risk issues, which are redacted for security reasons. The memo said “the threat and risk potential (to the system) is limitless.” The memo shows CMS gave deadlines of mid-2014 and early 2015 to address them.

But Chao testified he’d been told the opposite.

“What I recall is what the team told me, is that there were no high findings,” he said.

Chao testified security gaps could lead to identity theft, unauthorized access and misrouted data.

Based on this false information, Chao gave the goahead to launch:

It was Chao who recommended it was safe to launch the website Oct. 1. When shown the security risk memo, Chao said, “I just want to say that I haven’t seen this before.

A Republican staff lawyer asked, “Do you find it surprising that you haven’t seen this before?”

Chao replied, “Yeah … I mean, wouldn’t you be surprised if you were me?” He later added: “It is disturbing. I mean, I don’t deny that this is … a fairly nonstandard way” to proceed.

Sharyl Attkisson, who has been covering this issue closely for CBS, has a new report, titled “High security risk found after HealthCare.gov launch”

A top HealthCare.gov security officer told Congress there have been two, serious high-risk findings since the website’s launch, including one on Monday of this week, CBS News has learned.

Teresa Fryer, the chief information security officer for the Centers for Medicare and Medicaid Services (CMS), revealed the findings when she was interviewed Tuesday behind closed doors by House Oversight Committee officials. The security risks were not previously disclosed to members of Congress or the public. Obama administration officials have firmly insisted there’s no reason for any concern regarding the website’s security.

The Department of Health and Human Services (HHS) responded to questions about the security findings in a statement that said, “in one case, what was initially flagged as a high finding was proven to be false. In the other case, we identified a piece of software code that needed to be fixed and that fix is now in place. Since that time, the feature has been fully mitigated and verified by an independent security assessment, per standard practice.”

In another security bombshell, Fryer told congressional interviewers that she explicitly recommended denial of the website’s Authority to Operate (ATO), but was overruled by her superiors. The website was rolled out amid warnings Fryer said she gave both verbally and in a briefing that disclosed “high risks” and possible exposure to “attacks”.

Fryer also said that she refused to put her name on a letter recommending a temporary ATO be granted for six months while the issues were sorted out.

“My recommendation was a denial of ATO,” Fryer told Democrats and Republicans who sat in on the day-long interview.

This is the first time a government insider has gone on record challenging the administration’s insistence that there were no worrisome security concerns. On Oct. 30, Rep. Gus Bilirakis, R-Fla., asked Health and Human Services (HHS) Secretary Kathleen Sebelius in testimony to Congress whether “any senior department officials” advised delaying the rollout of HealthCare.gov.

“I can tell you that no senior official reporting to me ever advised me that we should delay,” Sebelius answered. “We have testing that did not advise a delay. So not — not to my knowledge.”

I have enjoyed Zach Price’s blogging this week on the President’s duty to take care that the laws are faithfully executed. In his penultimate post, he applies his framework to President Obama’s decisions regarding the Affordable Care Act.

The administration has announced policies temporarily suspending enforcement of at least two provisions of the law: the requirement that employers above a certain size provide health coverage to employees or else pay a penalty; and the requirement that individual health plans with plan years starting after January 1, 2014 meet certain minimum coverage requirements.

(Just yesterday the department announced a third policy of also allowing certain individuals who’ve been dropped from existing insurance plans to forego buying insurance without paying a statutory penalty for doing so. This policy, however, appears to be based on an interpretation of a “hardship” provision in the statute, so it’s not a non-enforcement policy.)

In my judgment, in both these policies, the administration is presuming more discretion than the statute should be understood to give it. In this notice and this testimony, the IRS justified its one-year suspension of the employer mandate as a form of “transition relief” to give the agency more time to develop regulations regarding what information employers will need to report to enable the agency to police their compliance with the law.

But even if completing these regulations on time was impossible and the agency couldn’t realistically enforce the employer penalties without the reports, it seems to me it would have been more consistent with the executive’s responsibility to execute the law to require employers to take their chances in not complying.

It’s true that agencies often claim authority to grant “transition relief” from new statutory provisions, so it might be argued that Congress has implicitly ratified this practice. The administration in fact cited some prior IRS examples as support for the policy.

At least outside of situations where implementation is truly impracticable, this practice strikes me as dubious. Given the important separation of powers values at stake, it should take more to rebut the presumption against categorical suspensions of enforcement. But even granting this theory, the relief provided in this case seems to me to go beyond the IRS precedents invoked as support, so even implicit ratification may be lacking.

As for the suspension of insurance plan requirements, the administration to my knowledge has not provided any terribly clear legal explanation of this policy, so it’s possible I’m missing something. Again, though, it seems to me there’s little reason to read the statute as conferring this degree of discretion.

Under the administration’s policy, as described in this letter to state insurance commissioners, insurers may continue coverage under existing non-compliant plans with plan years starting before October 1, 2014, even though the statute says plans must comply if they’re renewed after January 1, 2014. As the letter implicitly recognizes, however, the statute gives state officials primary responsibility for enforcing the insurance requirements, so this policy can take effect only insofar as state regulators also choose to forego enforcement for ten months. (Some have said they will do so while others have not.)

Yet the statute also gives an enforcement role to the Secretary of HHS. The statute requires the Secretary to enforce the law’s requirements through civil penalties if the Secretary determines “that a State has failed to substantially enforce a provision (or provisions) in [the ACA] with respect to health insurance issuers in the State.” Far from implying broad enforcement discretion, this belt-and-suspenders enforcement architecture seems designed to ensure compliance. It requires the Secretary to step in as a backstop if states fail to execute the law.

In conclusion:

Both these examples, then, reflect too loose an approach to enforcement of statutory provisions. This approach to statutory enforcement improperly shifts policymaking authority and accountability away from Congress, where it belongs, and onto the executive branch, which should properly exercise such authority only with a more explicit statutory delegation.

Price notes that the President’s decisions set bad precedents for future administrations:

What’s more, executive practices in one administration set precedents that may be used to quite different policy purposes in future administrations. For instance, a future president might well be less committed to the Affordable Care Act than President Obama is. The interests of those who (like me) would like to see the Act succeed in the long run might well have been better served if the administration had established a stronger norm of literal compliance with the law’s terms than it has done (as I’ll explain shortly).

I’ve often seen the argument go like this–if Obama can exempt some people from Obamacare, why couldn’t President Paul exempt *everyone.* The President’s decisions would embolden that drastic position (which I would not support).

John Herron, father of Nellie Herron who married William Howard Taft, was also close with two other Presidents. He was classmates with William Henry Harrison at Miami of Ohio, and later shared a law office with Rutherford B. Hayes. This man was a presidential magnet.

I don’t even know what to make of such an absurd and offensive statement from the former Dean of the University of Chicago Law School, Geofrey Stone.

Despite the panel’s conclusions, Stone strongly  rejected the idea they justified Snowden’s actions in leaking the NSA documents about the phone collection. “Suppose someone decides we need gun control and they go out and kill 15  kids and  then a state enacts gun control?” Stone said, using an analogy he acknowledged was “somewhat inflammatory.” What Snowden did, Stone said, was put the country “at risk.”

“My emphatic view,” he said, “is that a person who has access to classified information — the revelation of which could damage national security — should never take it upon himself to reveal that information.”