PPACA directed each state to establish a state-based health insurance marketplace for individuals to enroll in private health insurance plans, apply for income-based financial assistance, and, as applicable, obtain a determination of their eligibility for other health coverage programs, such as Medicaid or the State Children’s Health Insurance Program (CHIP). For states that did not establish a marketplace, PPACA required the federal government to establish and operate a marketplace for that state, referred to as the federally facilitated marketplace. For plan year 2014, 17 states elected to establish their own marketplace, and CMS operated a federally facilitated marketplace or partnership marketplace for 34 states. The act required the marketplaces to be operational on or before January 1, 2014, and Healthcare.gov began facilitating enrollments on October 1, 2013, at the beginning of the first annual open enrollment period established by CMS. The initial open enrollment period ended on April 15, 2014. Requirements for ensuring the security and privacy of individuals’ personally identifiable information (PII), such as that collected and processed by Healthcare.gov and related systems, have been established by a number of federal laws and guidance. These include the following: The Federal Information Security Management Act of 2002 (FISMA), which requires each federal agency to develop, document, and implement an agency-wide information security program. National Institute of Standards and Technology (NIST) guidance and standards, which are to be used by agencies to, among other things, categorize their information systems and establish minimum security requirements. The Privacy Act of 1974, which places limitations on agencies’ collection, access, use, and disclosure of personal information maintained in systems of records. The Computer Matching Act, which is a set of amendments to the Privacy Act requiring agencies to follow specific procedures before engaging in computerized comparisons of records for establishing or verifying eligibility or recouping payments for federal benefit programs. The E-Government Act of 2002, which requires agencies to analyze how personal information is collected, stored, shared, and managed before developing or procuring information technology that collects, maintains, or disseminates information in an identifiable form. The Health Insurance Portability and Accountability Act of 1996, which requires the adoption of standards for the electronic exchange, privacy, and security of health information. The Internal Revenue Code, which provides for the confidentiality of tax returns and return information. IRS Publication 1075, which establishes security guidelines for safeguarding federal tax return information used by federal, state, and local agencies. Under FISMA, the Secretary of HHS has overall responsibility for the department’s agency-wide information security program; this responsibility has been delegated to the department’s Chief Information Officer (CIO). The HHS CIO is also responsible for the department’s response to information security incidents and the development of privacy impact assessments for the department’s systems. The CMS Center for Consumer Information and Insurance Oversight has overall responsibilities for federal systems supporting the federally facilitated marketplace and for overseeing state marketplaces. Further, security and privacy responsibilities for Healthcare.gov and supporting systems are shared among several offices and individuals within CMS, including the CIO, the Chief Information Security Officer, component-level information systems security officers, the CMS Senior Official for Privacy, and the CMS Office of e-Health Standards Privacy Policy and Compliance. In particular, the CMS CIO is responsible for implementing and administering the CMS information security program, which covers the systems developed by CMS to satisfy PPACA requirements. The Chief Information Security Officer is responsible for, among other things, ensuring the assessment and authorization of all systems and the completion of periodic risk assessments, including annual security testing and security self-assessments. The process of enrolling for insurance through Healthcare.gov is facilitated by a number of major systems managed by CMS. Figure 1 shows the major entities that exchange data in support of marketplace enrollment in qualified health plans and how they are connected. The major systems that facilitate enrollment include the following: The Healthcare.gov website: This serves as the user interface for individuals to obtain coverage through a federally facilitated marketplace. It has two major functions: (1) providing information about PPACA health insurance reforms and health insurance options and (2) facilitating enrollment in coverage. Enterprise Identity Management System: This system allows CMS to verify the identity of an individual applying for coverage and establish a login account for that user. Once an account is created using a name and e-mail address, the person’s identity is confirmed using additional information, which can include a Social Security number, address, phone number, and date of birth. Federally Facilitated Marketplace System (FFM): This system consists of three major modules to facilitate (1) eligibility and enrollment, (2) plan management, and (3) financial management. For eligibility, an applicant’s information is collected to determine whether they are eligible for insurance coverage and financial assistance. Once eligibility is determined, the system allows the applicant to view, compare, select, and enroll in a qualified health plan. The plan management module is to provide state agencies and issuers of qualified health plans with the ability to submit, certify, monitor, and renew qualifying health plans. The financial management module is to facilitate payments to health insurers, among other things. From a technical perspective, the FFM system relies on “cloud-based” data processing and storage services from private- sector vendors. Federal Data Services Hub: This system acts as a single portal for exchanging information between the FFM system and other systems or external partners, which include other federal agencies, state-based marketplaces, other state agencies, other CMS systems, and issuers of qualified health plans. The data hub supports, among other things, real- time eligibility queries, transfer of applicant and taxpayer information, exchange of enrollment information with plan issuers, monitoring of enrollment information, and submission of health plan applications. Healthcare.gov-related activities are also supported by other CMS systems, including a data warehouse system to provide reporting and performance metrics; the Health Insurance Oversight System, which provides an interface for issuers of qualified health plans to submit information about qualifying health plans; and a general accounting system that handles payments associated with advance premium tax credits and cost-sharing reductions. In addition, CMS relies on a variety of federal, state, and private-sector entities to support Healthcare.gov-related activities, and these entities exchange information with CMS’s systems: Federal agencies such as the Social Security Administration (SSA), Department of Homeland Security (DHS), and Internal Revenue Service (IRS), along with Equifax, Inc. (a private-sector credit agency under contract with CMS) provide or verify information used in making determinations of a person’s eligibility for coverage and financial assistance. The Department of Defense (DOD), Office of Personnel Management (OPM), Peace Corps, and Department of Veterans Affairs (VA) assist in determining whether a potential applicant has alternate means for obtaining minimum essential coverage. State-based marketplaces may rely on the FFM system for certain functions, and state Medicaid and CHIP agencies may connect to the FFM to exchange enrollment data, which are typically routed through CMS’s data hub. In addition to accessing the plan management and financial management modules of the FFM, issuers of qualified health plans receive information from the system when an individual completes the application process. Agents and brokers may access the Healthcare.gov website on behalf of applicants. To facilitate offline, paper-based applications, CMS contracted with a private-sector company for intake, routing, review, and troubleshooting of paper applications for enrollment into health plans and insurance affordability programs. While CMS has security and privacy-related protections in place for Healthcare.gov and related systems, weaknesses exist that put the personal information these systems collect, process, and maintain at risk of inappropriate modification, loss, or disclosure. The agency needs to take a number of actions to address these deficiencies in order to better protect individuals’ personally identifiable information. CMS established security-related policies and procedures for Healthcare.gov. Specifically, it assigned overall responsibility for securing the agency’s information and systems to appropriate officials, including the agency CIO and Chief Information Security Officer, and designated information system security officers to assist in certifying particular CMS systems; documented information security policies and procedures to safeguard the agency’s information and systems; developed a process for planning, implementing, evaluating, and documenting remedial actions to address identified information security deficiencies; and established interconnection security agreements with the federal agencies with which it exchanges information, including DOD, DHS, IRS, SSA, and VA; these agreements identify the requirements for the connection, the roles and responsibilities of each party, the security controls protecting the connection, the sensitivity of the data to be exchanged, and the required training and background checks for personnel with access to the connection. In addition, CMS took steps to protect the privacy of applicants’ information. For example, it published and updated a system-of-records notice for Healthcare.gov that addressed required information such as the types of information that will be maintained in the system and the external entities that may receive such information without affected individuals’ explicit consent; developed basic privacy training for all staff and role-based training for staff who have access to PII while executing their routine duties; and established an incident-handling and breach response plan and an incident response team to manage responses to privacy incidents, identify trends, and make recommendations to HHS to reduce risks to PII. However, when Healthcare.gov was deployed in October 2013, CMS accepted increased security risks because of the following: CMS allowed four states to connect to the data hub even though they had not completed all CMS security requirements. These states were given a 60-day interim authorization to connect, because CMS officials regarded this as a mission-critical need. Subsequently, all four states addressed the weaknesses in their security assessments and were granted 3-year authorizations.