Privacy and Security in the Affordable Care Act’s Data Hub
Last week, two committees of the U.S. House of Representatives held a joint hearing to examine privacy and security issues related to an information exchange system, commonly referred to as the “data hub.” The data hub is managed by HHS and facilitates access to information currently held in federal government databases that is necessary to determine an individual’s eligibility for certain aspects of the Affordable Care Act (health reform). For example, an individual’s eligibility for a federal subsidy to purchase health insurance requires verification of income and family size from the Internal Revenue Service (IRS), immigration status from the Department of Homeland Security (DHS) and incarceration status from the Social Security Administration (SSA).
The hearing took place only a few months before enrollment will open for individuals seeking to purchase health insurance through one of the new “health insurance marketplaces” (formerly called health insurance exchanges) and a month after a GAO report found that as of April, HHS had only completed 20% of its work to “establish appropriate privacy protections and capacity to accept, store, associate and process documents from individual applicants.”
Although the system is called the data hub, it is not a repository of information but rather a “routing tool.” When an individual enrolls in a health insurance marketplace, her application information is processed through the hub in three steps. In the first step, the hub receives her Social Security Number and passes it on to the SSA and DHS in order to verify her identity, that she is lawfully in the US, and that she is not incarcerated. Once SSA and DHS verify her information, a response is sent back through the hub to the health insurance marketplace. A similar process occurs in the second and third steps where the marketplace forwards her application information through the data hub to the IRS in order to verify her income and family size and to calculate the maximum premium tax credit for which she qualifies. The health insurance marketplaces will be able to verify eligibility by communicating with one secure portal administered by CMS instead of having to establish their own secure connections to SSA, DHS and IRS databases.
Another common misconception is that the hub will be storing health information. No evidence can be found to support these claims. The purpose of the data hub is to assist health insurance marketplaces in determining eligibility for Affordable Care Act benefits.
Several Members of Congress raised pointed questions to CMS Administrator Marilyn Tavenner about the security of the data hub. Ms. Tavenner addressed these concerns by stating that the data hub is designed to query (and pass along to insurance marketplaces) only the minimum amount of information necessary from each government database to facilitate applicant enrollment.
This is key since another misconception about the data hub is that unauthorized persons will have access to your sensitive information. CMS has established privacy and security regulations that will govern the health insurance marketplaces and external parties, including the Navigators who will help individuals enroll in health plans. All of these parities will be required to complete privacy and security training. Federal tax data is further protected by Safeguard Procedures Reports which require non-IRS entities to have strong data protection plans in place before they can receive tax data.
As it stands today, the health insurance marketplaces and the data hub appear to be moving in the right direction with respect to the privacy and security of an insurance applicant’s sensitive information.
