Hearing of the Cybersecurity, Infrastructure Protection, and Security Technology Subcommittee of the House Homeland Security Committee and the Energy Policy, Health Care and Entitlements Subcommittee of the House Oversight and Government Reform Committee - Evaluating Privacy, Security, and Fraud Concerns with ObamaCare's Information Sharing Apparatus

Hearing

When President Obama signed the Patient Protection and Affordable HealthCare Act, or as we now fondly call it, ObamaCare, in the East Room of the White House on March 23, 2010, the federal government started making plans to operate health care insurance marketplaces, also called exchanges, and to assist states that opted to run their own exchanges, by developing a complex web-based service that would allow millions of Americans access to affordable health care in the most efficient and safest way possible.

This was an enormous undertaking, and includes a complex federal and state inter-agency software and database effort, commonly known as a "federal data services hub', based at the Department of Health and Human Services. What is important about this effort is that we must create, collect, and use or disclose the personal information of millions of our citizens in a responsible and confidential way.

The health care exchanges must establish and implement cyber and personal information protection standards that are consistent with specific principles outlined in our existing health care law. Those principles, which are comparable to the ones upon which the Health Insurance Portability and Accountability Act privacy rule, and other federal privacy standards, are based.

These principles include; providing a right of access to one's Personally identifiable information or Pii and a right to have erroneous information corrected; also, the principles must ensure openness and transparency about the policies, procedures, and technologies of the Affordable Care Act; and lastly, provide accountability through appropriate monitoring, and reporting of information breaches.

Healthcare Exchanges must also establish and implement reasonable operational, technical, and physical safeguards to protect the confidentiality, integrity, and availability of Personally identifiable information (Pii), and to prevent unauthorized or inappropriate access, use, or disclosure. In addition, Health Exchanges must monitor, periodically access, and update their security controls, and develop secure electronic interfaces when sharing Pii electronically.

We are going to hear testimony today about the massive efforts that the Centers for Medicare and Medicaid Services have made to stand-up this essential core of ObamaCare. I know that we will learn much from this undertaking, and it will help
us deliver health care to those citizens who really need it.

Today, I want to hear how the Centers for Medicare & Medicaid Services, or CMS, has approached getting its key activities completed, including those activities that deal with the development of the "data hub" that will connect the exchanges with other federal and state agencies to determine applicants' eligibility, and review the certification of the health insurance plans offered to consumers. We want to help this effort in every way we can, and I look forward to the testimony today.

Source