Watchdog: Obamacare Site Still Puts Users at Risk

The Obamacare website still has major security flaws that put users' private information at risk, according to a new warning from the nonpartisan Government Accountability Office.

HealthCare.gov is used by more than 5 million Americans. The site collects their private information like names, birth dates, and Social Security numbers, which could potentially be hacked.

Congressional investigators at the GAO have issued a new report saying they've uncovered more than 20 specific security flaws that still plague the site.

Those security issues affect key functions, like who can get into the system and who can make changes in it.

The GAO's director of information security Gregory Wilshusen tells Congress in prepared testimony, "Significant weaknesses remain that put these systems and the sensitive, personal information they contain at risk of compromise."

The report says that the agency running HealthCare.gov "had not always required or enforced strong password controls, adequately restricted access to the Internet, consistently implemented software patches and properly configured an administrative network."

The investigators also say the Obama administration took a major risk by going live with HealthCare.gov last autumn when the system had not been fully tested.

The Obamacare site had numerous technical problems when it was launched, causing widespread frustration since it did not work for most consumers.

Even the administration's own technical experts were concerned during the launch because security testing could not be completed as the system was undergoing many last-minute changes.

In fact, some testing was still incomplete as of June 2014.

Meanwhile, HealthCare.gov was hacked this summer, partly proving the GAO's security fears for the site.

No consumer information was reported stolen, but hackers installed malicious software that could have been used to launch an attack on other websites using the federal insurance portal.