The Government Accountability Office has found cybersecurity weak points in the health insurance websites of three states: California, Kentucky and Vermont, according to The Associated Press.
A few of the weaknesses still haven't been fixed.
After analyzing the states' websites between October 2013 and March 2015, the GAO released a report — which did not explicitly identify the affected states — last month. The GAO disclosed the states' names April 7 after a request from The Associated Press.
The GAO report found the following problems in the three states' websites, although it did not match each state with a specific problem.
- A state didn't "encrypt passwords, potentially making it easier for hackers to gain access to individual accounts," according to the report.
- Another state didn't correctly utilize "a filter to block hostile attempts to visit the website," according to the report.
- One state didn't "use the proper encryption on its servers," according to the report.
The Associated Press reached out to officials from each state to discuss the cybersecurity issues.
Roy Kennedy, a spokesman from California's state exchange, Covered California, declined to comment on the exchange's plans to address the flaws. Instead, he cited a letter to Congress from Peter Lee, Covered California's executive director, in which Mr. Lee said there haven't been successful website security breaches.
Kentucky's former governor, Steve Beshear (D), said "because of the time required to fix the technical issues, not all those issues had been addressed" when Gov. Matt Bevin (R) took office late last year. However, he added that "there were never any security breaches of any kind," according to the report. Gov. Bevin plans to dismantle the state exchange, Kynect, this year.
Lawrence Miller, director of health reform for Vermont Gov. Peter Shumlin (D), said the state's exchange had changed vendors since March 2015, and that "the correct controls were in place" during the transition, according to the report.