Over the past several months, a stream of reports from government auditors and news stories has raised serious questions about the Administration’s implementation of Obamacare and its effects on the privacy of millions of Americans. The reports paint a portrait of an Administration casting aside security concerns—potentially putting Americans’ financial and health data at risk—in its push to open insurance exchanges in all 50 states by October 1. These recent developments should provide further impetus for Congress to defund the entire law before the exchanges are able to undermine personal privacy.

Security Delays, Timetables Slipping

In August, the Department of Health and Human Services (HHS) inspector general released a report highlighting many missed deadlines with respect to the security measures surrounding the Obamacare data hub.[1] The hub will provide access to government data from various government agencies—tax filings and Social Security records, for example—allowing exchanges to determine eligibility for subsidized insurance.

The inspector general’s report found that “several critical tasks remain to be completed in a short period of time” in order to ensure the data hub’s security.[2] Important elements of the security testing were delayed by two months. As a result, the official certification that the data hub is secure is not scheduled to occur until September 30, 2013—one day before the exchanges are scheduled to open for business.[3]

The inspector general’s report noted the obvious problem that this tight timetable presents: “If there are additional delays…the authorizing official may not have the full assessment of implemented security controls needed for the security authorization decision by” the time open enrollment begins.[4] In other words, government officials could face a choice about whether to open the exchanges despite the potential risk to Americans’ data security. Even if the security assessments are completed on time, there is no assurance they will work properly; the inspector general’s report “did not review the functionality of the [data] hub.”[5]

Warnings Ignored

Some government officials have warned of the privacy and security implications arising from shoddy data security—even as the Obama Administration ignored those concerns. Michael Astrue, a former general counsel of HHS, offered objections while serving as the commissioner of Social Security through February 2013. He has called the Administration’s exchange portal “an overly simplistic system without adequate privacy safeguards”:

The system’s lack of any substantial verification of the user would leave members of the public open to identity theft, lost periods of health insurance coverage, and exposure of address for victims of domestic abuse and others.[6]

Astrue dubbed the version of the portal “the most widespread violation of the Privacy Act in our history,” noting that both he and the head of the IRS “raised strong legal objections” with the Office of Management and Budget—objections that, Astrue argues, have been ignored in favor of what he calls “an absurdly broad interpretation of the Privacy Act’s ‘routine use’ exemption.”[7]

Navigators Pose a Security Risk

While the data hub creates concerns that Americans could be subjected to electronic identity fraud, Obamacare’s “navigators” could subject Americans to in-person scams.[8] HHS recently announced it was lowering by one-third—from 30 hours to 20—the minimum training time for navigators.[9] As a result, individuals can be certified as navigators with fewer than three full days’ training—and few security checks. While guidelines regarding navigators released in July permitted states to establish “minimum eligibility criteria and background checks” for navigators, it did not require them to do so.[10]

Because their job involves helping Americans figure out their insurance options, navigators will often have access to sensitive personal information—bank accounts, Social Security numbers, insurance identification, and more. Yet navigators will not be required to undergo background checks, and the process for filing complaints about unscrupulous navigators remains unclear at best. Even California’s insurance commissioner—a Democrat and strong supporter of Obamacare—raised concerns that navigators would put consumers at risk for scams: “We can have a real disaster on our hands.”[11]

Not One Dime

Federal agencies have already encountered difficulties preserving the integrity of Americans’ sensitive information. Earlier this year, a medical provider in California sued the IRS for improperly seizing 60 million records of 10 million Americans.[12] Yet under Obamacare, the IRS and other federal agencies will hold more new powers and have access to even more of Americans’ personal health and financial information.

In its mad rush to implement its unworkable law, the Obama Administration has taken a slapdash and shoddy approach to Americans’ personal security. Given these stakes, the choice for Congress could not be clearer: Congress should preserve Americans’ privacy by refusing to spend another dime implementing Obamacare.

—Chris Jacobs is Senior Policy Analyst in the Center for Health Policy Studies at The Heritage Foundation.