Last week we learned once again that the Affordable Care Act (ACA) is not quite ready for primetime. A memo released by the HHS Office of Inspector General, documented that the Administration is well behind schedule in testing security of the Data Services Hub (Hub) that will be a key part of the new health care exchanges. The Hub will serve as the single entry point for state exchanges through which they will be able to access information they need, from across a number of federal agencies,  to enroll individuals in coverage. While personal data will not be stored in the Hub, any breach of the Hub’s security would provide easy access to the personal information of millions of Americans.

According to the IG’s memo, “several critical tasks remain to be completed in a short period of time, such as the final independent testing of the Hub’s security controls, remediating security vulnerabilities identified during testing, and obtaining the security authorization decision for the Hub before opening the exchanges.”

Emily Egan produced a helpful chart that outlines the various delays in testing the security of the Hub as part of Wednesday’s Weekly Checkup, but it’s most notable that a final security authorization decision, originally scheduled for September 4^th, is now scheduled to occur on September 30^th, the day before the exchanges go live.

So why is the Administration so far behind security testing for this critical system? Well because they haven’t finished building and testing it yet. As the Administration continues its mad dash to open the exchanges on October 1^st, the IG’s memo notes that “CMS is working with very tight deadlines […] If there are additional delays in completing the security assessment and testing, CMS may have limited information on the security risks and controls before the exchanges open.”

In other words, there’s a real possibility that the security of the Hub will be in doubt on October 1^st, begging the question, will the Administration push forward with an on time opening even without a properly secured Hub – putting at risk the personal information of millions of Americans? The White House owes it to the American people to state publically that the exchanges will not open without being fully vetted for security, even if that means pushing back enrollment.