Heritage Foundation
Exclusive: HealthCare.gov Users Warn of Security Risk, Breach of Privacy
by Kelsey Harris and Rob Bluey
November 2, 2013

Justin Hadley logged on to HealthCare.gov to evaluate his insurance options after his health plan was canceled. What he discovered was an apparent security flaw that disclosed eligibility letters addressed to individuals from another state.

“I was in complete shock,” said Hadley, who contacted Heritage after becoming alarmed at the breach of privacy.

Hadley, a North Carolina father, buys his insurance on the individual market. His insurance company, Blue Cross Blue Shield of North Carolina, directed him to HealthCare.gov in a cancellation letter he received in September.

After multiple attempts to access the problem-plagued website, Hadley finally made it past the registration page Thursday. That’s when he was greeted with a downloadable letter about eligibility — for two people in South Carolina.

The letter, dated October 8, acknowledges receipt of an application to the Health Insurance Marketplace and the eligibility of family members to purchase health coverage. The letter was addressed to Thomas Dougall, a lawyer from Elgin, SC.

Hadley shared a screenshot and copy of the letter with redacted personal information.

For the rest of this article, including sample letters, go to Heritage Foundation