CalHEERS: Protecting Consumer Data by Developing and Implementing Strong Physical, Technical and Administrative Security Safeguards

CALPIRG Education Fund

Executive Summary

With the passage of the federal Patient Protection and Affordable Care Act (ACA), Californians will soon enjoy unprecedented access to affordable health insurance. Once fully implemented in 2014, 92 percent of non-Medicare eligible Californians will enjoy health care coverage provided either by their employer, the new Covered California run health insurance exchange market, or public benefit programs such as Medi-Cal. [1]

Last year Covered California established the California Health care Eligibility, Enrollment and Retention System (“CalHEERS”) to provide Californians with easy access to the health care solutions.[2] The California Public Interest Research Group (CALPIRG) Education Fund is pleased to be able to provide recommendations on best practices and standards for the development and implementation of strong physical, technical and administrative security safeguards for the CalHEERS data ecosystem.

Key to the success of CalHEERS is the element of trust. Simply put, Californians must have confidence that their personal information will be safe, accurate, and used responsibly within CalHEERS. For its part, CalHEERS must be able to rely on the authentication of the individual with which they are engaging and the data they provide in order to offer accurate health care coverage solutions.

This report sets to highlight and address relevant data security and integrity concerns relevant to CalHEERS, and provide a framework for both protecting consumers and supporting the success of Covered California. CALPIRG Education Fund recognizes that Covered California has already addressed several data security and integrity concerns involving CalHEERS.[3] Yet the fact that 30% of data breaches in the U.S. targeted government and health care service providers during 2012 adds urgency to identifying threats and implementing robust policies that secure user data. This report lays out proactive measures that Covered California should take to protect and secure sensitive consumer data within the CalHEERS data ecosystem.[4]

Building on strong security protections found in the Health Information Portability and Accountability Act (HIPAA) Security Rule,[5] and the Fair Information Practice Principles (FIPs)[6], this report provides guidance for protecting against, assessing and addressing risks to data security and integrity, while encouraging a robust cyber-security culture.

Guiding Principles

As the design and implementation of CalHEERS moves forward, we have the opportunity to build in data security mechanisms and procedures, rather than bolting them on later to an existing design or realized system. Various technical solutions exist to address specific issues outlined in this report.  We do not in this report recommend a specific technology or mechanism. Instead, the report seeks to provide technology neutral guidelines and key principles Covered California should take into consideration as they move forward with CalHEERS development.

These include, but are not limited to, the following guiding principles:

Trust: Californian consumers should be able to trust that their personal information will be safe, secure, used responsibly, exposed only to those specifically authorized to access the data, and stored and retrievable under strong security mechanisms.  Policies and procedures, as detailed below, should be put in place so that consumers have the confidence and trust in CalHEERS necessary to ensure its success.

Accuracy & Reliability of Data: CalHEERS should take reasonable steps to assure data integrity by implementing policies and procedures that protect information from improper alteration or destruction. Preventing those who do not have access to sensitive data from accessing it, limiting the degree of access to sensitive data for those who do require it, and monitoring user behavior to identify and prevent inappropriate access or modification of sensitive data are all key to maintaining data security and integrity.

Restrictive: The collection of data should be minimal in scope, servicing only the direct needs for which data is collected. Access to collected information must also be minimal, following the principal of “need to know”. Both elements are important to avoid the misuse or abuse of sensitive personal information. 

Accountability: Whether intentionally or not, system users can put the information held by CalHEERS at risk.[7] Data managers should be able to conduct audits to accurately detail who accesses information, what actions they are taking, from which locations the system is accessed, and at what times. This is crucial to preventing, minimizing, and addressing potential data breaches.

Key Policy Recommendations

Our report makes the following policy recommendations:

1. Data incident plans: CalHEERS should put into place data incident plans, to ensure a rapid and effective response in the event a data breach or other data incident does occur. Such a plan will include a check list of required actions staff can immediately take in order to prevent further damage to the system, contain threats, and preserve existing forensic evidence.
2. Protecting data security and integrity: We recommend two key policies for the CalHEERS ecosystem. First is Role Based Access – i.e. preventing those who do not require access to sensitive data from getting it while limiting the degree of access to sensitive data for those who do require it. Second, we recommend monitoring user behavior to identify and prevent inappropriate access or modification of sensitive data.
3. CalHEERS ID number: In order to prevent social security numbers from being used as CalHEERS identifiers, we recommend creating a unique CalHEERS identifier (ID number) assigned to each individual consumer after an initial sign-up process. This new CalHEERS ID number will be linked to each individual’s profile, but will not display any of their personal identifiable information. The number could migrate from CalHEERS to relevant insurance provider, and could then be used to track and monitor each consumer’s history throughout the CalHEERS system without putting at risk sensitive user information.
4. Two-stage authentication: When users first registeronto the online CalHEERS system, consumers should be authenticated through a two-stage authentication system. This means that in addition to their login ID and password, users will be asked to provide an additional verification code, sent via SMS or email to a device that only they can access.
5. Staff oversight:To ensure that all staff  and assister activity is monitored and controlled for consumer protection: 
1. Assisters and CalHEERS staff must be assigned unique individual credentials with specific and limited roll-based permissions that can be audited to monitor actions throughout the system.
2. Detailed logs regarding Assisters and other CalHEERS staff activity must be created and retained. Auditors must be able to recognize when an assister has acted on behalf of a consumer, and what actions the Assister has taken.
3. Exiting staff profiles must be deleted from the system to prevent unauthorized access.
4. Two-stage verification must be required for Assister and staff sign-in.
5. Instruction on security and data protection policies must be included in the training of Assisters and other CalHEERS staff.