Healthcare.gov processed an application I did not submit: Is There A Problem Here?: Healthcare.gov processed an application I did not submit

20131013

Problem ID: 54205674288555338
Entered by: Ben Simo

Healthcare.gov processed an application I did not submit

I started an insurance application at Healthcare.gov in search of options for a family member who is not covered by my employer's plan.

I abandoned the application. The status screen shows that my application is "In progress".

However, I got a notification that my application had been processed and my eligibility results are available.

How is it that my application was processed when I did not submit the application?

Additionally, I had explicitly selected the option at the end of the application stating that I do not agree to the terms for submitting the application. However, it appears that the system ignored my telling it that I do not want them to pull the necessary info to process the application and processed my application anyway.

Not only did they process an application I did not submit, the letter says they referred my application to a state agency -- a state agency with which I did not authorize them to share any information. (BTW, this particular state agency outsources application processing and claims that state and federal privacy laws don't apply to them.)

Furthermore, the decision letter I received says that I have 10 days to appeal any decisions or I will be ineligible for coverage in the future. Now, they've put me in a position that I have to get Healthcare.gov and a state agency to collaborate to withdraw the application I never submitted.

I now have zero trust in Healthcare.gov.

UPDATE 10/27:

To clarify: "processed an application" refers to the first step -- determining eligibility to purchase insurance via the Marketplace. I've seen much speculation that assigns malice to a variety of parties as to why and how this occurred. I doubt that this is intentional. My application got into a bad state in the software systems. In the two weeks since the application was processed (and I wrote this blog post), I have not yet received a call from the state agency the letter said would be contacting me. It is likely that the application never for forwarded as the letter states.

My distrust of the software systems is based on the apparent lack of sufficient testing of the individual components and the full Healthcare.gov system; not malice on the part of any individual or group.

HHS Secretary Kathleen Sebelius testified "We didn't have enough testing, specifically for high volumes, for a very complicated project. We had two years and almost no testing." Regardless of the political influence, building a complex system like Healthcare.gov without testing and adjusting design as you go is a recipe for failure. This is especially evident in the security issues that I've observed -- especially, those noted in my Appalled! post.

UPDATE 11/03:

I've found something interesting in the data for the application for which I got an eligibility determination without submission. I see many memberEvent entries when appears to mostly be referencing eligibility checks. The datetime values listed for these appear to be spread out over the time during which I was attempting to fill out the application. This suggests that Healthcare.gov might be doing eligibility processing before the form is submitted. I'm guessing, so I might be wrong. I do find it interesting that so much history data is being collected behind the scenes as applications are being completed.

Edit

18 Comments:

Comment ID: 3912505546328523062 Written by: Anonymous: It seems to me that this whole Healthcare program is just a way to force people to increase the wealth of the Obama's cronies. As in the no bid contract that went to Obama and Michell's friend's company to create the useless web site.
Comment ID: 5024733948039023570 Written by: Jeremy: That's step one, when you fill out your information, it simply determines if you are eligible for a subsidy, or if you qualify for medicare. There are two more steps, one where you look at plans and pick one, then the last when you enroll in the plan.
Comment ID: 4936365232402800643 Written by: Anonymous: There's also a step 4: Two years from now, after you've bought into this mess and have nowhere else to go, your cost will be tripled.
Comment ID: 3167556928758028627 Written by: whitecollargreenspaceguy: The states are contracting with statewide organizations who sub- contract to local organizations. This is too disjointed and waters down getting the word out and the work done. ACA clients will need ongoing help making decisions about providers and claims problems which may be too much for third level contractors to handle. CMS should arrange for Obamacare application helpers to work in all 1300 SSA offices. SSA has lost 10% of staff in last 3 years. There now between 4 and 8 empty work stations in each SSA office. They total 6,000 to 10,000, altogether they are worth up to $200 million, and they are unused due to staffing losses. If not used by Obamacare, the government is wasting about $1billion over next 5 years. This would greatly simplify national PSA'a - just tell citizens to visit their local SSA office. ACA navigators should use them to reach the public. When Medicare first started, SSA offices had to be open at night and on the weekends to get everyone enrolled. We must be successful in the roll-out of customer services for Affordable Care Act. Web Site and 800# are not enough. I would not buy a car or a house that way. Many citizens need face-to-face customer service. This plan can be applied to other federal agencies and we could add a second shift of white collar workers, see http://whitecollargreenspace.blogspot.com/ or Contact timalantoo@hotmail.com or Tim at 989-701-8813
Comment ID: 941142393537846809 Written by: JAL: You mean qualify for "Medicaid."

Medicare is what most retirees 65+ have. Medicaid is for the "poor." (Though (all?) SSDI recipients (disabled) have a Medicare plan which covers, followed by Medicaid.)

Think -- "poor need aid" and seniors (I was going to write "old people") need "care."

Just a quibble but lots of people seem to get them mixed up all the time.

And yes, it's a dragnet to scoop up more people to support. But it will catch young people not making much -- then who's going to want to make more money? Not a great business plan after all.
Comment ID: 2695690964219300229 Written by: Anonymous: No thanks to all of the above.
Comment ID: 3972168899142925877 Written by: Anonymous: At least you're now a registered democrat voter...Oh the corruption that democrats sow.
Comment ID: 3403708816269277240 Written by: Oysteria: Here's what everyone keeps forgetting. This whole plan is first to gather as much personal information about you as possible for a central database and second to help you get insured. That's a very distant second, mind you.
Comment ID: 8312677124551689068 Written by: Anonymous: You DO NOT need to authorize any agency access to your health care information, the TARP program legislation combined with more recent legislation including several of the NDA Acts took care of that minor detail for you. And if you think your information is being shared between state and federal agencies alone you are in for a an even bigger surprise - private corporations contracted through state and federal agencies may also have access to your health information - WITHOUT your expressed written consent.
Comment ID: 5010230122754957029 Written by: Anonymous: "WE MUST"??? lol When BHO signs up , I'll do the same . Until then........no we mustn't
Comment ID: 415244755157555062 Written by: Anonymous: Don't worry about voting. The system does that for you, too.
Comment ID: 2061309655732764069 Written by: Anonymous: I recognize that address and that system is so broken that the physicians' practice I work for refuses to deal with them. We would rather give people on that system the chance to apply for indigent assistance and KNOW we will never get paid for treating them than deal with that hot mess. Good luck getting out!
Comment ID: 2020078231143615638 Written by: Unknown: Bummer Ben. Welcome to the Borg.
Comment ID: 1471495233122244288 Written by: Texan99: There's no "must" for this citizen. In fact, rather than eat a sudden $5K increase in my premiums, I'm seriously considering going bare. I can save $10K-12K a year in premiums that way, which I can bank against medical bills. If I get really sick, I can get reinsured in a year, because under this stupid law they can't turn me down now, and I don't believe we'll repeal the stupid law. If we do, and I can't get reinsured, it will still be worth it. Take all your programs and shove them. I'm opting out, and after the way you handled this catastrophe for the last three years starting with the tricks you pulled to pass it, you'll never get the votes for a mandate with teeth. Live with it.
Comment ID: 6294271070989176311 Written by: Anonymous: Make no mistake....Obamacare is here to stay!
Comment ID: 7817680407570793882 Written by: JAL: A physican friend was telling us this (Sunday) morning about his experiences with EMR (Electronic Medical Records -- with new coding, to boot). Originally he thought it would be a good idea, but the extra work is so onerous he opted for a "scribe" to help keep track and enter info.

Imagine his surprise when his online scribe turned out to be an Indian -- in India. The way it worked, when doc logged on, scribe would also be logged onto HIS computer screen and could make changes. (Helloooo HIPAA?)

A bit unnerving, but the other problem was doc friend could not understand the guy because his English was very rapid and very Indian.

So -- take comfort in the news that personal info will be flying all over the world and I am sure errors will be minimized. /s

Meanwhile docs who choose to do it themselves are spending literally hours (80 -100) doing their jobs, at home, at night (per doc friend's wives).

Sometimes the cure is worse than the disease.
Comment ID: 2746188950523519198 Written by: Ben Simo: @gogman asks: In regards to your "submitted" ACA app, the email says "will be ineligible for coverage in the future" What does that mean?

I'm not exactly sure. There is a mismatch of information in the letter I received. Parts lead me to believe they think the family member for which I was attempting to apply might be eligible for some Medicaid program but at the same time it suggest I make too much money for that. And, as can be seen in the excerpt of the letter I posted above, the eligibility table referenced in the letter is missing from the letter.

Below is the part of the letter that I initially interpreted to say I had to appeal within 10 days or not get coverage. It could be that all that is needed is to submit another application --- except that the Healthcare.gov site appears to allow only one application at a time. Regardless of what it means, the letter is confusing.

EXCERPT from the eligibility decision letter:

To ask [REDACTED] to continue to review your application and make a decision about whether or not you qualify for [REDACTED], log into your Marketplace account at HealthCare.gov/marketplace, or call 1-800-318-2596 (TTY: 1-855-889-4325) to let us know. If you do not ask for the [REDACTED] to review your application and make a formal decision about whether you qualify for [REDACTED], you will not be able to appeal the fact that you are not being enrolled in the [REDACTED] program without also appealing your eligibility for tax credits and cost-sharing reductions.

You have 10 days to request to have [REDACTED] continue to review your application for [REDACTED] coverage. After that time, your application for [REDACTED] coverage will no longer be considered. If you are not sure whether you should ask [REDACTED] to make a formal decision, then you should make this request. You can keep your coverage described in this notice while [REDACTED] continues to review your application.
Comment ID: 5365829832894703374 Written by: Anonymous: I'd tell your doctor friend what doctors have been telling us for years - “Shut up and swallow your pill. You have a disease and this is your one size fits all cure.”

Usability Heuristics

from Jakob Nielsen

• Visibility of system status Visibility of system status: The system should always keep users informed about what is going on, through appropriate feedback within reasonable time.
• Match between system and the real world Match between system and the real world: The system should speak the users' language, with words, phrases and concepts familiar to the user, rather than system-oriented terms. Follow real-world conventions, making information appear in a natural and logical order.
• User control and freedom User control and freedom: Users often choose system functions by mistake and will need a clearly marked "emergency exit" to leave the unwanted state without having to go through an extended dialogue. Support undo and redo.
• Consistency and standards Consistency and standards: Users should not have to wonder whether different words, situations, or actions mean the same thing. Follow platform conventions.
• Error prevention Error prevention: Even better than good error messages is a careful design which prevents a problem from occurring in the first place. Either eliminate error-prone conditions or check for them and present users with a confirmation option before they commit to the action.
• Recognition rather than recall Recognition rather than recall: Minimize the user's memory load by making objects, actions, and options visible. The user should not have to remember information from one part of the dialogue to another. Instructions for use of the system should be visible or easily retrievable whenever appropriate.
• Flexibility and efficiency of use Flexibility and efficiency of use: Accelerators -- unseen by the novice user -- may often speed up the interaction for the expert user such that the system can cater to both inexperienced and experienced users. Allow users to tailor frequent actions.
• Aesthetic and minimalist design Aesthetic and minimalist design: Dialogues should not contain information which is irrelevant or rarely needed. Every extra unit of information in a dialogue competes with the relevant units of information and diminishes their relative visibility.
• Help users recognize, diagnose, and recover from errors Help users recognize, diagnose, and recover from errors: Error messages should be expressed in plain language (no codes), precisely indicate the problem, and constructively suggest a solution.
• Help and documentation Help and documentation: Even though it is better if the system can be used without documentation, it may be necessary to provide help and documentation. Any such information should be easy to search, focused on the user's task, list concrete steps to be carried out, and not be too large.

Consistency Heuristics

from James Bach
and Michael Bolton

-F amiliar Familiar: The product is not consistent with the pattern of any familiar problem.
E xplainable Explainable: The product is explainable.
W orld World: The product is consistent with the real world.
H istory History: The present version of the product is consistent with past versions of it.
I mage Image: The product is consistent with an image that the organization wants to project.
C omparable Products Comparable Products: The product is consistent with comparable systems.
C laims Claims: The product is consistent with what important people say it’s supposed to be.
U ser Expectations User Expectations: The product is consistent with what users want.
P roduct Product: Each element of the product is consistent with comparable elements in the same system.
P urpose Purpose: The product is consistent with its purposes, both explicit and implicit.
S tatutes Statutes: The product is consistent with applicable laws.

FAILURE Heuristics

from Ben Simo

F unctional Functional: The error detecting, reporting, and handling functions properly.
A ppropriate Appropriate: Errors are reported at the appropriate time in an appropriate manner.
I mpact Impact: The impact of the failure is communicated to those impacted.
L og Log: The error is appropriately logged; or not logged.
U ser Interface User Interface: The error is reported in the user interface in terms that the user understands.
R ecovery Recovery: The user is informed of what they need to do to recover from the error.
E motions Emotions: The error handling and reporting has a positive influence on user emotions.

Security Vulnerabilities

the OWASP Top 10

1. Injection Injection: Injection flaws occur when untrusted data is sent to an interpreter as part of a command. The attacker’s hostile data can trick the interpreter into executing unintended commands or accessing data without authorization.
2. Broken authentication and session management Broken authentication and session management: Application functions related to authentication and session management are often not implemented correctly, allowing attackers to compromise passwords, keys, or session tokens, or to exploit other implementation flaws to assume other users’ identities.
3. Cross-Site Scripting Cross-Site Scripting (XSS): XSS flaws occur whenever an application takes untrusted data and sends it to a web browser without proper validation or escaping. XSS allows attackers to execute scripts in the victim’s browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites.
4. Insecure Direct Object References Insecure Direct Object References: A direct object reference occurs when a developer exposes a reference to an internal implementation object, such as a file, directory, or database key. Without an access control check or other protection, attackers can manipulate these references to gain unauthorized access to data.
5. Security Misconfiguration Security Misconfiguration: Good security requires having a secure configuration defined and deployed for the application, frameworks, application server, web server, database server, and platform. Secure settings should be defined, implemented, and maintained, as defaults are often insecure. Additionally, software should be kept up to date.
6. Sensitive Data Exposure Sensitive Data Exposure: Many web applications do not properly protect sensitive data, such as credit cards, tax IDs, and authentication credentials. Attackers may steal or modify such weakly protected data to conduct credit card fraud, identity theft, or other crimes. Sensitive data deserves extra protection such as encryption at rest or in transit, as well as special precautions when exchanged with the browser.
7. Missing Function Level Access Control Missing Function Level Access Control: Most web applications verify function level access rights before making that functionality visible in the UI. However, applications need to perform the same access control checks on the server when each function is accessed. If requests are not verified, attackers will be able to forge requests in order to access functionality without proper authorization.
8. Cross-Site Request Forgery Cross-Site Request Forgery (CSRF): A CSRF attack forces a logged-on victim’s browser to send a forged HTTP request, including the victim’s session cookie and any other automatically included authentication information, to a vulnerable web application. This allows the attacker to force the victim’s browser to generate requests the vulnerable application thinks are legitimate requests from the victim.
9. Using Components with Known Vulnerabilities Using Components with Known Vulnerabilities: Running software components with known vulnerabilities can compromise the vulnerable components and anything those components can access -- undermining defenses.
10. Unvalidated Redirects and Forwards Unvalidated Redirects and Forwards: Using untrusted data, without validation, to determine the destination of redirects and forwards can enable attackers to redirect victims to phisihing or malware sites.

Is There A Problem Here?

20131013

Healthcare.gov processed an application I did not submit

18 Comments:

Post a Comment

Problem or no problem?

Usability Heuristics

Consistency Heuristics

FAILURE Heuristics

Security Vulnerabilities

Popular

Recent Problems

Recent Comments