Healthcare.gov tells people to wait for email that was not sent: Is There A Problem Here?: Healthcare.gov tells people to wait for email that was not sent

20131013

Problem ID: 2207394471170708173
Entered by: Ben Simo

Healthcare.gov tells people to wait for email that was not sent

After several failed attempts to create an account at Healthcare.gov, I finally made it to the end of the process. It told me to check my email for instructions to get my username. I waited. I checked my email repeatedly. I received no email.

I then called their support line and was told that the system was under heavy load and I therefore needed to wait at least 3 days to receive an email. Thinking that 3 days was a bit unreasonable when the user interface tells me it was already sent, I tried to create another account.

This time, I kept my browser's developer tools open so that I could monitor the requests and responses and I completed the account creation process. On the last step, I noticed a problem: The final request that submits all the data entered into the multi-page form fails. Most-likely, my data was not received and no email was sent.

That Status 500 in the image above indicates that a server-side (likely software) error occurred in the submission of the data I entered.

I tried again, and on each attempt, the site told me my data was received and an email sent when submitting the data failed.

Maybe I'm just too picky, but I expect information given to me in a software user interface to match reality. It seems that may not be a requirement at Healthcare.gov. This type of error wastes users' time, frustrates users, generates unnecessary support phone calls, and costs us taxpayers money.

Edit

17 Comments:

Comment ID: 226070859555916120 Written by: Anonymous: Have you tried just calling in and giving a representative your information, that is, applying over the phone? I did that after I completed applications over two consecutive days (uploading identity verification documents as well). I was told after applying online that I would receive an email but never did. Now, I can't login to my profile, I just get kicked out with no message. The representatives say it should take about 3-6 weeks before I can shop online, it would be shorter if I apply online. I said I had gone through the process twice. Well, they can't tell if my online application or over-the-phone application is processing...Frustrating? You bet!
Comment ID: 4930963098971095624 Written by: Anonymous: I've been waiting for over two weeks for an email from the healthcare.gov technical staff that my identity verification has been approved. Every time I sign into my account I have the same notification message that my application status is in progress and identity verification pending verification review. I was successful in uploading my verification documents and still know email from them to let me know that my application is now finalized. There is not a way with this flawed system to delete an incomplete application and there is no link to send the tech support staff an email indicating any problems that one may have with their application. I had created my account back in the summer and on October 1, 2013 started my application process only to receive a message at the end of the process that my identity needed to be verified. If this is actually true, the system is supposed to generate a reference number so that you can call Experian and get identified through the process of verification. However, Experian is not being flagged by the healthcare system that a person has to be identified. I know this to be true because I spoke twice with CSR's at Experian who said if nothing comes up in their system they are not aware of a potential identity problem. Healthcare.gov can learn something about how a system is supposed to work if they would contact the developers of Facebook who have over a billion users around the world. They don't have all the problems that the government seems to have. My 2 cents worth.
Comment ID: 7571922469950702319 Written by: Anonymous: That is not how a website worked up to now, SLOPPY WORK NOW SEEMS TO BE THE NORM ACCORDING TO THE GOVERNMENT.
Comment ID: 524913740967823246 Written by: Anonymous: Just reading over the above 3 comments and I am absolutely certain the first one is mine! On or about December 3rd, 2 months and a 2 days after the opening of the healthcare.gov site, I was able to finally not only log in to my site (a rep finally suggested to me to try changing my password! after w months!) but I was able to shop. I still comparing plans and yes, they are higher than I expected, even with a tax credit. It is great that healthcare is now available to folks with pre-existing conditions and others but still, the price of healthcare is sky-high!
Comment ID: 7482086734711402712 Written by: Anonymous: Just set up an account on healthcare.gov and was told an email was sent with an email verification link in it. I never received that email but did get another on welcoming me to the site with a link to login and shop for insurance. When i try to log in the site tells me that my email was not verified and I need to click on the link in the email they sent (which they never did). I tried changing my password, which i was able to do and I tried having the site send me my account user name (my email address) which I was also able to do. I still cannot login. I then tried calling the phone number and the person on the other end found my account and was willing to help me 'shop' but could NOT set the system so I could log in. After going around and around with this 'support' person it was clear that she had NO clue how to send a second email for verification (I asked her to do that). There is NO link on the site to cause a second verification email to be sent (unlike ANY other site I have ever been on). It is clear that who ever designed this site did not think about the fact that NOT all emails go through and thus did NOT test for a failed send. VERY POOR design and testing. I have been in the computer business (programmer) for over 30 years and if I wrote a program like this I would not have a job for long. I see NO way to ever log into this account ever again.
Comment ID: 5373378007033518952 Written by: visoundguy: I found this old thread from 2013. It's now Jan 2016 - and the problem still exists! I can't get registered because I'm not getting the email!! So much for Obummer care.
Comment ID: 5231566363674903631 Written by: Anonymous: Same/Similar issues here! I have had an account since 2013, and now I am unable to login, and I am not receiving the password reset emails. (I have my password, but it is no longer being accepted - so i thought I would try and reset it) There is no tech support to contact, only the reps who are not able to help with an account related issues - they just want me to sign up over the phone and ignore the "account situation". According to the reps, they are have no knowledge of any issues like this (which is true, they do not know anything) , and so it is my fault.

So anytime I need to make a change to my application, I have to call in, wait on hold (which has been over an hour at times), to take care of it. I have to mail in documents to verify my information, which no one can tell me have been received. This is quite crazy - I have a feeling that the admins are fully aware that many people are having the same issue, and in typical fashion instead of correcting the mistake it gets ignored.
Comment ID: 150258612132266280 Written by: AJ: November 1st 2016 and this problem is still around.
Comment ID: 6386234167136980095 Written by: Anonymous: I've been trying to login to healthcare.gov for 3 years. I've been waiting for that email verification forever. I've requested and re-requested that verification link over and over. I've changed the password numerous times without any issues, so obviously they know that they have my correct email address. It's now Nov 2016 and I still can't login. What a bunch of freaking idiots who still can't fix it after three years. A high school student who took a computer programming class could have fixed that in 10 minutes.
Comment ID: 7150046600400130744 Written by: mj starke: The madness continues.

We get repeated requests for documents we have already mailed in. Sometimes we get an email saying the documents have been received but then a few days later get another letter in the mailbox threatening to cut us off if we don't send in the documentation. When we call for assistance the representative tells us our account is fine.

We have never once been able to log into the web site during the past 3 years.

Thank you, Nancy Pelosi for voting for this mess so we could see what was in it... a load of horse crap.
Comment ID: 5660123255408467303 Written by: Unknown: Same here! This has been ongoing for the past 2 to 3 years! I create a new password til the cows come home, an email confirms successful password creation, then i go to log in and get "click on verification email" that NEVER arrives.... I've escalated this several times and it's still not resolved so I have to call for all transactions and am unable to upload any requested information, and am told I can't fax information since the department requiring information doesn't have a fax machine.... arghhhh. Very frustrating.
Comment ID: 5713177392622724595 Written by: Unknown: I have had this problem since the year before last, I have never been able to log onto this website because of the "Verify your email" email it supposedly sends but never, ever did. While I was in the hospital once, my Sister-in-law(She is a RN) even tried to sign in my account to enter some required info, she couldn't, she called HealthCare.gov and with them on the phone, telling her exactly what to do, she still could not sign into my account. I even have a completely different laptop now, but to this day 1/15/17 I have never, not 1 time, ever been allowed to sign in my account here. I have even tried changing the password to no avail.

I have read the comments here and see repeatedly that people will call wait and wait for a rep and the rep has no knowledge of a problem. All I can say about that - Either it is the reps first day (possibly first hour) on the job or they are lying. You cannot tell me that hundreds of people a day are having this problem and some like me and others for years, but not a single person has ever mentioned it to a rep, come on! I if they really expect us to believe "This is the first we are hearing about it" I guess the government really does think we are sheep.
Comment ID: 2886804092809178210 Written by: Unknown: Can this be added to the comment I sent a few minutes ago? If not just post it separate. I have read where there is no tech support email to write to, just a number to call to submit your healthcare info. I did find this tech support comment box, I sent my complaint on the matter, maybe if everyone did they may fix it, I will paste the address below. The comment box is down toward the bottom of the page.

https://www.healthcare.gov/tips-and-troubleshooting/logging-in/
Comment ID: 3836104821540877799 Written by: Anonymous: 1-19-17 Received no email verification. Read this blog. Figures. Government. Health care...not. just a money grab by big business. Frustrating. They want to fine us for wanting to eat right and live healthy lifestyle. I would rather put my money into organic veggies and not eat junk food, then pay 'the system' for poison drugs and doctors who don't know what the bleep they are doing. Remember its a medical 'practice'. You are being practiced on. Eat whole foods, exercise, live healthy. Costs more. spend your money wisely. dont waste it on this non government health non care.
Comment ID: 4956666039817579117 Written by: Anonymous: its 2017 and this problem still exists. horrible, absolutely unacceptable.
Comment ID: 8947751339273002580 Written by: Unknown: 2018 enrollment. Looking online to see if others are having the same problems as me. YUP! FIVE years later and I'm waiting for emails that aren't being sent. I've spent two weeks trying to log into an account that. Apparently my password is incorrect and I can't reset it because the reset email never comes!
Comment ID: 7062135108132242087 Written by: rosita: Same/Similar issues here! I have had a record
since 2013, and now I can't login, and I am not accepting the secret key reset messages. (I have my secret word, yet it is never again being acknowledged - so I figured I would attempt and reset it) There is no technical support to contact, just the reps who are not ready to help with a record related issues - they simply need me to join via telephone and overlook the "record circumstance". As indicated by the reps, they are have no learning of any issues this way (which is valid, they don't know anything) , thus it is my blame.

So whenever I have to roll out an improvement to my application, I need to bring in, look out for hold (which has been over a hour now and again), to deal with it. I need to mail in records to check my data, which nobody can let me know have been gotten. This is very insane - I have an inclination that the administrators are completely mindful that numerous individuals are having a similar issue, and in run of the mill design as opposed to remedying the slip-up it gets overlooked.

Usability Heuristics

from Jakob Nielsen

• Visibility of system status Visibility of system status: The system should always keep users informed about what is going on, through appropriate feedback within reasonable time.
• Match between system and the real world Match between system and the real world: The system should speak the users' language, with words, phrases and concepts familiar to the user, rather than system-oriented terms. Follow real-world conventions, making information appear in a natural and logical order.
• User control and freedom User control and freedom: Users often choose system functions by mistake and will need a clearly marked "emergency exit" to leave the unwanted state without having to go through an extended dialogue. Support undo and redo.
• Consistency and standards Consistency and standards: Users should not have to wonder whether different words, situations, or actions mean the same thing. Follow platform conventions.
• Error prevention Error prevention: Even better than good error messages is a careful design which prevents a problem from occurring in the first place. Either eliminate error-prone conditions or check for them and present users with a confirmation option before they commit to the action.
• Recognition rather than recall Recognition rather than recall: Minimize the user's memory load by making objects, actions, and options visible. The user should not have to remember information from one part of the dialogue to another. Instructions for use of the system should be visible or easily retrievable whenever appropriate.
• Flexibility and efficiency of use Flexibility and efficiency of use: Accelerators -- unseen by the novice user -- may often speed up the interaction for the expert user such that the system can cater to both inexperienced and experienced users. Allow users to tailor frequent actions.
• Aesthetic and minimalist design Aesthetic and minimalist design: Dialogues should not contain information which is irrelevant or rarely needed. Every extra unit of information in a dialogue competes with the relevant units of information and diminishes their relative visibility.
• Help users recognize, diagnose, and recover from errors Help users recognize, diagnose, and recover from errors: Error messages should be expressed in plain language (no codes), precisely indicate the problem, and constructively suggest a solution.
• Help and documentation Help and documentation: Even though it is better if the system can be used without documentation, it may be necessary to provide help and documentation. Any such information should be easy to search, focused on the user's task, list concrete steps to be carried out, and not be too large.

Consistency Heuristics

from James Bach
and Michael Bolton

-F amiliar Familiar: The product is not consistent with the pattern of any familiar problem.
E xplainable Explainable: The product is explainable.
W orld World: The product is consistent with the real world.
H istory History: The present version of the product is consistent with past versions of it.
I mage Image: The product is consistent with an image that the organization wants to project.
C omparable Products Comparable Products: The product is consistent with comparable systems.
C laims Claims: The product is consistent with what important people say it’s supposed to be.
U ser Expectations User Expectations: The product is consistent with what users want.
P roduct Product: Each element of the product is consistent with comparable elements in the same system.
P urpose Purpose: The product is consistent with its purposes, both explicit and implicit.
S tatutes Statutes: The product is consistent with applicable laws.

FAILURE Heuristics

from Ben Simo

F unctional Functional: The error detecting, reporting, and handling functions properly.
A ppropriate Appropriate: Errors are reported at the appropriate time in an appropriate manner.
I mpact Impact: The impact of the failure is communicated to those impacted.
L og Log: The error is appropriately logged; or not logged.
U ser Interface User Interface: The error is reported in the user interface in terms that the user understands.
R ecovery Recovery: The user is informed of what they need to do to recover from the error.
E motions Emotions: The error handling and reporting has a positive influence on user emotions.

Security Vulnerabilities

the OWASP Top 10

1. Injection Injection: Injection flaws occur when untrusted data is sent to an interpreter as part of a command. The attacker’s hostile data can trick the interpreter into executing unintended commands or accessing data without authorization.
2. Broken authentication and session management Broken authentication and session management: Application functions related to authentication and session management are often not implemented correctly, allowing attackers to compromise passwords, keys, or session tokens, or to exploit other implementation flaws to assume other users’ identities.
3. Cross-Site Scripting Cross-Site Scripting (XSS): XSS flaws occur whenever an application takes untrusted data and sends it to a web browser without proper validation or escaping. XSS allows attackers to execute scripts in the victim’s browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites.
4. Insecure Direct Object References Insecure Direct Object References: A direct object reference occurs when a developer exposes a reference to an internal implementation object, such as a file, directory, or database key. Without an access control check or other protection, attackers can manipulate these references to gain unauthorized access to data.
5. Security Misconfiguration Security Misconfiguration: Good security requires having a secure configuration defined and deployed for the application, frameworks, application server, web server, database server, and platform. Secure settings should be defined, implemented, and maintained, as defaults are often insecure. Additionally, software should be kept up to date.
6. Sensitive Data Exposure Sensitive Data Exposure: Many web applications do not properly protect sensitive data, such as credit cards, tax IDs, and authentication credentials. Attackers may steal or modify such weakly protected data to conduct credit card fraud, identity theft, or other crimes. Sensitive data deserves extra protection such as encryption at rest or in transit, as well as special precautions when exchanged with the browser.
7. Missing Function Level Access Control Missing Function Level Access Control: Most web applications verify function level access rights before making that functionality visible in the UI. However, applications need to perform the same access control checks on the server when each function is accessed. If requests are not verified, attackers will be able to forge requests in order to access functionality without proper authorization.
8. Cross-Site Request Forgery Cross-Site Request Forgery (CSRF): A CSRF attack forces a logged-on victim’s browser to send a forged HTTP request, including the victim’s session cookie and any other automatically included authentication information, to a vulnerable web application. This allows the attacker to force the victim’s browser to generate requests the vulnerable application thinks are legitimate requests from the victim.
9. Using Components with Known Vulnerabilities Using Components with Known Vulnerabilities: Running software components with known vulnerabilities can compromise the vulnerable components and anything those components can access -- undermining defenses.
10. Unvalidated Redirects and Forwards Unvalidated Redirects and Forwards: Using untrusted data, without validation, to determine the destination of redirects and forwards can enable attackers to redirect victims to phisihing or malware sites.

Is There A Problem Here?

20131013

Healthcare.gov tells people to wait for email that was not sent

17 Comments:

Post a Comment

Problem or no problem?

Usability Heuristics

Consistency Heuristics

FAILURE Heuristics

Security Vulnerabilities

Popular

Recent Problems

Recent Comments