New Privacy Concerns About ObamaCare Website

WASHINGTON (AP) -- The government's health insurance website is quietly passing along consumers' personal data to outside websites, just as President Barack Obama is calling for stronger cybersecurity protections.

It works like this: When you apply for coverage on HealthCare.gov, dozens of data companies may be able to tell that you are on the site. Some can even glean details such as your age, income, ZIP code, whether you smoke or if you are pregnant.

HealthCare.gov contains embedded connections to multiple data firms that the administration says generate analysis to improve the consumer experience. Officials say outside firms barred are from using the data to further their own business interests.

Still, ever-evolving technology allows for individual Internet users to be tracked, building profiles coveted by advertisers.

Connections to third-party tech firms were documented by technology experts who analyzed HealthCare.gov, and confirmed by The Associated Press. There is no evidence that personal information from HealthCare.gov has been misused, but the high number of outside connections is raising questions.

"As I look at vendors on a website...they could be another potential point of failure," said corporate cybersecurity consultant Theresa Payton. "Vendor management can often be the weakest link in your privacy and security chain."

A former White House chief information officer under President George W. Bush, she said the large number of outside connections on HealthCare.gov seems like "overkill" and makes it "kind of an outlier" among government websites.

The privacy concerns come against the backdrop Obama's new initiative to protect personal data online, a highlight of his State of the Union message scheduled for Tuesday night. The administration is getting the health care website ready for the final enrollment drive of 2015, aiming to have more than 9 million people signed up by Feb. 15 for subsidized private coverage.

Spokesman Aaron Albright said outside vendors "are prohibited from using information from these tools on HealthCare.gov for their companies' purposes." The government uses them to measure the performance of HealthCare.gov so consumers get "a simpler, more streamlined and intuitive experience," he added.

The administration did not explain how it ensures that its privacy and security policies are being followed.

Albright said Tuesday that HealthCare.gov comports with standards set by the federal National Institute for Standards and Technology. But recent NIST guidance cautions that collecting bits of seemingly random data can be used to piece together someone's identity.

In a recent visit to the site, AP found that certain personal details - including age, income, and whether you smoke - were being passed along likely without your knowledge to advertising and Web analytics sites.