Until last week, the system that is used to enroll people in federal Affordable Care Act insurance plans inadvertently allowed access by insurance brokers to consumers\u2019 full Social Security numbers, information brokers don\u2019t need.<\/p>\n

That raised concerns about the potential for misuse.<\/p>\n

The access to policyholders\u2019 personal information was one of the problems cited in a KFF Health News article<\/a> describing growing complaints about rogue agents enrolling people in ACA coverage, also known as Obamacare, or switching consumers\u2019 plans without their permission in order to garner the commissions. The consumers are often unaware of the changes until they go to use their plan and find their doctors are not in the new plan\u2019s network or their drugs are not covered.<\/p>\n

Agent Joshua Brooker told KFF Health News it was relatively easy for agents to access full Social Security numbers through the federal insurance marketplace\u2019s enrollment platforms, warning that \u201cbad eggs now have access to all this private information about an individual.\u201d<\/p>\n

On April 1, the morning the article was posted on NPR\u2019s website, Brooker said, he got a call from the Centers for Medicare & Medicaid Services questioning the accuracy of his comments.<\/p>\n

A CMS representative told him he was wrong and that the numbers were hidden, Brooker said April 7. \u201cI illustrated that they were not,\u201d he said.<\/p>\n

After he showed how the information could be accessed, \u201cthe immediate response was a scramble to patch what was acknowledged as \u2018problematic,\u2019\u201d Brooker posted to social media late last week.<\/p>\n

Brooker has followed the issue closely as chair of a marketplace committee for the National Association of Benefits and Insurance Professionals<\/a>, a trade group.<\/p>\n

After some phone calls with CMS and other technical experts, Brooker said, the federal site and direct enrollment partner platforms now mask the first six digits of the SSNs.<\/p>\n

\u201cIt was fixed Wednesday evening,\u201d Brooker told KFF Health News. \u201cThis is great news for consumers.\u201d<\/p>\n

An April 8 written statement from CMS said the agency places the highest priority on protecting consumer privacy.<\/p>\n

\u201cUpon learning of this system vulnerability, CMS took immediate action to reach out to the direct enrollment platform where vulnerability was identified to make sure it was addressed,\u201d wrote Jeff Wu, acting director of the Center for Consumer Information & Insurance Oversight at CMS.<\/p>\n

He added that the Social Security numbers were not accessible through routine use of the platform but were in a portion of the site called developer tools. \u201cThis issue does not impact healthcare.gov,\u201d Wu wrote.<\/p>\n

Brooker\u2019s concern about Social Security numbers centered on access by licensed agents to existing policyholder information though the federal marketplace, not including the parts of healthcare.gov used by consumers, who cannot access anything but their own accounts.<\/p>\n

While consumers can enroll on their own, many turn to agents for assistance. There are about 70,000 licensed agents nationwide certified to use the healthcare.gov site or its partner enrollment platforms. They must meet certain training and licensing requirements to do so. Brooker has been quick to say it is a minority of agents who are causing the problem.<\/p>\n

But agents increasingly are frustrated by what they describe as a sharp increase during the second half of 2023 and into 2024 of unscrupulous rivals switching people from one plan to another, or at least switching the \u201cagent of record\u201d on the accounts, which directs the commission to the new agent. Wu\u2019s statements have so far not included requested information on the number of complaints about unauthorized switching, or the number of agents who have been sanctioned as a result.<\/p>\n

The changes shielding the Social Security numbers are helpful, Brooker said, but won\u2019t necessarily slow unauthorized switching of plans. Rogue agents can still switch an enrollee\u2019s plan with simply their name, date of birth, and state of residence, despite rules that require agents to collect written or recorded consent from consumers before making any changes.<\/p>\n