Highlight on Oregon: Bugs, Resignations, and Other Failures Could Mean the End of ‘Cover Oregon’

After over a year of set-backs, glitches, unanticipated costs, and missed deadlines, the fate of the website for Oregon’s health insurance exchange, Cover Oregon, may soon be sealed. On April 10, 2014, the board of the health insurance exchange was scheduled to meet and some sources have predicted that, at that time, the board could make the decision to put an end to the project that has been in the works since August of 2011. Earlier reports have indicated that the number of bugs in the system have risen rather than fallen, the cost and time needed to resolve the website’s remaining issues are significant, and, still, Cover Oregon remains the only exchange in the country that does not provide the opportunity for complete self-enrollment in a single-sitting on its website. The Governor of Oregon, John Kitzhaber, has maintained that the issue with Cover Oregon is a technical one, not a policy one, and that the issues have not prevented the state from using alternative avenues to enroll individuals for health coverage. A review of the evolution of the website since its inception, however, shows that the decision to “scrap or salvage” the exchange may not be an easy one.

Bugs and Other Failures

According to a report released in February of 2014, when coveroregon.com opened for business on October 1, 2013, it was not a fully functioning website. According to recent reports, the same is still true, as the website does not allow individuals to enroll in coverage and determine eligibility for tax credits at the same time. Specifically, oregonlive.com has reported that officials from Cover Oregon stated that in order to fix the exchange online the number of serious bugs would have to be cut down to 13, yet since that statement the number of serious bugs recorded is approximately 300.


In addition to strictly technical problems, at least three major players in the Cover Oregon executive hierarchy, including the chief information officer (CIO), have resigned since the start of 2014. Although Rocky King, the former executive director purportedly resigned for health reasons, Aaron Karjala, who was the top information manager as the CIO, and Bruce Goldberg, the top healthcare administrator and the acting director of Cover Oregon, both turned in resignations near the end of March without giving such personal reasons. According to another report by oregonlive.com, after the Oregon Health Authority (OHA) turned over a “deeply flawed, largely unfinished project to a Cover Oregon team that was understaffed and ill-prepared for a rescue mission…” in April of 2013, Karjala and King attempted to internally address these issues rather than broadcast the problems. After Governor Kitzhaber accepted Goldberg’s resignation, he publicly encouraged the Cover Oregon executive board to remove Karjala and Triz delaRosa, who is the chief operating officer. Relatedly, Carolyn Lawson, the chief information officer of the OHA, also recently resigned and then in a five-page notice of tort liability letter to the state claimed that she was forced into that resignation, made to participate in a cover-up of the failures of the exchange, and defamed.

Time and Money

Initially, Oregon contracted with Oracle Corporation to design, develop, and implement the state-based Marketplace. After the failures of the initial plan had become abundantly clear and Oracle had been blamed for many for those failures, Oregon enlisted Deloitte Development, the authors of the February report, to determine what the next step should be and the costs of the potential alternatives. According to that analysis, it would cost over $40 million and take at least two more years to carry out the initial scheme for the exchange using Oracle’s technology. In the alternative, the state could terminate that plan and revert to using the federal exchange, as many other states have opted to do thus far, which was estimated would cost only four to six million. Further, in its “scrap or salvage” debate oregonlive.com referenced Oregon’s officials’ doubts as to the chances of the system ever working out, noting that state Senator Alan Bates (D-Memford) said that “political insiders are giving the exchange only 60 to 70 percent change of being up and running by November.” Yet, this report also noted the disadvantage of switching gears this late in the game: “moving to the federal exchange means abandoning years of work and settling for a less consumer- and agent-friendly system, one that doesn’t enroll qualified people directly into the Oregon Health Plan as intended.”

Report Details Administration’s Delays and Extensions of ACA Implementation

The Congressional Research Service (CRS) has issued a report summarizing significant actions the Obama Administration has taken to delay, extend, or otherwise modify implementation of the Patient Protection and Affordable Care Act (ACA) (P.L. 111-148). Although not all-inclusive, the report lists decisions that have affected the ACA’s core insurance expansion provisions, highlighting the most controversial. Specifically, it mentions the delay of the employer mandate, the decision to allow the renewal of noncompliant insurance policies, and the implementation of special enrollment periods. The document provides background for each provision and a detailed history of administrative actions.

Employer Mandate Delay

The ACA requires employers with 50 or more employees to make a shared responsibility payment in the following two scenarios: (1) the employer does not offer coverage to at least 95 percent of full-time employees and dependents and at least one full-time employee receives a premium tax credit for an insurance policy purchased on a Health Insurance Exchange or (2) the employer offers coverage to 95 percent of full-time employees, but at least one full-time employee receives a premium tax credit for a policy purchased on an Exchange because the employer did not offer coverage to that employee, coverage was unaffordable, or coverage did not provide minimum value.

Although the provision became effective January 1, 2014, the IRS decided to delay enforcement of the requirement until 2015, along with a requirement that employers and insurers report certain information to the Internal Revenue Service (IRS). The agency then further delayed enforcement with respect to employers with 50 to 99 employees until 2016 and announced that employers of 100 or more workers would only be required to offer coverage to 70 percent of full-time employees in 2015 to avoid enforcement actions. The IRS explained that it could not enforce the requirements until a related requirement that employers report offered coverage had been implemented. It contended that the relief it offered is part of a practice of providing relief to taxpayers struggling to comply with a new law. Critics argue that it is an unconstitutional failure to enforce the law.

Renewal of Noncompliant Plans

When many insurers began to cancel individual and small business health plans that did not meet the ACA’s standards for health insurance coverage, CMS urged, but did not require, state regulators to allow insurers who issued or planned to issue policies in the individual and small group markets to renew the policies at any time through October 1, 2016. Critics argue that, in doing so, the Administration ignored ACA requirements that had become “politically inconvenient.” However, CMS is still considering an additional one-year extension of this policy. Consumers whose policies were cancelled are eligible for a hardship exemption where available options are unaffordable and may purchase a catastrophic plan to meet individual mandate requirements if available.

Open Enrollment

The CRS report also detailed a number of delays related to open enrollment. Individuals without employer-sponsored coverage have the option of enrolling in a qualified health plan (QHP) through a Health Insurance Exchange to avoid paying a tax for failure to carry insurance. Because consumers who enroll after the fifteenth day of a given month will not be covered by a policy until the first day of the second month following enrollment, those who enrolled after February 15, 2014 would not have been covered until April 1, 2014. They would thus have been uncovered for a full three month period and would have been required to pay a fine. However, CMS exempted individuals who enrolled after the February 15th from paying the penalty. It also issued guidance allowing state Exchanges to retroactively make advance payments of premium tax credits and apply cost-sharing reductions to individuals who were unable to enroll in a QHP on an Exchange because information technology issues prevented timely eligibility determinations.

In perhaps the most controversial of these open enrollment extensions, the Administration announced on March 26, 2014 that certain persons unable to enroll in a QHP by March 31, 2014 would be permitted to enroll in a special enrollment period. Qualifying circumstances included, but were not limited to, natural disasters, untimely transfers of data regarding applicants ineligible for Medicaid and CHIP from state agencies to Marketplaces, and technical problems with HealthCare.gov. In addition to the changes affecting open enrollment for 2014, CMS delayed the beginning of open enrollment for 2015 to November 14, 2014, extending the period to run through February 15, 2015.

The report described a number of other changes in detail, including those affecting Small Business Health Option Program (SHOP) Exchanges, annual limits on cost-sharing and deductibles, and basic health plan (BHP) options.

Software Vulnerability Endangers EHR, Devices; HHS Websites Unaffected

The “Heartbleed” bug, discovered last week by two information technology (IT) security teams, caused a vulnerability in a popular encryption software used by many medical professionals to protect patient data. Electronic health record (EHR) systems often use OpenSSL’s encryption software to secure protected health information (PHI). Heartbleed can reveal the contents of a server’s memory to hackers, including private data such as usernames, passwords, and credit card numbers. Attackers are also able to obtain copies of a server’s digital keys, and use those keys to impersonate servers or to decrypt communications. Security experts estimate that 66 percent of all devices connected to the internet, including internet-capable medical devices, could be attacked using Heartbleed.

Heartbleed Danger

According to members of the security team that discovered Heartbleed, the bug allows anyone on the internet to access and read the memory of systems protected by the vulnerable versions of the OpenSSL software. Affected information includes secret keys used to identify service providers and to encrypt data, as well as user names, passwords, and actual saved content, allowing attackers to steal data directly from the services and users and to impersonate services and users. A fixed version of OpenSSL has been released, but the vendors of operating systems, appliances, and independent software all must adopt the fix for each program that uses OpenSSL. Further, users and administrators should change their passwords to prevent use of their accounts by anyone who has accessed their private account information. Passwords changed before the fixed version is installed are not secure.

The security team that discovered Heartbleed said, “We attacked ourselves from outside, without leaving a trace. Without using any privileged information or credentials we were able steal from ourselves the secret keys used for our X.509 certificates, user names and passwords, instant messages, emails and business critical documents and communication.”

Impact on Health Industry

OpenSSL is an open source protocol. Open source means users are universally granted free license to the product, which is not copyrighted. As a result, many health IT-related programs and devices use the protocol, including those that use Apache servers. A “cursory review” conducted by health IT developer Lauren Still found many web-based EHR platforms were vulnerable to the bug. Additionally, some Health Insurance Exchanges operated by states under the Patient Protection and Affordable Care Act (ACA) (P.L. 111-148) were exposed. Medical Device and Diagnostic Industry says that the bug could be used to attack systems used to communicate with insulin pumps, home health care networks, and medical devices such as MRI machines.

Safety of HealthCare.gov, MyMedicare.gov

When the discovery of Heartbleed was announced, the Department of Homeland Security’s (DHS) U.S.-Computer Emergency Readiness Team (US-CERT) issued an immediate alert. Other DHS teams have reached out to vendors and asset owners to notify and assist them in determining vulnerabilities and protecting their data. DHS announced that “the Federal government’s core citizen-facing websites are not exposed to risks from this cybersecurity threat.” Building on DHS’s announcement, a CMS spokesperson stated “Due to CMS’s security protections, HealthCare.gov consumer accounts are not affected by this vulnerability. Additionally, other CMS consumer accounts, including MyMedicare.gov, were not affected by this vulnerability. Per standard practice, CMS continues to work with the states to monitor this issue and ensure that appropriate security measures continue to be in place.”

Developer and cryptography consultant Filippo Valsorda published a tool that allows users to check websites for Heartbleed vulnerability. For websites that require passwords, Last Pass created a similar checker tool. Wolters Kluwer tested a number of HHS websites, and confirmed that in addition to HealthCare.gov, Medicare.gov and the FDA’s online Drug Registration and Listing system were not vulnerable to Heartbleed; tests revealed that MyMedicare.gov and CMS’s EHR Incentive Program Registration & Attestation system may possibly be affected.

Vermont’s Single Payer System Slow Down

On May 28, 2011, Gov. Peter Shumlin signed Act 48 into law, which calls for a three-stage implementation of a publicly-financed universal health care system by 2017. The goal of Act 48 is an eventual state-funded and operated single-payer system. It’s three years later, however, and what momentum the Act had is starting to slow down, especially as the Governor is expected to release the finance plan for the project.

Single Payer System Design.

Vermont’s move to a single payer system was designed to meet the federal requirements the Patient Protection and Affordable Care Act (P.L. 111-148) (ACA). In doing so, it may take advantage of federal monies targeted for Vermont’s Health Insurance Exchange and to petition for federal waivers that would streamline Vermont’s reform. The system should extend coverage to each of Vermont’s 620,000 residents while containing soaring health care costs.

Vermont’s plan establishes a state Health Insurance Exchange, as mandated by new federal health care laws, that will offer coverage from private insurers, state-sponsored and multi-state plans. It also will include tax credits to make premiums affordable for uninsured Vermonters. The exchange will be managed by a five-member board which sets reimbursement rates for health care providers and streamlines administration into a single, unified system. On the Exchange, Vermont residents and small employers will be able to compare rates from a variety of plans and enroll in the plan of their choice. Among the criteria are adoption of a financing plan by 2014; ensuring the new system costs less than the current fee-for-service one; and obtaining federal permission via a waiver to allow Vermont to proceed with the single-payer option, in around 2017.


There are many benefits to a single payer system. When the government owns and operates one health insurance plan for all residents, it sets a single price for each medical procedure. These prices tend to be lower because the government is negotiating one rate for all citizens. Administrative costs are also lower because there is no insurance company. Physicians send their bill to the federal government.


Of course, it’s not quite that easy – single payer system also has several problems. First, the government is the one to make difficult decisions about what benefits will and will not be covered. It could theoretically be up to the government to determine whether or not a patient will receive things like prescription drugs or dentist visits. Some single payer systems are associated with longer wait times for medical care, however a recent study by the Commonwealth Fund found that while some single payer systems have longer wait times, others see patients quicker than here in the United States.

Pause in the Process.

Under Act 48, Governor Shumlin was required last year to outline some financing options for lawmakers to consider but that has yet to be done.  The legislation required that the state provide an outline on how it plans to raise the estimated $1.7 billion to $2.2 billion to finance the future single payer system. At the beginning of the current legislative session, the governor said a menu of financing options would be released in April for legislators to discuss. Now, Governor Shumlin says he will wait until 2015 for the release. Despite the delay in developing the financing plan for the state’s single payer system, Shumlin said in a recent interview that he still thinks there’s enough time to meet his target date of 2017 for Vermont to become the first state in the country to implement a single payer health care system.

“I believe that we will collectively come to the same conclusion, that moving to a system where you spend less money for better quality and better outcomes,” said Shumlin. “Combined with a payment system where we all, based on our ability to pay, (will) lead to prosperity and an affordable quality health care system for all.”

He offered a slightly different reason for the stall in another interview last February, when he said the decision to delay unveiling the finance options was made over the past several weeks. “We have a very good business advisory group … that’s helping us to put together a package that will work for Vermonters as well as for businesses,” he said. “As we’ve gotten into the weeds of the various details that need to be ready to lay out a menu of options, there’s pretty broad agreement that we’re just not there yet.” Either way, it’s clear Vermont needs more time.

Fresh Faces to Figure Things Out.

Governor Shumlin has made some new hires to help him with figuring out details for the Exchange. Agency of Commerce and Community Development (ACCD) Secretary Lawrence Miller will become Senior Advisor to the Governor and Chief of Health Care Reform, where he will be tasked with overseeing the state’s health care reform efforts and transition to Green Mountain Care. He will report directly to the governor. Patricia Moulton will replace Vermont Administration Secretary Lawrence Miller when he moves up to advise the Governor.

In a recent interview, Miller commented, ““We know that concern about health benefits holds people back from striking out on their own and starting new businesses, and it keeps people locked in jobs for the wrong reasons…Health insurance is also a huge cost factor for all enterprises, including our schools.  We obviously have to do something different. I am encouraged that Vermont’s efforts at cost containment are beginning to bear fruit, and I am ready to help move us forward.”

Global Budget Payment.

Recent reports indicate that at least one hospital in the state will begin testing a “global budget payment” system. Global budgets are set payments determined by state regulators to care for the population a hospital serves, as opposed to the hospital billing for each individual service it provides. With this program, if the hospital exceeds its budget it loses money. The budget is based on the hospital’s historic revenue with adjustments for inflation and changes within the population it serves.

For more information on health reform in Vermont, please see Michelle Oxman’s post, “Highlight on Vermont: Implementing the ACA on the Road to a Single Payer System,” from February, 2014. She reviews the struggles Vermont is having with its Health Insurance Exchange and the state’s struggle to provide coverage for its uninsured population, which is the highest in the country.