ACA Registration Platforms Suspended Overseas for Alleged Access to Consumer Data

Suspicions that personal information about American consumers could be accessed from India prompted regulators to abruptly block two large private patient registration websites in August from accessing a marketplace covered by the Affordable Care Act.

The new details about the suspension emerged in legal documents filed Friday evening, in connection with actions taken by the two parties to regain access to the Obamacare marketplace before the upcoming ACA enrollment period, which begins on November 1.

In a letter sent to the companies on Sept. 2, the Centers for Medicare & Medicaid Services said they were suspended after the agency discovered “serious security flaws” that could have led to market data, including consumers’ personal information, being accessed from overseas countries.

The letter, which is included in court documents, also notes that regulators will conduct audits of both companies because they have “reasonable suspicion” that they are involved in another problem: signing people up for Obamacare insurance — or changing their policies — without consumers’ consent.

The question remains whether these legal issues will be resolved before the upcoming enrollment period. At present, the concerns about the companies remain allegations, and none of the legal or audit challenges are close to a ruling or conclusion.

Still, the larger problem of fraudulent ACA enrollment by rogue insurance agents seeking commissions will continue to be a headache for regulators, with more than 200,000 complaints filed by consumers in the first half of 2024. And it has become a political dilemma for the Biden administration. GOP lawmakers have blamed the schemes in part on expanded Obamacare premium subsidies supported by Biden.

President Joe Biden has called record enrollment under the ACA a major accomplishment of his administration, and regulators are looking to disrupt fraudulent enrollment schemes without slowing legitimate enrollment. At least 200 agents have been barred from the federal ACA marketplace in recent weeks, and in July, they began requiring brokers, in many cases, to participate in phone calls with customers and the healthcare.gov help center before the changes are finalized.

CMS’s letter now adds another layer. For the first time this year, the agency has called a company to account for questionable enrollment, saying it suspects Speridian Companies may have “directed its employees and other agents to change the coverage of Marketplace enrollees and to enroll insured and uninsured consumers without the consent of enrollees.”

California-based Speridian Global Holdings owns the companies in question, which include enrollment platform Benefitalign and TrueCoverage, which operates as the enrollment site Inshura. It has a data center in India.

According to court documents, Benefitalign’s now-suspended website processed at least 1.2 million applications for ACA coverage during the most recent open enrollment period, making it among the largest private enrollment sites allowed to integrate with healthcare.gov, the federal marketplace.

Previously, CMS had only publicly stated that it had suspended the websites due to “unusual activity.”

The suspended companies deny any wrongdoing in their recruitment programs. Spokeswoman Catherine Riedel declined to comment beyond their court documents.

In late August, they filed a complaint against CMS over the suspensions in the U.S. District Court for the District of Columbia, seeking a restraining order. They added to that complaint on Sept. 6, calling CMS’s suspension “unlawful.”

On August 8, CMS suspended both sites’ access to healthcare.gov information.

It did so, according to the September 2 letter, due to concerns that some consumer information “is being processed and/or stored” in India, citing “suspicions” that the data “is being accessed from outside the United States.”

That’s a problem, the letter says, because the marketplace data must remain in the U.S. to “eliminate the possibility of access by foreign powers.” Additionally, sites approved by CMS to integrate with the federal marketplace are not allowed to transfer data outside the U.S. or allow access from outside the country, according to the terms of the agreements such companies sign to obtain CMS approval to operate.

CMS has not specified what consumer information may be included, but ACA applications may include information such as an individual’s name, date of birth, address and detailed household income information.

According to the CMS letter, Speridian companies have been suspended and then reinstated from the market in previous years for other reasons, including issues with fraudulent Social Security numbers being submitted on some TrueCoverage ACA applications in 2018 and Benefitalign’s actions in 2023 to gain access to the federal marketplace’s “software testing environment” from India.

In seeking an injunction against CMS, the companies argue that the agency’s decision to suspend them is arbitrary and capricious and violates its own regulations as well as the Due Process Clause of the Constitution.

In court documents, a September 2 CMS letter explaining the reasons for the suspension was called “ after the fact “justification” that includes a litany of “concerns, suspicions, accusations.” The filing also states that “these allegations of violations are made without evidence of any actual violations.”

Court documents say the suspensions will prevent the companies from participating in the upcoming open enrollment period, harming them and the “thousands of brokers” and “millions of consumers who rely on brokers” who use those websites to sign up for ACA coverage.

The suspension remains in effect, partly because the information provided by the companies did not allay the concerns, but also until an audit is conducted, CMS said in a letter.

CMS has a “reasonable suspicion, based on credible evidence it takes into consideration,” that the companies engaged in enrolling consumers or changing their insurance coverage without express consent, the letter said, noting that such allegations were made in a civil lawsuit filed by private sector attorneys in the U.S. District Court for the Southern District of Florida.

The companies have previously stated that the allegations raised in the civil lawsuit are unfounded.

Brokers that have used suspended sites in the past have other options for signing up customers, including several other sites that are now approved to integrate with the federal Obamacare marketplace. Consumers can also go directly to federal or state ACA sites and sign up on their own or get help from call centers affiliated with those marketplaces.

This article was reprinted from khn.org, a national newsroom dedicated to in-depth reporting on health issues and one of the core operating programs of KFF, an independent source of health policy research, polling, and journalism.