[{"innerBlocks":[],"name":"core\/freeform","postId":798,"blockType":{"name":"core\/freeform","keywords":[],"attributes":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"providesContext":[],"usesContext":[],"selectors":[],"supports":{"className":false,"customClassName":false,"reusable":false},"styles":[],"variations":[],"apiVersion":3,"title":"Classic","description":"Use the classic WordPress editor.","category":"text"},"originalContent":"The Centers for Medicare and Medicaid Services is taking a risk by continuing to use a knowledge-based verification process to remotely verify individuals\u2019 identities seeking access to its Healthcare.gov service.

That\u2019s the assessment of the Government Accountability Office, which contends that CMS and Healthcare.gov applicants will remain at an increased risk of identity fraud.

\u201cData stolen in recent breaches, such as the 2017 Equifax breach, could be used fraudulently to respond to knowledge-based verification questions,\u201d states a GAO audit<\/a>. \u201cThe risk that an attacker could obtain and use an individual\u2019s personal information to answer knowledge-based verification questions and impersonate that individual led the National Institute of Standards and Technology to issue guidance in 2017 that effectively prohibits agencies from using knowledge-based verification for sensitive applications.\u201d

However, despite the fact that alternative methods are available that provide stronger security, CMS has no plans to reduce or eliminate knowledge-based verification for remote identity proofing, according to auditors.

While the agency employs a two-step email verification process to reduce the risks associated with knowledge-based verification, auditors contend that this process confirms only the email address that was used to create the account, but it does not confirm the identity of the individual who is applying for the account.

\u201cCMS uses knowledge-based verification to remotely verify individuals\u2019 identities prior to granting them access to its Healthcare.gov service,\u201d the GAO notes. \u201cCMS has not implemented alternative methods to better ensure the effectiveness of the remote identity proofing processes used for its Healthcare.gov service.\u201d

Also See<\/b>: OIG finds cybersecurity risks within HHS divisions\u2019 systems<\/a>

Auditors recommended that the CMS Administrator \u201cshould develop a plan with time frames and milestones to discontinue knowledge-based verification, such as by using Login.gov or other alternative verification techniques.\u201d

Nonetheless, the Department of Health and Human Services\u2014on behalf of CMS\u2014disagreed with the GAO\u2019s recommendation because the agency did not believe that the available alternatives to knowledge-based verification were feasible for the individuals it serves.

\u201cHowever, a variety of alternative methods exist, and GAO continues to believe CMS should develop a plan for discontinuing the use of knowledge-based verification,\u201d contend the auditors.","saveContent":"The Centers for Medicare and Medicaid Services is taking a risk by continuing to use a knowledge-based verification process to remotely verify individuals\u2019 identities seeking access to its Healthcare.gov service.

That\u2019s the assessment of the Government Accountability Office, which contends that CMS and Healthcare.gov applicants will remain at an increased risk of identity fraud.

\u201cData stolen in recent breaches, such as the 2017 Equifax breach, could be used fraudulently to respond to knowledge-based verification questions,\u201d states a GAO audit<\/a>. \u201cThe risk that an attacker could obtain and use an individual\u2019s personal information to answer knowledge-based verification questions and impersonate that individual led the National Institute of Standards and Technology to issue guidance in 2017 that effectively prohibits agencies from using knowledge-based verification for sensitive applications.\u201d

However, despite the fact that alternative methods are available that provide stronger security, CMS has no plans to reduce or eliminate knowledge-based verification for remote identity proofing, according to auditors.

While the agency employs a two-step email verification process to reduce the risks associated with knowledge-based verification, auditors contend that this process confirms only the email address that was used to create the account, but it does not confirm the identity of the individual who is applying for the account.

\u201cCMS uses knowledge-based verification to remotely verify individuals\u2019 identities prior to granting them access to its Healthcare.gov service,\u201d the GAO notes. \u201cCMS has not implemented alternative methods to better ensure the effectiveness of the remote identity proofing processes used for its Healthcare.gov service.\u201d

Also See<\/b>: OIG finds cybersecurity risks within HHS divisions\u2019 systems<\/a>

Auditors recommended that the CMS Administrator \u201cshould develop a plan with time frames and milestones to discontinue knowledge-based verification, such as by using Login.gov or other alternative verification techniques.\u201d

Nonetheless, the Department of Health and Human Services\u2014on behalf of CMS\u2014disagreed with the GAO\u2019s recommendation because the agency did not believe that the available alternatives to knowledge-based verification were feasible for the individuals it serves.

\u201cHowever, a variety of alternative methods exist, and GAO continues to believe CMS should develop a plan for discontinuing the use of knowledge-based verification,\u201d contend the auditors.","order":0,"get_parent":{},"attributes":[],"attributesType":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"dynamicContent":""}]

GAO: CMS needs to change its ID verification process

More for you