HealthCare.gov audits: findings, response and fixes
- Auditor
- US Government Accountability Office
- Report date
- 30 July 2014, with follow-up reports in 2015 and 2016
- Subject
- HealthCare.gov development, contracts, testing, oversight and security
- Contractor
- Multiple contractors for the federal marketplace and data hub
- Status
- resolved
- Last checked
- 19 October 2026
What the audit found
GAO found that the Centers for Medicare & Medicaid Services developed the federal marketplace and data hub without effective acquisition planning or oversight. Federal marketplace obligations rose from $56 million in September 2011 to more than $209 million by February 2014. Data hub obligations rose from $30 million to nearly $85 million 1.
CMS launched the site on 1 October 2013 without verifying that it met performance requirements. GAO found unclear oversight roles, late governance reviews and limited use of contract performance tools 1.
A March 2015 follow-up found inadequate capacity planning, coding errors and missing functions at launch. CMS had not applied consistent requirements, testing and schedule practices 2.
The official response
HHS agreed with four of the five 2014 recommendations and partly agreed with one. CMS said it had taken steps on cost control and performance. GAO later verified new spending controls, contractor monitoring, acquisition guidance and governance reviews 1.
HHS agreed with all eight recommendations in the 2015 report. CMS documented requirements approval, testing rules, schedule controls and effort estimates. HHS activated investment review oversight for high-risk IT work 2.
Parliament
Congress requested the GAO reviews after the launch problems. The 2014 audit examined three central contracts that represented about 40% of CMS marketplace spending, and the 2015 audit examined system development and federal oversight 1,2.
GAO reports to Congress and publishes recommendation status. The public pages now mark all five recommendations from 2014 and all eight from 2015 closed as implemented 1,2.
Follow-up audits and recommendations
GAO reported in March 2016 on information security and privacy. CMS records listed 316 security incidents from October 2013 to March 2015, most involving probing that did not compromise systems or information sent to the wrong recipient. GAO found no evidence in that set that an outside attacker had compromised sensitive data 3.
The 2016 audit found weak administrator restrictions, patching and network configuration. It made three public recommendations on state marketplace oversight and monitoring. GAO records show implementation between 2016 and 2023 3.
Courts, tribunals and investigations
No court or tribunal judgment deciding the GAO audit findings was found as of 19 October 2026. The reports examined programme management, contract oversight, testing and security controls 1,23.
Where it stands now
GAO marks the public recommendations from the three reports used here as closed and implemented 1,23. The site remained an operating federal marketplace rather than a cancelled programme.
The audit record shows both the launch failures and later corrective work. It does not support a claim that every marketplace technology risk ended when the listed recommendations closed.
Timeline
| Date | Event |
|---|---|
| 1 October 2013 | HealthCare.gov opens and users report access and enrollment problems 1,2 |
| January 2014 | CMS awards a new $91 million development contract 1 |
| 30 July 2014 | GAO publishes its contract management audit 1 |
| 4 March 2015 | GAO publishes its systems development follow-up 2 |
| 23 March 2016 | GAO publishes its security and privacy audit 3 |
| February 2023 | GAO verifies the last open public recommendation from the 2016 report 3 |
Common questions
Why did HealthCare.gov fail at launch?
GAO found weak capacity planning, coding errors, missing functions, incomplete testing and ineffective oversight 1,2.
How much did obligations rise?
Federal marketplace obligations rose from $56 million to more than $209 million between September 2011 and February 2014 1.
Were the recommendations implemented?
GAO marks the public recommendations from the three reports used here closed as implemented 1,23.
Did GAO find a successful outside data breach?
For the incidents reviewed through March 2015, GAO found no evidence that an outside attacker compromised sensitive data 3.
Audit cases move on. Each page shows the date we last checked it. Spotted an error or a newer official record? Email hello@auditoutcomes.org with the official link.
Sources
- US GAO: HealthCare.gov contract management, GAO-14-694 (30 July 2014)
- US GAO: HealthCare.gov systems development, GAO-15-238 (4 March 2015)
- US GAO: HealthCare.gov security and privacy controls, GAO-16-265 (23 March 2016)
Related
- NHS National Programme for IT: audits and final outcome
NAO reports, the Department of Health response, Parliament's recommendations, dismantling of the programme and the final benefits review.
- ArriveCAN audit: findings, responses and where the case stands
The Auditor General audited ArriveCAN in February 2024. What followed: Parliament, the procurement ombud, the RCMP and the GC Strategies ban.
- Australia Robodebt: audit, Royal Commission and follow-up
The ANAO, Senate, Royal Commission, government response, Federal Court settlement, reforms and the current NACC investigation.
- How to read a public audit report
A guide to the parts of a public audit report: scope, criteria, findings, management response, recommendations, audit opinions and management letters.
- Universal Credit audit: what happened after the 2013 report
NAO findings on Universal Credit from the 2013 programme reset through the 2024 migration review and current audit position.
- Audit recommendation trackers by country
Where to check whether public audit recommendations remain open, were accepted, were implemented or need a later follow-up report.