MONTPELIER - Department of Vermont Health Access Commissioner Mark Larson publicly apologized Monday for misleading lawmakers about a security breach within Vermont Health Connect, the state's version of the online health insurance exchange.
Rep. Mary Morrissey, R-Bennington, directly asked Larson if any security breaches had occurred within Vermont Health Connect since its inception in October during a Nov. 5 House Health Care Committee hearing, VTDigger's Alicia Freese reported Monday.
Larson answered no, failing to cite an Oct. 17 incident during which time one Vermont Health Connect user was able to access the social security information of another user.
Associated Press Reporter Dave Gram first reported the news of the incident and Larson's withholding of information in a story published last Friday.
In a letter to the House Health Care Committee Chairman Rep. Michael Fisher, D-Lincoln, dated Sunday and made public Monday, Larson said he failed to report the incident of unauthorized access to private information because it did not occur to him at the time that it was "responsive."
"It is extremely important that Vermonters and you who serve as their representatives have confidence in the information shared by public servants," he wrote. "I take this responsibility very seriously and regret that my answers have not inspired the confidence that Vermonters should expect. I would like to express my sincere apology and reaffirm my commitment to providing information to your committee that is as timely and accurate as possible. My omission did not reflect either your or the administration's expectation of candor."
Larson went on to say that the security of information within the Vermont Health Connect system is a "top priority."
"I want to assure the public that appropriate procedures and policies are in place to protect the privacy of information and security of the website."
Reached by phone Monday evening, Morrissey said she felt Larson's apology was appropriate for the committee, but that another apology should be extended to Vermonters.
"(Vermont Health Connect) has been a complex roll out on its own merit," Morrissey said. "When we're asking questions - and they're not trick questions - I expect honest, transparent statements. It's information that we as a committee need to know so that we can respond appropriately. If we can't, even out of the gate, get these questions answered and hopefully corrected, how is there any faith in what we're doing? How can we help?"
Gov. Peter Shumlin scolded Larson for his actions in a statement issued Monday morning.
"I take this incident extremely seriously. It is unacceptable to be anything less than fully cooperative and transparent with Vermonters and their elected representatives in the Legislature," he said, noting that his administration would not withhold information in the future.
"I am tremendously disappointed in Commissioner Larson's lapse of judgment in this matter. The legislators in Montpelier represent the Vermonters we are all elected to serve, and they have a right to have their questions answered fully. That did not happen in this case, and I have made clear to Mark and other members of my administration that it must never happen again."
Morrissey said the decision on whether or not to fire Larson is out of her hands, but she feels the higher powers should seriously consider his recent actions.
"At the end of the day, we're looking at a multi-billion-dollar initiative that affects every Vermonter," Morrissey said. "I would hope that the administration would look very long and very hard at what has occurred, being that they appointed him to that position."
VTDigger reported Monday that the Governor has no plans to fire Larson at this time.
Contact Elizabeth A. Conkey at firstname.lastname@example.org or follow her on Twitter @bethconkey.