Public Summary Report: New York Implemented Security Controls Over Its Health Insurance Exchange Web Site and Database but Could Improve Security Controls 

This summary report provides an overview of the results of our audit of the information security controls at New York's health insurance exchange, New York State of Health (New York marketplace). It does not include specific details of the vulnerabilities that we identified because of the sensitive nature of the information. We have provided more detailed information and recommendations to the New York marketplace so that it can address the issues we identified. The findings listed in this summary report reflect a point in time regarding system security and may have changed since we reviewed these systems.