Equifax, Experian will earn millions doing ID checks for new health care exchanges; will their systems work?

When consumers try to sign up at just-launched health care exchanges next week, they might be surprised that credit bureau Experian and its telephone help desk may stand in the way. And those seeking a subsidy will be confronted by Equifax’s controversial The Work Number product, a massive database the firm now holds which includes week-by-week paystub information for tens of millions of Americans.

As states around the country prepare to open their health care exchanges for business, the technology that will be used to positively identify consumers’ identities and other information is being called into question.  Equifax has a contract that could pay $330 million over five years to make sure consumers don’t lie about their income when applying for subsidies.  Experian is part of an $80 million contract to supply technology that will make sure consumers are who they say they are when they sign up.

Technology experts are wondering if the bureaus are up to the task.

When Americans rush to sign up for new health care exchanges on Oct. 1, they will confront a series of important questions, like these:

“Which of these banks holds your mortgage?”

“On which street have you lived in the past?”

“Which of these is a car you’ve owned?”

The annoying and sometimes impossible-to-answer questions are familiar to anyone who’s ever tried to obtain a free credit report from AnnualCreditReport.com, or who has signed up for benefits at the Social Security Administration’s website.  Sometimes called “out of wallet questions,” but more formally known as “knowledge-based authentication,” the questions are designed to prevent would-be criminals from impersonating consumers — hard to answer, even for a criminal looking at a stolen credit report or credit card, but theoretically easy for the authentic user.

(Want to read more stories like this? Subscribe to Bob Sullivan’s newsletter.)

As consumers know, that’s often not the case. Due to inaccurate data and foggy memories, the failure rate of knowledge-based authentication hovers between 10 and 15 percent. Consumers who fail the test often find themselves in a frustrating red tape quagmire, calling busy numbers or forced to mail in paperwork that’s hard to produce.   That same troubled process will be used by health care exchanges.

Security analyst Avivah Litan of consultancy Gartner said failure rates can soar as high as 30 percent with certain populations, such as immigrants and young adults with short credit histories.

When the exchange websites go online, hundreds of thousands of consumers will fail the automated authentication, and have to call Experian’s helpdesk.

A spokesperson for the Centers for Medicaid and Medicare (CMS) confirmed on background that Experian’s help desk will handle consumers who fail the knowledge-based authentication process, but would not discuss the system’s readiness to handle potential call volume. Those who fail will be allowed to continue their application process online, but they will not receive an eligibility determination until they succeed at an alternative method for proving their identity.

Experian referred questions to CMS, but when asked specifically if the firm was ready for a potential deluge of frustrated consumers, spokesman Michael Troncale said, “Experian is prepared to handle calls.”

But Experian’s telephone operators, just like those who work at Equifax or Trans Union, don’t have a great reputation with consumers. Complaints from those rejected by AnnualCreditReport.com are plentiful. Earlier this year, the Federal Trade Commission issued a report saying as many as 42 million Americans had an error in their credit reports. Back in 2000, after a federal law required the bureaus to make it easier to call and get errors fixed, a crush of telephone busy signals and accusations of inadequate staffing led to the three bureaus paying a $2.5 million settlement to the FTC.  Experian paid $1 million and agreed to increase call center efficiency. And in July, a jury awarded an Oregon consumer $18 million for getting the run-around from Equifax.

Meanwhile, security expert Brian Krebs revealed earlier this week that an underground crime ring has infiltrated a series of data brokers and used the access to download millions of pieces of data that helped them overcome knowledge-based authentication barriers.

The combination of honest failures and stolen data suggests to Litan that knowledge-based questions are destined to cause serious problems in the launch of the exchanges.

“Most failures are good people who can’t answer the questions while the bad guys who buy the stolen information have no problems answering them,” she said. “Frankly, it’s another ominous and bad sign for Obamacare, I imagine their failure rates will near 25-30 percent given the population of applicants …The likely results will be chaotic and troublesome, and will no doubt fuel the fire of Obamacare opponents.”

Concerns over Equifax’s role in launching the exchanges are very different.  In July, The New York Times revealed that the Obama administration had hired Equifax to verify employment status and income of applicants hoping to qualify for a subsidy.  The firm will check applicants against its Work Number database, which contains 190 million employment and salary records, including paystub-level data on at least one-third of U.S. adults.

Most consumers have never heard of The Work Number, and are unaware that thousands of human resource departments share their salary and benefits information with Equifax.  The firm then sells some of the information to debt collectors and other financial services companies.

Revelations about The Work Number earlier this year, in a story I wrote for NBC, led to legislation calling for change at Equifax.   Several U.S. Congress members signed a letter asking Equifax to explain the product in light of the story, including Rep. Jackie Speier (D-Cal.).

The New York state assembly passed legislation that would prohibit the sale of Work Number data to third parties without express written consent on consumers, but the proposal was never considered by the state senate.

“The sale of employment data reports is a major violation of privacy and most employees are completely unaware that this is taking place,” said Assemblyman Edward Braunstein, a Democrat, at the time. “It is outrageous that Equifax is selling information gained from its human resource services to third parties. This legislation sends a message that the privacy rights of hardworking Americans must be respected.”

Now, the Obama administration is one of those third parties.

A spokesperson for Braunstein’s office said the assemblyman is working on a new version of the legislation, and would not comment on its use for health care exchanges. But government agencies, specifically those that screen applicants for needs-based benefits programs, are frequent customers of the Work Number, making it challenging for government to regulate its use.