"As you know, I feel very strongly that it's my administration's job -- commissioners, secretaries, staff, state employees -- to be absolutely transparent with legislators," said Governor Peter Shumlin Monday.
But Shumlin says that did not happen at a hearing earlier this month when his point person in charge of Vermont Health Connect denied any security breaches. On Friday new documents show there actually had been a breach last month. Two people created identical usernames, with one getting access to the others private information.
"So we reported it way back when. CMS said, 'Yeah, this doesn't rise to the level of concern,' and I think that was how Mark understood the question. That's what he was focused on in his answer," Shumlin said.
Shumlin called it a mistake. The exchange between Rep. Mary Morrissey (R-Bennington) and Commissioner Larson was recorded by the Health Care Committee.
Rep. Mary Morrissey: Have we had any security failures in Vermont within the system?
Commissioner Mark Larson: Uh, We have no situations where somebody's private information has been breached. No. I want to be very clear, there have been concerns raised to us that we have looked into and found no situation where someone's private information has been breached.
Rep. Mary Morrissey: There has been none you are saying?
Commissioner Mark Larson: Yes.
"We are getting sugar-coated or told statements that are not totally honest, that's a real concern," Rep. Morrissey said Monday. She said lawmakers can't help fix problems without accurate information. "I'm extremely disappointed, but again it's not about me. It's about all Vermonters who deserve accountable, transparent information. If this is to work -- the health care reform -- we need all hands on deck to be doing the right thing," she said.
"I should have gone further that there was one instance where private information has been viewed. It had not been breached. But it is clear I made a mistake not including that additional information in my answer to communicate," Larson said Monday.
Reporter Kristin Carlson: Sounds like parsing of the definition of breach. Why parse words?
Commissioner Mark Larson: It's not by intention to parse words. I acknowledged in my letter to Rep. Fisher I should have gone further with my answer.
Larson was chair of that same Health Care committee when he was appointed to his current job. He sent a letter to lawmakers Sunday apologizing for his testimony. "I should have continued to provide additional information, that is what I should have done," Larson said.
Reporter Kristin Carlson: But don't you think this plays into lawmakers concerns and some public concerns that you are -- quote -- sugar-coating some of the problems here. Why not lay it on the table and say this is what we've got, lets work it out.
Commissioner Mark Larson: Again, I take full responsibility for the fact I should have continued with that answer. It was not an intentional attempt to mislead legislators or the public.
Commissioner Larson says this was the only security lapse and that people should feel safe on the Vermont Health Connect web site. The Governor Monday said they have not started the pay function yet on the web site because of security issues. And they won't until it is fixed. So far 7,888 people have signed up out of the expected 70,000.
Governor Shumlin said he takes Larson at his word that it was "a lapse in judgement" and that he has confidence in the commissioner.