click to enlarge

In an uncharacteristic rebuke of one his own, Gov. Peter Shumlin said Monday he was "tremendously disappointed" with his chief health care reform administrator for misleading a legislative committee about a security lapse in the state's new health insurance exchange.

The official, Department of Vermont Health Access Commissioner Mark Larson, sent a letter of apology Monday morning to members of the House Health Care Committee. Larson said that after listening to a recording of his testimony at a November 5 committee hearing, he had come to the conclusion that he had been insufficiently candid with committee members.

The Associated Press' Dave Gram reported Friday that Larson's department had reported what it believed to be an isolated security breach to federal authorities prior to the commissioner's appearance before the committee. But Larson told committee members that DVHA had investigated only one complaint and believed it to be unfounded, according to Gram.

In his letter to legislators, Larson wrote that he "failed to disclose" the security breach to legislators, a lapse he said violated his responsibility to be fully transparent with his fellow public servants.

"I take this responsibility very seriously and regret that my answers have not inspired the confidence that Vermonters should expect," he wrote. "I would like to express my sincere apology and reaffirm my commitment to providing information to your committee that is as timely and accurate as possible. My omission did not reflect either your or the administration's expectations of candor."

Minutes after Larson's office emailed his apology to reporters, Shumlin and House Speaker Shap Smith (D-Morristown) sent their own statements, each expressing disappointment with Larson.

"I take this incident extremely seriously," the governor wrote. "It is unacceptable to be anything less than fully cooperative and transparent with Vermonters and their elected representatives in the Legislature. I am tremendously disappointed in Commissioner Larson's lapse of judgment in this matter."

He added, "I have made clear to Mark and other members of my administration that it must never happen again."

In response to follow-up questions, Shumlin spokesman Scott Coriell said Larson retained the governor's full confidence. He said the governor had taken no action with regard to Larson's responsibilities at DVHA and did not plan to make any leadership changes at Vermont Health Connect.

In his statement, Smith said the incident was "particularly troubling coming from a friend, a former legislative colleague and Chair of the committee." Prior to his appointment to the Shumlin administration, Larson spent a decade representing Burlington in the legislature and chaired the House Health Care Committee.

"Incidents such as this erode the public's confidence in their officials," Smith wrote. "I have spoken with Commissioner Larson and Governor Shumlin and have shared with them my view that this incident is unacceptable. I have also expressed my view that a breach such as this will undermine Commissioner Larson's ability to be an effective representative for the administration in the legislature. It is now incumbent on Commissioner Larson to work to rebuild the trust he once had with his legislative colleagues."

In interviews and statements, officials maintained that while Larson's misleading statements were unfortunate, they believed the October 17 security breach was an isolated incident. They said a single Vermont Health Connect user inadvertently came upon another user's application material. Gram reported that the unidentified user mailed that information to the person to whom it belonged, writing on the envelope, "VERMONT HEALTH CONNECT IS NOT A SECURE WEBSITE!"

Shumlin said he "received updates as the incident was investigated, and... was relieved to learn that it was isolated, involved two individuals, and was not caused by any malicious or intentional breach of the site's security." The governor said he did not and does not have "broader concerns about the security of Vermont Health Connect."

Rep. Mike Fisher (D-Lincoln), who chairs the committee, called the episode "a big deal." 

"The commissioner got it wrong," Fisher said Monday morning. "He did not answer accurately the specific question put to him in the health care committee, and that's a big deal."

But, Fisher said, "There's another story that's really closely linked, and that is whether Vermont Health Connect is secure. What happened was an individual person's information was shared with another individual. We're not talking about a security breach on the order of people hacking into the system or the system being insecure."

Rep. Chris Pearson (P-Burlington), who has criticized the administration for not being more forthcoming about technical problems plaguing Vermont Health Connect, said he believed Larson's omission was merely an "oversight." He said he was far more concerned about whether the exchange would meet its enrollment goals by January 1.

"I've raised some of these kinds of concerns about getting glossy answers from the administration in the past, so this perhaps continues the trend," Pearson said. "But the incident that everybody's talking about, to me, doesn't warrant a cover-up. It wasn't an enormous security breach in any way, so I find it hard to believe this was much more than an oversight from the commissioner. But at the end of the day, right now I'm worried about January 1 — and that Vermonters are covered and that Vermont Health Connect is, indeed, secure."

File photo of Larson with Deputy DVHA Commissioner Lindsey Tucker and Vermont Director of Health Care Reform Robin Lunge by Paul Heintz.