Government memo warned of high security risk at health care website

WASHINGTON -- An internal government memo obtained by CNN and written just days before the start of open enrollment for Obamacare warned of a "high" security risk because of a lack of testing of the HealthCare.gov website.

"Due to system readiness issues, the SCA (security control assessment) was only partly completed," said the internal memo from the U.S. Center for Medicare and Medicaid Services. "This constitutes a risk that must be accepted and mitigated to support the Marketplace Day 1 operations."

The memo goes on to explain that the Center for Medicare and Medicaid Services would create a "dedicated security team" to monitor the risk, conduct weekly scans and, within 60 to 90 days after the website went live, "conduct a full-scale SCA test."

The memo did not detail the security concerns. It was written by IT officials at the Center for Medicare and Medicaid Services, and was sent to and signed by the agency's director, Marilyn Tavenner, who testified on Capitol Hill on Tuesday that she thought the website was ready to go when it began its crash-riddled rollout on October 1.

"We had tested the website and we were comfortable with its performance," Tavenner told lawmakers, although she added the caveat, "we knew all along there would be, as with any new website, some individual glitches we would have to work out."

Republican lawmakers referred to the document Wednesday as they raised concerns at a Capitol Hill grilling of Health and Human Services Secretary Kathleen Sebelius, Tavenner's boss. Sebelius also testified that she thought the website, which has been prone to crashing, was ready to be rolled out on October 1. She compared the early rollout to a sort of early beta test and said the system is secure because data is stored in the same systems used by the Internal Revenue Service and Department of Homeland Security.

For more on this CNN story, click here.