This distinction is not useful to the people whose information was accessed. Perhaps healthcare.gov could have been designed in such a way that sensitive user information was not available to client systems, or somehow required that clients have higher levels of security to prevent this from happening.
This is big, east coast, many-contractor design. By the time things made it to the point that somebody was thinking about security, a rule like "providers will be given access to the following fields for a client upon request" was likely already written into a half dozen contracts between seventeen sub-contractors.
Yes, take note east coasters. This doesn't happen on the west coast.
It is explicitly limited by geography. The magnetic pull of the earth on the west coast, because of the San Andreas fault, prevents this from happening there.
Is that not a thing? I had thought "west coast" described startupy, in-house, vaguely agile type of software development, and "east coast" described government contracting, sub-sub-sub contracting, waterfall-style development. Maybe I just picked it up from the folks around me and thought it was more universal.
Haha, were those 'folks around' you on the west coast, perhaps?