WASHINGTON — The Obama administration said Thursday that 7.3 million people who bought private health insurance under the Affordable Care Act had paid their premiums and were still enrolled.

Marilyn B. Tavenner, the administrator of the Centers for Medicare and Medicaid Services, disclosed the latest count at a hearing of the House Committee on Oversight and Government Reform.

President Obama had announced in April that eight million people had signed up for coverage in the federal and state insurance exchanges, also known as marketplaces.

The chairman of the committee, Representative Darrell Issa, Republican of California, asked why the reported enrollment had dropped by 700,000 people, or about 9 percent.

“Individuals may have gotten employer-sponsored insurance, or found out they were eligible for Medicaid, and some individuals may have decided not to go forward and pay,” Ms. Tavenner said. Some, she added, may have gone “into the ranks of the uninsured.”

Federal computer systems still cannot keep a complete, up-to-date count of people enrolled in health plans under the Affordable Care Act, and the government relies heavily on reports from private insurers. With encouragement from the administration, some consumers have signed up or switched plans since April, taking advantage of “special enrollment periods” available to people who marry, divorce, have a baby or were stymied by “technical errors” at HealthCare.gov.

Administration officials said they were pleased that most consumers were paying their share of premiums. More than 85 percent of people with marketplace coverage are receiving subsidies in the form of tax credits that lower their premiums.

“The vast majority of consumers who gained private insurance coverage through the marketplace are paying $100 or less per month,” Ms. Tavenner told the committee. “In fact, nearly half of individuals selecting plans with tax credits in the federally facilitated marketplace — specifically, 46 percent — were able to get covered for $50 per month or less.”

The hearing Thursday focused on security weaknesses in HealthCare.gov, the website for the federal insurance exchange.

Gregory C. Wilshusen, director of information security issues at the Government Accountability Office, an investigative arm of Congress, said that federal health officials “did not assess risks associated with the handling of personally identifiable information.”

The exchanges opened in October, but Mr. Wilshusen said that security testing of the federal website “remained incomplete” in June of this year.

Moreover, he said, federal health officials did not always use or require strong passwords and were sometimes slow in applying “security patches” to computer systems of the federal exchange.

The administration has often said that Republican concerns about the security of HealthCare.gov were unfounded.

But in her testimony on Thursday Ms. Tavenner said: “There’s very little that concerns me more on a daily basis than the security of this website. I will always worry about the safety and security of the website.”

Hackers broke into part of the federal website in July, but did not steal any personal information on consumers, the administration said early this month. The hackers, it said, placed malicious software onto a test server of HealthCare.gov as part of a broader denial-of-service attack, intended to cripple other websites.

In response to questions on Thursday, Ms. Tavenner said, “To date we have had no malicious breach, no breach of personal information.” At another point, she said, “We haven’t had any malicious attacks on the site that resulted in personal information being stolen,” and she emphasized the word “malicious.”

source: nytimes.com