Rhode Island: In the end, 2025 OEP enrollment was still record-breaking

Last winter, Rhode Island residents were hit by an extremely nasty security breach of their RIBridges social services computer system:

On Monday, Gov. Dan McKee said his team has identified 650,000 people whose personal information was stolen in the recent cyberattack on the state’s IT system for social services.

...Earlier this month, the cyberattack shut down the state’s IT system known as RIBridges, which serves as an eligibility database for a host of social services, such as SNAP and Medicaid, along with subsidized health insurance through HealthSourceRI.

...According to McKee, the state aims to turn the system back on in January. In the meantime, R.I. Human Services Director Kim Merolla-Brito said people will still receive benefits through SNAP, Medicaid and other cash-assistance programs. She said EBT cards should be refilled for January under normal distribution methods.

She added that nobody will be terminated from Medicaid while the system is down.

...HealthSourceRI, however, heavily relies on RIBbridges to determine eligibility for coverage, and state officials said last week they’ve decided against trying to use a paper-based system for new applications.

...HealthSourceRI Director Lindsay Lang said they will extend their open-enrollment period through February and back-date coverage to Jan. 1 for people who sign up after the system returns online.

Among the various measures taken by the Rhode Island government was a month-long extension of the 2025 ACA Open Enrollment Period, with coverage being made retroactive to the beginning of the year.

In mid-January, the state reported that they had gotten on top of the security breach and were ramping things back up again:

This week, the State of Rhode Island will begin a controlled, phased relaunch of the HealthyRhode customer portal associated with RIBridges system, which manages many of the State’s social service and benefit programs as well as its health insurance exchange.

This development comes after a successful relaunch of the system’s internally facing employee portal earlier this month. Previously, the State proactively took the RIBridges system offline due to security concerns associated with the recent data breach. After extensive testing and validation by Deloitte—the manager of RIBridges, the State, and the State’s third-party risk assessor, it has been determined that RIBridges is safe to use.

As part of the phased relaunch, limited groups of RIBridges customers will receive e-mails over the next week that direct them to log into the portal, reset their password, and access their account. This approach allows the state to carefully manage the amount of activity in the portal while we relaunch so that all of our customers can have a successful experience getting back into their accounts. After evaluating the portal’s performance during these initial phases, the State will determine the timeline for a full restoration of the HealthyRhode website for all customers.

I haven't read about any other issues since then so I'm assuming that the relaunch went smoothly.

In any event, HealthSource RI finally released their official 2025 Open Enrollment Period report, and in the end it looks like they did pretty well all things considered...although the final enrollment tally ended up being slightly lower than the 43,514 reported by CMS back in mid-January:

HealthSource RI’s 12th annual health coverage Open Enrollment (OE) period began November 1, 2024 and ended on February 28, 2025, with a record-setting enrollment, outpacing internal projections and eclipsing last year’s previous historic high.

Enrollment

• Individual and Family enrollments totaled 42,695 during this Open Enrollment, an increase of 24 percent over the close of Open Enrollment 2024 and a new historic high close to Open Enrollment (2024’s previous historic high was 34,456).

• Of these 42,695 enrollees, 8,557 (20%) were new customers during the OE period, down somewhat as compared to 9,539 (28%) last year. The remaining 34,138 were renewals, representing retention of 73% of those enrolled and paid prior to the November 1 start of OE.

• Enrollees are 57% female and 43% male.

• Enrollment among 18–25-year-olds in this OE remains strong, with the group growing to a proportion of 11% of total enrollment, up from 8.7% last year. As with last year, this group’s overall enrollment growth outpaced all other age categories substantially. All age categories saw growth in numbers over last year, most by multipliers between 1.1 and 1.3, apart from the 18-25 year-old cohort at 1.57 times.

• Those aged 55-64 continue to make up a substantial portion of HSRI’s total enrollment, with 27% of enrollees.

Affordability

• HealthSource RI is the only place that eligible Rhode Island residents can access financial assistance for health coverage. In February 2025, 88.1% of HealthSource RI customers received financial assistance, up from 86.5% in 2024.

• For 2025, HealthSource RI’s second-lowest-cost silver plan, also known as a “benchmark plan,” has an average premium of $425/month before tax credits (based on a single 40-year-old), which is about 15% lower than the national average of $497 per month, and 9th lowest in the nation, down slightly from 8th last year. (Source: Kaiser Family Foundation)

• During this Open Enrollment, HSRI customers qualified for nearly $16.3 million in monthly Advance Premium Tax Credits, a form of federal financial assistance to lower their premiums. This is up from $11.7 million in 2024.

• Since HealthSource RI’s inception, Rhode Islanders have received more than $1.19 billion in financial assistance to lower their monthly coverage costs.

• Through 2025, historically high levels of financial assistance made available through the American Rescue Plan Act (ARPA, March 2021) and extended by the Inflation Reduction Act (August 2022) remain intact, meaning that coverage through HSRI became more affordable than ever for plan years 2021 through 2025. Without federal action those enhanced premium tax credits stand to expire in December.

• Customers are also using the enhanced tax credits to buy plans that provide them a higher degree of coverage and fewer out-of-pocket costs. Gradually, from 2022 to 2025, customers have moved by several percentage points of overall share out of bronze level plans, into silver, gold, and even small increases in platinum plans.

• Tax credits continue to protect consumers from rising costs. While the average unsubsidized premium of all currently active plans is $567, after APTCs have been applied, the average customer pays $110 per month.

Impact of APTC Subsidies on Net Premium

• In 2025, 12,909 (30.2%) of customers are enrolled in a plan with a premium of less than $10/month after tax credits. Comparatively, in 2021, HSRI had just over 3,000 customers who paid less than $10/month in premium costs.

• ARPA also created opportunity for those whose income is over 400% of the federal poverty level (FPL – about $60,000 for a single adult) to receive financial assistance. In 2025, of the 4,122 enrollees whose income exceeds 400% FPL, nearly 52% (2,132) received financial assistance, with an average subsidy amount of $275 per month.

• Rhode Island maintains one of the highest insured rates in the country, with just 2.2% uninsured according to the RI Health Information Survey, a biannual survey of thousands of Rhode Islanders updated in 2024. The national uninsured rate is approximately 8%.

Cybersecurity Event and Adaptations

Deloitte, the vendor that manages the RIBridges information system for the State of Rhode Island, reported in mid-December 2024 a breach of the system by cyber criminals, leading to a proactive system shutdown. HealthSource RI took several steps to provide customers sufficient access
considering several weeks of system downtime, including an extension of the open enrollment deadline (ordinarily January 31), an alternative Direct Enrollment program, and a Special Enrollment Period.

Direct Enrollment, created in late December on a fast-track with the partnership of our insurance carrier partners and offered into the first week of February, allowed customers to enroll in off- exchange plans directly with two carriers, Blue Cross & Blue Shield of Rhode Island and Neighborhood Health Plan of Rhode Island. Premiums and out-of-pocket costs were covered for January and February by the State.

Approximately 2,000 Rhode Islanders took advantage of this temporary program to stay covered; many have returned to marketplace coverage through HealthSource RI at the plan’s February 28 conclusion.1 Throughout the event, payment as confirmation of previously selected enrollments was able to be processed through a variety of secure means. As the system was deemed safe and restored in phases, beginning with employee access to resume enrollment functions in the second week of January, and with broad customer access regained by the first week of February, exchange enrollments continued to rise.

Outreach and Customer Support Throughout Open Enrollment and the Cybersecurity Event Response

Open Enrollment 2025 presented unique and evolving challenges to HSRI’s usual marketing and outreach cadence. Six weeks into the three-month campaign, with enrollment systems down and restoration uncertain, HSRI was in the midst of addressing a number of operational challenges related to best serving customers who were at varying points along the enrollment process for 2025.

1 Note: Those who enrolled in the Direct Enrollment program are not counted among total end-of-OE enrollment unless they had committed by February 28 to returning to a policy purchased through HealthSource RI for March 1.

This puts the drop of 819 enrollments into context...it sounds like total enrollment was actually more like 44.7K, but up to 2,000 of them aren't officially counted due to the direct enrollment workaround.

Even as HSRI made these unprecedented operational pivots, our marketing and customer outreach needed to pivot concurrently.

The Open Enrollment campaign for 2025 was underway as planned, an evolution of the 2024 campaign echoing the “Stay…” phrases but with a more active twist – “Stay on top of your game,” “Stay on the ball,” “Stay on track,” etc. The campaign, as with past years of both Open Enrollment and Special Enrollment Periods, focused on targeted audiences with special attention paid to zip code areas of Rhode Island where the RI Health Information Survey (HIS) indicates there are people who remain uninsured, as well as cross-walking those zip codes with communities known to be high Medicaid utilization areas where customers were likely to be impacted by coverage loss during annual renewal
activity.

All materials, including radio, buses, outdoor, digital, streaming audio and streaming TV/video ads, were presented in both English and Spanish. Technologically, HSRI had introduced a new advancement this year in time for Open Enrollment – a chatbot on its website designed to answer many basic customer questions, preserving live agent time for more complex or individualized inquiries.

In the week following the one in which the RIBridges system went down, public messaging was about to roll out to emphasize the January 31 end of Open Enrollment. With some quick action, the campaign was able to be updated digitally and on transit to reflect the extended February 28 Open Enrollment, a new radio campaign for Direct Enrollment was recorded and layered over the existing schedule, a new Covered2025 web page was created with regular updates, social media posts reflected the most to- the-minute information including important accessibility info like our extended contact center hours, and OE brochures in community locations were updated with stickers reflecting the new OE date and
webpage.

Throughout the data breach response, HSRI stayed in regular contact with its existing customers and past applicants/eligible parties through frequent use of email and text outreach, to inform, assure, and encourage Rhode Islanders that their options for quality, affordable health insurance remained available to them despite the inability to access the customer portal. HSRI leadership was also part of a multi-agency communications outreach effort, ensuring that the affected agencies were communicating to the public in a regular, coordinated and clear way about the situation and the accessibility of their state programs.

Navigator agencies were kept closely apprised through partnership with RIHCA, and the joint HSRI/RIHCA info sessions continued in English and Spanish, answering customer questions and concerns about both enrollment and the breach with content pulled into the presentation from the state’s cyberalert web repository of resources.

The efforts paid dividends as HSRI not only preserved its enrollment for the season but also surpassed its own internal projections during the time of upheaval. Overall, year-over-year website traffic driven by the advertising campaign was up 17.3%. Paid search and paid social were highly effective, with paid search yielding the highest number of website events of any tactic (21.7K), and paid social delivering click-through rates of 1.18%, notably higher than benchmarks of .5-.8%, assessed to be a function of the use of carousel ads. Clicks in the early part of the campaign were driving traffic into a newly redesigned Open Enrollment page with clear visuals and calls-to-action, while the latter half began to point customers to the Covered2025 page. More than 240,000 new users visited HSRI’s website during the OE period.

Conclusion

Now firmly into Plan Year 2025, HSRI enrollment is at an all-time high. Affordability and accessibility of our exchange-based plans matter now more than ever to tens of thousands of Rhode Islanders, an effect seen clearly through the utilization of the enhanced premium tax credits to not only obtain health coverage but also migrate to higher value, lower out-of-pocket cost plans. Rhode Island’s state-based marketplace, built specifically to serve the needs of our state and its people, continues to position Rhode Island to best serve residents in need of health coverage. HSRI remains nimble – quick to get enhanced tax credits into the hands of consumers, agile in the face of a considerable challenge like the cybersecurity event, and responsive and adaptable in partnering with RI Medicaid to continue smoothing the path to continuity of coverage. HealthSource RI will continue to support Rhode Island in maintaining near-universal health coverage, and its citizens with connections to coverage they can afford and utilize.