Updated at 5:10 p.m.

Eighteen months after its launch, Vermont Health Connect continues to suffer from serious technological, operational and security problems, according to a new report released Thursday by state Auditor Doug Hoffer.

In a long-awaited look at the federally mandated health insurance exchange, Hoffer sounded a pessimistic note about the state's progress complying with recommendations made by its own consultants. 

"While the State has taken steps to correct problems, gaps in VHC’s functionality have been patched by manual and time-consuming processes that have caused hardship for Vermonters," he wrote in an introductory letter.

Much hinges upon whether Gov. Peter Shumlin's administration can meet two fast-approaching, self-imposed deadlines, Hoffer wrote. Last month, the governor promised the system would be able to automatically process changes to account information by May and smoothly reenroll users by October. If the administration fails to meet either target, Shumlin said at the time, he would replace the state-based system with the federal exchange or a state-federal hybrid.

"Although the State has developed a high-level plan to correct IT shortcomings in 2015, significant obstacles and challenges remain to the successful implementation of the plan," Hoffer wrote. "The schedule for the [May] release is aggressive and the State does not yet have a defined scope of work or a contract with Optum, its current vendor, for a second major release in the fall."

Hoffer did not endorse abandoning Vermont Health Connect in favor of a federal alternative, but he recommended that the state conduct a cost-benefit analysis of potential alternatives.

"We agree that it is prudent to consider whether to continue with VHC or to move to an alternative model for running an exchange and to develop a plan for this scenario," he wrote.

In an interview later Thursday, Hoffer said he would like to see the administration succeed. “I hope they pull it off, frankly,” he said. “But if history is any guide, they may not make it.”

Hoffer questioned the wisdom of adopting such an aggressive deadline to fix the so-called change-of-circumstances functionality, given the administration’s track record. “I don’t know why the hell the governor adopted this May 30 deadline,” he said.

After the document’s release Thursday, Shumlin and his advisers downplayed its import.

"I haven't read the audit but from what I heard it doesn't tell us anything we haven't been working on,” Shumlin said Thursday morning. “I'm glad it doesn't suggest we abandon [the exchange]. I think that we have been through a long and frustrating process that it would be foolish to give up on. I'm optimistic we can get it right."

The governor’s chief of health care reform, Lawrence Miller, echoed those remarks at a press briefing.

“Anybody who’s heard my testimony over the last year knows that I didn’t find any surprises in the audit,” he said.

Miller acknowledged that the late May deadline is “a high-risk schedule, an aggressive schedule without any slack.” But, he said, “Right now, I am optimistic that we will hit that milestone.”

House Speaker Shap Smith (D-Morristown) said he plans to hold the administration to that marker.

“I think if we cant meet that deadline then we have to move on to another option,” he said. “At that point in time, I will be in a place where my mind will be made up.”

The 62-page report largely built upon the work of six previous reviews conducted by independent contractors engaged by the state. Hoffer's office sought to determine whether the Shumlin administration implemented recommendations outlined in those reports.

In some areas, he found, it did. The state, for example, "has improved its project management processes," Hoffer wrote.

But other problems remain, he found. For example:

• Optum "has not produced documentation deliverables in a timely fashion," he wrote, and the state's contract with the company "does not include provisions to measure vendor performance."
  
  
• While the state corrected its "highest priority security weaknesses" last fall, "70 moderate risk weaknesses remained as of January 31, 2015, and the State has known about 91 percent of those weaknesses for at least 13 months."
  
  
• "The State’s premium payment process is cause for concern, and the State has taken little action to improve its shortcomings," Hoffer wrote. "The financial controls of Vermont Health Connect’s premium payment process have serious deficiencies. The lack of financial reporting, account oversight, and a full reconciliation of customer account balances is troubling."

In his conclusion, Hoffer recommended "close oversight by the legislature to ensure that the schedule is being maintained and, if not, that corrective actions have been implemented."

The auditor's report included a written response from Secretary of Human Services Hal Cohen, who said the administration has "implemented or [is] in the process of implementing improvements to address all of the Auditor's recommendations."

Cohen also emphasized the positive.

"Despite all of the well-documented problems associated with the rollout of the exchange, Vermont's uninsured rate dropped from 6.8 to 3.7 percent, the second lowest in the nation," he wrote. "It is important to ensure that we have the tools to get all Vermonters the coverage that they need."