Google advanced search operators are just a way to filter the google index:
http://www.googleguide.com/advanced_operators_reference.html
Here, he would have been using something like “site:healthcare.gov inurl:x” potentially. Where X would be a part of the url string that matched individual accounts.
Now, the pages shouldn’t really show up in the search index, so gotcha Gov there. But, that also doesn’t mean any sensitive information is accessible at all.
