The Health and Human Services Department's inspector general (IG) recently reported that security tests focused on the exchanges are taking place this and next week after months of delay.
The revised schedule means that the exchange's data system will not be declared secure or insecure until Sept. 30, just before enrollment is scheduled to begin, according to the IG report.
Hatch asked the GAO to describe risk management efforts by the federal agencies involved with the data hub and to assess plans for correcting any problems.
He also suggested that the system's information sharing could be against federal law.
The Centers for Medicare and Medicaid Services (CMS) defended the data system's progress this week after the release of the IG investigation.
"We are on schedule and will be ready for the marketplaces to open on Oct. 1. This study was conducted in May, and we have made significant progress in the three months since then,” said CMS spokesman Brian Cook.