A government data warehouse that stores personal information on millions of HealthCare.gov customers is raising privacy concerns at a time when major breaches have become distressingly common.

A government privacy assessment dated Jan. 15 says data “is maintained indefinitely at this time,” but the administration said Monday no final time frame has been decided, and the National Archives has recommended a 10-year retention period.