The state, which recently reached a $45 million settlement with the prime contractor on the failed state health exchange, plans to pursue more money from other contractors, Attorney General Brian Frosh said in a letter to legislative leaders.
Frosh settled with Noridian Healthcare Solution for about 60 percent of what it had been paid. The company did not admit wrongdoing.
In his letter, Frosh blamed the vendors for the faulty site — which crashed on its opening day in October 2013 — and said the legislative auditors who are investigating the exchange's performance should consider information his office has uncovered.
"Our investigation, which has included witness interviews, expert software analysis, and limited document discovery, has revealed that the vendors' misstatements about their software and the vendors' poor performance under the contract were the actual and proximate cause of the system's failed launch," Frosh wrote.
"We are involved in an active investigation with the federal government that we expect to lead in the near future to additional litigation and recovery in this case."
The legislative audit could be a key piece of evidence in future litigation, and Frosh wrote that excluding the results of his investigation could "adversely affect the state's efforts to recover funds from the vendors who were responsible for the failed launch."
Frosh did not name the new target of his investigation.
Former Gov. Martin O'Malley and exchange officials have repeatedly pointed to technology giant IBM and its Curam software.
The company declined to comment. IBM officials have said the state shared some blame for the website's troubles, which affected thousands of people who were trying to buy health insurance under the Affordable Care Act.
The exchange still uses some IBM software.
It's not clear how much IBM was paid for its work because it operated as a subcontractor paid directly by Noridian, or on what basis the state could sue to recoup funds.
The exchange website's troubles and squabbling over who was to blame became an embarrassment for O'Malley, a Democrat now running for president, and for his lieutenant governor, Anthony Brown, who lost to Republican Larry Hogan in his bid to succeed O'Malley.
Hogan, a Republican, criticized the exchange website during his campaign, and has replaced many of its board members.
Exchange officials ended up enrolling several hundred thousand people during the first open enrollment by using mainly manual work-arounds.
The state spent $41 million replacing the website technology with code written for Connecticut in time for the second open enrollment. That round launched more smoothly. The exchange began its third open enrollment period on Sunday.
Exchange officials say they will provide any information investigators need.
"As always, [the exchange] is committed to providing the information requested by the Office of Legislative Audits and in cooperating with the attorney general in his investigation in whatever way possible," spokesman Andrew Ratner said.
Warren G. Deschenaux, the state's executive director of legislative services, did not respond to a request for comment.
Sen. Guy Guzzone, co-chair of the General Assembly's Joint Audit Committee, said he would consult with panel members about whether to expand the scope of the performance audit to include vendors, as Frosh requested.
Performance audits are typically used to evaluate how members of the government did their jobs. Guzzone said including vendors is "not routine, necessarily, but it's not without precedent to go outside of government to get a fuller picture of what's going on."
The Howard County Democrat said Frosh's letter was the first time lawmakers saw anyone point to an entity as the "cause" of the health exchange failure.
"This is significant information that certainly we haven't had before," Guzzone said. "In the end Noridian didn't accept any responsibility."
Lawmakers expected to see the audit completed within the next few months, but expanding the scope could delay it.
"Our No.1 job is to protect taxpayers' dollars," Guzzone said. "It seems to me that to get the fullest picture and to ensure the success of any litigation. … What we want to see is the truth of the situation. The citizens deserve that."
The Hogan administration, however, said if there is evidence of mistakes available now, it should be released.
"The roll-out of the health care exchange was a complete disaster, not only costing the state hundreds of millions of dollars but a good portion of our reputation as well," spokesman Doug Mayer said in a statement. "Clearly, many people are to blame for this debacle including the previous administration and the vendors involved in the project. If there is a report detailing the mistakes that were made and who made them, it should be released immediately."
Jennifer Bevan-Dangel, executive director of Common Cause Maryland, said the procurement process used to hire the exchange vendors still needs attention.
The exchange had legislative approval to use a procurement process outside the normal state system. A recent Sun investigation found lack of competition for $84 million in contracts, about a third of the money spent while officials worked on the broken website.
State auditors were critical of the practice, and of security and vendor oversight.
"On the one hand, we are glad to see the attorney general is pursuing action against contractors who possibly contributed to a significant waste and loss of taxpayer money," Bevan-Dangel said. "However, we hope that the attention paid to the vendors in this case doesn't overshadow the broken procurement process that allowed their selection in the first place. Increased transparency in procurement is critical to ensure that the state does not go through an experience like this one again."
Baltimore Sun reporter Erin Cox contributed to this article.