§155.260. Privacy and security of personally identifiable information. — Inbound Citations

(iv) The privacy and security standards applicable under § 155.260.

(3) Complies with the Exchange's privacy and security standards adopted consistent with § 155.260.

(3) Limit marketing of non-QHPs during the Exchange eligibility application and QHP selection process in a manner that minimizes the likelihood that consumers will be confused as to which products and plans are available through the Exchange and which products and plans are not, except as permitted under paragraph (c)(1) of this section;

(3) Complies with the Exchange's privacy and security standards adopted consistent with § 155.260, and applicable authentication and data security standards;

(d) In conducting an electronic transaction with a QHP issuer that involves the payment of premiums or an electronic funds transfer, the Exchange must comply with the privacy and security standards adopted in accordance with § 155.260 and use the standards and operating rules referenced in § 155.270.

(a) HHS will oversee and monitor the Federally-facilitated Exchanges, State-based Exchanges on the Federal platform, and non-Exchange entities required to comply with the privacy and security standards established and implemented by a Federally-facilitated Exchange pursuant to § 155.260 for compliance with those standards. HHS will oversee and monitor State Exchanges for compliance with the standards State Exchanges establish and implement pursuant to § 155.260. State Exchanges will oversee and monitor non-Exchange entities required to comply with the privacy and security standards established and implemented by a State Exchange in accordance to § 155.260.

(A) Any use or disclosure performed which violates relevant privacy and security standards established by the Exchange pursuant to § 155.260;

(3) Applicable requirements under 45 CFR 155.260, 155.270, and 155.315(i), and section 6103 of the Code for the confidentiality, disclosure, maintenance, and use of information are met.

(h) HHS may approve an Exchange Blueprint in accordance with § 155.105(d) or a significant change to the Exchange Blueprint in accordance with § 155.105(e) to modify the methods to be used for collection of information and verification of information as set forth in this subpart, as well as the specific information required to be collected, provided that HHS finds that such modification would reduce the administrative costs and burdens on individuals while maintaining accuracy and minimizing delay, that it would not undermine coordination with Medicaid and CHIP, and that applicable requirements under §§ 155.260, 155.270, paragraph (i) of this section, and section 6103 of the Code with respect to the confidentiality, disclosure, maintenance, or use of such information will be met.

(i) Would reduce the administrative costs and burdens on individuals while maintaining accuracy and minimizing delay, that it would not undermine coordination with Medicaid and CHIP, and that applicable requirements under §§ 155.260, 155.270, 155.315(i), and section 6103 of the Code with respect to the confidentiality, disclosure, maintenance, or use of such information will be met; and

(2) Complies with the Exchange's privacy and security standards adopted consistent with § 155.260; and

(1) Ensure that all data exchanges that are part of the appeals process, comply with the data exchange requirements in §§ 155.260, 155.270, and 155.345(i); and

(f) HHS may approve an Exchange Blueprint in accordance with § 155.105(d) or a significant change to the Exchange Blueprint in accordance with § 155.105(e) to modify the methods to be used for collection of information and verification as set forth in this subpart, as well as the specific information required to be collected, provided that HHS finds that such modification would reduce the administrative costs and burdens on individuals while maintaining accuracy and minimizing delay, and that applicable requirements under §§ 155.260, 155.270, and paragraph (j) of this section, and section 6103 of the Code with respect to the confidentiality, disclosure, maintenance, or use of such information will be met.

(7) Adhere to privacy and security standards established and implemented under § 155.260 of this subchapter by the Exchange with which they are associated;

(c) A QHP issuer must accept enrollment information consistent with the privacy and security requirements established by the Exchange in accordance with § 155.260 and in an electronic format that is consistent with § 155.270.

(2) Receive enrollment information in an electronic format, in accordance with the requirements in §§ 155.260 and 155.270 of this subchapter, from the SHOP as described in § 155.720(c);

(B) Any other use or disclosure which has not been determined by the Secretary to be in compliance with section 1411(g)(2)(A) of the Affordable Care Act pursuant to § 155.260(a); and

(i) Be consistent with the principles and requirements listed in paragraphs (a)(1) through (6) of this section, including being at least as protective as the standards the Exchange has established and implemented for itself in compliance with paragraph (a)(3) of this section;

(2) For purposes of this section, the term “person” is defined to include, but is not limited to, all individuals; corporations; Exchanges; Medicaid and CHIP agencies; other entities gaining access to personally identifiable information submitted to an Exchange to carry out additional functions which the Secretary has determined ensure the efficient operation of the Exchange pursuant to § 155.260(a)(1); and non-Exchange entities as defined in § 155.260(b) which includes agents, brokers, Web-brokers, QHP issuers, Navigators, non-Navigator assistance personnel, certified application counselors, in-person assistors, and other third party contractors.

(i) Be consistent with the principles and requirements listed in paragraphs (a)(1) through (6) of this section, including being at least as protective as the standards the Exchange has established and implemented for itself in compliance with paragraph (a)(3) of this section;

(i) Be consistent with the principles and requirements listed in paragraphs (a)(1) through (6) of this section, including being at least as protective as the standards the Exchange has established and implemented for itself in compliance with paragraph (a)(3) of this section;

(i) Be consistent with the principles and requirements listed in paragraphs (a)(1) through (6) of this section, including being at least as protective as the standards the Exchange has established and implemented for itself in compliance with paragraph (a)(3) of this section;

(i) Be consistent with the principles and requirements listed in paragraphs (a)(1) through (6) of this section, including being at least as protective as the standards the Exchange has established and implemented for itself in compliance with paragraph (a)(3) of this section;

(i) Be consistent with the principles and requirements listed in paragraphs (a)(1) through (6) of this section, including being at least as protective as the standards the Exchange has established and implemented for itself in compliance with paragraph (a)(3) of this section;

The State must comply with the standards and procedures set forth in 45 CFR 155.260(b) and (c) as are applicable to the operation of the BHP.

(D) Ensure that the process used for consumers to complete the eligibility application complies with all applicable Exchange standards, including §§ 155.230 and 155.260(b).

(2) For purposes of this section, the term “person” is defined to include, but is not limited to, all individuals; corporations; Exchanges; Medicaid and CHIP agencies; other entities gaining access to personally identifiable information submitted to an Exchange to carry out additional functions which the Secretary has determined ensure the efficient operation of the Exchange pursuant to § 155.260(a)(1); and non-Exchange entities as defined in § 155.260(b) which includes agents, brokers, Web-brokers, QHP issuers, Navigators, non-Navigator assistance personnel, certified application counselors, in-person assistors, and other third party contractors.

(iii) Ensure that the process used for consumers to complete the eligibility application complies with all applicable Exchange standards, including §§ 155.230 and 155.260(b) of this subchapter; and

(c) The Exchange must perform required functions and cooperate with activities related to oversight and financial integrity requirements in accordance with section 1313 of the Affordable Care Act and as required under this part, including overseeing its Exchange programs and non-Exchange entities as defined in § 155.260(b)(1).

(4) After the applicable period in paragraph (g)(3) of this section has elapsed and the agreement under paragraph (d) of this section is terminated, the agent, broker, or web-broker will no longer be registered with the Federally-facilitated Exchanges, or be permitted to assist with or facilitate enrollment of a qualified individual, qualified employer, or qualified employee in coverage in a manner that constitutes enrollment through a Federally-facilitated Exchange, or be permitted to assist individuals in applying for advance payments of the premium tax credit and cost-sharing reductions for QHPs. The agent's, broker's, or web-broker's agreement with the Exchange under § 155.260(b)(2) will also be terminated through the process set forth in that agreement. The agent, broker, or web-broker must continue to protect any personally identifiable information accessed during the term of either of these agreements with the Federally-facilitated Exchanges.

(C) Any other use or disclosure which is not necessary to carry out a function described in a contract with a non-Exchange entity executed pursuant to § 155.260(b)(2).

(iv) Protect consumer personally identifiable information according to § 155.260(b)(3) and the agreement described in § 155.260(b)(2);

The State must comply with the standards and procedures set forth in 45 CFR 155.260(b) and (c) as are applicable to the operation of the BHP.

(iii) Trained in and adhere to all rules regulations relating to the safeguarding and confidentiality of information and prohibiting conflict of interest, including regulations set forth at part 431, subpart F of this chapter, and at 45 CFR 155.260(f), regulations relating to the prohibition against reassignment of provider claims specified in § 447.10 of this chapter, and all other State and Federal laws concerning conflicts of interest and confidentiality of information.

(e) The agency must require that, as a condition of serving as an authorized representative, a provider or staff member or volunteer of an organization must affirm that he or she will adhere to the regulations in part 431, subpart F of this chapter and at 45 CFR 155.260(f) (relating to confidentiality of information), § 447.10 of this chapter (relating to the prohibition against reassignment of provider claims as appropriate for a facility or an organization acting on the facility's behalf), as well as other relevant State and Federal laws concerning conflicts of interest and confidentiality of information.