Source: https://www.law.cornell.edu/cfr/text/45/155.260
Timestamp: 2018-02-21 21:18:01
Document Index: 296413518

Matched Legal Cases: ['art 155', '§ 155', '§ 155', 'art 102', '§ 155', '§ 155']

45 CFR 155.260 - Privacy and security of personally identifiable information. | US Law | LII / Legal Information Institute
CFR › Title 45 › Chapter A › Subchapter B › Part 155 › Subpart C › Section 155.260
(a)Creation, collection, use and disclosure.
(1) Where the Exchange creates or collects personally identifiable information for the purposes of determining eligibility for enrollment in a qualified health plan; determining eligibility for other insurance affordability programs, as defined in § 155.300; or determining eligibility for exemptions from the individual shared responsibility provisions in section 5000A of the Code, the Exchange may only use or disclose such personally identifiable information to the extent such information is necessary:
(i) For the Exchange to carry out the functions described in § 155.200;
(A)Substantive requirements. The Secretary may approve other uses and disclosures of personally identifiable information created or collected as described in paragraph (a)(1) of this section that are not described in paragraphs (a)(1)(i) or (ii) of this section, provided that HHS determines that the information will be used only for the purposes of and to the extent necessary in ensuring the efficient operation of the Exchange consistent with section 1411(g)(2)(A) of the Affordable Care Act, and that the uses and disclosures are also permissible under relevant law and policy.
(B)Procedural requirements for approval of a use or disclosure of personally identifiable information. To seek approval for a use or disclosure of personally identifiable information created or collected as described in paragraph (a)(1) of this section that is not described in paragraphs (a)(1)(i) or (ii) of this section, the Exchange must submit the following information to HHS:
(i)Individual access. Individuals should be provided with a simple and timely means to access and obtain their personally identifiable information in a readable form and format;
(ii)Correction. Individuals should be provided with a timely means to dispute the accuracy or integrity of their personally identifiable information and to have erroneous information corrected or to have a dispute documented if their requests are denied;
(iii)Openness and transparency. There should be openness and transparency about policies, procedures, and technologies that directly affect individuals and/or their personally identifiable information;
(iv)Individual choice. Individuals should be provided a reasonable opportunity and capability to make informed decisions about the collection, use, and disclosure of their personally identifiable information;
(v)Collection, use, and disclosure limitations. Personally identifiable information should be created, collected, used, and/or disclosed only to the extent necessary to accomplish a specified purpose(s) and never to discriminate inappropriately;
(vi)Data quality and integrity. Persons and entities should take reasonable steps to ensure that personally identifiable information is complete, accurate, and up-to-date to the extent necessary for the person's or entity's intended purposes and has not been altered or destroyed in an unauthorized manner;
(vii)Safeguards. Personally identifiable information should be protected with reasonable operational, administrative, technical, and physical safeguards to ensure its confidentiality, integrity, and availability and to prevent unauthorized or inappropriate access, use, or disclosure; and,
(viii)Accountability. These principles should be implemented, and adherence assured, through appropriate monitoring and other means and methods should be in place to report and mitigate non-adherence and breaches.
(4) For the purposes of implementing the principle described in paragraph (a)(3)(vii) of this section, the Exchange must establish and implement operational, technical, administrative and physical safeguards that are consistent with any applicable laws (including this section) to ensure -
(b)Application to non-Exchange entities -
(1)Non-Exchange entities. A non-Exchange entity is any individual or entity that:
(c)Workforce compliance. The Exchange must ensure its workforce complies with the policies and procedures developed and implemented by the Exchange to comply with this section.
(d)Written policies and procedures. Policies and procedures regarding the creation collection, use, and disclosure of personally identifiable information must, at minimum:
(1) Be in writing, and available to the Secretary of HHS upon request; and
(2) Identify applicable law governing collection, use, and disclosure of personally identifiable information.
(e)Data sharing. Data matching and sharing arrangements that facilitate the sharing of personally identifiable information between the Exchange and agencies administering Medicaid, CHIP or the BHP for the exchange of eligibility information must:
(1) Meet any applicable requirements described in this section;
(2) Meet any applicable requirements described in section 1413(c)(1) and (c)(2) of the Affordable Care Act;
(3) Be equal to or more stringent than the requirements for Medicaid programs under section 1942 of the Act; and
(4) For those matching agreements that meet the definition of “matching program” under 5 U.S.C. 552a(a)(8), comply with 5 U.S.C. 552a(o).
(f)Compliance with the Code. Return information, as defined in section 6103(b)(2) of the Code, must be kept confidential and disclosed, used, and maintained only in accordance with section 6103 of the Code.
(g)Improper use and disclosure of information. Any person who knowingly and willfully uses or discloses information in violation of section 1411(g) of the Affordable Care Act will be subject to a CMP of not more than $25,000 as adjusted annually under 45 CFR part 102 per person or entity, per use or disclosure, consistent with the bases and process for imposing civil penalties specified at § 155.285, in addition to other penalties that may be prescribed by law.
[ 77 FR 18444, Mar. 27, 2012, as amended at 77 FR 31515, May 29, 2012; 79 FR 13837, Mar. 11, 2014; 79 FR 30346, May 27, 2014; 81 FR 12341, Mar. 8, 2016; 81 FR 61581, Sept. 6, 2016]
42 CFR 600.350 — Privacy and Security of Information.
45 CFR 155.215 — Standards Applicable to Navigators and Non-Navigator Assistance Personnel Carrying Out Consumer Assistance Functions Under §§ 155.205(d) and (E) and 155.210 in a Federally-Facilitated Exchange and to Non-Navigator Assistance Personnel Funded Through an Exchange Establishment Grant.
45 CFR 155.210 — Navigator Program Standards.
45 CFR 155.615 — Verification Process Related to Eligibility for Exemptions.
45 CFR 156.285 — Additional Standards Specific to SHOP.
45 CFR 156.1105 — Establishment of Standards for HHS-approved Enrollee Satisfaction Survey Vendors for Use by QHP Issuers in Exchanges.
45 CFR 155.240 — Payment of Premiums.
45 CFR 155.510 — Appeals Coordination.
45 CFR 155.225 — Certified Application Counselors.
45 CFR 155.280 — Oversight and Monitoring of Privacy and Security Requirements.
45 CFR 155.285 — Bases and Process for Imposing Civil Penalties for Provision of False or Fraudulent Information to an Exchange or Improper Use or Disclosure of Information.
45 CFR 155.221 — Standards for HHS-approved Vendors to Perform Audits of Agents and Brokers Participating in Direct Enrollment.