CMS Explains the PPACA Exchange Record System

On February 6, 2013, the Centers for Medicare & Medicaid Services ("CMS") published a notice about how the new system of records, intended to support the new health insurance exchanges, will operate. A "system of records" is a group of any records under the control of a federal agency from which information about individuals is retrieved by name or other personal identifier. 

The Privacy Act, 5 U.S.C. 522a, requires each agency to publish in the Federal Register a system of records notice ("SORN") identifying and describing each system of records the agency maintains, including the purposes for which the agency uses personally identifiable information ("PII") in the system, the routine uses for which the agency discloses such information outside the agency, and how individual record subjects can exercise their rights under the Privacy Act. 

Accordingly, CMS provided information about the new system of records, also known as the Health Insurance Exchanges ("HIX") Program. The notice includes the following information about the HIX Program: 

• The Patient Protection and Affordable Care Act ("PPACA") requires the U.S. Department of Health and Human Services ("HHS") to collaborate with state agencies in establishing a system of individual and small group exchanges by October 1, 2013. 
• The primary purpose of the HIX system is to collect, create, use, and disclose PII on individuals who apply for eligibility determinations for enrollment in a qualified health plan through the exchanges, for insurance affordability programs, and for certifications of exemption from the individual responsibility requirement.   
• After consumers provide PII during the application process, the exchanges will share their information with health insurers that sell coverage through the exchanges and others involved in helping consumers use the exchanges. 

The text of the notice to establish a new system of records is available here.