CMS Explains the PPACA Exchange Record System
Client Alert | 1 min read | 02.11.13
On February 6, 2013, the Centers for Medicare & Medicaid Services ("CMS") published a notice about how the new system of records, intended to support the new health insurance exchanges, will operate. A "system of records" is a group of any records under the control of a federal agency from which information about individuals is retrieved by name or other personal identifier.
The Privacy Act, 5 U.S.C. 522a, requires each agency to publish in the Federal Register a system of records notice ("SORN") identifying and describing each system of records the agency maintains, including the purposes for which the agency uses personally identifiable information ("PII") in the system, the routine uses for which the agency discloses such information outside the agency, and how individual record subjects can exercise their rights under the Privacy Act.
Accordingly, CMS provided information about the new system of records, also known as the Health Insurance Exchanges ("HIX") Program. The notice includes the following information about the HIX Program:
- The Patient Protection and Affordable Care Act ("PPACA") requires the U.S. Department of Health and Human Services ("HHS") to collaborate with state agencies in establishing a system of individual and small group exchanges by October 1, 2013.
- The primary purpose of the HIX system is to collect, create, use, and disclose PII on individuals who apply for eligibility determinations for enrollment in a qualified health plan through the exchanges, for insurance affordability programs, and for certifications of exemption from the individual responsibility requirement.
- After consumers provide PII during the application process, the exchanges will share their information with health insurers that sell coverage through the exchanges and others involved in helping consumers use the exchanges.
The text of the notice to establish a new system of records is available here.
Insights
Client Alert | 3 min read | 11.21.25
On November 7, 2025, in Thornton v. National Academy of Sciences, No. 25-cv-2155, 2025 WL 3123732 (D.D.C. Nov. 7, 2025), the District Court for the District of Columbia dismissed a False Claims Act (FCA) retaliation complaint on the basis that the plaintiff’s allegations that he was fired after blowing the whistle on purported illegally discriminatory use of federal funding was not sufficient to support his FCA claim. This case appears to be one of the first filed, and subsequently dismissed, following Deputy Attorney General Todd Blanche’s announcement of the creation of the Civil Rights Fraud Initiative on May 19, 2025, which “strongly encourages” private individuals to file lawsuits under the FCA relating to purportedly discriminatory and illegal use of federal funding for diversity, equity, and inclusion (DEI) initiatives in violation of Executive Order 14173, Ending Illegal Discrimination and Restoring Merit-Based Opportunity (Jan. 21, 2025). In this case, the court dismissed the FCA retaliation claim and rejected the argument that an organization could violate the FCA merely by “engaging in discriminatory conduct while conducting a federally funded study.” The analysis in Thornton could be a sign of how forthcoming arguments of retaliation based on reporting allegedly fraudulent DEI activity will be analyzed in the future.
Client Alert | 3 min read | 11.20.25
Client Alert | 3 min read | 11.20.25
Client Alert | 6 min read | 11.19.25
