CMS covered their new rules around Consent and Review for all marketplace enrollments at their CMS Summit for Agents and Brokers on 5/24/2023. These rules build upon the existing rules that were outlined in the 2022 Understanding Marketplace Compliance Rules & Regulations slides found here, as well as the various FAQs that address Consent and PII rules and regulations.
When comparing the 2023 Understanding Key CMS Rules and Regulations to Maintain Marketplace Compliance slides to the Rules and Regulations from previous plan years, the following are some of the key additional requirements that will need to be met in addition to past guidance. This is not an exhaustive list, so be sure to review the 2023 Rules and Regulations yourself when developing your consent documenting systems for PY 2024.
Consent Documentation Requirements:
The consumer or their authorized representative must take an action to produce the documentation;
Provide consumers a process with which they can rescind consent;
A description of the scope, purpose, and duration of the consent provided by the consumer or their authorized representative.
In addition to the previously required fields.
Review Documentation Requirements:
Maintain documentation stating a consumer or their authorized representative has reviewed and confirmed their application information is accurate (45 C.F.R § 155.220(j)(2)(ii)(A)(1)-(2)). (Referred to as “Review Documentation Requirements”);
The consumer or their authorized representative takes an action to produce the documentation;
The documentation must contain, at a minimum, the following information:
The date the information was reviewed;
The name of the consumer or their authorized representative;
An explanation of the attestations at the end of the eligibility application; and
The name of the assisting agent, broker, or web-broker.
The agent, broker, or web-broker must maintain the documentation for a minimum of 10 years.
Protecting Consumer PII:
You must provide consumers the opportunity to opt-in and allow you (and your agency, if applicable) to use their PII (e.g., through the record of consent). You should also provide a mechanism through which the consumer, or their authorized representative, can limit the use of their PII.
PII may only be used for the authorized functions discussed earlier, in the context of completing an application for QHP, APTC, or CSRs eligibility, if applicable, or enrolling in a QHP, or any data transmitted from or through the Marketplace, if applicable.
PII may not be used for any other purposes not outlined in these agreements without the explicit consent of the consumer or their authorized representative.
Third Party Relationships:
Agents and brokers and any third party with which they have entered into a business relationship must adhere to requirements for the use and disclosure of all consumer PII or protected health information (PHI), including all PII/PHI collected by the third party.
Agents and brokers are required to obtain consent from the consumer or their authorized representative. Third party means, such as lead-generators, do not constitute consent in a manner that complies with 45 C.F.R. § 155.220.
For example, consumers merely checking a box to indicate that they attest to being enrolled in Marketplace coverage does not constitute consumer consent for purposes of complying with CMS Marketplace requirements.
System Usage:
CMS systems that agents and brokers access when assisting consumers, include, but are not limited to, the CMS Enterprise Portal, HealthCare.gov, and HealthSherpa EDE and DE Pathways.
Only maintain one CMS Enterprise Portal account, accessible by the registered agent or broker.
Only conduct one log-in session at a time.
No scripting or automation without written CMS permission.
The documentation requirements go into effect beginning June 18th, 2023. They are not retroactive; agents do not have to go back and gather documentation for applications completed before this date, but should implement these practices moving forward. We do expect further guidance in the form of Clarifying FAQs to come from CMS by or shortly after this date.
Remember, all of the rules and regulations around consent and client review are to help you protect your client and your relationship with your client.
If you have comments or questions, please reach out via our dedicated Consent Feedback Form so we can prioritize requests accordingly.