Update
In June 2023, the Centers for Medicare & Medicaid Services (CMS) implemented new consent requirements for agents and brokers assisting consumers with Affordable Care Act (ACA) Marketplace enrollments. These rules mandate that agents and brokers obtain explicit consumer consent before accessing personal information or aiding in application processes. Additionally, they must document that consumers have reviewed and confirmed the accuracy of their eligibility applications prior to submission.
This documentation must include the date of review, the consumer's name, an explanation of the attestations at the end of the eligibility application, and the assisting agent's or broker's name. Agents and brokers are required to maintain these records for a minimum of ten years.
In October 2024, CMS proposed further updates to enhance consumer protection and ensure compliance. These proposals include expanding CMS's authority to suspend agents or brokers who pose unacceptable risks to Marketplace operations or the accuracy of eligibility determinations.
Additionally, CMS plans to update its model consent form to better document that consumers have reviewed and confirmed the accuracy of their eligibility application information before submission.
These measures aim to safeguard consumer information, uphold the integrity of the Marketplace, and ensure that agents and brokers adhere to stringent compliance standards.
Original post 6/18/2023 | Source: HealthSherpa
CMS covered their new rules around Consent and Review for all marketplace enrollments at their CMS Summit for Agents and Brokers. These rules build upon the existing rules that were outlined in the 2022 Understanding Marketplace Compliance Rules & Regulations slides, as well as the various FAQs that address Consent and PII rules and regulations.
When comparing the 2023 Understanding Key CMS Rules and Regulations to Maintain Marketplace Compliance slides to the Rules and Regulations from previous plan years, the following are some of the key additional requirements that will need to be met in addition to past guidance. This is not an exhaustive list, so be sure to review the 2023 Rules and Regulations yourself when developing your consent documenting systems for PY 2024.
Consent Documentation Requirements:
-
The consumer or their authorized representative must take an action to produce the documentation;
-
Provide consumers a process with which they can rescind consent;
-
A description of the scope, purpose, and duration of the consent provided by the consumer or their authorized representative.
-
In addition to the previously required fields.
Review Documentation Requirements:
-
Maintain documentation stating a consumer or their authorized representative has reviewed and confirmed their application information is accurate (45 C.F.R § 155.220(j)(2)(ii)(A)(1)-(2)). (Referred to as “Review Documentation Requirements”);
-
The consumer or their authorized representative takes an action to produce the documentation;
-
The documentation must contain, at a minimum, the following information:
-
The date the information was reviewed;
-
The name of the consumer or their authorized representative;
-
An explanation of the attestations at the end of the eligibility application; and
-
The name of the assisting agent, broker, or web-broker.
-
The agent, broker, or web-broker must maintain the documentation for a minimum of 10 years.
-
You must provide consumers the opportunity to opt-in and allow you (and your agency, if applicable) to use their PII (e.g., through the record of consent). You should also provide a mechanism through which the consumer, or their authorized representative, can limit the use of their PII.
-
PII may only be used for the authorized functions discussed earlier, in the context of completing an application for QHP, APTC, or CSRs eligibility, if applicable, or enrolling in a QHP, or any data transmitted from or through the Marketplace, if applicable.
-
PII may not be used for any other purposes not outlined in these agreements without the explicit consent of the consumer or their authorized representative.
Third Party Relationships:
-
Agents and brokers and any third party with which they have entered into a business relationship must adhere to requirements for the use and disclosure of all consumer PII or protected health information (PHI), including all PII/PHI collected by the third party.
-
Agents and brokers are required to obtain consent from the consumer or their authorized representative. Third party means, such as lead-generators, do not constitute consent in a manner that complies with 45 C.F.R. § 155.220.
-
For example, consumers merely checking a box to indicate that they attest to being enrolled in Marketplace coverage does not constitute consumer consent for purposes of complying with CMS Marketplace requirements.
-
CMS systems that agents and brokers access when assisting consumers, include, but are not limited to, the CMS Enterprise Portal, HealthCare.gov, and HealthSherpa EDE and DE Pathways.
-
Only maintain one CMS Enterprise Portal account, accessible by the registered agent or broker.
-
Only conduct one log-in session at a time.
-
No scripting or automation without written CMS permission.
The documentation requirements go into effect beginning June 18th, 2023. They are not retroactive; agents do not have to go back and gather documentation for applications completed before this date, but should implement these practices moving forward. We do expect further guidance in the form of Clarifying FAQs to come from CMS by or shortly after this date.
Remember, all of the rules and regulations around consent and client review are to help you protect your client and your relationship with your client.
Source: HealthSherpa
