Commonwealth Health Insurance Connector Authority Policy and Procedures for the Protection of Member Privacy Rights

Last modified December 1, 2022

PURPOSE:

The Massachusetts Commonwealth Health Insurance Connector Authority (the “Health Connector”) is committed to safeguarding the privacy of individuals who apply for and receive insurance through the Health Connector (“Members”) by maintaining the confidentiality, integrity and accuracy of Members’ personal information obtained and used by the Health Connector, in compliance with applicable privacy requirements, including 45 CFR § 155.260 and the latest version Minimum Acceptable Risk Standards for Exchanges (MARS-E). This Policy and Procedures for the Protection of Member Privacy Rights is designed to provide Members with the ability to (1) access, (2) correct, and (3) make decisions about the collection, use, and disclosure of their personally identifiable information (PII) that is obtained or used by the Health Connector and/or its business associates, and to guide Health Connector personnel in implementing mechanisms to ensure Members’ rights are protected, including the processing of appeals of determinations related to such Member rights.

APPLICABILITY:

This Policy applies to all Health Connector employees and third-party contractors involved in the use of Members’ PII. The Policy covers all Members’ PII collected, stored, used, shared, transmitted, disposed of, or otherwise handled by the Health Connector or its business associates. The requirements provided within this Policy cover all Health Connector functions.

POLICY:

Access. Members have the ability to access and review electronic information about them, which is maintained in the Health Connector’s electronic eligibility determination, enrollment and premium billing systems. Additionally, members have the right to request in writing that they be allowed to inspect and copy their PII maintained by the Health Connector and its business associates except under certain limited circumstances explained in this policy, in which case the Health Connector may deny access to records.

Correction. Members have the ability to review and change electronic information about them, which is maintained in the Health Connector’s eligibility determination system, provided that their changed information may be subject to verification. Additionally, the Health Connector will maintain a process for Members to request corrections to their PII in the Health Connector’s control. The Health Connector will provide a timely written response to all such requests. When such a request is allowed, the Health Connector will take steps to make the correction. When such a request is denied, the Health Connector will so notify the Member and permit the Member to submit a statement of disagreement with the denial.

Decisions About Collection, Use and Disclosure. The Health Connector maintains a process to assure that Members may request restrictions as to how the Health Connector will collect, use, or disclose their PII. The Health Connector may refuse to agree to Members’ requested restrictions on the disclosure of PII. When such a request is denied, the Health Connector will so notify the Member and permit the Member to submit a statement of disagreement with the denial.

DEFINITIONS:

Personally Identifiable Information (PII) means information that can be used to distinguish or trace an individual’s identity, such as name, social security number, biometric records, etc. alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc.

Reviewer: “Reviewer” is defined as the Health Connector’s Compliance Manager or such other person as the Health Connector’s General Counsel may designate to review requests submitted by Members in accordance with this Policy. Any other Health Connector personnel that get such a request should refer the request to the Compliance Manager for review.

PROCEDURES:

I. General Procedures for Written Member Requests

Request in Writing. Requests made by Members under this Policy must be in writing using the appropriate Health Connector forms. Copies of the forms will be provided upon request and may be made available on the Health Connector’s website. Copies of the forms are attached hereto as Exhibits A(1), B(1), and C(1).

Verifying the Requester’s Identity. The Reviewer will take reasonable steps to verify the identity of the Requester, who must be either the Member who is the subject of the PII, the Member’s legal representative, or the executor or administrator of the Member’s estate. (For purposes of this Policy, references to a request by a Member or Requester will be interpreted to include requests made by a Member’s legal representative or the executor or administrator of the Member’s estate.) The Reviewer may ask for identification or other documentation of the individual’s identity, including signatures, photographic identification, or copies of court appointments.

Time to Respond to Request. The Health Connector will acknowledge requests within 10 working days of receipt of the request and complete review of the request within 30 working days of receipt of the request, unless unusual or exceptional circumstances preclude completing action by that time. If the Health Connector cannot respond to the request within 30 working days, it will extend the deadline an additional 30 working days, and it will give written notice of the extension to the Requester within the original 30-working-day timeframe.

Responses. All responses to requests will be in writing using the appropriate form, a copy of which is attached hereto as Exhibits A(2), B(2), and C(2). The response will state the reasons for the decision in plain language.

Appeals. Members may appeal any written decision issued by the Reviewer. The Health Connector’s Privacy Officer or that person’s designee will review appeal requests and respond to them no later than 30 working days after receipt, unless there is good cause to extend the period. If the Health Connector cannot respond to an appeal within 30 working days of receipt, it will extend the deadline an additional 30 working days, and it will give written notice of the extension to the Requester within the original 30-working-day timeframe. Any decision issued regarding such appeal will be final. Appeal requests can be made using Exhibit D(1) and responses to appeal request will be provided in the form of Exhibit D(2), each such exhibit attached hereto.

II. Procedures for Providing Member Access

Electronic Access. Members have the ability to access the information about them that is maintained in the Health Connector’s electronic eligibility determination, enrollment and premium billing systems. Members may access this information through the Health Connector’s website (https://www.mahix.org/individual) by using their account identification information (user name and password) to log on to their account and review the information contained there. Information includes the application information provided by the Member, the eligibility determinations made in response to the application information, the enrollment of the Members in Health Connector plans, and current account information about premium billing and payments.

Written Request. If a member believes that there is PII about them that is not available through the electronic access described above, that Member may submit a written request for Access to PII on the Request to Inspect or Receive a Copy of PII form (Exhibit A(1)).

Reviewer’s Obligations. When a Member requests access to that Member’s PII, the request will be reviewed by the Reviewer as follows:

1. The Reviewer will determine if the request was made by the Member.
2. The Reviewer will determine whether the Health Connector or one of its business associates maintains the information requested by the Member in connection with the provision of insurance to that Member. If the Health Connector or its business associate does not maintain the PII, but the Reviewer knows where it is maintained (e.g., the member’s health plan), the Reviewer shall inform the requester where to redirect the request.
3. The Reviewer may ask the Requester to clarify scope, applicable time period, etc. of a request if necessary.
4. The Reviewer will determine whether the request should be allowed or denied, based on the standards stated below.

After completing the above review, the Reviewer will respond to the request using the Health Connector Response to Request for Access to PII form (Exhibit A(2)).

Standards for Review. Generally, a Member has the right to have access to his or her PII. The Health Connector may deny a request for access to PII in the following circumstances, all of which are extremely unlikely or impossible:

• The requested PII consists of individual psychotherapy notes (It is not likely that the Health Connector would have individual psychotherapy notes for an individual because the Health Connector does not collect medical records.);
• The PII was created or obtained in the course of research that includes treatment, for as long as the research is in progress, provided that the Requester has agreed to the denial of access when consenting to participate in the research that includes treatment, and the Health Connector has informed the Requester that the right of access will be reinstated upon completion of the research;
• The PII was obtained from someone other than a health care provider under a promise of confidentiality and the access requested would be reasonably likely to reveal the source of the information; or
• The PII was compiled in reasonable anticipation of, or for use in, a civil, criminal or administrative action or proceeding.

A denial for any of the foregoing grounds will be subject to review via an appeal.

Additionally, the Health Connector may deny a request for PII in the following very unlikely circumstances:

1. A licensed health professional has determined that access to the PII is reasonably likely to endanger the life or physical safety of the individual or another person;
2. The PII makes reference to another person (unless such other person is a health care provider) and a licensed health care professional has determined in the exercise of professional judgment that the access requested is reasonably likely to cause substantial harm to such other person; or
3. The request for access is made by a Member’s personal representative and a licensed health care professional has determined that the provision of access to such personal representative is reasonably likely to cause substantial harm to the individual or another person.

The foregoing three grounds typically involve providers that maintain sensitive medical records-based PII. Thus, it is unlikely that the Health Connector will have occasion to deny access to PII on such grounds because the Health Connector does not collect records from health care providers, facilities, institutions or insurers. However, should such a situation occur, the denial shall clearly state the grounds relied upon and further that the Member whose request is being denied has a right to further review. If the Member exercises the right of further review, the Privacy Officer will arrange to have the matter reviewed by a licensed health professional not involved in the initial decision to deny the request and will promptly provide written notice to the Member about the determination of that review and will take other action required to carry out the determination.

Responses. If access is granted, the Health Connector will notify the Requester in writing that access is granted, and of the means by which access will be provided. The Health Connector will provide access to the information in electronic format if it is able. The Health Connector will use its best efforts to provide records in the format requested, or in the absence of a requested format, in a machine-readable format. The Requester may designate an entity or person to whom the PII should be sent, and the Health Connector should send the information to that person or entity, so long as that choice is clear, conspicuous, and specific.

The Health Connector may provide the Requester with a summary of the PII requested, in lieu of providing access, or may provide an explanation of the information to which access has been provided, if the Requester agrees in advance to such a summary or explanation and to the fees imposed, if any, for such summary or explanation.

If access is denied in whole or in part, the Health Connector will notify the Requester in writing, in plain language, stating the reason for the denial. The Health Connector will make available any requested information that is not covered by the denial. If the Requester has a right to ask for review of the denial, the response shall state how such a review may be requested.

Fees. The Health Connector will assess a reasonable fee for providing copies of PII or producing a summary/explanation of the information. Costs will include the cost of supplies and the labor for preparing a summary/explanation and copying. Postage may be charged to the member if the information is mailed. Fees associated with provision of information in electronic form, or a summary or explanation of such information, will not be greater than the Health Connector’s labor costs in responding to the request. The Requester will be informed of any applicable fees in advance through the response form.

III. Procedures for Requests for Correction

Electronic Access. A Member may review electronic information about them that is maintained in the Health Connector’s eligibility determination, enrollment and premium billing systems. The information contained in the eligibility determination system has generally been provided by the Member subject to verification against external databases. If a Member believes information in the eligibility determination system is incorrect or is no longer accurate due to a change in circumstances, the Member may correct that information themselves in one of two ways:

1. By logging into their account (https://www.mahix.org/individual) through the Health Connector’s website and make the change.
2. If the Member is unable or unwilling to do that electronically, the Member may seek the assistance of a customer service representative to make the change by calling 1-877-MA-ENROLL (1-877-623-6765); TTY: 711.

Any new information that the Member provides will be subject to verification in accordance with federal requirements. A Member may not change enrollment or premium billing information electronically. However, if a Member believes that information in those areas is incorrect or outdated, the Member may contact the customer service center to request a correction by calling 1-877-MA-ENROLL (1-877-623-6765); TTY: 711.

Request in Writing. If a Member wishes to correct PII that they believe cannot be corrected through the self-service options described above, they may make a request to correct in writing on the Request to Correct PII form (Form B(1)). The form requires the Member to state the PII in question; the correction that he or she seeks to make; the reason to support that request; and, if applicable, the identification of persons other than the individual with whom the corrected information needs to be shared.

Review Process. All requests to correct will be referred to the Reviewer, who will make a decision according to the following standards.

Standards for Review. The Health Connector may deny the request if it determines that the PII that is the subject of the request:

1. Was not created by the Health Connector, unless the Requester has provided a reasonable basis to believe that the originator of the PII is no longer available to act on the requested amendment;
2. Is not in the Health Connector’s control;
3. Is not available for inspection under the provisions of this Policy regarding access to PII; or
4. Is accurate and complete.

Procedure for Allowing the Correction. If based on the foregoing procedure, the Health Connector agrees to allow the correction, in whole or in part, it must:

1. Identify where the PII is located.
2. If the PII is in paper form, attach a separate paper containing the correction in the file.
3. If the PII or record is in electronic form, correct the electronic record, when possible, or provide a link to a correction or a note in the electronic record describing the correction.
4. Notify the Requester that the correction is accepted, using the Response to Request to Correct PII form (Exhibit B(2))
5. Make reasonable efforts to inform and provide the correction within a reasonable time to:
   1. Persons identified by the individual in the Request to Correct PII form as having received the PII and needing the correction.
   2. Persons, including the Health Connector’s business associates, that the Health Connector knows have the PII that is the subject of the amendment, and that may have relied, or could foreseeably rely, on such information to the detriment of the Member.

Procedure for Denial. If the Health Connector determines to deny the request, it will:

1. Provide the Member who made the request with a timely, written denial (using the Response to Request to Correct form) that states the basis for the denial and informs the Member of his or her right to submit a written statement disagreeing with the denial and the procedure for submitting such a statement.
2. If the Health Connector considers it necessary, prepare a written rebuttal to the statement of disagreement, and provide a copy of that rebuttal to the Member.
3. If the PII is in paper form, attach a copy of the request for correction, the Health Connector’s denial, and the statement of disagreement and rebuttal, if any, to that paper record.
4. If the PII is in electronic form, take technologically feasible steps to provide a link to the request for amendment, the Health Connector’s denial, and any statement of disagreement or rebuttal.
5. Include the request for correction, the Health Connector’s denial, and any statement of disagreement or rebuttal, or, an accurate summary of such information, in any future disclosure of the PII or, if not technologically feasible, separately transmit the material.

Actions on Notices of Correction. If the Health Connector is informed by another covered entity that a Member with PII held by that entity and by the Health Connector has requested that the other covered entity amend the Member’s PII, and if that other covered entity has granted the Member’s request, the Health Connector will follow the steps listed in this Procedure with respect to making corrections for the relevant member.

IV. Procedures Regarding Member Decisions About Collection, Use and Disclosure

Right to Request Restrictions to Use Of PII. Members may request restrictions on how the Health Connector collects, uses, and discloses their PII, including situations in which the Health Connector uses a Member’s PII without individual authorization for treatment, payment, and health care operations; and situations in which the Health Connector discloses the information to family members or others involved in their care. The Health Connector does not have to agree to such requests. Requests will be reviewed on a case-by-case basis.

Request in Writing. Requests for restrictions will be made in writing, using the Request to Restrict Collection, Use, or Disclosure of Personal Information form (Exhibit C(1)).

Review. Requests for restrictions will be reviewed by the Reviewer in accordance with the following standards.

Standards for Granting Request for Restrictions. The Health Connector’s decision to accommodate the Member’s request for restrictions will be made by the Reviewer based on the feasibility and business implications of the requested restriction and any applicable legal requirements. The Health Connector may decide not to agree with the requested restrictions. Restrictions are not permitted for collection, use, or disclosure of PII that is:

1. Required by law;
2. Required by a court order;
3. Disclosed to a health oversight agency for oversight purposes;
4. For certain law enforcement purposes and certain specialized government functions; or
5. For certain research purposes.

Requests to restrict the disclosure of PII will generally be granted if the disclosure is for the purpose of carrying out payment or health care operations and the PII pertains solely to a health care item or service for which the covered entity has been paid in full.

Response. The Reviewer will notify the Marketplace member in writing of the decision through the Response to Restriction Request form (Exhibit C(2)). If the Health Connector agrees to a request for restriction, then the collection, use, or disclosure of the PII will be restricted as agreed. The restriction applies to applicable PII that the Health Connector has at the time the request is granted and to PII created or received while the restriction is in place. If applicable, the Health Connector will communicate this restriction to any business associates who have PII affected by the restriction and will take steps to ensure that the business associate will implement the restriction.

Revoking a Restriction. The Health Connector may revoke its agreement to a restriction if:

1. The Member agrees to, or requests the revocation either orally or in writing (any oral agreement will be documented); or
2. The Health Connector informs the Member that it is revoking its agreement to a restriction; except that the Health Connector may not, without authorization from the Member, revoke a restriction on the use or disclosure of PII if the PII is to be disclosed for the purpose of carrying out payment or health care operations and the PII pertains solely to a health care item or service for which the covered entity has been paid in full.

This revocation will only be effective for PII created after the Health Connector informs the enrollee affected by the termination.

Documentation. A copy of the restriction request, the disposition of the request, and any revocation requests will be kept in the Health Connector’s files for at least ten years from the date the restriction was last in effect.

Download EXHIBITS A through D (PDF)