CACs Confidentiality & Privacy Standards 3 — Questions and Answers
Question 1: A CAC overhears a colleague casually discussing a consumer's income and immigration status in a public waiting room. What should the CAC do?
- Ignore it since the colleague likely has authorization to discuss the case
- Intervene immediately to stop the discussion and report the incident to a supervisor (Correct answer)
- Ask the consumer if they mind their information being shared
- File a complaint with HHS Office for Civil Rights
Correct answer: Intervene immediately to stop the discussion and report the incident to a supervisor
CACs have an obligation to protect consumer privacy; overhearing an unauthorized disclosure requires immediate intervention and internal reporting.
Question 2: Under the 'minimum necessary' privacy standard, what does a CAC's access to consumer information mean in practice?
- CACs may access all information in the Marketplace system for any enrolled consumer
- CACs should only access and use the consumer information needed to perform their specific assistance function (Correct answer)
- CACs must request special permission each time they need to view a consumer's file
- The standard only applies to medical records, not Marketplace enrollment data
Correct answer: CACs should only access and use the consumer information needed to perform their specific assistance function
The minimum necessary standard requires that access to and use of consumer information be limited to what is required to complete the specific enrollment task at hand.
Question 3: A state agency contacts a CAC requesting information about a specific consumer's enrollment status. The CAC should:
- Provide the information since state agencies are authorized recipients
- Verify the request is legitimate and check whether a valid data-sharing agreement or consumer consent exists before disclosing (Correct answer)
- Decline all state agency requests as outside the scope of CAC duties
- Ask the consumer first, then provide the information without further verification
Correct answer: Verify the request is legitimate and check whether a valid data-sharing agreement or consumer consent exists before disclosing
Even government agencies must have proper legal authority or consumer consent before a CAC can disclose information; the CAC must verify legitimacy first.
Question 4: Which scenario BEST illustrates proper use of a consumer's immigration status information collected during enrollment?
- Sharing it with a local school district to verify a child's enrollment eligibility
- Using it solely to determine eligibility for Marketplace coverage and APTC/CSR (Correct answer)
- Including it in outreach reports to community partners to improve targeting
- Providing it to the consumer's employer upon request
Correct answer: Using it solely to determine eligibility for Marketplace coverage and APTC/CSR
Immigration status collected during enrollment may only be used to determine eligibility for the specific program — it cannot be shared for other purposes.
Question 5: A consumer's ex-spouse calls a CAC claiming to be authorized to make changes to the consumer's Marketplace account. The CAC should:
- Make the changes if the caller knows the consumer's date of birth and address
- Require written proof of legal authorization such as a power of attorney before taking any action (Correct answer)
- Ask the consumer via text message and proceed if there is no response within 24 hours
- Refuse all third-party account changes as prohibited
Correct answer: Require written proof of legal authorization such as a power of attorney before taking any action
Verbal claims of authorization are insufficient; a CAC must verify legal authority through documented authorization before allowing a third party to modify an account.
Question 6: What is the primary purpose of requiring CACs to use unique login credentials when accessing Marketplace systems?
- To track how many consumers each CAC assists for performance metrics
- To ensure accountability and maintain an audit trail of who accessed which consumer records (Correct answer)
- To restrict CACs to only their assigned geographic region
- To prevent multiple CACs from assisting the same consumer
Correct answer: To ensure accountability and maintain an audit trail of who accessed which consumer records
Unique credentials create an audit trail that links all system activity to a specific user, enabling accountability and detection of unauthorized access.
Question 7: A consumer discloses they have HIV during an enrollment session. Under CAC confidentiality standards, this information:
- Must be recorded in the enrollment file for continuity of care
- Should not be recorded by the CAC unless it is directly relevant to determining plan eligibility (Correct answer)
- Should be shared with the selected insurer so they can prepare appropriate care management
- May be included in outreach reports if the consumer's name is removed
Correct answer: Should not be recorded by the CAC unless it is directly relevant to determining plan eligibility
CACs should not collect or record health condition information unless it is directly required for the enrollment determination — sensitive health disclosures beyond that scope must remain confidential and unrecorded.
CACs Confidentiality & Privacy Standards 3
A CAC overhears a colleague casually discussing a consumer's income and immigration status in a public waiting room.
What should the CAC do?