CACs Privacy and Security Standards 3 — Questions and Answers
Question 1: A consumer wants their CAC to help them understand their Explanation of Benefits (EOB). Under what condition may the CAC view this document?
- Only if the consumer is present and explicitly shares the document with the CAC (Correct answer)
- Anytime, since EOBs are not protected health information
- Only after obtaining a signed HIPAA authorization from the consumer's insurer
- Only with a court order
Correct answer: Only if the consumer is present and explicitly shares the document with the CAC
EOBs contain PHI, so a CAC may only review them when the consumer voluntarily shares the document and consents to assistance in the moment.
Question 2: Which of the following is NOT considered Personally Identifiable Information (PII) in the context of Marketplace applications?
- Social Security Number
- Date of birth
- Consumer's favorite color (Correct answer)
- Home address
Correct answer: Consumer's favorite color
A consumer's favorite color is not PII because it cannot be used to identify, contact, or locate an individual.
Question 3: A consumer refuses to sign a privacy notice acknowledgment before receiving CAC assistance. What should the CAC do?
- Refuse to provide any assistance until the form is signed
- Provide assistance anyway and note the refusal, since assistance cannot be conditioned on signing (Correct answer)
- Report the consumer to CMS for non-compliance
- Terminate the appointment immediately
Correct answer: Provide assistance anyway and note the refusal, since assistance cannot be conditioned on signing
CACs cannot condition the provision of assistance on a consumer signing a privacy notice; they should document the refusal and still provide help.
Question 4: What is the primary purpose of a CAC providing a consumer with a privacy notice?
- To obtain consent to sell their data to third-party marketers
- To inform the consumer about how their information will be collected, used, and protected (Correct answer)
- To satisfy a legal requirement that automatically authorizes data sharing
- To replace the Marketplace's own privacy disclosure requirements
Correct answer: To inform the consumer about how their information will be collected, used, and protected
Privacy notices inform consumers of their rights and explain how the CAC organization collects, uses, and safeguards their personal information.
Question 5: A CAC overhears a colleague discussing a consumer's income information loudly in a public waiting area. This violates which privacy principle?
- Data minimization
- Purpose limitation
- Reasonable safeguards / minimum necessary (Correct answer)
- Data integrity
Correct answer: Reasonable safeguards / minimum necessary
Discussing consumer PII in a public area violates the 'reasonable safeguards' and 'minimum necessary' principles by exposing information beyond its intended audience.
Question 6: Under CMS rules, which of the following entities must CACs report a data breach to?
- Only to the affected consumers
- To CMS and potentially to affected consumers and HHS depending on the scope (Correct answer)
- Only to local law enforcement
- Only to their organization's board of directors
Correct answer: To CMS and potentially to affected consumers and HHS depending on the scope
CAC organizations must report breaches to CMS and may also be required to notify affected consumers and HHS's Office for Civil Rights depending on the nature and scale of the breach.
Question 7: A consumer's authorized representative requests a full copy of all information the CAC organization has on file for that consumer. What should the CAC do?
- Deny the request since only the consumer can access records
- Fulfill the request after verifying the representative's authorization documentation (Correct answer)
- Provide the records only if the consumer is present
- Require the representative to submit a HIPAA release directly to CMS
Correct answer: Fulfill the request after verifying the representative's authorization documentation
A properly documented authorized representative has the same rights as the consumer, so the CAC should verify their credentials and then fulfill the records request.
CACs Privacy and Security Standards 3
A consumer wants their CAC to help them understand their Explanation of Benefits (EOB).
Under what condition may the CAC view this document?