The Non-Exchange Entity must obtain informed consent from individuals for any use or disclosure of information that is not permissible within the scope of the Privacy Notice Statement and any relevant agreements that were in effect as of the time the PII was collected. Such consent must be subject to a right of revocation.
The Non-Exchange Entity must obtain informed consent from individuals for any use or disclosure of information that is not permissible within the scope of the Privacy Notice Statement and any relevant agreements that were in effect as of the time the PII was collected. Such consent must be subject to a right of revocation. 2. Any such consent that serves as the basis of a use or disclosure must: a. Be provided in specific terms and in plain language; b. Identify the entity collecting or using the PII, and/or making the disclosure; c. Identify the specific collections, use(s), and disclosure(s) of specified PII with respect to a specific recipient(s); and d. Provide notice of an individual’s ability to revoke the consent at any time. 3. Consent documents must be appropriately secured and retained for ten (10) years. (4) Creation, Collection, Disclosure, Access, Maintenance, Storage, and Use Limitations. In keeping with the standards and implementation specifications used by the FFE, Non- Exchange Entities must ensure that PII is only created, collected, disclosed, accessed, maintained, stored, and used, to the extent necessary to accomplish a specified purpose(s) in the contractual agreement and any appendices. Such information shall never be used to discriminate against a Consumer, Applicant, Qualified Individual, Enrollee, Qualified Employee, or Qualified Employer. a. Standard: Creation, Collection, Disclosure, Access, Maintenance, Storage, and Use Limitations. Other than in accordance with the consent procedures outlined above, the Non-Exchange Entity shall only create, collect, disclose, access, maintain, store, and use PII: 1. To the extent necessary to ensure the efficient operation of the Exchange; 2. In accordance with its published Privacy Notice Statement and any applicable agreements that were in effect at the time the PII was collected, including the consent procedures outlined above in Section (3) above; and/or 3. In accordance with the permissible functions outlined in the regulations and agreements between CMS and the Non-Exchange Entity.
