Exchange Operations Center

• Internal Flow or Collection
• PIA Validation (PIA Refresh/Annual Review)
• New Interagency Uses

System user accounts are created for 3rd party vendor software (Google Workspace) and stored on the vendor web portals.

For 2018, the Direct Enrollment (DE) Partner Program has been implemented. The Program allows DE Partners (Insurance Issuers and Web Brokers) to collect information from consumers who choose to provide their information to the DE Partners. When working with consumers, DE Partners will enter consumer information into a HealthCare.gov application for eligibility and enrollment directly from the DE Partner Website. This Program enables consumers to complete their applications, receive eligibility results, and enroll in plans when working with DE Partners and without leaving DE Partner Website(s).

The Exchange Operations Center (XOC) is an operations center that simply monitors the systems that comprise the Federally Facilitated Marketplace (FFM) and Data Services Hub (DSH) Technologies.  

The Eligibility and Enrollment (E&E) functionally is used to verify an applicant's eligibility for health insurance, plan selection and enrollment through the Affordable Care ACT (ACA) Marketplace available online at healthcare.gov.

The Exchange Operations Center (XOC) can retrieve data files which contain the social security number, name, Mothers' maiden name, email address, phone number, military status, taxpayer identification, date of birth, mailing address, financial account numbers, legal documents, password, userID, employment status and foreign activity when there is a data breach or data spillage resulting from an HHS Numbered Incident.  

The XOC ensures all systems / applications data elements are electronically masked in accordance with existing HHS Federal Privacy Laws for Advertising, social media, and Web Analytics. 

Information found is only shared within CMS during an actual Security Incident. XOC staff directly involved in a specific HHS Incident, must provide their unique name, both first and last, Employment Status and Contractor affiliation, phone number and email address on the Incident Report filled out using an HHS issued Template.

XOC does not store the data, but it is captured during the verify and validate steps of the actual investigation.  XOC does provide forensics evidence and operational artifacts into ServiceNow, the Incident CMS ticket system which is covered by a separate PIA.

The XOC is a secure enclave, for Federal Facilitated Marketplace and State Based Exchanges (SBM) to securely move PII data elements to the trusted Federal Data Partners using DSH secure hub website portals, including the Enterprise Portal, Enterprise Identity Management (EIDM), and Enhanced Direct Enrollment. EIDM, FFM and DSH are also CMS systems which are covered in a separate PIA.

XOC also supports Enhanced Direct Enrollment Partner websites, which has an existing Third-Party Website and Application (TPWA) PIA.

The Exchange Operations Center does not retrieve PII by default, but geographical regional searches can result in a limited number of records, not to exceed the first 1,000.

Agent. Broker and Issuer information is stored as a coded string separately masking their private identity.

The Exchange Operations Center is a focal point for monitoring other autonomous systems supporting and coordinating the processes and activities of Agents, Brokers, and Issuers that ensure applicants get the proper health insurance each ACA Open Enrollment period, from November 1 to December 15, each calendar year, as well as Special Enrollment Needs, from December 16 to October 30.

Personally identifiable information can be shared temporarily with a Call Center Representative, via 1-800 toll free services, to assist the submitter of the Federal or State application.

• Social Security Number
• Name
• Mother's Maiden Name
• E-Mail Address
• Phone Numbers
• Military Status
• Foreign Activities
• Taxpayer ID
• Date of Birth
• Mailing Address
• Financial Account Info
• Legal Documents
• Employment Status
• Other - UserID, password, Contractor Affiliation

• Employees
• Business Partners/Contacts (Federal, state, local agencies)
• Vendors/Suppliers/Contractors
• Other - Only CMS employees and CMS contractors

The Exchange Operations Center includes a record of the actual SSNs pulled from the FFM, DSH, and CMS systems, and provides a secure list to the CMS security and privacy office or breach response team.

XOC system does not actively collect, store or process PHI or PII. XOC as part of its day-to-day business function is responsible for participating and coordinating special investigations related to security and privacy related incidents. As part such investigations, XOC staff members may have access to, or receive PII or PHI, for further research and analysis. This sensitive information may result in storage or transmission within XOC system boundary.

All staff members are trained to limit their exposure to sensitive information. All sensitive information is encrypted during transmission (primarily through email).

• Online
• Email
• Other - New Relic, Splunk, Layer 7

• Within the OPDIV
• Other HHS OPDIV
• Other Federal Entities

• Members of the Public
• Commercial Data Broker
• Private Sector

Individuals requesting access must sign an Acceptable User Agreements prior to account creation. Account request form must also be filled indicating name, email, phone number and access level needed. This form is reviewed and approved by the System information Security Officer (ISSO) prior to account creation.

All data is stored in the CMS controlled portal in accordance with established business rules for processing a federal applicant, both for the Issuers and Purchasers of a specific health insurance plan.

In order to maintain the integrity, availability, accuracy, and relevancy of the PII, system Administrators review user accounts at least semi-annually. Any anomalies are addressed and resolved by contacting the user, and modifying their user data, or by removing their access if no longer required. 

Under this process, outdated, unnecessary, irrelevant, and inaccurate PII is identified and deleted. The PII is available as needed and is sufficient (minimum required) for the purposes needed. Only system administrators can create or modify PII. Activities of all users including system administrators are logged and reviewed by XOC System information Security Officer (ISSO) to identify abnormal activities if any.

• Users: Users monitor system performance and failed transactions along with any failed login attempts within the different system components
• Administrators: Administrators create the accounts for the users and modify account information if necessary.
• Developers: Developing secure code for consumer facing business needs
• Contractors: CMS direct contractors, as users or administrators required to coordinate Infrastructure Change Requests across three to nineteen contracts.

System user accounts are created for 3rd party vendor software (Google Workspace) and stored on the vendor web portals. Individuals requesting access must sign an Acceptable User Agreement prior to account creation. Account request form must also be filed indicating name, email, phone number and access level needed. This form is reviewed and approved by the System information Security Officer (ISSO) prior to account creation. XOC uses the principle of least privilege as well as a role-based access control to ensure system administrators, and users are granted access on a "need-to-know" and "need-to-access" commensurate with their assigned duties. System Administrators review user accounts at least semi-annually. Any anomalies are addressed and resolved by contacting the user, and modifying their user data, or by removing their access if no longer required. Activities of all users including system administrators are logged and reviewed by XOC ISSO to identify abnormal activities if any.

National Archives and Records Administration (NARA), General Records Schedule (GRS) 5.1 Common Office Records and 5.2 Transitory Record states that XOC will destroy/delete no sooner than 7 years or when no longer needed for business, whichever is later and GRS 2.4 Employee Records states that XOC will delete/destroy no sooner than 7 years or when agency determines they are no longer needed for administrative, legal, audit or other operational purposes.

System Administrators review user accounts at least quarterly to remove user PII if access is no longer required.

XOC uses the principle of least privilege as well as a role-based access control to ensure system administrators, and users are granted access on a "need-to-know" and "need-to-access" commensurate with their assigned duties. System Administrators review user accounts at least semi-annually. Any anomalies are addressed and resolved by contacting the user, and modifying their user data, or by removing their access if no longer required. Activities of all users including system administrators are logged and reviewed by XOC ISSO to identify abnormal activities if any.

XOC is located at a secured facility. Physical controls are in place such as security guards to ensure access to the buildings is granted to only authorize individuals. Identification of personnel is checked at the facility.  

XOC is built using industry best practices and independently reviewed against Federal Information Security Management Act (FISMA) and National Institute of Science and Technology (NIST) Security and Privacy controls to ensure technical, operational, and management controls are properly applied. 
Personally Identifiable Information (PII) in XOC is secured administratively by ensuring that the system goes through the Assessment and Authorization (A&A) process, and all documentation is submitted to the Information Security & Privacy Group (ISPG) that supports the system and to comply with Federal Information Security Management Act (FISMA) regulations.

• Session Cookies
• Persistent Cookies