Marketplace Consumer Record

The MCR system is an internal CMS system that retrieves and aggregates consumer information from the FFM E&E databases. MCR enables other CMS programs to directly answer consumer questions about their healthcare coverage enrollment; identify and resolve enrollment discrepancies, assists with the reduction in the length of time to resolve issues and more quickly evaluate and make accurate enrollment and appeals decisions. 

The MCR system supports the following CMS programs: Eligibility Support Workers (ESW), FFM Call Center Representatives (CCR), CMS Regional Office Account Managers and Caseworkers, Appeals Workers, and 1095A Discrepancy Resolution & Enrollment Reconciliation Workers.

The consumer information transferred to and stored in MCR is retained permanently, subject to any updates or changes to the information. MCR records on the system are retrieved by one or more PII data elements:

First Name
Last Name
Date of Birth (DOB)
Social Security Number (SSN)
State
City
Zip Code
Email

MCR system users and administrators are CMS direct contractors who log into MCR utilizing their CMS username and password. This user information is maintained for as long as the user requires access to MCR. 

• Social Security Number
• Name
• E-Mail Address
• Phone Numbers
• Taxpayer ID
• Date of Birth
• Mailing Address
• Employment Status
• Other - Username; healthcare insurance plan identification; household income; Federal Tax Information (FTI); Death Confirmation Code; Person Death Date; Person Tracking Number (PTN)

• Employees
• Public Citizens

42 U.S.C. Section 18081

Affordable Care Act (ACA), Section 1414

Affordable Care Act (ACA), Section 1411

42 U.S.C Section 18081

Affordable Care Act (ACA), Section 1414

Affordable Care Act (ACA), Section 1411

5 U.S.C. 301, Departmental Regulation

• In-Person
• Online

• Within the OPDIV

• Members of the Public

CMS Form Number: CMS-10400 Title: Establishment of Exchanges and Qualified Health Plans

OMB control number: 0938-1156

ICR Reference Number: 202406-0938-009 - Extension without change of a currently approved collection was received By OIRA on 6/18/2024.

Expiration Date: TBD

There is no process in place to notify individuals that their personal information will be collected because MCR system retrieves PII data from other FFM E&E information systems. Those systems are responsible for notification to Individuals.

There is no method in place for individuals to opt-out of the collection or use of their PII within MCR. PII stored within MCR is not collected by MCR. The PII is collected from the individual by FFM E&E systems.

MCR system users cannot opt out of PII collection (their username and password) because it is required for system access. 

For information obtained from EIDM, it is the responsibility of this system to provide individuals the option to opt-out. 

There is no process to notify and obtain consent from the individuals whose PII is stored by MCR if a major change to the system occurred because the PII is collected by the FFM E&E databases. 

If an individual has a concern about their PII, the process to report a PII related issue is to contact the Health Insurance Marketplace (HIM) call center at 1-800-318-2596 and describe the concern. The call center would investigate and work with the individual to resolve their concern. MCR is one of the databases that support the call center for that purpose.

MCR system users would contact the CMS IT help desk and the help desk would investigate the issue and determine if further action is needed. 

As part of CMS, MCR is part of the CMS continuous monitoring process based on the National Institutes of Science and Technology (NIST) recommendations to ensure system integrity, availability, accuracy and relevancy. The program is reviewed annually.

MCR and the FFM E&E databases are designed with logic checks to ensure data accuracy, availability and integrity. The CMS Center for Consumer Information and Insurance Oversight (CCIIO) is required to review and update the enrollment process on a yearly basis to ensure that all data collected is relevant to the health insurance enrollment process.

• Administrators: MCR system administrators may have access to PII as part of their maintenance support activities.
• Contractors: Direct Contractors: CMS contractors in their role as system administrators may have access to PII as part of their role as an administrator.

Individuals requesting access to MCR must sign an account request form prior to account creation. The account request form must indicate access level needed. This form is reviewed and approved by MCR managers. MCR uses the principle of least privilege to ensure system administrators are granted access on a "need-to-know" basis. 

Only validated administrators have access to MCR. Managers must approve all system access and re-certify that access within every 365 days. 

Administrative controls such as written policy, procedures and guidelines have been established. System users are required to take annual Security and Privacy awareness training. Third-party assessments are done to validate the implementation of the system controls that have been implemented to prevent unauthorized access, to safeguard the data in the event of a disaster, and to audit activity within the application.

The technical controls in place are firewalls and encryption to prevent unauthorized access. Other technical controls include security scans, penetration testing, intrusion detection and prevention systems (IDS/IPS) and computer system controls that prevent users without administrative or developer access to log into a test environment and the test environment and usable application are not joined together.

The physical controls in place are that servers are located in a secured data center with surveillance cameras, security guards, locked rooms, locked server cabinets, a network operations center, and security desk with visitor logs for controlled access.