Marketplace Learning Management System

• Significant System Management Change
• PIA Validation (PIA Refresh/Annual Review)
• Other - MLMS is undergoing a major change to the content management application. The new content management application is a Software-as-a-Service (SaaS) application.

The CMS Center for Consumer Information and Insurance Oversight (CCIIO) Marketplace Learning Management System (MLMS) provides online training, testing and registration for agents, brokers and assisters. The training and testing requirements ensure agents, brokers and assisters are knowledgeable and adequately trained for their role aiding consumers.  MLMS provides training services for the Center for Program Integrity (CPI) Data Analytics and Systems Group (DASG) for course administrators, instructors, and learners. 

The MLMS integrates with the CMS IT environment to provide seamless registration with the Federally Facilitated Exchange (FFE) such that upon completion for agents and brokers is able to immediately access the Marketplace. The MLMS also integrates with the CMS Enterprise Portal to allow user access, and the CMS Identity Management (IDM) for authentication.

The MLMS provides a web service accessible to the IDM to provide training status for agents and brokers. The MLMS makes a web service request to the IDM to access user profile information for a user.

MLMS collects basic user profile information from IDM. IDM is the source of record for basic profile information. MLMS collects additional profile information specific for training. MLMS generates training completion information for users. Training completion information is shared with other systems such as HIOS, IDM, SHOP and potentially the Multidimensional Information and Data Analytics System (MIDAS).

The data collected through MLMS is published in various formats such as reports, fact sheets, and other informational documents.  MLMS is accessible only after a user account and ID is successfully generated via IDM where the authentication process occurs, www.portal.cms.gov. The Personal Identifiable Information (PII) that is collected via the IDM portal is subject to the IDM PIA. After authenticated/authorized by IDM, a user selects the MLMS application button and inputs their user credentials- user ID and password. These credentials are created and stored within the IDM system for the length of employment/need to access the MLMS system.

• Name
• E-Mail Address
• Phone Numbers
• Mailing Address
• Employment Status
• Other - National Producer Number, CAC ID, HIOS ID, CMS Portal User ID

• Online

• Within the OPDIV
• Other - The collection is registration information for agents and brokers taking training on the MLMS site.

The registration process starts with IDM where there is the previously mentioned "I agree" acknowledgment, which if not checked will terminate the registration. There isn't an 'option to object,' in MLMS since the process is voluntary and necessary only if an account creation at IDM is desired. The person can elect to "Decline" the Terms and Conditions and then no account will be created.

The MLMS is located behind the CMS firewall, thus all individuals seeking access to an application on the CMS Portal must submit required information attesting and verifying their identity.  User of the MLMS will have Level of Assurance (LOA) 1, LOA 2 and LOA 3 with multifactor authentication (MFA) in place.

IDM completes its own CMS privacy impact assessment.

MLMS is a downstream of the IDM environment registration process.  Notification of any major changes to the system related to PII would be done by IDM, in the form of online notices on portal.CMS.gov.

Individuals will be notified, as they are now, about the changes to the use of their PII based on IDM procedures.  MLMS is located behind the CMS Portal fire-wall.  Consent is assumed when individuals complete access to obtain IDM password and userID to access CMS systems of which the MLMS is one.

IDM completes its own CMS privacy impact assessment.

MLMS will undergo comprehensive and then annually for three years 1/3 test to ensure security, integrity, availability and accuracy and relevancy of al PII contained within the system.

PII is submitted and managed (including any corrections) by the user. Incorrect data is corrected in the course of using the system by updating whichever element is incorrect, for example, a name change, new telephone number, or email address.

MLMS administrators maintain the allowable/registered users by deleting, reactivating, and assigning users to modules.  The availability of the user accounts is managed on the backend by IDM, since that is where the initial creation of the user account occurs.  There are processes in place to review the current users and eliminate any inactive accounts such as user accounts of individuals are removed from the group or automatically disable inactive MLMS accounts within 60 days.

Data integrity and availability is also managed by security technologies, including firewalls and encryption layers.

• Users: Access only to PII information for self and not for others' PII.  Users create PII for self. They can access their own profile (that contains PII) and can change own profile information.
• Administrators: Administrators are provided with a minimum necessary system access for each module for the performance of required tasks. Administrators do not regularly access PII. There are discretionary security controls and audit controls are in place.
• Developers: Developers are provided with a minimum necessary system access. Developers do not regularly access PII but only as necessary to perform tasks. Discretionary security controls and audit controls are in place.

• Contractors: System is maintained and developed under contract by IBM. They will have access to data in the system. Some contractor personnel are administrators in MLMS. They need access to PII to retrieve / change any data to complete support tickets created by users.

  In their roles as either an administrator or developer, a direct contractor may have access to PII to perform those job functions.

All data retention and destruction of all data/remnants is required to be in accordance with the National Institute of Standards and Technology (NIST) Special Publication 800-88.

Those with access to PII have only the minimum amount of information necessary to perform their job in accordance with the least privilege principle. There is a process in place for requesting, establishing, issuing, and closing user accounts and tracking access authorizations. The disabling of inactive accounts and auditing of user accounts allow those with access to PII to only access the minimum amount of information necessary to perform their job.

There are various kinds of Administrators. Only few of the administrator roles will have access to PII data. This is controlled by roles in the product.

MLMS users are granted the minimum access necessary to perform their job function. There are different levels of access depending on the role of the individual accessing MLMS, in accordance with role based privileges. All MLMS users are authenticated via the IDM system credentials. If an individual is removed from a module or automatically disabled, then the account is made inactive in MLMS within 60 days. There is also multi-factor authentication of the user for access.  The direct contractor accounts are reviewed annually in order to determine if a user still requires access to the data.

All CMS employees and direct contractors with access to CMS networks, applications, or data must complete mandatory annual Security and Privacy Awareness Training. Since MLMS is a CMS application, the system personnel must take the CMS Security Awareness training.  Direct contractors also complete their own annual corporate security training.

CMS employees and direct contractors with privileged access are required to complete role-based training and meet continuing education requirements commensurate with their role and participate in an annual contingency planning exercise.

CCIIO relies on the HHS Computer Incident Response Center to monitor and respond to privacy and/or security incidents.

MLMS complies with CMS Records Control Schedule (RCS) "Bucket 8, Public outreach and Engagement," DAA-0440-2015-0011.

All PII data is persisted in MLMS database. When the database is deleted, PII can be destroyed.

PII will be persisted in database. Database resides on a server in the Data Zone.

PII is secured in the system using administrative, technical, and physical controls, in accordance with policies and regulations detailed in the CMS Information Security Acceptable Risk Safeguards- Minimum Security Requirements (ARS).

Administrative controls include role-based permissions to access MLMS modules, request and authentication through the CMS IDM system, and periodic review of users and deletion of non-active accounts.

Technical controls include: access is allowable through one of 3 internet gateways; limitation on the number of concurrent sessions two concurrent sessions, inactivity timeout, multifactor authentication and intrusion detection and prevention software.

Physical controls include video monitoring of the data center where the system resides; controlled heating, air conditioning, smoke and fire suppression systems; and restricted access with fencing and security guards.