Registration for Technical Assistance Portal

REGTAP collects and stores user registration information which includes the following: email address, name, password, organization name, state, organization type, role in organization, position title, telephone number and training event registration and attendance history.

In accordance with ARS requirements, individual user accounts expire after 60 days without accessing the system. Passwords are maintained by the user once an account is created and changed upon first use by the user in accordance with ARS requirements. No other person, including system administrators, have access to user passwords once they are changed and managed by the user. Name and telephone are stored and used to contact users for system support service desk tickets. Names are required to properly account for training and outreach inquires, attendance records and reporting.  Stakeholder registration and attendance data are shared with CMS only. This information is collected in the REGTAP database and stored permanently based on the CCIIO Government Task Lead business requirements and the February 26, 2015 direction which states. “This is a reminder that the agency is under a records freeze related to the following issues: Tobacco, Hurricane Katrina, Deepwater Horizon Multidistrict Litigation, Development and Implementation of Federally Facilitated Marketplace (FFM), and Documents Relating to Effectuated Enrollment in the Marketplaces (both Federal and State).  This means that you must retain and preserve all current and future "records" relating to these issues. The agency may be asked to provide these records for review, so under no circumstances should records to be destroyed until you are officially notified the freeze has been lifted.  Any routine data destruction policies (i.e., the CMS Records Schedule) that could affect responsive documents are discontinued until further notice.   Additionally, actions to preserve these records must ensure the information in the preserved record is accessible.

It is important that all employees adhere to this guidance, as well as litigation hold procedures.  Litigation holds are issued by OSORA, upon direction by the Office of the General Counsel (OGC), as a result of current or reasonably anticipated litigation.  A litigation hold suspends the normal disposition, retention, and processing of records for the course of the litigation. 

Further, Contracting Officers Representatives (CORs) are reminded that CMS contractors must also adhere to CMS records policies and are asked to instruct contractors about this guidance accordingly through their contracting officer

"Records" include all documents, reports, writings, letters, memoranda, notices, communications (including e-mails, faxes, telephone records, and all communications with other Federal departments and agencies, State and local governments, and private sector entities), contracts, agreements, schedules, spreadsheets, travel records, data, electronically stored information, audio and video recordings, computer disks and hard drives, drawings, graphs, charts, photographs, and all other records of any kind.  "Records" include, but are not limited to, all records required to be preserved pursuant to the Federal Records Act. (Found at http://www.archives.gov/about/laws/fed-agencies.html).

Every departing employee must return all official records (paper and electronic) along with any and all removable computer data storage devices (e.g., thumb drives, flash drives, DVDs or CDs) to their immediate supervisor or a designated staff person in accordance with their office’s departure policy.  Electronic files can be saved to the office’s shared drive; however, the immediate supervisor or replacement must know where those files are stored.  Managers of departing employees should ensure that they secure all records before signing the CMS form 129, clearance form.  

Please direct any questions about the records freeze or reporting requirements to Carlos Simon, Director, Issuances, Records and Information Systems Group, 410-786-4201.”

REGTAP supports the CMS commitment to providing technical assistance, education and communication related to ACA Marketplace, Consolidation Appropriations Act (CAA), and the No Surprises Act. REGTAP provides a secure, public, website for only registered users from organizations such as health plan issuers, insurance agents and brokers, third party administrators, regulators, and other healthcare-related organizations. We were notified on February 26, 2015 that a CMS Records Freeze in relation to Marketplace Enrollment data supersedes NARA requirements.  No PII is available publicly. Types of Personally Identifiable Information REGTAP Collects includes Email address, Full Name, Organization Name, State, Organization Type, Title, Role in Organization, Work Phone, Mobile Phone. REGTAP reports are available only to CMS and REGTAP staff who need this information to perform their duties. REGTAP may also use surveys to collect opinions and feedback. Users do not have to answer these questions. The REGTAP staff analyzes and uses this information to improve the site's operation and content. Reports are available only to CMS and REGTAP staff who require this information to perform their duties. 

The website includes the following services: training event registration, a library of CMS-published resource materials, a frequently asked questions (FAQ) database and an inquiry submission module to submit questions to CMS.

The information collected and maintained in REGTAP includes user account information and the CMS library of resources. The user account information, including the system support staff user credentials, is retained for as long as the user retains their account or as long as the user needs access to the system. The library material is considered ‘public’ as it is informational about healthcare marketplace and Premium Stabilization program topics. Both categories of information are retained indefinitely on an ‘as necessary’ or ‘as applicable’ basis and is updated periodically.

The PII collected by the REGTAP system is only used for the purpose of account creation and access to the platform. This information is not shared or used for any other activities. 

• Name
• E-Mail Address
• Phone Numbers
• Other - Organizational role and title; Organization Name; State; Training event registration history; Password; User name Other information includes Email address, Full Name, Organization Name, State, Organization Type, Title, Role in Organization, Work Phone, Mobile Phone.

• Employees
• Business Partners/Contacts (Federal, state, local agencies)
• Vendors/Suppliers/Contractors
• Other - ACA Marketplace Stakeholders which consist of health plan issuers, insurance agents and brokers, third party administrators, regulators, and other healthcare-related organizations.

Email address, Phone number, organizational role and title, organization name, state, training event, and registration history are used to provide educational events and communication for organizations involved in federal and state healthcare insurance marketplaces, exchanges.

User name and password are used to access REGTAP.

Affordable Care Act 42 USC Sections 18031, 18041, 18081-18083 and Section 1414.

5 USC Section 301 Department Regulations

Consolidated Appropriations Act, 2021 (CAA) including the No Surprises Act.

• In-Person
• Online
• Email

• Within the OPDIV
• State/Local/Tribal

• Members of the Public
• Private Sector

If an individual believes their PII has been inappropriately obtained, used, or disclosed, or that the PII is inaccurate, they may report this to REGTAP Registrar by telephone at 1-800-257-9520 or E-mail registrar@regtap.info.

Then the REGTAP Registrar will contact the office of the Chief Information Security Officer (CISO) and/or the Information System Security Officer (ISSO) within one (1) business hour of issue identification for investigation, and resolution.

• Administrators: Administrators have access to PII to manage user accounts.
• Developers: Developers may have incidental access to PII for system development and maintenance.
• Contractors: Direct contractors may have the role of administrators, developers and the Registrar. They would have access to PII in accordance with the descriptions of those roles.
• Others - Registrar: The Registrar has access to PII to manage user inquiries and respond to them.

The administrative controls in place to secure the PII include role-based access and permissions, periodic review of users and deletion of non-active accounts.  

The technical controls in place are firewalls that prevent unauthorized access, encrypted access when users log into REGTAP, security scans, penetration testing and intrusion detection and prevention technologies. There is also active penetration testing and a tiered system architecture which means users can only log into the application but not into any test environment and the testing and active applications are not joined together.

The physical controls in place are as follows: the use of security cards and pass codes, security guards and a separately located backup system.

• Web Beacons
• Session Cookies