State Exchange Resource Virtual System

As part of the Affordable Care Act (ACA), the SERVIS application was created for the CMS Center for Consumer Information and Insurance Oversight (CCIIO) to track and manage the establishment and implementation of State Based Exchanges (SBE) or State Based Exchange on Federal Platform (SBE-FP). SBEs and SBE-FPs are healthcare marketplaces for consumers from the respective states to purchase insurance. States which are not SBE or SBE-FP purchases their medical insurance through Federally-Facilitated Marketplaces (FFM).

The SBEs provide information to CMS about their insurance exchanges through the SERVIS web interface. SERVIS is the central repository for any state with an SBE. The state SBE uploads information about the SBE's implementation details (such as an operational management plan), implementation milestones, and other program information. It also provides the SBEs with access to resources and technical assistance

The SBEs provide information to CMS about their insurance exchanges through the SERVIS web interface. SERVIS is the central repository for any state with an SBE. The state SBE uploads information about the SBE's implementation details (such as an operational management plan), implementation milestones, and other program information. It also provides the SBEs with access to resources and technical assistance.

The SERVIS is a database system for the States with health insurance exchanges. It collects and maintains SBEs' information, including: designated SBE official(s) name; State profile information - HHS region and information on any Federally- recognized Tribes; SBE contact personnel name, email address and telephone; and information about the overall SBE program. The name and contact information of the SBE official is input by the designated SBE user and not collected from the SBE official.

The SBE program information is a detailed description of the how the SBE will operate: the type of healthcare exchange model; the governing board of directors; the exchange by-laws; budget and human resources plans; a description of the consumer-related educational and outreach programs; information on whether the SBE will allow insurance agents or brokers to assist consumers apply for insurance; an explanation of the eligibility and enrollment processes; procedures to evaluate and manage the Qualified Health Plan (QHP) insurers; and the information technology and security and privacy policies and procedures in place.

Additionally, the SERVIS will allow SBEs to upload the implementation progress milestones and supporting documentation; technical assistance requests (name of requestor, email address of requestor, request details, resolution details); meeting information (date, time, location, description, federal point-of-contact); interactions data (date of interaction, type of interaction, details of interaction); links to useful websites (some federal, some non-federal); SBE-related news postings; and their CMS contact person's name, email address and policy area of responsibility.

To access SERVIS, an individual must create an account in Enterprise Portal System (EPS) and request access to the SERVIS application. Once approved by the CMS approver, the user will be able to access the application. EPS provides authentication via the backend IDM system and SERVIS (Drupal) handles user authorization, and role management within the application.

SERVIS is an informational/database-type website designed to provide states with direct access to resources and technical assistance as they implement SBEs. It is the central repository for any state with an SBE and includes information about the SBE's implementation details (such as an operational management plan), implementation milestones, and other program information. Access to SERVIS is limited to only registered and approved CMS employees, contractors and designated state users.

SERVIS is a place for states to update their SBE information, have direct access to federal government resources and technical assistance for the implementation and continual operation of the SBEs. It is also the place for SBE Officials and CCIIO's cross-functional team (CFT) to use as they support, track, and aggregate states’ adherence to ACA regulations. The SBE information is maintained for as long as the SBE is in existence and is updated as necessary by the designated officials.

To access SERVIS, a registered user must input their EPS user credentials, user ID and password (which are PII). User credentials are maintained by IDM and inherits their account policies. IDM has its own PIA to manage any PII that system collects, maintains and stores. Users of the SERVIS system include CMS employees and contractors in a support capacity and the SBE designated user(s).

• Name
• E-Mail Address
• Phone Numbers
• Other - user credentials (user ID and password); request details, resolution details); meeting information (date, time, location, description, federal point-of-contact); interactions data (date of interaction, type of interaction, details of interaction), name of requestor, email address of requestor, request details, resolution details); meeting information (date, time, location, description, federal point-of-contact); interactions data (date of interaction, type of interaction, details of interaction);

• Employees
• Business Partners/Contacts (Federal, state, local agencies)

Patient Protection and Affordable Care Act as amended by the Health Care and Education Reconciliation Act of 2010, collectively the Affordable Care Act (ACA) Title 42 USC 18031, 18041, 18081-18083 and sections 1311, and 1414 

5 USC 301 Departmental Regulation

• In-person
• Online
• Email

• Within the OPDIV
• State/Local/Tribal

If there were any major changes to the system, the CCIIO would notify the SBEs, which would notify their registered users. CMS employees and direct contractors with access would be notified by CCIIO as well via email.

Any additional documentation that an SBE may elect to upload that includes an individual's PII (name and telephone and /or email) would not be notified by the SERVIS, since this information is not directly collected.

• Users: Users have limited access to PII to interface and collaborate with other users.
• Administrators: Administrators have access to PII to manage the access to SERVIS and communicate with any users as necessary.
• Developers: Developers may have incidental access to PII to perform any updates to the system's functionality or necessary fixes to problems. It would be on a rare occasion.
• Contractors: Direct contractors, in their roles as administrators and developers, would have access to PII as described in those roles. 

Any records containing PII will be retained and destroyed in accordance with published records schedules of CMS as provided by National Archives and Records Administration (NARA) General Record Schedule:

(GRS) DAA-GRS-2017-0003-0002 (GRS20 Item 2a4) Intermediary records  

disposition authority- GRS 5.2 item 20; disposition instruction: Temporary. Destroy upon verification of successful creation of the final document or file, or when no longer needed for business use, whichever is later. 

(GRS) DAA-GRS-2017-0003-0002 PKI administrative records, N1-GRS_07-3, Item 13a1 (GRS24, Item 13a1)

disposition authority- GRS 3.2 item 60; disposition instruction: Temporary. Destroy/delete when 7 years 6 months, 10 years 6 months, or 20 years 6 months old, based on the maximum level of operation of the Certification Authority (CA), or when no longer needed for business, whichever is later. 

The PII within SERVIS is secured in the following ways. Administrative controls include using IDM to create user credentials; and implementation of role-based access that restricts the activities of users to specific functions. 

The technical controls include firewalls that prevent unauthorized access to the system, encrypted access to the application, anti-virus and intrusion detection and prevention systems.

SERVIS is hosted within AWS.