CACs Privacy and Security Standards 2 — Questions and Answers
Question 1: A consumer asks their CAC to email a copy of their completed Marketplace application to a family member. What is the correct response?
- Send the email immediately as requested by the consumer
- Decline unless the consumer provides written authorization and the family member is an authorized representative (Correct answer)
- Forward the application only if the family member is listed as a dependent
- Send a password-protected copy to the family member's email
Correct answer: Decline unless the consumer provides written authorization and the family member is an authorized representative
CACs must obtain written authorization before sharing application information with anyone other than the consumer, even family members, unless they are an authorized representative.
Question 2: Which federal law primarily governs the privacy protections that CACs must follow when handling consumers' health information?
- The Privacy Act of 1974
- The Health Insurance Portability and Accountability Act (HIPAA) (Correct answer)
- The Fair Credit Reporting Act (FCRA)
- The Affordable Care Act (ACA) Privacy Rule
Correct answer: The Health Insurance Portability and Accountability Act (HIPAA)
HIPAA establishes the baseline privacy and security standards for protected health information (PHI) that CACs must comply with.
Question 3: A CAC discovers that a co-worker has been accessing consumer application files without a business need. What should the CAC do first?
- Confront the co-worker directly and ask them to stop
- Report the incident to their supervisor or privacy officer immediately (Correct answer)
- Notify the affected consumers before taking any other action
- Document the access and wait to see if it continues
Correct answer: Report the incident to their supervisor or privacy officer immediately
Unauthorized access to consumer data is a potential breach that must be escalated to a supervisor or privacy officer immediately per standard incident response protocols.
Question 4: When a consumer calls a CAC's office and wants to discuss their application over the phone, what should the CAC do first?
- Proceed with the conversation since the consumer initiated the call
- Verify the caller's identity using established authentication questions before discussing any PII (Correct answer)
- Ask the caller to come in person since phone discussions are prohibited
- Request the consumer's Marketplace username and password to confirm identity
Correct answer: Verify the caller's identity using established authentication questions before discussing any PII
CACs must verify caller identity through security questions or other authentication methods before discussing any personally identifiable information over the phone.
Question 5: A CAC prints a consumer's application summary and accidentally leaves it on a shared printer. This is an example of what type of privacy risk?
- A phishing incident
- An inadvertent disclosure of PII (Correct answer)
- A HIPAA security rule violation only
- An authorized use of consumer data
Correct answer: An inadvertent disclosure of PII
Leaving printed PII unattended in a shared space constitutes an inadvertent disclosure, which is a privacy incident that must be reported and remediated.
Question 6: Under Marketplace privacy rules, for how long are CAC organizations generally required to retain records of their consumer assistance activities?
- 1 year
- 3 years
- 5 years (Correct answer)
- 10 years
Correct answer: 5 years
CMS generally requires certified entities like CAC programs to retain records related to their Navigator/CAC activities for a minimum of 5 years.
Question 7: A consumer provides their Social Security Number during an enrollment session. How should a CAC handle this information after the session ends?
- Keep a personal copy for follow-up purposes
- Store it in any convenient location as long as it's at the workplace
- Ensure it is stored only in approved, secured systems and any physical notes are shredded (Correct answer)
- Share it with the Navigator network for coordination purposes
Correct answer: Ensure it is stored only in approved, secured systems and any physical notes are shredded
SSNs are highly sensitive PII and must be stored exclusively in approved secure systems; physical copies must be securely destroyed immediately after use.
CACs Privacy and Security Standards 2
A consumer asks their CAC to email a copy of their completed Marketplace application to a family member.
What is the correct response?