HIPAA Compliance Checklist for State-Based Health Insurance Marketplaces

A state-based health insurance marketplace needs to protect sensitive applicant and enrollee information, but HIPAA is not the only—or necessarily the primary—privacy framework that applies. Your obligations depend on the marketplace’s legal role, the information it handles, its agreements with CMS and other agencies, and whether it acts as a HIPAA covered entity or business associate.

Use this checklist to distinguish HIPAA duties from the marketplace-specific privacy and security requirements that govern personally identifiable information (PII), system documentation, data sharing, and consumer protections.

Which HIPAA requirements apply to state-based health insurance marketplaces?

HIPAA applies to covered entities—health plans, health care clearinghouses, and certain health care providers—and to business associates performing specified services involving protected health information (PHI) on behalf of covered entities. A marketplace is not automatically a HIPAA covered entity simply because it is a government-operated health program or handles health-related application data. Determine the marketplace’s status by examining its legal role and actual data flows, not its name. See HHS guidance on covered entities and business associates and the HIPAA definitions in 45 CFR 160.103.

Health-related information collected for marketplace eligibility or enrollment may be PII subject to Exchange-specific privacy requirements even when it is not HIPAA PHI. Under 45 CFR 155.260, Exchanges must limit certain uses and disclosures of PII, establish privacy and security safeguards, use secure electronic interfaces for electronic sharing, and periodically assess and update security controls.

• Map each entity involved in eligibility, enrollment, plan selection, and data verification.
• Identify the information each entity creates, receives, maintains, or transmits, and the purpose for each use or disclosure.
• Assess whether the marketplace or a particular program function meets the HIPAA definition of a covered entity or business associate.
• Apply HIPAA where its definitions and rules cover the entity and activity; separately apply Exchange, state, federal-agency, and contractual requirements that govern PII.

Do not treat a marketplace’s privacy framework as a substitute for HIPAA when the marketplace is acting as a covered entity or business associate. Conversely, do not label all marketplace information “PHI” solely because it concerns health coverage.

How should marketplaces identify and protect PHI?

Start with a data inventory that follows information from collection through use, disclosure, storage, retention, and disposal. Document the data elements, source, system, authorized users, recipients, purpose, and legal authority. Include eligibility applications, enrollment records, verification responses, call-center records, file transfers, and data held by vendors or other partners.

Classify information according to the laws and agreements that apply. If information is PHI held or handled by a covered entity or business associate, apply the relevant HIPAA Privacy, Security, and Breach Notification Rules. If it is Exchange PII, apply the safeguards and limits in 45 CFR 155.260 and any stricter requirements imposed by tax, Medicaid, state, or CMS rules.

For Exchange PII, the regulation calls for operational, technical, administrative, and physical safeguards to protect confidentiality, integrity, and availability; restrict access to authorized users; guard against reasonably anticipated threats and unauthorized uses; and securely dispose of information under applicable retention schedules. It also requires Exchanges to monitor and periodically assess security controls and related system risks. Review the requirements in 45 CFR 155.260(a).

• Use role-based access and promptly change or remove access when job duties change or employment ends.
• Maintain secure transfer methods, access logs, incident-reporting channels, and approved retention and disposal procedures.
• Train workforce members on marketplace policies and the data they handle; keep records of training and access authorization.
• Reassess safeguards when systems, vendors, data flows, or operating conditions change.

When HIPAA applies, its Security Rule also requires a risk analysis and risk management process for electronic PHI, along with appropriate policies, procedures, and documentation. The specific safeguards should reflect the organization’s circumstances and risks; HIPAA does not make every marketplace document a HIPAA-mandated document. See HHS guidance on HIPAA risk analysis.

Which written privacy policies and agreements are required?

Under 45 CFR 155.260, an Exchange must maintain written policies and procedures for creating, collecting, using, and disclosing PII. These must be available to HHS upon request and identify the laws that govern those activities. The policies should explain permitted uses, access controls, consumer-facing privacy information, retention and disposal, workforce responsibilities, and procedures for information sharing.

The agreement depends on the relationship and the data activity. An agreement with a non-Exchange entity that accesses Exchange PII must describe its functions, bind it to applicable privacy and security requirements, address periodic security assessment and material environmental changes, and require downstream entities to follow the same applicable standards. The requirements appear in 45 CFR 155.260(b).

A HIPAA business associate agreement is different. Use a HIPAA business associate agreement when a covered entity engages a business associate to perform functions or services involving PHI on its behalf, and the relationship is not subject to an exception. It should define permitted uses and disclosures, safeguards, incident and breach reporting, subcontractor obligations, and other required terms. See HHS sample business associate agreement provisions.

Depending on the marketplace’s systems and data-sharing activities, CMS or other partners may require additional documents. These can include a privacy impact assessment, computer matching agreement, information exchange agreement, or interconnection security agreement. A privacy impact assessment documents privacy impacts; it is not itself a data-sharing agreement. Identify the applicable documents from the current CMS review, connection, and agreement requirements rather than assuming every marketplace needs every agreement.

What security policies and assessment documents must exchanges submit?

Separate two questions: what safeguards an Exchange must implement, and what artifacts it must submit for a particular CMS process or system connection. HIPAA does not, by itself, require every state marketplace to submit a system security plan to CMS. CMS Blueprint materials for state-based marketplaces list specific privacy and security artifacts for applicable CMS review and Federal Data Services Hub connectivity.

CMS’s Blueprint Application materials identify items including an ACA Health Insurance Exchange privacy impact assessment, a computer matching agreement, an information exchange agreement, and a system security plan. For the relevant review and connection processes, the materials also list an independent security assessment report, a plan of actions and milestones for identified residual risks, and required interconnection security agreements. The exact submission set depends on the Exchange’s operating arrangement and the current CMS requirements.

Build a document register that states each artifact’s owner, purpose, approval status, submission recipient, review date, and related system or data exchange. Depending on the activity, the register may include:

• Privacy impact assessment: describes how PII is collected, used, shared, and maintained and documents privacy impacts and safeguards.
• System security plan: describes the system boundary, implemented security controls, responsibilities, and relevant operational procedures.
• Independent security assessment report: records assessment results and identified security findings.
• Plan of actions and milestones: tracks remediation work for identified risks or control deficiencies.
• Interconnection security agreement: documents security responsibilities and requirements for connected systems when required.

If the Exchange handles federal tax information, additional IRS safeguards documentation may apply. CMS Blueprint materials list an ACA Safeguards Security Report for IRS review in the relevant context. Do not treat this or other CMS-specific documents as universally required HIPAA forms; confirm the applicable scope, version, and submission path with CMS and the relevant agency.

How can marketplaces manage business associate compliance and data sharing?

Maintain separate records for HIPAA business associate relationships and Exchange data-sharing relationships. A HIPAA business associate agreement is needed when the HIPAA criteria are met; it is not a universal substitute for the marketplace agreement required under 45 CFR 155.260. In some arrangements, an organization may be subject to Exchange requirements, HIPAA requirements, both, or other confidentiality rules.

Before sharing data, record the purpose, legal authority, data elements, recipients, permitted uses, safeguards, retention period, and incident-notification process. Limit the information shared to what is authorized and necessary for the approved activity. Use secure electronic interfaces and verify that access and use restrictions are reflected in technical controls and agreements.

A computer matching agreement is relevant when a proposed automated comparison qualifies as a matching program under the Privacy Act and applicable rules; it is not automatically required for every data transfer. An information exchange agreement can document an authorized exchange of data, while an interconnection security agreement can address a secure system connection. CMS describes these agreement types in its Computer Matching Agreement guidance and Security and Privacy Agreement Guidance.

• Confirm the legal authority and agreement requirements before initiating or changing a data exchange.
• List each party’s security, privacy, access, incident-reporting, and records-disposition responsibilities.
• Require downstream parties to follow applicable privacy and security protections.
• Review the arrangement when the purpose, data elements, systems, recipients, or operating environment changes.

How should marketplaces respond to a PHI breach?

Maintain a response plan that enables staff to report suspected exposure promptly, contain the incident, preserve relevant evidence, identify affected information and individuals, and escalate the matter to privacy, security, legal, and program leadership. Determine whether the incident involves HIPAA PHI, Exchange PII, federal tax information, or more than one protected data category. Apply each relevant law and agreement rather than assuming one reporting route covers them all.

When the HIPAA Breach Notification Rule applies, a covered entity generally must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery of a breach of unsecured PHI. A breach affecting 500 or more individuals must also be reported to HHS without unreasonable delay and no later than 60 days; a breach affecting fewer than 500 individuals must be reported to HHS within 60 days after the end of the calendar year in which it was discovered. Media notice is also required for breaches affecting more than 500 residents of a state or jurisdiction. See the HHS Breach Notification Rule overview.

A business associate that discovers a breach of unsecured PHI must notify the covered entity under the HIPAA rule and its agreement. The agreement may set a faster operational deadline. Separately, the marketplace may have to report an incident to CMS or another partner under a data-sharing, security, or connection agreement. Check the applicable agreement for that deadline and process; do not assume HIPAA’s outside deadline governs CMS reporting.

Document the discovery date, investigation, risk assessment, containment and mitigation, notifications, decisions, and corrective actions. If the marketplace is not a HIPAA covered entity or business associate, HIPAA’s breach-notification duties do not automatically attach to it—but other laws and agreements may still require notification.

How do HIPAA nondiscrimination rules affect marketplace health plans?

HIPAA nondiscrimination requirements concerning health status generally address group health plans and issuers offering group coverage. They restrict eligibility rules and premium or contribution differences based on specified health-status factors. These group-market requirements should not be confused with the privacy and security rules, or treated as a blanket description of every rule that governs marketplace plans. See 45 CFR 146.121.

Marketplace issuers and Exchanges also have obligations under other laws. HHS identifies state-based and federally facilitated Marketplaces, as well as participating issuers in covered circumstances, as subject to ACA Section 1557 nondiscrimination protections. Those protections address discrimination on specified bases in covered health programs and activities, including discriminatory coverage decisions, marketing, or benefit design. See HHS information on Section 1557 and health insurance.

For current compliance decisions, distinguish HIPAA’s group-plan health-factor rules from ACA market reforms and civil-rights requirements. HHS reported on June 1, 2026, that a court had vacated certain provisions of the 2024 Section 1557 rule concerning gender-identity discrimination and that OCR would not enforce those vacated provisions, while continuing to enforce protections not affected by the ruling. Review HHS’s notice on the partial vacatur alongside applicable law and current agency guidance.

In short, first determine the marketplace’s role and classify its data, then apply HIPAA where its definitions require it and meet the separate Exchange privacy, security, documentation, agreement, and nondiscrimination obligations that apply to your program.

FAQs.

Are all state-based marketplaces HIPAA covered entities?

No. A state-based marketplace is not automatically a HIPAA covered entity just because it handles health-related application or enrollment information. HIPAA status depends on whether the organization meets the covered-entity definition or acts as a business associate for a covered entity. Exchange PII protections under 45 CFR 155.260 can apply independently of HIPAA.

What agreements must a state-based exchange submit to support information sharing?

It depends on the data exchange, CMS process, and system connection. Applicable CMS Blueprint materials identify artifacts that can include a computer matching agreement, information exchange agreement, and interconnection security agreement. A HIPAA business associate agreement is required only when the relationship meets HIPAA’s business-associate criteria. Confirm the current agreement package with CMS and the participating agencies.

Which security documents are required for a state-based marketplace?

The applicable package depends on the Exchange’s activities and CMS review or connectivity requirements. CMS Blueprint materials list items such as a privacy impact assessment, system security plan, independent security assessment report, plan of actions and milestones, and interconnection security agreements for relevant processes. These are not all universal HIPAA submission requirements; confirm which documents apply to your marketplace and system.

What breach notifications are required when PHI is exposed?

If the HIPAA Breach Notification Rule applies and unsecured PHI is breached, affected individuals generally must be notified without unreasonable delay and no later than 60 days after discovery. HHS notification is due within 60 days for breaches affecting 500 or more individuals; breaches affecting fewer than 500 are reported within 60 days after the calendar year ends. Media notice is required for breaches affecting more than 500 residents of a state or jurisdiction. A business associate must notify the covered entity, and separate Exchange or CMS agreements may impose additional reporting duties or faster deadlines.