4.08 Privacy and security of personally identifiable information73

When personally-identifiable information is collected or created for the purposes of determining eligibility for enrollment in a QHP, determining eligibility for health-benefits programs, or determining eligibility for exemptions from the individual responsibility provisions in § 5000A of the Code, such information will be used or disclosed only to the extent such information is necessary to administer health care program functions in accordance with federal and state laws. Requirements of AHS. AHS must establish and implement privacy and security standards that are consistent with the following principles. (i) Individual access. Individuals should be provided with a simple and timely means to access and obtain their personally identifiable information in a readable form and format; (ii) Correction. Individuals should be provided with a timely means to dispute the accuracy or integrity of their personally identifiable information and to have erroneous information corrected or to have a dispute documented if their requests are denied; (iii) Openness and transparency. There should be openness and transparency about policies, procedures, and technologies that directly affect individuals and/or their personally identifiable information; (iv) Individual choice. Individuals should be provided a reasonable opportunity and capability to make informed decisions about the collection, use, and disclosure of their personally identifiable information; (v) Collection, use, and disclosure limitations. Personally identifiable information should be created, collected, used, and/or disclosed only to the extent necessary to accomplish a specified purpose(s) and never to discriminate inappropriately; (vi) Data quality and integrity. Persons and entities should take reasonable steps to ensure that personally identifiable information is complete, accurate, and up-to-date to the extent necessary for 73 See generally, Social Security Act §§ 1137 and 1902(a)(7); 26 USC §§ 6103; § 1413(c)(1) and (c)(2) of the ACA; 42 CFR Part 431, Subpart F; 45 CFR § 155.260; 45 CFR § 155.280. General Provisions and Definitions Part 1 – Page 24 (Sec.4.00, Sub.4.09) the person's or entity's intended purposes and has not been altered or destroyed in an unauthorized manner; (vii) Safeguards. Personally identifiable information should be protected with reasonable operational, administrative, technical, and physical safeguards to ensure its confidentiality, integrity, and availability and to prevent unauthorized or inappropriate access, use, or disclosure; and (viii) Accountability. These principles should be implemented, and adherence assured, through appropriate monitoring and other means and methods should be in place to report and mitigate non- adherence and breaches. Safeguards. For the purposes of implementing the principle described in paragraph (a)(1)(vii) of this subsection, AHS must establish and implement operational, technical, administrative and physical safeguards that are consistent with any applicable laws (including this subsection) to ensure: (i) The confidentiality, integrity, and availability of personally identifiable information created, collected, used, and/or disclosed by AHS; (ii) Personally identifiable information is only used by or disclosed to those authorized to receive or view it; (iii) Return information, as such term is defined by § 6103(b)(2) of the Code, is kept confidential under § 6103 of the Code; (iv) Personally identifiable information is protected against any reasonably anticipated threats or hazards to the confidentiality, integrity, and availability of such information; (v) Personally identifiable information is protected against any reasonably anticipated uses or disclosures of such information that are not permitted or required by law; and (vi) Personally identifiable information is securely destroyed or disposed of in an appropriate and reasonable manner and in accordance with retention schedules. Monitoring. AHS must monitor, periodically assess, and update the security controls and related system risks to ensure the continued effectiveness of those controls. Secure interfaces. AHS must develop and utilize secure electronic interfaces when sharing personally identifiable information electronically.