Common use of Implementation Specifications Clause in Contracts

Implementation Specifications. 1. Access rights must apply to any PII that is created, collected, disclosed, accessed, maintained, stored, and used by the Non- Exchange Entity to perform any of the Authorized Functions outlined in their respective agreements with CMS. 2. The release of electronic documents containing PII through any electronic means of communication (e.g., e-mail, web portal) must meet the verification requirements for the release of “written documents” in Section (5)b below. 3. Persons legally authorized to act on behalf of Consumers, Applicants, Enrollees, Qualified Employees, and Qualified Employers regarding their PII, including individuals acting under an appropriate power of attorney that complies with applicable state and federal law, must be granted access in accordance with their legal authority. Such access would generally be expected to be coextensive with the degree of access available to the Subject Individual. 4. At the time the request is made, the Consumer, Applicant, Enrollee, Qualified Employees, and Qualified Employers—or these individuals’ legal representatives or Authorized Representatives—should generally be required to specify which PII he or she would like access to. The Non-Exchange Entity may assist them in determining their Information or data needs if such assistance is requested. 5. Subject to paragraphs (1)a.i.6 and 7 below, Non-Exchange Entities generally must provide access to the PII in the form or format requested, if it is readily producible in such form or format. 6. The Non-Exchange Entity may charge a fee only to recoup the costs for labor for copying the PII, supplies for creating a paper copy or a copy on electronic media, postage if the PII is mailed, or any costs for preparing an explanation or summary of the PII if the recipient has requested and/or agreed to receive such summary. If such fees are paid, the Non-Exchange Entity must provide the requested copies in accordance with any other applicable standards and implementation specifications. 7. A Non-Exchange Entity that receives a request for notification of, or access to, PII must verify the requestor’s identity in accordance with Section (5)b below. 8. A Non-Exchange Entity must complete its review of a request for access or notification (and grant or deny said notification and/or access) within 30 Days of receipt of the notification and/or access request. 9. Except as otherwise provided in (1)a.i.10, if the requested PII cannot be produced, the Non-Exchange Entity must provide an explanation for its denial of the notification or access request, and, if applicable, information regarding the availability of any appeal procedures, including the appropriate appeal authority’s name, title, and contact information. 10. Non-Exchange Entities may deny access to PII that they maintain or store, without providing an opportunity for review, in the following circumstances: A. If the PII was obtained or created solely for use in legal proceedings; B. If the PII is contained in records that are subject to a law that either permits withholding the PII or bars the release of such PII.

Implementation Specifications. 1. Access rights must apply to any PII that is created, collected, disclosed, accessed, maintained, stored, and used by the Non- Non-Exchange Entity to perform any of the Authorized Functions outlined in their respective agreements with CMSthe NMHIX. 2. The release of electronic documents containing PII through any electronic means of communication (e.g., e-mail, web portal) must meet the verification requirements for the release of “written documents” in Section (5)b below. 3. Persons legally authorized to act on behalf of the Consumers, Applicants, Qualified Individuals, Enrollees, Qualified Employees, and Qualified Employers regarding their PII, including individuals acting under an appropriate power of attorney that complies with applicable state and federal law, must be granted access in accordance with their legal authority. Such access would generally be expected to be coextensive with the degree of access available to the Subject Individual. 4. At the time the request is made, the Consumer, Applicant, Qualified Individual, Enrollee, Qualified Employees, and Qualified Employers—, or these individuals’ legal representatives or Authorized Representatives—Representatives should generally be required to specify which PII he or she would like access to. The Non-Exchange Entity may assist them in determining their Information or data needs if such assistance is requested. 5. Subject to paragraphs (1)a.i.6 1) a.i.6 and 7 below, Non-Exchange Entities generally must provide access to the PII in the form or format requested, if it is readily producible in such form or format. 6. The Non-Exchange Entity may charge a fee only to recoup the their costs for labor for copying the PII, supplies for creating a paper copy or a copy on electronic media, postage if the PII is mailed, or any costs for preparing an explanation or summary of the PII if the recipient contractors has requested and/or agreed to receive such summary. If such fees are paid, the Non-Non- Exchange Entity must provide the requested copies in accordance with any other applicable standards and implementation specifications. 7. A Non-Exchange Entity that receives a request for notification of, or access to, to PII must verify the requestor’s identity in accordance with Section (5)b below5)b. 8. A Non-Exchange Entity must complete its review of a request for access or notification (and grant or deny said notification and/or access) within 30 Days days of receipt of the notification and/or access request. 9. Except as otherwise provided in (1)a.i.10, if the requested PII cannot be produced, the Non-Exchange Entity must provide an explanation for its denial of the notification or access request, and, if applicable, information regarding the availability of any appeal procedures, including the appropriate appeal authority’s name, title, and contact information. 10. Unreviewable grounds for denial. Non-Exchange Entities may deny access to PII that they maintain or store, store without providing an opportunity for review, in the following circumstances: A. a. If the PII was obtained or created solely for use in legal proceedings; B. If the PII is contained in records that are subject to a law that either permits withholding the PII or bars the release of such PII.

Implementation Specifications. 1. Access rights must apply to any PII that is created, collected, disclosed, accessed, maintained, stored, and used by the Non- Exchange Entity to perform any of the Authorized Functions outlined in their respective agreements with CMS. 2. The release of electronic documents containing PII through any electronic means of communication (e.g., e-mail, web portal) must meet the verification requirements for the release of “written documents” in Section (5)b below. 3. Persons legally authorized to act on behalf of Consumers, Applicants, Enrollees, Qualified EmployeesIndividuals, and Qualified Employers Enrollees regarding their PII, including individuals acting under an appropriate power of attorney that complies with applicable state and federal law, must be granted access in accordance with their legal authority. Such access would generally be expected to be coextensive with the degree of access available to the Subject Individual. 4. At the time the request is made, the Consumer, Applicant, Enrollee, Qualified EmployeesIndividual, and Qualified EmployersEnrollee—or these individuals’ legal representatives or Authorized Representatives—should generally be required to specify which PII he or she would like access to. The Non-Exchange Entity may assist them in determining their Information or data needs if such assistance is requested. 5. Subject to paragraphs (1)a.i.6 and 7 below, Non-Exchange Entities generally must provide access to the PII in the form or format requested, if it is readily producible in such form or format. 6. The Non-Exchange Entity may charge a fee only to recoup the costs for labor for copying the PII, supplies for creating a paper copy or a copy on electronic media, postage if the PII is mailed, or any costs for preparing an explanation or summary of the PII if the recipient has requested and/or agreed to receive such summary. If such fees are paid, the Non-Exchange Entity must provide the requested copies in accordance with any other applicable standards and implementation specifications. 7. A Non-Exchange Entity that receives a request for notification of, or access to, PII must verify the requestor’s identity in accordance with Section (5)b below. 8. A Non-Exchange Entity must complete its review of a request for access or notification (and grant or deny said notification and/or access) within 30 Days of receipt of the notification and/or access request. 9. Except as otherwise provided in (1)a.i.10, if the requested PII cannot be produced, the Non-Exchange Entity must provide an explanation for its denial of the notification or access request, and, if applicable, information regarding the availability of any appeal procedures, including the appropriate appeal authority’s name, title, and contact information. 10. Non-Exchange Entities may deny access to PII that they maintain or store, store without providing an opportunity for review, in the following circumstances: A. If the PII was obtained or created solely for use in legal proceedings;; and B. If the PII is contained in records that are subject to a law that either permits withholding the PII or bars the release of such PII.

Implementation Specifications. 1. Access rights must apply to any PII that is created, collected, disclosed, accessed, maintained, stored, and used by the Non- Exchange Entity to perform any of the Authorized Functions outlined in their respective agreements with CMS. 2. The release of electronic documents containing PII through any electronic means of communication (e.g., e-mail, web portal) must meet the verification requirements for the release of “written documents” in Section (5)b 5)b. below. 3. Persons legally authorized to act on behalf of the Consumers, Applicants, Qualified Individuals, Enrollees, Qualified Employees, and Qualified Employers regarding their PII, including individuals acting under an appropriate power of attorney that complies with applicable state and federal law, must be granted access in accordance with their legal authority. Such access would generally be expected to be coextensive with the degree of access available to the Subject Individual. 4. At the time the request is made, the Consumer, Applicant, Qualified Individual, Enrollee, Qualified Employees, and Qualified Employers—or these individuals’ legal representatives or Authorized Representatives—Representatives should generally be required to specify which PII he or she would like access to. The Non-Exchange Entity may assist them in determining their Information or data needs if such assistance is requested. 5. Subject to paragraphs (1)a.i.6 1)a.i.6. and 7 7. below, Non-Exchange Entities generally must provide access to the PII in the form or format requested, if it is readily producible in such form or format. 6. The Non-Exchange Entity may charge a fee only to recoup the their costs for labor for copying the PII, supplies for creating a paper copy or a copy on electronic media, postage if the PII is mailed, or any costs for preparing an explanation or summary of the PII if the recipient recipients has requested and/or agreed to receive such summary. If such fees are paid, the Non-Exchange Entity must provide the requested copies in accordance with any other applicable standards and implementation specifications. 7. A Non-Exchange Entity that receives a request for notification of, or access to, to PII must verify the requestor’s identity in accordance with Section (5)b 5)b. below. 8. A Non-Exchange Entity must complete its review of a request for access or notification (and grant or deny said notification and/or access) within 30 Days of receipt of the notification and/or access request. 9. Except as otherwise provided in (1)a.i.10, if the requested PII cannot be produced, the Non-Exchange Entity must provide an explanation for its denial of the notification or access request, and, if applicable, information regarding the availability of any appeal procedures, including the appropriate appeal authority’s name, title, and contact information. 10. Non-Exchange Entities may deny access to PII that they maintain or store, without providing an opportunity for review, in the following circumstances: A. If the PII was obtained or created solely for use in legal proceedings; B. If the PII is contained in records that are subject to a law that either permits withholding the PII or bars the release of such PII.

Implementation Specifications. 1. Access rights must apply to any PII that is created, collected, disclosed, accessed, maintained, stored, and used by the Non- Non-Exchange Entity to perform any of the Authorized Functions outlined in their respective agreements with CMSthe FFE. 2. The release of electronic documents containing PII through any electronic means of communication (e.g., e-mail, web portal) must meet the verification requirements for the release of “written documents” in Section (5)b below. 3. Persons legally authorized to act on behalf of the Consumers, Applicants, Qualified Individuals, Enrollees, Qualified Employees, and Qualified Employers regarding their PII, including individuals acting under an appropriate power of attorney that complies with applicable state and federal law, must be granted access in accordance with their legal authority. Such access would generally be expected to be coextensive with the degree of access available to the Subject Individual. 4. At the time the request is made, the Consumer, Applicant, Qualified Individual, Enrollee, Qualified Employees, and Qualified Employers—or these individuals’ legal representatives or Authorized Representatives—Representatives should generally be required to specify which PII he or she would like access to. The Non-Exchange Entity may assist them in determining their Information or data needs if such assistance is requested. 5. Subject to paragraphs (1)a.i.6 and 7 below, Non-Exchange Entities generally must provide access to the PII in the form or format requested, if it is readily producible in such form or format. 6. The Non-Exchange Entity may charge a fee only to recoup the their costs for labor for copying the PII, supplies for creating a paper copy or a copy on electronic media, postage if the PII is mailed, or any costs for preparing an explanation or summary of the PII if the recipient recipients has requested and/or agreed to receive such summary. If such fees are paid, the Non-Exchange Entity must provide the requested copies in accordance with any other applicable standards and implementation specifications. 7. A Non-Exchange Entity that receives a request for notification of, or access to, to PII must verify the requestor’s identity in accordance with Section (5)b below. 8. A Non-Exchange Entity must complete its review of a request for access or notification (and grant or deny said notification and/or access) within 30 Days days of receipt of the notification and/or access request. 9. Except as otherwise provided in (1)a.i.10, if the requested PII cannot be produced, the Non-Exchange Entity must provide an explanation for its denial of the notification or access request, and, if applicable, information regarding the availability of any appeal procedures, including the appropriate appeal authority’s name, title, and contact information. 10. Unreviewable grounds for denial. Non-Exchange Entities may deny access to PII that they maintain or store, store without providing an opportunity for review, in the following circumstances: A. a. If the PII was obtained or created solely for use in legal proceedings; B. If the PII is contained in records that are subject to a law that either permits withholding the PII or bars the release of such PII.

Implementation Specifications. 1. Access rights must apply to any PII that is created, collected, disclosed, accessed, maintained, stored, and used by the Non- Exchange Entity to perform any of the Authorized Functions outlined in their respective agreements with CMS. 2. The release of electronic documents containing PII through any electronic means of communication (e.g., e-mail, web portal) must meet the verification requirements for the release of “written documents” in Section (5)b below. 3. Persons legally authorized to act on behalf of Consumers, Applicants, Enrollees, Qualified EmployeesIndividuals, and Qualified Employers Enrollees regarding their PII, including individuals acting under an appropriate power of attorney that complies with applicable state and federal law, must be granted access in accordance with their legal authority. Such access would generally be expected to be coextensive with the degree of access available to the Subject Individual. 4. At the time the request is made, the Consumer, Applicant, Enrollee, Qualified EmployeesIndividual, and Qualified EmployersEnrollee—or these individuals’ legal representatives or Authorized Representatives—should generally be required to specify which PII he or she would like access to. The Non-Non- Exchange Entity may assist them in determining their Information or data needs if such assistance is requested. 5. Subject to paragraphs (1)a.i.6 and 7 below, Non-Exchange Entities generally must provide access to the PII in the form or format requested, if it is readily producible in such form or format. 6. The Non-Exchange Entity may charge a fee only to recoup the costs for labor for copying the PII, supplies for creating a paper copy or a copy on electronic media, postage if the PII is mailed, or any costs for preparing an explanation or summary of the PII if the recipient has requested and/or agreed to receive such summary. If such fees are paid, the Non-Exchange Entity must provide the requested copies in accordance with any other applicable standards and implementation specifications. 7. A Non-Exchange Entity that receives a request for notification of, or access to, PII must verify the requestor’s identity in accordance with Section (5)b below. 8. A Non-Exchange Entity must complete its review of a request for access or notification (and grant or deny said notification and/or access) within 30 Days of receipt of the notification and/or access request. 9. Except as otherwise provided in (1)a.i.10, if the requested PII cannot be produced, the Non-Exchange Entity must provide an explanation for its denial of the notification or access request, and, if applicable, information regarding the availability of any appeal procedures, including the appropriate appeal authority’s name, title, and contact information. 10. Non-Exchange Entities may deny access to PII that they maintain or store, store without providing an opportunity for review, in the following circumstances: A. If the PII was obtained or created solely for use in legal proceedings; B. If the PII is contained in records that are subject to a law that either permits withholding the PII or bars the release of such PII.

Implementation Specifications. 1. Access rights must apply to any PII that is created, collected, disclosed, accessed, maintained, stored, and used by the Non- Exchange Entity to perform any of the Authorized Functions outlined in their respective agreements with CMSthe FFE. 2. The release of electronic documents containing PII through any electronic means of communication (e.g., e-mail, web portal) must meet the verification requirements for the release of “written documents” in Section (5)b below. 3. Persons legally authorized to act on behalf of the Consumers, Applicants, Qualified Individuals, Enrollees, Qualified Employees, and Qualified Employers regarding their PII, including individuals acting under an appropriate power of attorney that complies with applicable state and federal law, must be granted access in accordance with their legal authority. Such access would generally be expected to be coextensive with the degree of access available to the Subject Individual. 4. At the time the request is made, the Consumer, Applicant, Qualified Individual, Enrollee, Qualified Employees, and Qualified Employers—or Employers and/or these individuals’ legal representatives representative(s) or Authorized Representatives—Representative(s) should generally be required to specify which PII he or she would like access to. The Non-Non- Exchange Entity may assist them in determining their Information or data needs if such assistance is requested. 5. Subject to paragraphs (1)a.i.6 and 7 below, Non-Exchange Entities generally must provide access to the PII in the form or format requested, if it is readily producible in such form or format. 6. The Unless the Non-Exchange Entity is a Certified Application Counselor Designated Organization or Certified Application Counselor, it may charge a fee only to recoup the its costs for labor for copying the PII, supplies for creating a paper copy or a copy on electronic media, postage if the PII is mailed, or any costs for preparing an explanation or summary of the PII if the recipient recipients has requested and/or agreed to receive such summary. If such fees are paid, the Non-Exchange Entity must provide the requested copies in accordance with any other applicable standards and implementation specifications.. Under no circumstances may Certified Application Counselor Designated Organizations or Certified Application Counselors charge any consumers any fees for application or other assistance related to the Exchange 7. A Non-Exchange Entity that receives a request for notification of, or access to, to PII must verify the requestor’s identity in accordance with Section (5)b below. 8. A Non-Exchange Entity must complete its review of a request for access or notification (and grant or deny said notification and/or access) within 30 Days of receipt of the notification and/or access request. 9. Except as otherwise provided in (1)a.i.10, if the requested PII cannot be produced, the Non-Exchange Entity must provide an explanation for its denial of the notification or access request, and, if applicable, information regarding the availability of any appeal procedures, including the appropriate appeal authority’s name, title, and contact information. 10. Unreviewable grounds for denial. Non-Exchange Entities may deny access to PII that they maintain or store, store without providing an opportunity for review, in the following circumstances: A. a. If the PII was obtained or created solely for use in legal proceedings; B. If the PII is contained in records that are subject to a law that either permits withholding the PII or bars the release of such PII.

Implementation Specifications. 1. Access rights must apply to any PII that is created, collected, disclosed, accessed, maintained, stored, and used by the Non- Non-Exchange Entity to perform any of the Authorized Functions outlined in their respective agreements with CMSthe NMHIX. 2. The release of electronic documents containing PII through any electronic means of communication (e.g., e-mail, web portal) must meet the verification requirements for the release of “written documents” in Section (5)b below. 3. Persons legally authorized to act on behalf of the Consumers, Applicants, Qualified Individuals, Enrollees, Qualified Employees, and Qualified Employers regarding their PII, including individuals acting under an appropriate power of attorney that complies with applicable state and federal law, must be granted access in accordance with their legal authority. Such access would generally be expected to be coextensive with the degree of access available to the Subject Individual. 4. At the time the request is made, the Consumer, Applicant, Qualified Individual, Enrollee, Qualified Employees, and Qualified Employers—, or these individuals’ legal representatives or Authorized Representatives—Representatives should generally be required to specify which PII he or she would like access to. The Non-Exchange Entity may assist them in determining their Information or data needs if such assistance is requested. 5. Subject to paragraphs (1)a.i.6 1) a.i.6 and 7 below, Non-Exchange Entities generally must provide access to the PII in the form or format requested, if it is readily producible in such form or format. 6. The Non-Exchange Entity may charge a fee only to recoup the their costs for labor for copying the PII, supplies for creating a paper copy or a copy on electronic media, postage if the PII is mailed, or any costs for preparing an explanation or summary of the PII if the recipient contractors has requested and/or agreed to receive such summary. If such fees are paid, the Non-Exchange Entity must provide the requested copies in accordance with any other applicable standards and implementation specifications. 7. A Non-Exchange Entity that receives a request for notification of, or access to, to PII must verify the requestor’s identity in accordance with Section (5)b below5)b. 8. A Non-Exchange Entity must complete its review of a request for access or notification (and grant or deny said notification and/or access) within 30 Days days of receipt of the notification and/or access request. 9. Except as otherwise provided in (1)a.i.10, if the requested PII cannot be produced, the Non-Exchange Entity must provide an explanation for its denial of the notification or access request, and, if applicable, information regarding the availability of any appeal procedures, including the appropriate appeal authority’s name, title, and contact information. 10. Unreviewable grounds for denial. Non-Exchange Entities may deny access to PII that they maintain or store, store without providing an opportunity for review, in the following circumstances: A. a. If the PII was obtained or created solely for use in legal proceedings; B. If the PII is contained in records that are subject to a law that either permits withholding the PII or bars the release of such PII.

Implementation Specifications. 1. Access rights must apply to any PII that is created, collected, disclosed, accessed, maintained, stored, and used by the Non- Non-Exchange Entity to perform any of the Authorized Functions outlined in their its respective agreements agreement(s) with CMSCMS (including the QHP Issuer Agreement or the Web-broker Agreement). 2. The release of electronic documents containing PII through any electronic means of communication (e.g., e-mail, web portal) must meet the verification requirements for the release of “written documents” in Section (5)b below. 3. Persons legally authorized to act on behalf of Consumers, Applicants, Enrollees, Qualified EmployeesIndividuals, and Qualified Employers Enrollees regarding their PII, including individuals acting under an appropriate power of attorney that complies with applicable state and federal law, must be granted access in accordance with their legal authority. Such access would generally be expected to be coextensive with the degree of access available to the Subject Individual. 4. At the time the request is made, the Consumer, Applicant, Qualified Individual, Enrollee, Qualified Employees, and Qualified Employers—or these individuals’ legal representatives or Authorized Representatives—should generally be required to specify which PII he or she would like access to. The Non-Exchange Entity may assist them the Subject Individual in determining their Information his or her information or data needs needs, if such assistance is requested. 5. Subject to paragraphs (1)a.i.6 and 7 below, a Non-Exchange Entities Entity generally must provide access to the PII in the form or format requested, if it is readily producible in such form or format. 6. The Non-Exchange Entity may charge a fee only to recoup the its costs for labor for copying the PII, supplies for creating a paper copy or a copy on electronic media, postage if the PII is mailed, or any costs for preparing an explanation or summary of the PII if the recipient has requested and/or agreed to receive such summary. If such fees are paid, the Non-Exchange Entity must provide the requested copies in accordance with any other applicable standards and implementation specifications. 7. A Non-Exchange Entity that receives a request for notification of, of or access to, to PII must verify the requestor’s identity in accordance with Section (5)b below. 8. A Non-Exchange Entity must complete its review of a request for access or notification (and grant or deny said notification and/or access) within 30 thirty (30) Days of receipt of the notification and/or access request. 9. Except as otherwise provided in (1)a.i.10, if the requested PII cannot be produced, the Non-Exchange Entity must provide an explanation for its denial of the notification or access request, request and, if applicable, information regarding the availability of any appeal procedures, including the appropriate appeal authority’s name, title, and contact information. 10. A Non-Exchange Entities Entity may deny access to PII that they maintain or store, store without providing an opportunity for review, in the following circumstances: A. a. If the PII was obtained or created solely for use in legal proceedings; B. If the PII is contained in records that are subject to a law that either permits withholding the PII or bars the release of such PII.proceedings or