HPSAI Transformation

Product dossier — Lane 01 · Regulated greenfield

MarketLink

CMS EDE broker and agent enrollment platform for the ACA marketplace: broker onboarding, agency hierarchy, agent-scoped books of business, white-label consumer enrollment, CMS EDE transactions, protected-data controls, and the evidence trail needed for a regulated ACA platform.

Production-ready CMS UAT exercised Audit cycle in progress
Build pathway
The program records a six-week regulated build pathway — approximately 650–900 delivered hours against an 8,500–10,500-hour conventional estimate. Planning comparison on the program record.
Traceability
21 / 21 traceability rows mapped.
Evidence state
Capture active: 1 review candidate, 11 pending captures, 1 source pending, and 0 export-ready — of 13 FIT cases.
Security
Penetration test complete.
CMS scope
22 CMS EDE API modules mapped across the seven production-entry domains.

The platform

One governed pathway from entry to evidence.

This view is based on the MarketLink release source. It separates user entry paths from the authenticated broker desktop, then shows the control layer, domain services, persistence boundary, CMS/FFE integrations, carrier EDI outputs, and audit evidence.

MarketLink Broker / Agent Pathway Architecture ACA broker operations, agency hierarchy, white-label consumer entry, CMS EDE transaction services, and evidence controls. Users and entry Agency owner OWNER / ADMIN Licensed agent AGENT / SUPPORT Consumer Portal account White-label URL Agency or broker slug /b/<slug> Auditor Compliance evidence Edge and identity Ingress guard Geo, public routes, assets NextAuth Okta, IAL2, JWT MFA and proofing TOTP, RIDP/RBA gate Registration gate NPN, RCL, approval Route RBAC OWNER / ADMIN gates Product experiences Dashboard KPIs, checklist Agency Members, NPN Clients Book, leads Apps Draft, submit Plans APTC, CSR Consent AOR, TCPA Consumer portal Profile, enroll, notices, life events Compliance and artifacts Domain and API services Route handlers + Zod Validation, errors, audit context Broker context brokerId, agencyRole, userType CMS Marketplace API Plans, counties, SLCSP, cache CMS Hub adapters 22 API modules, mTLS, circuit breakers 834 builder and carrier files Data, evidence, externals PostgreSQL / Prisma Users, brokers, clients, apps Encrypted PHI/PII AES-256-GCM, masked response Audit hash chain prevHash, rowHash, AU-09 Hub evidence folder Req/res metadata, correlation ID CMS, NIPR, carriers EDE, license checks, 834/999 Protected-data access, enrollment mutations, Hub calls, route decisions, consent, DMI/SVI, and EDI outputs feed the evidence layer
MarketLink Broker / Agent Pathway Architecture — user entry paths, edge and identity controls, product experiences, domain and API services, and the data-and-evidence boundary, drawn from the release source.

Security posture

Layered identity, authorization, privacy, API, and evidence gates.

The control pattern is not just login. Requests are filtered before authentication, sessions carry producer and consumer context, routes enforce broker versus portal surfaces, APIs scope data to the authenticated broker, and every sensitive read or write leaves a compliance trail.

01

Ingress controls

Static asset allowlist, public route allowlist, country allowlist, auth rate limits, API rate limits, CSRF checks, CSP, frame protection, and strict referrer policy.

02

Identity assurance

Okta provider path with IAL2 intent, MFA enrollment and verification gates, identity proofing gates, password-change gates, and concurrent session supersession.

03

Role and pathway boundaries

OWNER, ADMIN, AGENT, SUPPORT, platform-admin, broker, and consumer surfaces are separated. Portal users cannot reach broker APIs, and brokers cannot access portal APIs.

04

Minimum necessary data

BrokerId and agencyId scoping, encrypted SSN/email/phone/address where implemented, masked SSN response, protected-data access logging, and protected-field re-proofing logic.

05

Tamper-evident evidence

AuditLog persistence, rowHash/prevHash chain, redacted metadata, protected-data read events, Hub request/response evidence, HMAC-authenticated inbound CMS events.

Assurance

Penetration test complete.

Security evidence is produced continuously, not only during audit preparation, and findings feed remediation and release gates on the program record.

Broker / Agent Security Control Flow The platform evaluates entry, identity, registration, role, pathway, data scope, and evidence capture before a sensitive action completes. Request Broker, agent, consumer, auditor, CMS webhook. Ingress decision Asset bypass, public route, geo allowlist. Abuse controls Auth/API buckets, reset, signin throttles. Session identity Okta, JWT, brokerId, agencyRole, userType. Proofing gates MFA, identity proof, registration status. Pathway split Broker routes versus consumer portal APIs. Route RBAC Audit, EDE testing, approvals, agency admin. Data scope brokerId, agencyId, clientId ownership. Protected-data handling AES-GCM, masked SSN, sensitive access logs. Controlled business action Create client, save application, capture consent, submit EDE transaction, upload document, export evidence. Denied path 401, 403, pending review, proofing required, or route redirect. Evidence path Audit row, hash chain, Hub evidence, notification, task, or report.
Broker / Agent Security Control Flow — entry, identity, registration, role, pathway, data scope, and evidence capture are evaluated before a sensitive action completes; every action resolves to a denied path or an evidence path.

The CMS EDE transaction path

A controlled sequence, not a collection of screens.

MarketLink operates as a workflow system, not as a collection of disconnected screens. The value is the controlled sequence: identify the broker, prove the consumer, scope the data, capture permission, call CMS safely, track evidence, resolve DMI/SVI, and produce downstream enrollment outputs.

CMS EDE Broker / Consumer Transaction Flow A controlled sequence from branded entry or broker desktop to CMS Hub submission, evidence capture, status follow-up, and 834 carrier handoff. 1. Start path Broker desktop or white-label URL. /dashboard /b/<slug> 2. Attribute Resolve brokerId, agency, NPN, role. broker profile 3. Create record Client, household, application draft. clients applications 4. Shop plans County, SLCSP, APTC, CSR, cache. Marketplace API 5. Consent Electronic, written, AOR, permission. ConsentRecord 6. Proof identity Consumer proofing and protected gate. StoreIDProofing 7. Submit through Hub SubmitApp / SubmitEnrollment mTLS, circuit breaker idempotency, evidence files 8. Receive status GetApp, GetEnrollment, GetDMI, GetSVI, notices, events webhook. 9. Resolve issues Documents, policy update, tasks, consumer notices, DMI/SVI follow-up. 10. Downstream 834 enrollment file, 999, commission, exports, audit packet. Evidence spine: audit log, row hash chain, protected-data access events, consent record, CMS correlation ID, Hub wire evidence, DMI/SVI history, 834 transaction record, webhook receipts, downstream file acknowledgments, and support task history. status changes, DMI/SVI exceptions, or consent defects route back into the controlled workflow
CMS EDE Broker / Consumer Transaction Flow — the controlled sequence from branded entry or broker desktop through Hub submission, status follow-up, and 834 carrier handoff, with the evidence spine underneath every step.

22 CMS EDE API modules mapped across the seven production-entry domains. The live domain-by-domain reference is the CMS EDE Production Requirements page.

Requirements to evidence

Business requirements tie directly to platform functions and controls.

The traceability model connects ACA broker operations to the platform capabilities, controls, and evidence required to operate a governed enrollment pathway at scale.

Requirement areas mapped to platform functions and controls
Requirement area Platform function Security / evidence control
Broker and agency onboarding Broker profile, agency profile, join code, member roster, lead-agent accountability, agency role assignment, NPN fields. Registration status gate, NPN/RCL fields, OWNER/ADMIN role control, audit log for role and profile changes.
Agent downline and book ownership OWNER/ADMIN can manage agency-wide activity; AGENT is scoped to assigned clients and applications unless delegated. brokerId and agencyId filters, route RBAC, no shared identities, API helper auth, PII access logging.
White-label consumer enrollment Agency or broker slug resolves branded consumer entry and broker attribution before portal account creation. Reserved slug validation, broker attribution metadata, consumer userType isolation, identity proofing before protected portal actions.
Client and household management Client profile, household members, dependents, documents, follow-ups, SVI/DMI queue, book import. AES-256-GCM PII encryption, SSN masking, protected-field re-proofing, PHI access logging, soft delete.
Application and plan shopping Application draft, household income, county, APTC/CSR, plan comparison, selected plan, effective date. Protected-data access logging, Zod validation, PlanCache, CMS Marketplace retry/cache controls, broker ownership checks.
Consent, AOR, and permission Electronic, verbal, written, three-way call, AOR transfer, consent scope, revocation, expiration. ConsentRecord with IP, user agent, timestamp, consumer/agent context, E-SIGN-compatible signature field, audit retention.
CMS EDE Hub transactions StoreIDProofing, StorePermission, SubmitApp, SubmitEnrollment, GetApp, GetEnrollment, GetDMI, GetSVI, NoticeRetrieval, UpdatePolicy. mTLS-capable keep-alive transport, circuit breakers, idempotency rows for non-idempotent submissions, correlation IDs, evidence capture.
Carrier and downstream operations EDI 834 generation, 999/997 acknowledgment tracking, carrier appointment context, commissions, exports, payments. Transaction IDs, validation errors, acknowledgment status, retry counts, export controls, commission records.
Audit and compliance evidence Compliance artifacts, audit report, audit integrity verification, CMS package, security remediation evidence. AuditLog hash chain, redacted audit metadata, Hub evidence folder, HMAC webhook receipts, generated audit-cycle artifacts.
  • Traceability Traceability matrix 21 / 21 traceability rows mapped.
  • CMS reference CMS EDE Production Requirements The live reference for the production-entry domains and API modules.
  • Evidence package Evidence readiness record Current position: 1 review candidate, 11 pending captures, 1 source pending, and 0 export-ready — of 13 FIT cases. Raw artifacts remain in the controlled evidence repository.

Status boundary

Status boundary

No external certification claim until the audit cycle completes.

Back to the portfolio Traceability matrix CMS EDE Production Requirements