# CMS Enhanced Direct Enrollment (EDE) Compliance Requirements

## Comprehensive Technical and Business Requirements for Health Insurance Broker Portals

**Version:** 1.0
**Date:** 2026-03-19
**Purpose:** Production compliance checklist for CMS EDE certification

---

## Working Baseline for This Branch

These rules override older notes elsewhere in the repo when there is any conflict.

- Build only against the CMS Year 9 EDE guidance published April 10, 2026 and the corresponding CMS zONE baseline toolkit package for the active audit window.
- Do not build against Classic DE or any decommissioned DE consumer or agent/broker pathway materials.
- Do not use Phase 1 as an implementation or audit target. CMS no longer accepts Phase 1 audit submissions.
- MarketLink's active implementation target is Phase 3. Keep Phase 2 toolkit material only where the Year 9 User Guide requires a Phase 3 entity to complete Phase 2 scenarios.
- If any older repo document conflicts with the Year 9 guidance or current CMS zONE baseline toolkits, treat the older repo document as historical and non-authoritative.

## Auditor-Ready Execution Rules

- Build, validate, and package this branch against the current CMS Year 9 EDE guidance, current CMS zONE toolkits, current companion guides, and current CMS API specifications.
- Keep consumer, broker, and agent/broker pathways auditable separately. Do not let one pathway's screenshots, UI checks, or API evidence stand in for another pathway.
- Maintain the evidence package in a submittal-ready structure:
  - pathway-labeled screenshots
  - raw request / response evidence with headers and bodies where required
  - CSV / HTML / manifest / evidence-index outputs
  - traceability back to CMS toolkit rows, case identifiers, and FIT case references
- If a controlling CMS source document is still missing, mark the gap explicitly in the handoff and submittal tracker rather than inventing a final requirement.

---

## Table of Contents

1. [Program Overview & Entity Types](#1-program-overview--entity-types)
2. [Regulatory Framework](#2-regulatory-framework)
3. [EDE Phase Requirements](#3-ede-phase-requirements)
4. [CMS Certification & Audit Requirements](#4-cms-certification--audit-requirements)
5. [API Integration Requirements](#5-api-integration-requirements)
6. [EDI 834 Transaction Requirements](#6-edi-834-transaction-requirements)
7. [EDI 997/999 Acknowledgment Processing](#7-edi-997999-acknowledgment-processing)
8. [Identity Proofing Requirements (IAL2)](#8-identity-proofing-requirements-ial2)
9. [Consent Management (45 CFR 155.260)](#9-consent-management-45-cfr-155260)
10. [Security & Privacy (MARS-E / ARC-AMPE)](#10-security--privacy-mars-e--arc-ampe)
11. [Audit Trail & Logging](#11-audit-trail--logging)
12. [Data Retention Requirements](#12-data-retention-requirements)
13. [Broker Licensing & NPN Requirements](#13-broker-licensing--npn-requirements)
14. [Special Enrollment Period (SEP) Handling](#14-special-enrollment-period-sep-handling)
15. [APTC/CSR Subsidy Calculations](#15-aptccsr-subsidy-calculations)
16. [Plan Display & Comparison Requirements](#16-plan-display--comparison-requirements)
17. [Application Submission Requirements](#17-application-submission-requirements)
18. [Data Matching Issue (DMI) Resolution](#18-data-matching-issue-dmi-resolution)
19. [Renewal & Re-enrollment Requirements](#19-renewal--re-enrollment-requirements)
20. [Accessibility Requirements](#20-accessibility-requirements)
21. [Language Access & LEP Requirements](#21-language-access--lep-requirements)
22. [Consumer Communication & Disclaimer Requirements](#22-consumer-communication--disclaimer-requirements)
23. [Session Management & Authentication](#23-session-management--authentication)
24. [CMS-0057-F Interoperability Requirements](#24-cms-0057-f-interoperability-requirements)
25. [Ongoing Monitoring & Compliance](#25-ongoing-monitoring--compliance)

---

## 1. Program Overview & Entity Types

### 1.1 What is EDE?

Enhanced Direct Enrollment (EDE) allows CMS-approved QHP issuers and third-party web-brokers to enroll consumers in Exchange coverage directly from their websites, integrating with the Federally-facilitated Exchange (FFE) via a suite of APIs.

**Reference:** CMS EDE Program Overview (cms.gov/marketplace-private-insurance/agents-brokers/direct-enrollment-partners)

### 1.2 Entity Types

| Entity Type | Description | Audit Requirements |
|---|---|---|
| **Primary EDE Entity** | Builds and hosts the EDE platform; integrates directly with 20+ CMS APIs | Full business requirements audit + full privacy/security audit |
| **Upstream: White-Label Issuer** | Uses primary entity's environment with minor branding/QHP display changes | No audit required; must submit DE Entity Documentation Package + EDE Business Agreement |
| **Upstream: Hybrid Issuer** | Implements additional functionality beyond minor branding changes | Privacy/security audit of additional systems; must sign EDE Business Agreement |
| **Upstream: Hybrid Non-Issuer** | Agents/brokers/web-brokers adding functionality to primary entity's environment | Privacy/security audit of additional functionalities; must sign EDE Business Agreement |

**Mandatory:** All entity types must maintain a unique Partner ID.

### 1.3 Classic DE Decommissioning

- **Deadline:** Classic DE pathways must be decommissioned by 10/31/2025
- No new Classic DE applications accepted
- All entities must transition to EDE
- For this branch, all active implementation work is EDE-only and Year 9-aligned

### 1.4 Current Working Scope

- Active target phase: **Phase 3**
- Active pathways in scope: **Consumer**, **Agent/Broker**, and shared supporting services
- Out of scope as implementation baselines: **Classic DE** and **Phase 1**
- Conditional reference only: **Phase 2 Eligibility Results Toolkit**, but only when the Year 9 toolkit instructions say a Phase 3 entity must also complete those scenarios

---

## 2. Regulatory Framework

### 2.1 Primary Federal Regulations

| Regulation | Scope | Status |
|---|---|---|
| **45 CFR 155.220** | Standards for web-brokers assisting with QHP enrollment | Mandatory |
| **45 CFR 155.221** | Standards for direct enrollment entities and third-party auditors | Mandatory |
| **45 CFR 155.260** | Privacy and security of PII in Exchange operations | Mandatory |
| **45 CFR 155.302** | Options for conducting eligibility determinations | Mandatory |
| **45 CFR 155.305** | Eligibility standards (income, citizenship, immigration, lawful presence) | Mandatory |
| **45 CFR 155.310** | Eligibility process requirements | Mandatory |
| **45 CFR 155.205(b)(1)** | Plan display and differential display requirements | Mandatory |
| **45 CFR 156.122(d)** | Machine-readable provider and formulary data | Mandatory |
| **45 CFR 156.230(c)** | Provider directory data submission standards | Mandatory |
| **45 CFR 156.265(b)(3)(iv)** | Standardized plan differential display requirements for DE entities | Mandatory |
| **45 CFR 156.705** | Compliance oversight for QHP issuers | Mandatory |
| **45 CFR 156.1230** | Direct enrollment additional standards | Mandatory |
| **45 CFR 164.316** | HIPAA documentation and record retention policies | Mandatory |
| **45 CFR 164.524** | Individual access to PHI | Mandatory |
| **45 CFR 164.530** | HIPAA administrative requirements and retention | Mandatory |

### 2.2 Key Agreements Required

| Agreement | Parties | Purpose |
|---|---|---|
| **EDE Business Agreement** | EDE Entity <-> CMS | Consumer communication and operational requirements |
| **Interconnection Security Agreement (ISA)** | Primary EDE Entity <-> CMS | Privacy and security requirements; roles and responsibilities |
| **Web-Broker Agreement** | Web-Broker <-> CMS | Pre-approval and operational standards per 45 CFR 155.220 |
| **Non-Exchange Entity SSP (NEE SSP)** | Primary EDE Entity -> Upstream entities | Documents inheritable Common Controls and Hybrid Controls |

### 2.3 Statutory Authority

- **ACA Section 1411(g)** — Privacy and security of Exchange information
- **ACA Section 1411(g)(2)(A)** — Consent requirements for information use/disclosure
- **IRC Section 6103** — Safeguarding Federal Tax Information (FTI)

---

## 3. EDE Phase Requirements

### 3.1 Phase Definitions

| Phase | Consumer Types Supported | Complexity |
|---|---|---|
| **Phase 2** | Supported by CMS as a remaining end-state phase, but not this branch's target end-state | Intermediate |
| **Phase 3** | Full target phase for this branch; broadest consumer scenario coverage and highest audit effort | Full |

**Working rule:** Do not use Phase 1 requirements, screens, or test inventories as a build target for this branch.

### 3.2 Mandatory Phase Requirements

- **REQ-PHASE-001:** Do not build or test this branch against Phase 1 as an active target. Treat any Phase 1 references in older repo materials as historical only. **[Mandatory for this branch]**
- **REQ-PHASE-002:** If any unsupported scenarios remain while operating in Phase 2, the UI must screen and redirect consumers to HealthCare.gov or another supported channel. **[Mandatory]**
- **REQ-PHASE-003:** MarketLink's active compliance target is Phase 3; implementation should converge on the full Phase 3 application and servicing requirements. **[Mandatory for this branch]**
- **REQ-PHASE-004:** For audit evidence, a Phase 3 entity must complete all required Phase 3 toolkit cases and any additional lower-phase scenarios required by the Year 9 Eligibility Results User Guide. **[Mandatory]**
- **REQ-PHASE-005:** Test cases must be executed in the CMS-provided test environment prior to production approval. **[Mandatory]**

---

## 4. CMS Certification & Audit Requirements

### 4.1 Two-Part Audit Structure

**REQ-AUDIT-001:** Primary EDE Entities must submit audits consisting of two parts: **[Mandatory]**
1. **Business Requirements Audit** (Exhibit 2/3 of CMS Guidelines)
2. **Privacy and Security Audit** (Exhibit 4 of CMS Guidelines)

### 4.2 Business Requirements Audit Scope

The business audit covers the following review areas:

| Review Area | Description |
|---|---|
| **Pre-Application Experience** | Screening questions, consumer routing, disclaimer display |
| **Application Experience** | Data collection, eligibility application submission, API integration accuracy |
| **Plan Shopping** | Plan display, standardized/non-standardized plan differentiation, filtering |
| **Plan Selection & Enrollment** | Enrollment submission, plan selection confirmation |
| **Post-Enrollment Experience** | DMI/SVI resolution, document upload, notice download, payment management |
| **Agent/Broker Workflows** | NPN validation, licensing verification, consent capture |

### 4.3 Privacy & Security Audit Scope

The security audit verifies compliance with:
- MARS-E 2.0 / ARC-AMPE security controls
- NIST SP 800-53 Rev 5 control families
- NEE SSP documentation
- ISA requirements
- Vulnerability scanning results
- Incident response procedures

### 4.4 Auditor Qualifications

**REQ-AUDIT-002:** Auditors must possess relevant certifications and experience: **[Mandatory]**
- FISMA (Federal Information Security Management Act) experience
- FedRAMP-certified third-party assessment organization experience
- SSAE 16/18 (SOC 1/SOC 2) audit experience
- NIST SP 800-53 compliance review experience

### 4.5 Audit Timeline

**REQ-AUDIT-003:** Annual audit submission window: April 1 - July 1 (3:00 AM ET). **[Mandatory]**

**REQ-AUDIT-004:** Initial approval process may take up to one year or more. **[Informational]**

### 4.6 CMS Approval Workflow

1. Submit Intent to Participate email to directenrollment@cms.hhs.gov
2. Review CMS Guidelines for Third-party Auditor Operational Readiness Reviews
3. Sign EDE Business Agreement and ISA
4. Engage independent third-party auditor
5. Complete business requirements and privacy/security audits
6. Submit audit reports to CMS
7. CMS review and conditional/full approval
8. Complete test cases in CMS test environment
9. Production access granted

---

## 5. API Integration Requirements

### 5.1 Overview

**REQ-API-001:** Primary EDE entities must integrate with a suite of 20+ CMS FFE APIs. **[Mandatory]**

### 5.2 Core API Categories

| API Category | Functions | Phase Required |
|---|---|---|
| **Identity Verification APIs** | Identity proofing, ID verification, account creation | All Phases |
| **Application Management APIs** | Create, retrieve, update, submit eligibility applications | All Phases |
| **Eligibility Determination APIs** | Submit application for FFE eligibility determination; receive APTC/CSR/Medicaid/CHIP results | All Phases |
| **Plan Shopping APIs** | Retrieve available QHPs, plan details, benefits, costs, provider networks, formularies | All Phases |
| **Enrollment APIs** | Submit plan selection, effectuate enrollment, generate 834 transactions | All Phases |
| **Post-Enrollment Management APIs** | Update enrollments, process life changes, handle terminations | All Phases |
| **Document Management APIs** | Upload verification documents for DMI/SVI resolution | All Phases |
| **Notice Management APIs** | Retrieve eligibility and enrollment notices from the Exchange | All Phases |
| **Account Transfer APIs** | Transfer consumers to/from HealthCare.gov or Medicaid/CHIP agencies | Phase 2+ |
| **Payment Management APIs** | Check payment status, manage premium payments | All Phases |
| **SEP/QLE APIs** | Verify qualifying life events, manage special enrollment periods | All Phases |
| **Renewal APIs** | Support annual redetermination and re-enrollment processes | All Phases |

### 5.3 API Security Requirements

**REQ-API-002:** All API communications must use TLS 1.2 or higher encryption. **[Mandatory]**

**REQ-API-003:** API authentication must use CMS-approved OAuth 2.0 or equivalent token-based authentication. **[Mandatory]**

**REQ-API-004:** API rate limits must be respected as specified in CMS developer documentation (developer.cms.gov). **[Mandatory]**

**REQ-API-005:** All API calls must include proper error handling with consumer-friendly error messages. **[Mandatory]**

### 5.4 CMS Marketplace API (Public)

- **Endpoint:** developer.cms.gov/marketplace-api/
- **Functions:** Plan shopping, eligibility estimation, provider/drug coverage lookup
- **Data Coverage:** Minimum last 3 years of plan data
- **Key Parameters:** age/dob, income, household size, location (ZIP/county FIPS), has_mec, relationship, aptc_eligible

---

## 6. EDI 834 Transaction Requirements

### 6.1 Standard

**REQ-EDI834-001:** All enrollment/disenrollment transactions must conform to ASC X12N/005010X220A1 - 834 Benefit Enrollment and Maintenance. **[Mandatory - HIPAA 5010]**

### 6.2 Transaction Types

| Transaction | Purpose | Code |
|---|---|---|
| **Initial Enrollment** | New member enrollment in QHP | 021 (Addition) |
| **Maintenance** | Changes to existing enrollment (address, dependent changes) | 001 (Change) |
| **Disenrollment** | Termination of coverage | 024 (Cancellation/Termination) |
| **Reinstatement** | Reinstate previously terminated coverage | 025 (Reinstatement) |

### 6.3 Key Segments

| Segment | Purpose |
|---|---|
| **BGN** | Beginning segment - transaction control information |
| **N1** | Sponsor and insurance company identification |
| **INS** | Insured benefit - enrollment/maintenance type |
| **REF** | Reference identification (subscriber ID, group number) |
| **NM1** | Individual name - member identification |
| **DMG** | Demographic information (DOB, gender) |
| **HD** | Health coverage - benefit plan selection |
| **DTP** | Date/time reference (effective date, termination date) |
| **AMT** | Monetary amount (premium, APTC amounts) |

### 6.4 Marketplace-Specific Requirements

**REQ-EDI834-002:** 834 transactions for Exchange enrollment must include Exchange-specific data elements as defined in the CMS Companion Guide to ASC X12N/005010X220A1. **[Mandatory]**

**REQ-EDI834-003:** APTC and CSR amounts must be accurately reflected in the AMT segments. **[Mandatory]**

**REQ-EDI834-004:** Effectuation dates must comply with CMS coverage effective date rules (1st or 15th of month depending on enrollment timing). **[Mandatory]**

### 6.5 Validation Requirements

**REQ-EDI834-005:** All 834 transactions must pass:
- Integrity testing (basic syntax and element attributes)
- HIPAA Implementation Guide requirement testing (repeat counts, qualifiers, codes, elements, segments)
**[Mandatory]**

---

## 7. EDI 997/999 Acknowledgment Processing

### 7.1 Standard

**REQ-EDI999-001:** Use 999 Implementation Acknowledgment (ASC X12N/005010X231A1) for all healthcare transaction acknowledgments. The 997 Functional Acknowledgment MUST NOT be used for healthcare transactions under HIPAA 5010. **[Mandatory]**

### 7.2 Processing Requirements

**REQ-EDI999-002:** The system must generate a 999 response for every received 834 transaction, confirming receipt and reporting compliance status. **[Mandatory]**

**REQ-EDI999-003:** The 999 must report:
- Whether the transaction was accepted or rejected
- Specific errors in segments or elements (if any)
- Compliance with the HIPAA Implementation Guide (not just general EDI standards)
**[Mandatory]**

**REQ-EDI999-004:** Neither a 997 nor 999 acknowledgment shall be acknowledged (no infinite acknowledgment loops). **[Mandatory]**

### 7.3 Error Handling

**REQ-EDI999-005:** Rejected 834 transactions identified via 999 responses must trigger automated error workflows for correction and resubmission. **[Mandatory]**

---

## 8. Identity Proofing Requirements (IAL2)

### 8.1 Standard

**Reference:** NIST SP 800-63A, Identity Assurance Level 2 (IAL2)

### 8.2 Evidence Requirements

**REQ-IDP-001:** For IAL2 remote identity proofing, collect one of the following combinations: **[Mandatory]**
- One piece of FAIR evidence + one piece of STRONG evidence, OR
- One piece of SUPERIOR evidence

**REQ-IDP-002:** Must collect all core attributes including at least one government-issued identifier (SSN, state ID/driver's license, passport). **[Mandatory]**

### 8.3 Verification Methods

**REQ-IDP-003:** Identity verification must include physical or biometric comparison of the photograph on the strongest piece of evidence to the applicant. For remote proofing, high-resolution video or camera capture of the applicant's facial image for comparison. **[Mandatory for IAL2]**

**REQ-IDP-004:** Liveness detection is strongly recommended (not strictly required by SP 800-63A) to prevent presentation attacks. **[Recommended]**

### 8.4 CMS-Specific Identity Requirements

**REQ-IDP-005:** Integration with CMS identity verification services via the EDE API suite for consumer account creation and authentication. **[Mandatory]**

**REQ-IDP-006:** Consumers must create/link a HealthCare.gov account (ID.me or Login.gov integration) for identity proofing. **[Mandatory]**

---

## 9. Consent Management (45 CFR 155.260)

### 9.1 Privacy Standards

**REQ-CONSENT-001:** PII may only be collected, created, used, and disclosed for the performance of Exchange functions. **[Mandatory - 45 CFR 155.260(a)]**

### 9.2 Fair Information Practice Principles (FIPP)

**REQ-CONSENT-002:** Implement all eight FIPPs: **[Mandatory - 45 CFR 155.260(a)(3)]**
1. **Individual Access** - Individuals can access their own PII
2. **Correction** - Individuals can request correction of inaccurate PII
3. **Openness and Transparency** - Clear privacy policies and practices
4. **Individual Choice** - Consumers can make informed decisions about PII use
5. **Collection, Use and Disclosure Limitations** - Minimum necessary principle
6. **Data Quality and Integrity** - Ensure PII accuracy and completeness
7. **Safeguards** - Administrative, technical, and physical protections
8. **Accountability** - Compliance monitoring and enforcement

### 9.3 Consent Documentation Requirements

**REQ-CONSENT-003:** Consent documentation must include: **[Mandatory]**
- Description of scope, purpose, and duration of consent
- Date consent was given
- Name of the consumer
- Name of the entity being granted consent
- Process through which the consumer may rescind consent

### 9.4 Tax Information Consent

**REQ-CONSENT-004:** Consumers must explicitly authorize the Marketplace to request updated tax return information from the IRS for annual redetermination. **[Mandatory]**

### 9.5 Agent/Broker Consent

**REQ-CONSENT-005:** Consumers must provide explicit consent for an agent or broker to act on their behalf, including consent for the agent's NPN to be associated with the application. **[Mandatory]**

### 9.6 Penalties

**REQ-CONSENT-006:** Any person who knowingly and willfully uses or discloses information in violation of ACA Section 1411(g) is subject to a penalty of not more than $25,000 per person or entity, per use or disclosure. **[Statutory]**

---

## 10. Security & Privacy (MARS-E / ARC-AMPE)

### 10.1 Current Framework: MARS-E 2.0

**Reference:** CMS MARS-E Document Suite, Version 2.2 (Volume I: Harmonized Security and Privacy Framework)

**REQ-SEC-001:** Implement security controls aligned with NIST SP 800-53 Rev 4/5 across 20 control families with 1,000+ individual controls. **[Mandatory]**

### 10.2 Transition to ARC-AMPE

**CRITICAL:** CMS is replacing MARS-E with the Acceptable Risk Controls for ACA, Medicaid, and Partner Entities (ARC-AMPE) framework.

| Entity Type | ARC-AMPE Compliance Deadline | Minimum Controls |
|---|---|---|
| ACA Administering Entities (AE) | March 4, 2026 | 402 controls |
| Direct Enrollment Entities (DEE) | End of June 2026 | 308 controls |

**REQ-SEC-002:** Migrate from MARS-E to ARC-AMPE by the applicable deadline. **[Mandatory]**

### 10.3 Key ARC-AMPE Changes

**REQ-SEC-003:** ARC-AMPE aligns with NIST SP 800-53 Revision 5 (updated from Rev 4). **[Mandatory]**

**REQ-SEC-004:** All sensitive data processing and storage must take place within the United States. No offshore hosting, even for cloud providers. **[Mandatory - New in ARC-AMPE]**

**REQ-SEC-005:** System Security and Privacy Plan (SSPP) must be documented using the ARC-AMPE Excel template format (changed from MARS-E Word format). **[Mandatory]**

### 10.4 NIST SP 800-53 Rev 5 Control Families

All 20 control families must be addressed:

| ID | Control Family |
|---|---|
| AC | Access Control |
| AT | Awareness and Training |
| AU | Audit and Accountability |
| CA | Assessment, Authorization, and Monitoring |
| CM | Configuration Management |
| CP | Contingency Planning |
| IA | Identification and Authentication |
| IR | Incident Response |
| MA | Maintenance |
| MP | Media Protection |
| PE | Physical and Environmental Protection |
| PL | Planning |
| PM | Program Management |
| PS | Personnel Security |
| PT | PII Processing and Transparency |
| RA | Risk Assessment |
| SA | System and Services Acquisition |
| SC | System and Communications Protection |
| SI | System and Information Integrity |
| SR | Supply Chain Risk Management |

### 10.5 Encryption Requirements

**REQ-SEC-006:** Data in transit: TLS 1.2 minimum (TLS 1.3 recommended). **[Mandatory]**

**REQ-SEC-007:** Data at rest: AES-256 encryption for all PII and FTI. **[Mandatory]**

### 10.6 FTI Safeguarding (IRS Publication 1075)

**REQ-SEC-008:** All Federal Tax Information received from or through IRS must be safeguarded per IRC Section 6103(p)(4) and IRS Publication 1075. **[Mandatory]**

**REQ-SEC-009:** Continuous safeguard protection for all FTI, including chain of custody logging, secure storage, and controlled destruction when retention period ends. **[Mandatory]**

### 10.7 Interconnection Security Agreement (ISA)

**REQ-SEC-010:** Primary EDE Entities must execute an ISA with CMS that defines: **[Mandatory]**
- Security-related aspects of the intended connection
- Responsibilities of each party
- Administrative, operational, and technical security safeguards
- Contractual obligations
- Courses of action for security incidents/breaches

### 10.8 System Security Plan (SSP)

**REQ-SEC-011:** SSP must comply with NIST SP 800-18 (Guide for Developing Security Plans for IT Systems). **[Mandatory]**

**REQ-SEC-012:** Primary EDE Entities must supply an NEE SSP to each Upstream EDE Entity identifying all Common Controls and Hybrid Controls. **[Mandatory - ISA Appendix B]**

---

## 11. Audit Trail & Logging

### 11.1 NIST AU Family Requirements

**REQ-LOG-001:** Implement audit and accountability controls per NIST SP 800-53 Rev 5, AU family: **[Mandatory]**
- AU-1: Policy and Procedures
- AU-2: Event Logging (define auditable events)
- AU-3: Content of Audit Records (what, when, where, source, outcome, identity)
- AU-4: Audit Log Storage Capacity
- AU-5: Response to Audit Logging Process Failures
- AU-6: Audit Record Review, Analysis, and Reporting
- AU-7: Audit Record Reduction and Report Generation
- AU-8: Time Stamps (synchronized to authoritative time source)
- AU-9: Protection of Audit Information (tamper-resistant)
- AU-11: Audit Record Retention
- AU-12: Audit Record Generation

### 11.2 Required Auditable Events

**REQ-LOG-002:** Log at minimum: **[Mandatory]**
- All authentication events (login, logout, failed attempts, MFA events)
- Application creation, modification, and submission
- Eligibility determination requests and responses
- Plan selection and enrollment transactions
- Consent grant and revocation events
- Agent/broker access and actions
- PII access and modifications
- API calls to/from CMS systems
- Document uploads
- System configuration changes
- Security events and incidents
- Administrative actions

### 11.3 Audit Record Content

**REQ-LOG-003:** Each audit record must contain: **[Mandatory]**
- Type of event
- Date and time of event
- Success or failure indication
- Identity of the subject (user/system)
- Source of the event
- Outcome of the event

### 11.4 Audit Log Retention

**REQ-LOG-004:** Audit logs must be retained for a minimum of 6 years per HIPAA requirements (45 CFR 164.530), or longer if required by state law. **[Mandatory]**

---

## 12. Data Retention Requirements

### 12.1 HIPAA Record Retention

**REQ-RET-001:** HIPAA documentation and compliance records must be retained for a minimum of 6 years from creation or last effective date, whichever is later (45 CFR 164.316, 45 CFR 164.530). **[Mandatory]**

### 12.2 FTI Retention

**REQ-RET-002:** Federal Tax Information must be retained for 5 years or per the agency's applicable records control schedule, whichever is longer (IRS Publication 1075, Table 9). **[Mandatory]**

**REQ-RET-003:** When FTI retention period ends, agency head must certify in writing that all residual FTI has been destroyed. **[Mandatory]**

### 12.3 Enrollment Records

**REQ-RET-004:** Enrollment and eligibility records should be retained for a minimum of 10 years to support IRS reconciliation, appeals, and audit requirements. **[Recommended / Check state law]**

### 12.4 Consent Records

**REQ-RET-005:** Consent documentation must be retained for the duration of the consent plus applicable retention period. **[Mandatory]**

### 12.5 Audit Reports

**REQ-RET-006:** Third-party audit reports and CMS correspondence must be retained for the duration of EDE participation plus 6 years. **[Mandatory]**

### 12.6 State-Specific Requirements

**REQ-RET-007:** Some states require policy documents to be retained longer than the HIPAA 6-year minimum. Verify state-specific requirements for all operating states. **[Mandatory]**

---

## 13. Broker Licensing & NPN Requirements

### 13.1 National Producer Number (NPN)

**REQ-NPN-001:** Every agent/broker must have a valid NPN assigned through the NAIC licensing process. **[Mandatory]**

**REQ-NPN-002:** NPN validation must verify exact match of first name, last name, and NPN between the NIPR (National Insurance Producer Registry) and CMS MLMS (Marketplace Learning Management System). **[Mandatory]**

**REQ-NPN-003:** Agents must include their SSN in their MLMS profile for NPN validation. **[Mandatory]**

### 13.2 State Licensure

**REQ-NPN-004:** Agents must hold an active state license with a health-related Line of Authority (LOA) for each state where they assist consumers. **[Mandatory]**

**REQ-NPN-005:** Agents without an approved health-related LOA must NOT have access to Marketplace systems. **[Mandatory]**

### 13.3 Annual Registration and Training

**REQ-NPN-006:** Each agent/broker must complete required annual Marketplace training and registration for each applicable plan year. **[Mandatory]**

**REQ-NPN-007:** Agents must sign applicable Marketplace Agreements with CMS using their individual NPN. **[Mandatory]**

### 13.4 Business Entity NPNs

**REQ-NPN-008:** If a business entity NPN is used for Marketplace consumer assistance, the designated representative associated with that NPN must complete registration, training, and sign applicable Marketplace Agreements. **[Mandatory]**

### 13.5 Web-Broker Pre-Approval

**REQ-NPN-009:** Web-brokers must provide to CMS: license information, NPN of designated representative, and other required data elements per 45 CFR 155.220. **[Mandatory]**

### 13.6 Portal NPN Validation Requirements

**REQ-NPN-010:** The broker portal must: **[Mandatory]**
- Validate NPN against NIPR before allowing agent access
- Verify active state licensure for the applicable state(s)
- Confirm completion of annual Marketplace training
- Prevent agents with inactive/expired licenses from conducting enrollments
- Associate the correct NPN with each application/enrollment

---

## 14. Special Enrollment Period (SEP) Handling

### 14.1 Qualifying Life Events (QLEs)

**REQ-SEP-001:** Support all CMS-recognized qualifying life events: **[Mandatory]**
- Loss of qualifying health coverage (loss of MEC)
- Marriage
- Birth, adoption, placement for adoption, placement in foster care
- Permanent move to a new coverage area
- Change in household income affecting eligibility
- Gaining citizenship or lawful presence
- Release from incarceration
- Court order for coverage
- Error by Marketplace or plan
- Medicaid/CHIP denial
- Exceptional circumstances (as determined by CMS)

### 14.2 SEP Timeframes

**REQ-SEP-002:** Consumers generally have 60 days from the date of the qualifying event to enroll. **[Mandatory]**

### 14.3 SEP Verification (SEPV)

**REQ-SEP-003:** Support SEP Verification process for applicable QLEs. As of May 16, 2025, CMS has resumed SEPV for the Loss of MEC SEP. **[Mandatory]**

**REQ-SEP-004:** Document requirements for SEPV include: **[Mandatory]**
- Loss of coverage: Documentation showing loss in past 60 days or expected within next 60 days
- Marriage: Marriage certificate
- New dependent: Birth certificate, adoption papers, court order
- Permanent move: Proof of previous and new address

### 14.4 SVI Resolution

**REQ-SEP-005:** Consumers have 30 days from plan selection date to resolve a Special Enrollment Period Verification Issue (SVI). **[Mandatory]**

**REQ-SEP-006:** Portal must support document upload capability for SVI resolution. **[Mandatory]**

---

## 15. APTC/CSR Subsidy Calculations

### 15.1 APTC Eligibility Criteria

**REQ-APTC-001:** The system must verify APTC eligibility based on: **[Mandatory]**
- Annual household income at or above 100% FPL (generally)
- Not eligible for other qualifying coverage (employer-sponsored, Medicaid, Medicare)
- Filing federal income tax returns
- Enrolled in a QHP through an individual Exchange
- For 2026: Income up to 400% FPL (or higher if enhanced PTCs extended)

### 15.2 APTC Calculation

**REQ-APTC-002:** APTC is calculated monthly based on: **[Mandatory - Calculated by FFE]**
- Estimated annual household income reported on the application
- Household size
- Second-lowest cost Silver plan (SLCSP) benchmark premium
- Expected contribution percentage (based on FPL percentage)

**REQ-APTC-003:** The portal must accurately display APTC amounts as determined by the FFE eligibility determination. **[Mandatory]**

### 15.3 CSR Eligibility

**REQ-APTC-004:** CSR eligibility based on: **[Mandatory]**
- Household income 100-250% FPL
- Enrollment in a Silver-level plan (CSR only available on Silver plans)
- CSR variants: 94% AV, 87% AV, 73% AV (based on income level)

### 15.4 Display Requirements

**REQ-APTC-005:** Display estimated monthly premium after APTC application. **[Mandatory]**

**REQ-APTC-006:** Show CSR benefits when applicable (reduced deductibles, copays, out-of-pocket maximums). **[Mandatory]**

**REQ-APTC-007:** Include reconciliation warning: APTC is estimated and subject to reconciliation when filing federal income tax returns. **[Mandatory]**

---

## 16. Plan Display & Comparison Requirements

### 16.1 Standardized Plan Differential Display

**REQ-PLAN-001:** Per 45 CFR 155.205(b)(1) and 45 CFR 156.265(b)(3)(iv), all standardized plan options must be prominently and differentially displayed in a manner consistent with HealthCare.gov. **[Mandatory]**

**REQ-PLAN-002:** If an issuer offers a non-standardized QHP at a given metal level/network type/service area, they must also offer a standardized QHP at the same metal level/network type/service area. **[Mandatory - for issuers, informational for brokers]**

### 16.2 Deviation Requests

**REQ-PLAN-003:** EDE Entities may request to deviate from HealthCare.gov's standardized plan display format, provided the alternate format provides a similar level of differentiation and clarity. **[Optional - requires CMS approval]**

### 16.3 Display Separation

**REQ-PLAN-004:** QHPs and non-QHPs must be displayed on separate website pages. **[Mandatory - 45 CFR 155.221]**

### 16.4 Required Plan Information

**REQ-PLAN-005:** Display the following for each QHP: **[Mandatory]**
- Plan name and issuer
- Metal level (Bronze, Silver, Gold, Platinum, Catastrophic)
- Monthly premium (before and after APTC)
- Deductible (individual and family)
- Out-of-pocket maximum
- Copays/coinsurance for key services
- Network type (HMO, PPO, EPO, POS)
- Provider directory link
- Formulary (drug list) link
- Summary of Benefits and Coverage (SBC) link
- Quality ratings (if available)
- Whether plan is standardized

### 16.5 Machine-Readable Data

**REQ-PLAN-006:** Provider and formulary data must be available in machine-readable format per 45 CFR 156.122(d) and 156.230(c). Drug information must be updated at least monthly. **[Mandatory]**

---

## 17. Application Submission Requirements

### 17.1 Eligibility Application Data Elements

**REQ-APP-001:** Collect and submit all required data elements for FFE eligibility determination: **[Mandatory]**

| Category | Required Elements |
|---|---|
| **Applicant Identity** | Full legal name, DOB or age, SSN (if available), gender |
| **Household** | Household size, relationships, tax filing status |
| **Income** | Projected annual household income, income sources |
| **Coverage Status** | Current coverage (has_mec), employer coverage offers |
| **Citizenship/Immigration** | Citizenship status, immigration status, document numbers |
| **Location** | Physical address, ZIP code, county FIPS code |
| **Special Circumstances** | Pregnancy, student status, incarceration, tribal membership (Phase 2+/3) |
| **Agent/Broker** | NPN, consent for agent assistance |

### 17.2 Eligibility Determination Process

**REQ-APP-002:** Application data is submitted to the FFE via API. The FFE performs the eligibility determination (not the EDE Entity). **[Mandatory]**

**REQ-APP-003:** The FFE determines eligibility for: **[Informational]**
- QHP enrollment through the Exchange
- Medicaid (MAGI-based assessment)
- CHIP (MAGI-based assessment)
- APTC amount
- CSR level
- Exemptions

### 17.3 Verification Process

**REQ-APP-004:** The FFE verifies applicant information against trusted data sources: **[Mandatory - performed by FFE]**
- SSA (Social Security Administration) - citizenship and SSN verification
- DHS (Department of Homeland Security) - immigration status
- IRS - income verification
- State Medicaid/CHIP agencies - Medicaid/CHIP eligibility

### 17.4 Coverage Effective Dates

**REQ-APP-005:** Display coverage effective dates per CMS rules: **[Mandatory]**
- OEP enrollments: Based on plan selection date (typically 1st of following month)
- SEP enrollments: Varies by QLE type and date

---

## 18. Data Matching Issue (DMI) Resolution

### 18.1 DMI Types

**REQ-DMI-001:** Support resolution of all DMI types: **[Mandatory]**
- Income inconsistencies
- Citizenship inconsistencies
- Immigration/lawful presence inconsistencies

### 18.2 Resolution Timelines

**REQ-DMI-002:** Enforce and display DMI resolution deadlines: **[Mandatory]**
- **Citizenship/Immigration DMIs:** 95 days from eligibility determination date
- **All other DMIs (including income):** 90 days from eligibility determination date
- **Income DMIs:** Additional automatic 60-day extension available

### 18.3 Document Upload

**REQ-DMI-003:** Provide capability for consumers and agents to upload supporting documentation to resolve DMIs. **[Mandatory]**

### 18.4 Status Tracking

**REQ-DMI-004:** Display DMI status, outstanding issues, and deadlines to consumers and agents. **[Mandatory]**

### 18.5 Consequences Communication

**REQ-DMI-005:** Clearly communicate to consumers: **[Mandatory]**
- Risk of losing financial assistance (APTC/CSR) if DMI is not resolved
- Risk of adjustment based on trusted data source information
- APTC reconciliation requirements at tax filing
- Potential coverage termination for unresolved citizenship/immigration DMIs

---

## 19. Renewal & Re-enrollment Requirements

### 19.1 Annual Redetermination

**REQ-RENEW-001:** Support annual eligibility redetermination for all enrolled consumers. **[Mandatory]**

### 19.2 Passive Re-enrollment

**REQ-RENEW-002:** Support passive (automatic) re-enrollment for consumers who take no action during OEP. **[Mandatory]**

### 19.3 2026 $5 Premium Rule

**REQ-RENEW-003:** For Plan Year 2026+, consumers who are automatically re-enrolled with $0 premium after APTC, and who have NOT affirmed or updated their eligibility information, must be enrolled with a $5 monthly premium until they confirm/update their information. **[Mandatory - 2025 Marketplace Integrity and Affordability Final Rule]**

### 19.4 Re-enrollment Consumer Groups

**REQ-RENEW-004:** Handle distinct re-enrollment groups: **[Mandatory]**
1. **Active re-enrollees** - Consumers who update their application (standard process)
2. **Passive re-enrollees** - Consumers who take no action (auto-re-enrolled in current or similar plan)
3. **Opt-out group** - Consumers who did not authorize IRS data requests
4. **Repeat passive re-enrollees** - Multi-year passive enrollees with no IRS income data available

### 19.5 Plan Crosswalk

**REQ-RENEW-005:** When a consumer's current plan is discontinued, map to the most similar available plan for passive re-enrollment. **[Mandatory]**

---

## 20. Accessibility Requirements

### 20.1 Section 508

**REQ-ACC-001:** Comply with Section 508 of the Rehabilitation Act, requiring equal access to electronic information for people with disabilities. **[Mandatory]**

### 20.2 WCAG 2.1 AA

**REQ-ACC-002:** Meet WCAG 2.1 Level AA conformance standards for all web content. **[Mandatory]**

**HHS Final Rule (May 2024):** Healthcare entities receiving federal funding must meet WCAG 2.1 AA standards for websites, mobile apps, and kiosks. Compliance deadlines:
- Organizations with 15+ employees: May 11, 2026
- Organizations with fewer than 15 employees: May 10, 2027

### 20.3 Specific Accessibility Requirements

**REQ-ACC-003:** Implement the following accessibility features: **[Mandatory]**
- Screen reader compatibility (ARIA labels, semantic HTML)
- Keyboard navigation for all interactive elements
- Color contrast ratios meeting WCAG 2.1 AA (4.5:1 for normal text, 3:1 for large text)
- Text resizing up to 200% without loss of content/functionality
- Alternative text for all non-decorative images
- Form field labels and error identification
- Consistent navigation structure
- Focus management for dynamic content
- Captions and transcripts for multimedia content
- No content that flashes more than 3 times per second

### 20.4 Third-Party Tool Compliance

**REQ-ACC-004:** All third-party tools integrated into the portal (appointment schedulers, payment portals, document upload tools) must also comply with WCAG 2.1 AA. **[Mandatory]**

### 20.5 Testing

**REQ-ACC-005:** Conduct accessibility testing with assistive technologies (JAWS, NVDA, VoiceOver) and automated tools (axe, WAVE, Lighthouse). **[Mandatory]**

---

## 21. Language Access & LEP Requirements

### 21.1 Oral Interpretation

**REQ-LANG-001:** Provide telephonic interpreter services in at least 150 languages at no cost to the individual (per 45 CFR 155.205(c)). **[Mandatory]**

### 21.2 Written Translation

**REQ-LANG-002:** Translate website content into any non-English language spoken by an LEP population that reaches 10% or more of the relevant state's population. **[Mandatory]**

### 21.3 Critical Document Translation

**REQ-LANG-003:** Translate non-website critical communications (notices, letters, consent forms) into qualifying non-English languages per the 10% threshold. **[Mandatory - per EDE Business Agreement]**

### 21.4 Tagline Requirements

**REQ-LANG-004:** Include taglines in at least the top 15 languages spoken by the LEP population of the relevant state, informing consumers of the availability of language assistance services. **[Mandatory]**

### 21.5 Spanish Language Support

**REQ-LANG-005:** Given the nationwide Spanish-speaking LEP population, Spanish translation of the full EDE experience is effectively mandatory in most states. **[Mandatory in most states]**

---

## 22. Consumer Communication & Disclaimer Requirements

### 22.1 Mandatory Disclaimer

**REQ-DISC-001:** Display prominent disclaimer language on all pages indicating: **[Mandatory]**
- The website is NOT the Health Insurance Marketplace website (HealthCare.gov)
- The website may not display all plans being offered in the state through HealthCare.gov
- Standardized CMS-prescribed disclaimer format and placement

### 22.2 QHP vs Non-QHP Separation

**REQ-DISC-002:** QHPs and non-QHPs must appear on separate website pages. Non-Exchange plans must never be presented in a way that could confuse consumers about what is/is not Exchange coverage. **[Mandatory - 45 CFR 155.221]**

### 22.3 CMS Monitoring

**REQ-DISC-003:** CMS continuously monitors EDE Entity websites for compliance with consumer communication requirements. Non-compliance can result in immediate suspension of EDE access. **[Mandatory]**

### 22.4 Website Display Change Standards

**REQ-DISC-004:** Significant changes to the EDE website display must comply with CMS website display change standards and may require notification to or approval from CMS. **[Mandatory]**

---

## 23. Session Management & Authentication

### 23.1 Multi-Factor Authentication (MFA)

**REQ-AUTH-001:** MFA is required for all CMS Enterprise Portal and EDE pathway access. Email address is automatically registered as the primary MFA device and cannot be removed. **[Mandatory]**

### 23.2 Session Timeout

**REQ-AUTH-002:** Agent/broker sessions must time out after 30 minutes of inactivity. **[Mandatory]**

**REQ-AUTH-003:** An inactivity warning must be displayed after 28 minutes (2 minutes before timeout). **[Mandatory]**

**REQ-AUTH-004:** After timeout, users must reauthenticate and reconnect their FFM account credentials. **[Mandatory]**

### 23.3 Credential Management

**REQ-AUTH-005:** Each individual is limited to one CMS Portal account. **[Mandatory]**

**REQ-AUTH-006:** Sharing login credentials is prohibited. The system must not facilitate credential sharing. **[Mandatory]**

**REQ-AUTH-007:** Only the person who created a CMS Portal account may use those login credentials. **[Mandatory]**

### 23.4 Consumer Authentication

**REQ-AUTH-008:** Consumer-facing authentication must integrate with CMS identity services (ID.me/Login.gov) for account creation and identity proofing. **[Mandatory]**

---

## 24. CMS-0057-F Interoperability Requirements

### 24.1 Applicability

**REQ-INTOP-001:** CMS-0057-F (Interoperability and Prior Authorization Final Rule, January 2024) applies to QHP issuers on FFEs. **[Mandatory for QHP Issuers]**

### 24.2 Required APIs (for QHP Issuers)

| API | Purpose | Compliance Date |
|---|---|---|
| **Patient Access API** | Allow enrollees to access their claims and clinical data via FHIR | January 1, 2027 |
| **Provider Access API** | Share patient data with in-network providers (treatment relationship) | January 1, 2027 |
| **Payer-to-Payer API** | Exchange claims/encounter data between payers for care continuity | January 1, 2027 |
| **Prior Authorization API** | Automate prior authorization decisions via FHIR | January 1, 2027 |

### 24.3 Data Standards

**REQ-INTOP-002:** APIs must use HL7 FHIR (Fast Healthcare Interoperability Resources) standard. **[Mandatory]**

**REQ-INTOP-003:** Support USCDI (United States Core Data for Interoperability) data classes and elements. **[Mandatory]**

### 24.4 Operational Requirements

**REQ-INTOP-004:** Prior authorization operational improvements effective January 1, 2026: **[Mandatory for QHP Issuers]**
- Specific timeframes for prior authorization decisions
- Reason codes for denials
- Prior authorization status tracking

### 24.5 Broker Portal Implications

**Note:** While CMS-0057-F primarily applies to QHP issuers, broker portals should be aware that:
- Member data access capabilities may need to interface with Patient Access APIs
- Prior authorization status information may need to be surfaced to brokers/consumers
- Payer data exchange may affect enrollment and coverage transition workflows

---

## 25. Ongoing Monitoring & Compliance

### 25.1 Information Security Continuous Monitoring (ISCM)

**REQ-MON-001:** Implement and maintain an ISCM program per NIST SP 800-137 and CMS guidance. **[Mandatory]**

**REQ-MON-002:** Conduct monthly vulnerability scans of IT systems. Submit reports from last three months during quarterly reviews. **[Mandatory]**

**REQ-MON-003:** Quarterly POA&M (Plan of Action and Milestones) updates until resolution of identified vulnerabilities. **[Mandatory]**

**REQ-MON-004:** For High-Value Assets (HVA), monthly POA&M updates including vulnerability scan reports to HHS. **[Mandatory if applicable]**

### 25.2 Annual Security Assessment

**REQ-MON-005:** Annual security control assessment by independent auditors. **[Mandatory]**

**REQ-MON-006:** Submit annual Security Assessment Reports to CMS. **[Mandatory]**

### 25.3 Change Management

**REQ-MON-007:** Follow CMS Change Notification Procedures for any changes to EDE Entity IT systems. Change categories are defined on CMS zONE. **[Mandatory]**

### 25.4 Incident Response

**REQ-MON-008:** Maintain and test an incident response plan that includes: **[Mandatory]**
- Breach notification procedures per HIPAA Breach Notification Rule
- CMS notification requirements for security incidents
- Consumer notification requirements
- Forensic investigation procedures
- Remediation and recovery procedures

### 25.5 CMS Compliance Reviews

**REQ-MON-009:** Cooperate with CMS compliance reviews, which may include: **[Mandatory]**
- Unannounced website reviews
- Documentation requests
- Technical system reviews
- Consumer complaint investigations

### 25.6 Suspension and Termination

**REQ-MON-010:** CMS may immediately suspend EDE access if non-compliance poses unacceptable risk to: **[Informational]**
- Accuracy of Marketplace eligibility determinations
- Marketplace operations
- Marketplace IT systems

---

## Appendix A: Key CMS Documents and Resources

| Document | Location |
|---|---|
| CMS EDE Program Page | cms.gov/marketplace-private-insurance/agents-brokers/direct-enrollment-partners |
| Guidelines for Third-party Auditor ORR (Year 9) | cms.gov/files/document/guidelines-enhanced-direct-enrollment-audits-year-9-final.pdf |
| EDE Business Agreement Template | reginfo.gov/public/do/DownloadDocument?objectID=137534301 |
| EDE ISA and Appendix A | hhs.gov/guidance/document/ede-interconnection-security-agreement-isa-appendix |
| Web-Broker Guidelines (Jan 2024) | cms.gov/files/document/web-broker-guidelines-01102024-final.pdf |
| MARS-E v2.2 Volume I | cms.gov/files/document/mars-e-v2-2-vol-1final-signed08032021-1.pdf |
| ARC-AMPE Volume I | cms.gov/files/document/arc-ampe-vol-1-v102-508-5cr-04112025.pdf |
| CMS Marketplace API Specs | developer.cms.gov/marketplace-api/api-spec |
| 45 CFR 155.220 (Web-Broker Standards) | ecfr.gov/current/title-45/section-155.220 |
| 45 CFR 155.221 (DE Entity Standards) | ecfr.gov/current/title-45/section-155.221 |
| 45 CFR 155.260 (Privacy/Security PII) | ecfr.gov/current/title-45/section-155.260 |
| NIST SP 800-53 Rev 5 | csrc.nist.gov/pubs/sp/800/53/r5/upd1/final |
| NIST SP 800-63A (Identity Proofing) | pages.nist.gov/800-63-3/sp800-63a.html |
| IRS Publication 1075 | irs.gov/pub/irs-pdf/p1075.pdf |
| CMS EDE FAQs | cms.gov/sites/default/files/repo-new/8/FAQs-EDE.pdf |
| EDE Audit Submission Timeline FAQs | cms.gov/files/document/2022-and-subsequent-calendar-years-ede-audit-submission-timeline-faqs.pdf |
| APTC/CSR Overview | cms.gov/files/document/aptc-cost-sharing-reductions-overview.pdf |
| DMI Resolution Job Aid | cms.gov/files/document/resolving-dmis-job-aid.pdf |
| SEP Verification Overview (June 2025) | cms.gov/files/document/special-enrollment-period-verification-sepv-overview.pdf |
| CMS Language Access Guidance | cms.gov/CCIIO/Resources/Regulations-and-Guidance/Downloads/Language-access-guidance.pdf |

---

## Appendix B: Compliance Checklist Summary

### Pre-Certification Phase

- [ ] Submit Intent to Participate to CMS (directenrollment@cms.hhs.gov)
- [ ] Review CMS Third-party Auditor ORR Guidelines (current year)
- [ ] Select and engage qualified independent third-party auditor(s)
- [ ] Determine EDE phase (1, 2, or 3)
- [ ] Determine entity type (Primary or Upstream)
- [ ] Execute EDE Business Agreement with CMS
- [ ] Execute Interconnection Security Agreement (ISA) with CMS (Primary entities)
- [ ] Develop System Security and Privacy Plan (SSPP) per ARC-AMPE
- [ ] Complete 20+ API integrations with CMS FFE
- [ ] Implement all UI/UX requirements (disclaimers, plan display, accessibility)
- [ ] Implement 834 transaction processing
- [ ] Implement 999 acknowledgment processing
- [ ] Implement DMI/SVI resolution workflows
- [ ] Implement SEP handling and verification
- [ ] Implement APTC/CSR display and workflows
- [ ] Implement broker NPN validation and consent management
- [ ] Implement language access (translations, interpreter services)
- [ ] Conduct WCAG 2.1 AA accessibility audit
- [ ] Complete all applicable test cases in CMS test environment

### Audit Phase

- [ ] Complete Business Requirements Audit (Exhibit 2/3)
- [ ] Complete Privacy and Security Audit (Exhibit 4)
- [ ] Submit audit reports within annual window (April 1 - July 1)
- [ ] Address any findings/remediation items
- [ ] Obtain CMS approval

### Operational Phase

- [ ] Maintain ISCM program (monthly vulnerability scans)
- [ ] Submit quarterly POA&M updates
- [ ] Complete annual security assessments
- [ ] Submit annual audit reports
- [ ] Monitor and comply with CMS website display standards
- [ ] Maintain agent/broker training and licensing compliance
- [ ] Support annual Open Enrollment Period (OEP) operations
- [ ] Support annual redetermination and re-enrollment
- [ ] Process and resolve DMIs within required timelines
- [ ] Migrate to ARC-AMPE by applicable deadline (DEE: June 2026)
- [ ] Maintain data retention compliance (6-year HIPAA minimum)
- [ ] Respond to CMS compliance reviews and inquiries

---

## Appendix C: Key Regulatory Cross-Reference

| Requirement Area | Primary Regulation | Secondary References |
|---|---|---|
| Web-Broker Standards | 45 CFR 155.220 | Web-Broker Agreement |
| DE Entity Standards | 45 CFR 155.221 | EDE Business Agreement |
| Privacy/Security | 45 CFR 155.260 | MARS-E/ARC-AMPE, ISA |
| Eligibility Determinations | 45 CFR 155.302, 155.305, 155.310 | CMS API documentation |
| Plan Display | 45 CFR 155.205(b)(1) | 45 CFR 156.265(b)(3)(iv) |
| HIPAA Transactions (834) | 45 CFR 162.1502 | ASC X12N/005010X220A1 |
| HIPAA Acknowledgments (999) | 45 CFR 162 | ASC X12N/005010X231A1 |
| HIPAA Privacy/Security | 45 CFR 164 | Subparts C, D, E |
| Machine-Readable Data | 45 CFR 156.122(d), 156.230(c) | QHP certification requirements |
| Interoperability (FHIR) | CMS-0057-F | HL7 FHIR, USCDI |
| FTI Safeguarding | IRC 6103 | IRS Publication 1075 |
| Identity Proofing | NIST SP 800-63A | IAL2 requirements |
| Accessibility | Section 508, HHS Final Rule 2024 | WCAG 2.1 AA |
| Nondiscrimination | Section 1557 ACA | Language access, disability access |
