(a) Enrollee identification numbers. An issuer of a risk adjustment covered plan or a reinsurance-eligible plan in a State in which HHS is operating the risk adjustment or reinsurance program, as applicable, must—

(1) Establish a unique masked enrollee identification number for each enrollee; and

(2) Maintain the same masked enrollee identification number for an enrollee across enrollments or plans within the issuer, within the State, during a benefit year.

(b) Prohibition on personally identifiable information. An issuer of a risk adjustment covered plan or a reinsurance-eligible plan in a State in which HHS is operating the risk adjustment or reinsurance program on behalf of the State, as applicable, may not—

(1) Include enrollee's personally identifiable information in the masked enrollee identification number; or

(2) Use the same masked enrollee identification number for different enrollees enrolled with the issuer.