(a) Data collection. If a State establishes a reinsurance program, the State must ensure that the applicable reinsurance entity:

(1) Collects data required to determine reinsurance payments as described in §§153.230 and 153.232, as applicable, from an issuer of reinsurance-eligible plans or is provided access to such data, according to the data requirements specified by the State in the State notice of benefit and payment parameters described in subpart B of this part.

(2) Makes reinsurance payments to the issuer of a reinsurance-eligible plan after receiving a valid claim for payment from that health insurance issuer in accordance with the requirements of §153.410.

(3) Provides a process through which an issuer of a reinsurance-eligible plan that does not generate individual enrollee claims in the normal course of business may use estimated claims costs to make a request for payment (or to submit data to be considered for reinsurance payments) in accordance with the requirements of §153.410. The State must ensure that such requests for reinsurance payment (or a subset of such requests) are subject to validation.

(b) Notification of reinsurance payments. For each applicable benefit year,

(1) A State, or HHS on behalf of the State, must notify issuers annually of:

(i) Reinsurance payments under the national payment parameters, and

(ii) Reinsurance payments under the State supplemental payment parameters if applicable, to be made for the applicable benefit year no later than June 30 of the year following the applicable benefit year.

(2) A State must provide to each issuer of a reinsurance-eligible plan the calculation of total reinsurance payment requests, on a quarterly basis during the applicable benefit year in a timeframe and manner specified by HHS, made under:

(i) The national reinsurance payment parameters, and

(ii) State supplemental reinsurance payments parameters if applicable.

(c) Maintenance of records. If a State establishes a reinsurance program, the State must maintain documents and records relating to the reinsurance program, whether paper, electronic, or in other media, for each benefit year for at least 10 years, and make them available upon request from HHS, the OIG, the Comptroller General, or their designees, to any such entity. The documents and records must be sufficient to enable the evaluation of the State-operated reinsurance program's compliance with Federal standards. The State must also ensure that its contractors, subcontractors, and agents similarly maintain and make relevant documents and records available upon request from HHS, the OIG, the Comptroller General, or their designees, to any such entity.

(d) Privacy and security.

(1) If a State establishes a reinsurance program, the State must ensure that the applicable reinsurance entity's collection of personally identifiable information is limited to information reasonably necessary for use in the calculation of reinsurance payments, and that use and disclosure of personally identifiable information is limited to those purposes for which the personally identifiable information was collected (including for purposes of data validation).

(2) If a State establishes a reinsurance program, the State must ensure that the applicable reinsurance entity implements security standards that provide administrative, physical, and technical safeguards for the personally identifiable information consistent with the security standards described at 45 CFR 164.308, 164.310, and 164.312.

[77 FR 17247, Mar. 23, 2012, as amended at 78 FR 15527, Mar. 11, 2013; 78 FR 65093, Oct. 30, 2013]