(a) General standard. Issuers offering QHPs in a Federally-facilitated Exchange may be subject to compliance reviews to ensure ongoing compliance with Exchange standards applicable to issuers offering QHPs in a Federally-facilitated Exchange.

(b) Records. In preparation for or in the course of the compliance review, a QHP issuer must make available for HHS to review the records of the QHP issuer that pertain to its activities within a Federally-facilitated Exchange. Such records may include, but are not limited to the following:

(1) The QHP issuer's books and contracts, including the QHP issuer's policy manuals and other QHP plan benefit information provided to the QHP issuer's enrollees;

(2) The QHP issuer's policies and procedures, protocols, standard operating procedures, or other similar manuals related to the QHP issuer's activities in a Federally-facilitated Exchange;

(3) Any other information reasonably necessary for HHS to—

(i) Evaluate the QHP issuer's compliance with QHP certification standards and other Exchange standards applicable to issuers offering QHPs in a Federally-facilitated Exchange;

(ii) Evaluate the QHP's performance, including its adherence to an effective compliance plan, within a Federally-facilitated Exchange;

(iii) Verify that the QHP issuer has performed the duties attested to as part of the QHP certification process; and

(iv) Assess the likelihood of fraud or abuse.

(c) Interest of Qualified Individuals and Qualified Employers. HHS's findings from the compliance reviews under this section may be in conjunction with other findings related to the QHP issuers' compliance with certification standards, used to confirm that permitting the issuer's QHPs to be available through a Federally-facilitated Exchange is in the interest of the qualified individuals and qualified employers as provided under §155.1000(c)(2) of this subchapter.

(d) Onsite and desk reviews. The QHP issuer will make available, for the purposes listed in paragraph (c) of this section, its premises, physical facilities and equipment (including computer and other electronic systems), for HHS to conduct a compliance review as provided under this section.

(1) A compliance review under this section will be carried out as an onsite or desk review based on the specific circumstances.

(2) Unless otherwise specified, nothing in this section is intended to preempt Federal laws and regulations related to information privacy and security.

(e) Compliance review timeframe. A QHP issuer may be subject to a compliance review up to 10 years from the last day of that plan benefit year, or 10 years from the last day that the QHP certification is effective if the QHP is no longer available through a Federally-facilitated Exchange; provided, however, that if the 10 year review period falls during an ongoing compliance review, the review period would be extended until the compliance review is completed.

(f) Failure to comply. A QHP issuer that fails to comply with a compliance review under this section may be subject to enforcement remedies under subpart I of this part.

[78 FR 65100, Oct. 30, 2013, as amended at 81 FR 94182, Dec. 22, 2016]