Protect ACA Exchange data and meet 45 CFR 155.260 with confidence

45 CFR 155.260 is the federal regulation that governs the privacy and security of personally identifiable information handled by Affordable Care Act health insurance Exchanges. Issued by HHS under section 1411(g) of the Affordable Care Act, it limits how Exchanges create, collect, use and disclose that information, requires privacy and security standards based on eight principles, and sets safeguards, written policy, workforce and contract obligations.

ACA Exchanges must comply directly, including state-based Exchanges and the Federally-facilitated Exchange. Any individual or organisation that gains access to Exchange personally identifiable information, or collects it while performing functions agreed with an Exchange, is a non-Exchange entity. That includes agents, brokers, web-brokers, navigators and IT contractors, who must be bound by contract to privacy and security standards at least as protective as the Exchange's own.

Paragraph (a)(3) requires Exchanges to adopt privacy and security standards consistent with eight principles: individual access, correction, openness and transparency, individual choice, collection, use and disclosure limitations, data quality and integrity, safeguards, and accountability. These mirror widely used fair information practice principles, and paragraph (a)(4) then sets six specific safeguard objectives, including protecting tax return information and securely disposing of data under retention schedules.

Under paragraph (g), any person who knowingly and willfully uses or discloses information in violation of section 1411(g) of the Affordable Care Act faces a civil money penalty of up to $25,000, adjusted annually for inflation, per person or entity, per use or disclosure. Penalties follow the process in 45 CFR 155.285 and can apply in addition to other penalties under law, such as those for misusing federal tax return information.

Before an entity becomes a non-Exchange entity, the Exchange must sign an agreement that describes the functions it will perform, binds it to specified privacy and security standards, requires it to monitor, assess and update its security controls, requires it to report material changes to its environment, and requires it to bind any downstream entities to the same standards and obligations.

45 CFR 155.260 sets the legal requirement, while CMS publishes the detailed security and privacy controls used to meet it. CMS's Minimum Acceptable Risk Standards for Exchanges, known as MARS-E, filled that role for years. In 2025 CMS published ARC-AMPE, the Acceptable Risk Controls for ACA, Medicaid and Partner Entities, which supersedes MARS-E and draws its controls from NIST SP 800-53 Revision 5.

45 CFR 155.260 is separate from HIPAA, though both are HHS rules protecting health-related personal information and many organisations handle both. ISO 27001 and SOC 2 do not satisfy it on their own, but their access control, risk assessment, vendor management, policy and monitoring controls overlap heavily with its safeguard requirements, so existing evidence can often be reused once the additional privacy and contract obligations are covered.

Yes, on request. 45 CFR 155.260 is mapped in OneClickComply's control library, so its requirements can be linked to controls you already run for frameworks such as ISO 27001, SOC 2 or NIST. Contact OneClickComply to enable it for your organisation. OneClickComply helps you collect evidence, generate policies and monitor controls, but it does not certify compliance or replace any CMS review.