Broker Attestations

Applicable to All Producers Registered to Sell Insurance on DC Health Link¹

By logging into DC Health Benefit Exchange Authority’s (DCHBX) Trained Experts website on DC Health Link, a producer attests to the following as a condition of maintaining their registration and “Approved Broker” designation for DC Health Link:

1. Producer attests that they have and will maintain a license in good standing with the DC Department of Insurance, Securities and Banking (DISB) as an insurance producer authorized to sell health insurance.
2. Producer attests that they will complete and comply with all current and future training requirements established by DCHBX in a timely manner and will not misrepresent satisfactory completion of or cheat on an examination for DCHBX required training.
3. Producer attests that they will adhere to all guidelines regarding the use of DC Health Link’s logo and branding.
4. Producer attest that they are appointed with all of the insurance carriers and their corresponding entities for the markets in which they participate.
5. Producer attests that they will provide DCHBX notification of status changes including, but not limited to, name changes, licensure standing changes, carrier appointments, changes in markets served, address or employment changes, and contact information changes, within 30 calendar days of any such change. Such notification can be made by email to [email protected] or via webform.
6. Producer attests that they will maintain a current email address where DCHBX will send notices.
7. Producer attests that they will not receive compensation from an individual or small employer for their enrollment through DC Health Link.
8. Producer attests that when quoting or prior to enrolling individuals or small employers through DC Health Link they will inform the individual or small employers of all the plan options available to them on DC Health Link.
9. Producer attests that they will use privacy and security standards at least as protective as DCHBX has established and implemented for itself, including but not limited to the requirements set forth in 45 C.F.R. § 155.260, the Privacy and Security Policies for the DC Health Benefit Exchange Authority Website, the Privacy and Security Policies for Exchange Operations, and the Privacy Act.
10. Producer attests that they shall not use or disclose personally identifiable information (PII) other than as permitted or required by this document or as required by law. “Personally identifiable information” or “PII” shall mean personally identifiable information as defined by OMB Memorandum M-17-12 (January 3, 2017) (“‘personally identifiable information’ refers to information which can be used to distinguish or trace an individual’s identity, such as their name, social security number, biometric records, etc. alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc.”).
11. Producer attests that they will create, collect, disclose, access, maintain, store, or use PII from consumers to the extent these activities are necessary to carry out the authorized functions outlined in this document. These authorized functions include, but are not limited to:
    
    1. Supporting qualified health plan (QHP) selection, (re-)enrollment and disenrollment;
    2. Assisting consumers with applications for QHP eligibility, including filing appeals of eligibility determinations in connection with DC Health Link;
    3. Educating and assisting consumers with applications for insurance affordability programs, including advance premium tax credit (APTC), selecting an APTC amount, and eligibility for Medicaid or DC Healthcare Alliance coverage;
    4. Assisting with applications for and determinations of certificates of exemption;
    5. Assisting enrollees with reporting changes in eligibility status to DC Health Link, including changes that may impact eligibility (e.g., adding a dependent); and
    6. Carrying out Producer’s legal responsibilities in DC Health Link, pursuant to Producer’s contractual relationships with QHP carriers.
12. Producer attests that they shall monitor, periodically assess, and update its security controls and related system risks to ensure the continued effectiveness of those controls.
13. Producer attests they will inform the Exchange of any change in Producer’s administrative, technical, or operational environments that would be material to Producer’s compliance with this Statement of Attestations for Work with DC Health Link.
14. Producer attests that it shall bind any downstream entities to the same privacy and security standards and obligations to which Producer has agreed in this document.

15. Producer attests that they will report to DCHBX all suspected or confirmed incidents involving use or disclosure of PII not permitted under this document or required by law. An “incident” is defined by OMB Memorandum M-17-12 as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. An incident is used to include the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar term referring to situations where persons other than authorized users and for an other than authorized purpose have access or potential access to personally identifiable information, whether physical or electronic.

    Producer shall report all suspected or confirmed incidents involving use or disclosure of PII to the DCHBX within one (1) hour of discovery. Producer shall notify DCHBX via email to [email protected] or by calling (855) 532-5465 / TTY: 711 and requesting escalation to the Privacy Officer. Producer shall assist DCHBX in its investigation of any suspected or confirmed privacy incident. Producers who make a willful breach of privacy or have a pattern of privacy incidents may be reported to DISB.

16. Producer attests that they will provide complaint information submitted by individuals and small employer’s they have enrolled through DC Health Link to the appropriate agency in a timely manner.
17. Producer attests that they will make relevant referrals to the DC Healthcare Alliance or to other agencies or programs as appropriate.
18. Producer attests they will maintain an exemplary standard of professional conduct, including providing the highest level of service to all individuals and treating all individuals with respect.
19. Producer attests that they will maintain complete and accurate records for a minimum of (3) years of all transactions pertaining to applications submitted to DC Health Link, and any other documents as may be required by law. Producer attests that they will make such records available to DCHBX upon reasonable prior notice.
20. Producer attests they will indemnify and hold harmless DCHBX and all of its executive board, officers, agents and servants against any and all claims of liability or lawsuits arising from or based on, or as a consequence of or result of, any act, omission or default of Producer, in activities related to DCHBX and DC Health Link including, but not limited to, misuse of private information.
21. Producer attests to requiring staff to complete Broker Staff Role Training every two years in coordination with the Broker’s recertification date. Producer attests that they will obtain and maintain written attestations from each staff member authorized to use the DC Health Link system upon completion of training. Producer attests that they will maintain all written attestations and produce upon request by HBX.

Producer attests to requiring staff that have staff roles in the DC Health Link system to take the Privacy Training module as legally required (initially before staff have been granted access to DC Health Link and annually, as determined by HBX, thereafter). Producer attests that they will obtain and maintain written attestations from each staff member authorized to use the DC Health Link system upon completion of training. Producer attests that they will maintain all written attestations and produce upon request by HBX.

These attestations shall remain in effect unless and until there is termination of Producer’s registration for DC Health Link. All requirements imposed hereunder with respect to recordkeeping and privacy and security of PII shall survive the termination of the producer’s registration with DC Health Link.

A Producer may be decertified for cause, including when a Producer’s license has been suspended, cancelled, surrendered or otherwise terminated, if the Producer fails to complete DC Health Link required training, or as otherwise authorized by law.

¹ DC Health Benefit Exchange Authority’s DC Health Link Statement of Producer Attestations does not apply to producers who are employed by carriers and may register as certified application counselors.

Attachment(s): Statement of Producer Attestations