Privacy Protections for California’s Insurance Exchange

Under health reform, the federal government (and states at their option) will create exchanges to connect individuals and small businesses with affordable health insurance coverage and determine individual eligibility for public insurance programs and financial subsidies.

These exchanges will collect, use and share personal information. Federal regulators have set baseline privacy and security rules to govern exchanges, but states are still required to develop specific privacy and security policies for their exchanges and ensure exchange compliance with other applicable privacy laws.

This paper focuses on California’s exchange, summarizing the federal and state privacy rules that apply, and calling on state policymakers to develop a comprehensive framework of privacy and security policies to build and maintain public trust in the exchange.