45 CFR 155.260

No changes recorded yet — we are watching, and nothing has been published.

1. 2026-03-04 Compliance date for ARC-AMPE Version 1.0, the CMS security and privacy controls for Exchanges and partner entities
2. 2025-03-04 CMS released ARC-AMPE Version 1.0, which supersedes MARS-E
3. 2012-05-29 Section 155.260 took effect with the Exchange establishment rule

1. 2016-09-06
   45 CFR 155.260 (as amended September 2016) AmendmentCurrent text

   The civil money penalty in paragraph (g) became "$25,000 as adjusted annually under 45 CFR part 102" as part of HHS's inflation adjustment of civil penalties. source

2. 2016-03-08
   Notice of Benefit and Payment Parameters for 2017 Amendment

   Technical correction to paragraph (a)(1) so that it cites section 155.300 for the definition of insurance affordability programs. source

3. 2014-05-27
   Exchange and Insurance Market Standards for 2015 and Beyond Amendment

   Revised paragraph (g) so that the existing civil money penalty of up to $25,000 per person or entity, per use or disclosure, follows the bases and process in the new 45 CFR 155.285. source

4. 2014-03-11
   Notice of Benefit and Payment Parameters for 2015 Amendment

   Revised paragraphs (a)(1), (a)(2) and (b), adding the process for HHS approval of other uses and disclosures and the contract terms that bind non-Exchange entities. source

5. 2012-05-29
   Correction of the Exchange establishment rule Errata

   Corrected wording in paragraphs (a)(3) and (d) of section 155.260. source

Binds the Exchange itself and, by contract, every non-Exchange entity that handles applicants' personally identifiable information for it.

Purpose limit

An Exchange may use or disclose eligibility and enrollment PII only as needed for its functions, or for other functions approved by HHS with the individual's consent. source

Eight principles

The Exchange's standards must follow eight principles: individual access, correction, openness, individual choice, collection and use limits, data quality, safeguards and accountability. source

Non-Exchange entities

Any person or entity that gains access to PII submitted to an Exchange, or collects it from applicants while performing functions agreed with the Exchange. source

Contract terms

Before access, the Exchange must sign an agreement binding the entity to its privacy and security standards, to monitor its controls, report material changes and bind downstream entities. source

Tax information

Federal tax return information must be kept confidential and used only in accordance with section 6103 of the Internal Revenue Code. source

Control catalogue

CMS describes ARC-AMPE as the next iteration of its Exchange security and privacy standards (citing section 155.260); ACA Administering Entities and select Partner Entities must comply with ARC-AMPE Volume II. source

Exchanges must keep assessing their own controls, and HHS oversees compliance through audits, investigations and inspections.

Ongoing assessment

The Exchange must monitor, periodically assess and update its security controls, and must require the same of non-Exchange entities by contract. source

Written policies

Privacy policies and procedures must be in writing and available to the Secretary of HHS on request. source

HHS oversight

HHS may conduct audits, investigations, inspections and other oversight, and may pursue civil, criminal or administrative proceedings. source

ARC-AMPE artifacts

Entities subject to ARC-AMPE Volume II complete artifacts, such as a System Security and Privacy Plan, to document their compliance. source source

Knowing and willful misuse or disclosure of Exchange information carries a civil money penalty per use or disclosure, on top of any other penalties in law.

Who can be penalised

Individuals, corporations, Exchanges, Medicaid and CHIP agencies, agents, brokers, web-brokers, issuers, Navigators, assisters and other third-party contractors. source

Factors

HHS may weigh the number and severity of violations and the person's history with the Exchange, among other factors. source

1. Law text 45 CFR 155.260 – Privacy and security of personally identifiable information
2. Law text 45 CFR 155.280 – Oversight and monitoring of privacy and security requirements
3. Law text 45 CFR 155.285 – Civil penalties for improper use or disclosure of information
4. Guidance ARC-AMPE Volume I (Version 1.02, April 2025)
5. Template CMS Marketplace regulations and guidance (ARC-AMPE Volume II overlays)

1. MARS-E

   MARS-E was CMS's control catalogue implementing section 155.260; CMS states it has been superseded by ARC-AMPE, while section 155.260 itself is the binding rule.

2. HIPAA

   The HIPAA Security Rule covers covered entities' electronic health information; section 155.260 covers personally identifiable information handled by Exchanges and their partners.

3. FIPPs

   The Fair Information Practice Principles are general privacy principles; section 155.260 writes eight of them into binding Exchange standards.

4. IRS Publication 1075

   IRS Publication 1075 sets safeguards for federal tax information; section 155.260 requires Exchanges to keep such return information confidential under section 6103.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to 45 CFR 155.260 (RSS)