I85PREP
⌘ K
CMS FFM Agent study materials
CMS FFM Agent study resources

CMS FFM Agent: Consumer protections and compliance

CMS FFM Agent · Work through your exam, one topic at a time.

All guide sections

Consumer protections and compliance

Domain 4 tests the consumer-protection and compliance rules that apply to FFM agents and brokers: privacy, nondiscrimination, marketing conduct, appeals, and recordkeeping.

Core protections

  • Guaranteed issue and renewability: QHP issuers cannot deny coverage or charge more because of health status, and cannot rescind coverage except for fraud or intentional misrepresentation.
  • No pre-existing condition exclusions; no annual or lifetime dollar limits on EHBs; dependent coverage through age 26.
  • Appeals: consumers can request an internal appeal and, for eligible denials, an external review. Agents should explain deadlines and help consumers use the plan's appeal process, not promise outcomes.
  • Privacy: HIPAA and Marketplace privacy rules apply to personally identifiable information and protected health information. Access consumer data only with consent and on a need-to-know basis. Do not share application data without authorization.
  • Nondiscrimination: Section 1557 and Marketplace standards prohibit discrimination based on race, color, national origin, sex, age, disability, and other protected classes. Provide language access and disability accommodations.
  • Marketing: identify yourself accurately, do not impersonate the government or use official logos deceptively, do not misrepresent plan benefits or costs, and do not enroll a consumer without consent.
  • Compliance: report suspected fraud, waste, and abuse; retain records, generally 10 years; cooperate with audits; follow the agent/broker agreement and state law.

Worked example

An agent receives a lead, uses the consumer's identity to log in to HealthCare.gov without consent, and submits an application with an income estimate the consumer never confirmed. Problems include accessing data without consent, failing to verify application information, and potentially submitting false information. Even if the enrollment helps the consumer, the conduct violates privacy and registration duties and can lead to termination, civil penalties, and licensing action.

Traps

  • Assuming HIPAA does not apply because the Marketplace is a government program.
  • Using official branding or implying government endorsement.
  • Relying on verbal permission without documenting consent.
  • Failing to escalate a data breach or suspected fraud.