1. (a) An agent, broker, or issuer participating in direct enrollment must engage a third-party entity to conduct an annual review to demonstrate operational readiness in accordance with §§ 155.220(c)(3)(i)(K) and with 156.1230(b)(2) of this subchapter. The third-party entity will be a downstream or delegated entity of the agent, broker or issuer that participates or wishes to participate in direct enrollment.

2. (b) An agent, broker, or issuer participating in direct enrollment must satisfy the requirement to demonstrate operational readiness under paragraph (a) of this section by engaging a third-party entity that meets each of the following standards:

   1. (1) Has experience conducting audits or similar services, including experience with relevant privacy and security standards;
   2. (2) Adheres to HHS specifications for content, format, privacy, and security in the conduct of an operational readiness review, which includes ensuring that agents, brokers, and issuers are in compliance with the applicable privacy and security standards and other applicable requirements;
   3. (3) Collects, stores, and shares with HHS all data related to the third-party entity's audit of agents, brokers, and issuers in a manner, format, and frequency specified by HHS until 10 years from the date of creation, and complies with the privacy and security standards HHS adopts for agents, brokers, and issuers as required in accordance with § 155.260;
   4. (4) Discloses to HHS any financial relationships between the entity and individuals who own or are employed by an agent, broker, or issuer for which it is conducting an operational readiness review.
   5. (5) Complies with all applicable Federal and State requirements;
   6. (6) Ensures, on an annual basis, that appropriate staff successfully complete operational readiness review training as established by HHS prior to conducting audits under paragraph (a) of this section;
   7. (7) Permits access by the Secretary and the Office of the Inspector General or their designees in connection with their right to evaluate through audit, inspection, or other means, to the third-party entity's books, contracts, computers, or other electronic systems, relating to the third-party entity's audits of agent's, broker's, or issuer's obligations in accordance with Federal standards under paragraph (a) of this section until 10 years from the date of creation; and
   8. (8) Complies with other minimum business criteria as specified in guidance by HHS.
3. (c) An agent, broker or issuer may engage multiple third-party entities to conduct the audit under paragraph (a) of this section and each third-party entity must satisfy the standards outlined under paragraph (b) of this section.

[83 FR 17061, Apr. 17, 2018]