Explore Health Privacy Policy

1.  Purpose

The Oregon Health Insurance Marketplace (“Marketplace") owns and operates the Explore Health platform and consumer assistance center, which function as Oregon's Health Insurance Exchange under the Affordable Care Act (ACA). As part of Explore Health's responsibilities, it will collect sensitive information from Individuals to perform its ACA-mandated functions, such as enrolling Individuals in Qualified Health Plans (QHPs) or Qualified Dental Plans (QDPs) and determining eligibility for a Premium Tax Credit (PTC) or Cost-Sharing Reductions (CSR). To do this, Explore Health is required to collect Personally Identifiable Information (PII) and Protected Health Information (PHI). Both PII and PHI are protected by federal and state laws.

At Explore Health, individual privacy is important. Explore Health respects your right to privacy and will strive to protect information we maintain about you in the ongoing operation of the health insurance exchange in accordance with the applicable laws, regulations, and standards for security and privacy.

This Privacy Policy describes how information gathered by Explore Health from various sources – such as the individual (applicant), parents and guardians of child or incapacitated applicants, employers, employees, and from governmental sources – may be collected, used, disclosed, and accessed. Explore Health may revise this Privacy Policy periodically to reflect changes in applicable law, technology, operational practices, or Marketplace functions. The most current version of this policy will be made available through Explore Health's official website.

2.  Scope & Applicability

This Privacy Policy applies to all PII, PHI, and other information collected, created, received, maintained, used, disclosed, or stored by Explore Health in connection with its administration of Oregon's Health Insurance Marketplace.

This policy applies to:

• Individuals who apply for, enroll in, or renew health or dental coverage through Explore Health.
• Parents, guardians, or authorized representatives acting on behalf of applicants or enrollees.
• Individuals seeking information or assistance through Explore Health's website, Customer Assistance Center, email, mail, chat, surveys, appeals, or other communication channels.
• Explore Health employees, contractors, vendors, and authorized third parties who access or handle information on behalf of Explore Health.
• Certified enrollment partners, including insurance agents, certified assisters, and community partner organizations authorized to assist consumers.

This policy governs the collection, use, disclosure, storage, protection, retention, and disposal of information obtained through Explore Health's programs, services, systems, and operations in accordance with applicable federal and state laws and regulations.

3.  Definitions

For purposes of this Privacy Policy, the following definitions apply:

• Affordable Care Act: The Patient Protection and Affordable Care Act, as amended by the Health Care and Education Reconciliation Act of 2010, which established health insurance exchanges and governs many of Explore Health's privacy, security, and eligibility requirements.
• Applicant: An individual seeking eligibility for enrollment in a QHP, QDP, the Oregon Health Plan (OHP), or other insurance affordability programs administered through Explore Health.
• Authorized Representative: An individual designated by an applicant or enrollee to act on their behalf in matters related to eligibility, enrollment, appeals, or other Marketplace activities.
• Cost-sharing Reductions: Federal financial assistance that lowers eligible individuals' out-of-pocket costs, such as deductibles, copayments, and coinsurance, when enrolled in a qualifying health plan.
• Enrollment Partner: A certified insurance agent, assister, or community partner organization authorized by Explore Health to provide Marketplace education and enrollment assistance to consumers.
• Individual: Unless otherwise specified, "Individual" refers to an applicant, enrollee, consumer, parent, guardian, or authorized representative who interacts with Explore Health.
• Oregon Health Plan (OHP): Oregon's Medicaid, Children's Health Insurance Program (CHIP), and Basic Health Program, administered by the Oregon Health Authority to provide health coverage to eligible individuals and families.
• Personally Identifiable Information: Information that identifies or can reasonably be used to identify an individual, either alone or when combined with other information. Examples include a person's name, address, telephone number, email address, Social Security number, date of birth, or other identifying information.
• Premium Tax Credit: Federal financial assistance that helps eligible individuals and families reduce the cost of health insurance premiums for coverage purchased through Explore Health.
• Protected Health Information: Individually identifiable health information that is created, received, maintained, used, or disclosed by Explore Health and is protected under applicable federal and state privacy laws.
• Qualified Dental Plan: A dental insurance plan that has been certified to be offered through Explore Health in accordance with applicable federal requirements.
• Qualified Health Plan: A health insurance plan that has been certified to be offered through Explore Health and meets the requirements established under the Affordable Care Act.

4.  Children's Data Protections

Explore Health collects and maintains information about children only as necessary to determine eligibility for health coverage, financial assistance, or related Marketplace functions. Information about children may be provided by a parent, guardian, or authorized representative and is protected under all applicable federal and state privacy laws, including the Affordable Care Act, the Health Insurance Portability and Accountability Act (HIPAA), and Oregon privacy regulations.

Explore Health may collect information from or about individuals under the age of 18 when necessary to provide services, process an application, or support their health coverage. All interactions and submissions involving minors' data must be conducted by an adult acting on the child's behalf. Children's PII/PHI is used only for eligibility determinations, enrollment, financial assistance calculations, and other Marketplace operations permitted by federal or state law.

Requests to correct, update, or delete a child's information may be made at any time by the parent, guardian, or authorized representative through the Explore Health online portal or by contacting the Customer Assistance Center. This includes demographic details, income information relevant to eligibility, and documentation required to verify identity, citizenship, or immigration status when applicable. When a child's information is no longer required for eligibility, enrollment, audit, or regulatory purposes, it is retained and securely destroyed in accordance with Explore Health's data retention and destruction standards.

5.  Privacy and Security Partnership

Your privacy is best protected by a partnership between Explore Health and you. We take steps to protect your privacy in accordance with the privacy and security standards for the protection of PII and PHI established in the ACA and its regulations (45 C.F.R. § 155.260). The information in this Privacy Policy will allow you to make informed decisions about your interactions with Explore Health, such as decisions about whether to share PII or PHI with us.

6.  Third-Party Service Providers

Explore Health works with contractors, vendors, service providers, insurance companies, certified enrollment partners, and other authorized third parties to support the administration and operation of Oregon's health insurance marketplace. These partners provide services that may include information technology, customer support, eligibility and enrollment assistance, communications, data management, and other operational functions.

Third-party service providers that create, receive, access, maintain, use, disclose, or store PII or PHI on behalf of Explore Health are required to safeguard your data in accordance with applicable federal and state laws, regulations, contractual requirements, and Marketplace privacy and security policies.

Explore Health requires its contractors, vendors, and other authorized third parties to:

• Protect the confidentiality, integrity, and availability of information entrusted to them.
• Access, use, and disclose information only as necessary to perform authorized services.
• Maintain appropriate administrative, technical, and physical safeguards to protect information from unauthorized access, use, disclosure, alteration, or destruction.
• Promptly report suspected or confirmed privacy or security incidents involving Explore Health information, as required by law, contract, or Marketplace policy.
• Cooperate with privacy, security, compliance, or audit activities, as appropriate.

Explore Health may share information with third-party service providers only to the extent necessary for them to perform authorized services on behalf of the Marketplace. All third-party service providers are contractually obligated to comply with applicable privacy and security requirements and are prohibited from using or disclosing information for unauthorized purposes.

Third-party technology providers that support Explore Health's website and digital services, including website analytics, tag management, accessibility, and performance monitoring services, are engaged under applicable agreements and are required to comply with contractual privacy, confidentiality, and security obligations. These providers may process information only as necessary to perform authorized services on behalf of Explore Health and may not use or disclose information for their own purposes except as permitted by law or contract.

7.  Transparency and Openness

Explore Health is committed to being transparent about how it collects, uses, protects, shares, and retains PII and PHI.

This Privacy Policy is intended to help individuals understand:

• What information Explore Health collects.
• Why the information is collected.
• How the information is used and protected.
• When and with whom information may be shared.
• The choices and rights available to individuals regarding their information.
• How individuals may access, correct, or inquire about their information.

Explore Health will make this Privacy Policy publicly available and will update it as necessary to reflect changes in applicable laws, regulations, operational practices, or Marketplace services. When material revisions are made, the most current version of the policy will be posted through Explore Health's official communication channels.

Explore Health is committed to administering its privacy practices in a manner that promotes accountability, transparency, and public trust while supporting its responsibility to administer Oregon's health insurance exchange.

8.  Collection of Information

Explore Health collects information from you that you provide voluntarily through several mechanisms, such as surveys, electronic messages you choose to send to Explore Health, the application process, verbal interactions with our employees and our Customer Assistance Center representatives, and appeals you may file. Surveys, for instance, may collect PII you voluntarily submit, such as name, e-mail address, mailing address, or telephone number. Explore Health may collect information through other means so that we may contact you to follow up to your questions, concerns, or recommendations. Electronic messages sent by you may contain PII, such as your name, e-mail address, mailing address, or telephone, and any other information you choose to give us to help us answer your inquiry. Applications also will include specific PII or PHI, such as Social Security numbers (SSN) and, in some instances, tax and income information.

If you opt in to receive text messages (SMS), Explore Health may use your phone number to send you important notifications about your account. Message frequency varies. Message and data rates may apply. You may opt out of text messages at any time by replying STOP to any message.

Please know that Explore Health will only collect the minimum information necessary to achieve its mission of providing affordable health insurance to individuals in Oregon. The information collected during the application process, enrollment, customer support, and renewals will only be used to ensure the efficient operation of Explore Health, verify the eligibility of an individual to enroll through Explore Health or to claim a PTC or CSRs, and the amount of the PTC or CSRs. This information will not be shared, sold, or transferred to any third party for the third party's direct marketing purposes without your prior consent and will not be provided to any other person or entity unless it is required to determine eligibility or enroll in a QHP/QDP. Once you voluntarily submit your PII or PHI to Explore Health, it will be governed by federal and state laws and regulations, including but not limited to section 155.260 of the ACA's regulations (45 C.F.R. § 155.260).

To facilitate enrollment in Explore Health, and to determine eligibility for QHPs/QDPs, PTC, and CSRs, Explore Health must collect necessary information to authenticate identity, citizenship status, residency, income, and incarceration status. This data includes, but is not limited to:

The information that you voluntarily submit to Explore Health may be used for purposes such as:

• Determining eligibility for enrollment in QHP/QDPs;
• Assessing eligibility for Oregon's Medicaid/Children's Health Insurance Program /Basic Health Program, called Oregon Health Plan, and other insurance affordability programs;
• Determining eligibility for financial help like a PTC or CSRs;
• Answering your questions;
• Responding to requests for assistance;
• Generating summary statistics about usage;
• Auditing applications and detecting fraud;
• Aiding in the planning, design, and development of Explore Health operations and Explore Health's website; and
• Fulfilling our legal obligations, including as necessary or advisable to protect Explore Health's rights, safety, or property or the rights, safety, or property of others to enforce this Privacy Policy and comply with legal process or cooperate with law enforcement or governmental requests.

Additionally, the information you voluntarily provide may be used to improve Explore Health's application and enrollment system and the overall usability of the site, some data regarding page views, browsing behavior, and system response times may also be collected. All personal data changes, eligibility results, plan selections, and any other action performed by the user will be tracked for audit and appeals purposes.

Each interaction between an individual and Explore Health's website or CAC will also be documented along with any communications, notifications, or emails. Additionally, telephone calls to Explore Health's CAC will be recorded for audit, training, and appeals purposes. The primary purpose of recording this information is to help improve the efficiency of Explore Health's operations, including streamlined support of the appeals process. Calling Explore Health's CAC will constitute consent to be recorded for these purposes.

The PII or PHI you provide us will be disclosed by us only to Explore Health employees, business partners, grantees, contractors, designees, governmental agencies, insurance companies, and (when required) to law enforcement officials on a “need to know" basis in order to fulfill their job responsibilities or duties in connection with Explore Health operations. This includes maintaining our website or improving customer experience and assisting with processing your application.

Explore Health will collect and aggregate the information you provide through surveys and other means for purposes of market research to make Explore Health more responsive to customer needs. From time to time, Explore Health may combine personal information we collect from you with information available from other sources (e.g., OHP eligibility information from the Oregon Department of Human Services (ODHS)). We will treat the combined information as PII.

Explore Health may, as permitted by law, use and share aggregate data or information that does not identify you (sometimes referred to as “de-identified" data). Such activities are not subject to restrictions under this Privacy Policy. We will not re-identify such data and will require our contracting parties to agree to keep the data in de-identified form.

9.  Cookies

If you interact with Explore Health through its website, ExploreHealthOR.gov, your browsing experience may be customized by utilizing your browser's “cookies" to store a randomly generated identifying tag on your computer. A cookie is a small text file that is saved on your computer when you visit a website

You can refuse the cookie or delete the cookie file from your computer browser at any time by using any one of several widely available methods. Cookies created by using our websites and stored on your computer do not contain PII/PHI and do not compromise your privacy or security.

Session cookies allow you to move through many pages of a website quickly and easily without having to authenticate or reprocess each new area you visit. Session cookies are destroyed after successful completion of a transaction, after a few minutes of inactivity, or when the browser is closed.

Persistent cookies help websites remember your information and settings when you visit them in the future. They continue to exist after a few minutes of inactivity, after the browser is closed or after a user completes a single session.

10.  Links

The information posted on Explore Health's website may include hyperlinks to information created and maintained by other public and/or private organizations, called external websites. These links are provided for your information and convenience. When you select a link to an outside website, you are leaving Explore Health's site and are subject to the privacy and security policies of the owners/sponsors of the external website.

Explore Health does not control or guarantee the accuracy, relevance, timeliness, or completeness of information contained on an outside website. Explore Health does not endorse the organizations sponsoring outside websites and does not endorse the views they express or the products/services they offer. Explore Health is not responsible for transmissions users receive from outside websites. Explore Health cannot guarantee that outside websites comply with accessibility requirements.

11.  Do I have to give PII or PHI to Explore Health?

By using Explore Health's services, whether through the website, customer assistance center, chat, email, mail, text message, or other means, you consent to the collection, use, and sharing of your information as outlined in this privacy policy and to the limitations on our responsibilities to you. You may opt out of SMS notifications at any time by replying STOP to a text message.

By providing information to Explore Health, you agree to be bound by these terms as in effect, all applicable laws and regulations, and any other applicable policies, terms, and guidelines established by Explore Health. If you do not agree with any of these terms, do not access Explore Health's website or customer assistance center.

You do not have to give PII or PHI to Explore Health. However, if you do not provide this information, it may delay or prevent Explore Health from deciding your eligibility for benefits/coverage, financial assistance, programs, or exemptions.

Be sure to provide correct information. Anyone who fails to provide correct information or who knowingly and willfully provides false or untrue information to Explore Health may be subject to a penalty and other law enforcement action.

People applying for coverage need to provide an SSN, if they have one. An applicant must also provide the SSN of any tax filer who is not applying for coverage if the tax filer's tax information will be used to verify the household's eligibility for help with paying for coverage. Other people who are not applying for coverage are not required to provide SSNs but may do so to speed up the application process.

Explore Health uses SSNs to check income and other information to see who is eligible for help with coverage costs. If you need help getting an SSN, visit SocialSecurity.gov, or call 800-772-1213. TTY users should call 800-325-0778.

12.  Authority to Collect

45 C.F.R. § 155.260 states that Explore Health may collect PII or PHI to determine eligibility for enrollment in QHP/QDPs and financial assistance, to assess potential eligibility for OHP, and to determine eligibility for exemptions. Explore Health will fully comply with this federal regulation. Explore Health will not create, collect, use or disclose PII or PHI for any purpose that is not authorized under this regulation.

The following principles are outlined in the regulation:

• Individual Access: Individuals will be provided with a simple and timely means to access and obtain their PII and PHI.
• Correction: Individuals will be provided with a timely means to dispute the accuracy of their PII and PHI and to have erroneous information corrected.
• Openness and Transparency: Explore Health maintains publicly available privacy policies and practices that describe how PII and PHI are collected, used, disclosed, protected, and managed.
• Individual Choice: Individuals will be provided with the reasonable opportunity and ability to make informed decisions about the collection, use, and disclosure of their PII and PHI.
• Collection, Use, and Disclosure Limitations: PII and PHI will be created, collected, used, and/or disclosed only to the extent necessary to accomplish the goals of Explore Health.
• Data Quality and Integrity: Persons and entities will take reasonable steps to ensure that personally identifiable health information is complete, accurate, and up to date to the extent necessary to provide services to the Individuals of Explore Health.
• Safeguards: PII and PHI are protected with reasonable operational, administrative, technical, and physical safeguards to ensure confidentiality, integrity, and availability and to prevent unauthorized access, use, or disclosure.
• Accountability: These principles are implemented, and adherence assured, through independent security audits by a third party.

13.  Information Sharing with External Entities

Explore Health will need to share information with insurance companies, as well as federal and state agencies to process requests for enrollment in QHPs/QDPs and determine eligibility for health/dental coverage and financial help. The following table outlines the entities Explore Health will share data with and how that data is used. All entities that receive data from Explore Health are required to support the same level of data security standards as Explore Health itself.

14.  Information Sharing with Enrollment Professionals

Individuals may, at their own discretion, elect to share their information with enrollment partners when requesting assistance with the application and enrollment process. Enrollment partners include:

• Assisters: Role was created under the ACA to provide impartial education to individuals regarding ACA health/dental plans and financial help but are not permitted to recommend specific plans.
• Insurance agents/brokers: Certified by Explore Health to provide ACA education and enrollment assistance and may offer plan recommendations based on an individual's specific requirements.

All enrollment partners are required to comply with the terms of this policy, as well as other criteria established by Explore Health.

Before information is shared with an enrollment partner, an individual must explicitly assign an assister or agent/broker using Explore Health's website, or by calling Explore Health's customer assistance center. Individuals may change or end their assignment at any time.

15.  Individual Access/Correction of Information

45 C.F.R. § 155.260 provides you with certain rights to get information about you that is in our records. Individuals may access their PII/PHI collected by Explore Health at any time through the user portal on Explore Health's website. Individuals are encouraged to review their application information on a regular basis to ensure continued accuracy. Incorrect information can be corrected directly through the applicant portal, or by contacting Explore Health's customer assistance center. Assigned enrollment partners can also correct information on behalf of their clients.

Please note that in accordance with ACA regulations, corrections to information provided on an application for coverage may result in a redetermination of eligibility.

16.  Website Technologies, Cookies, and Analytics

When individuals visit the Explore Health website, certain information is collected automatically to support website functionality, security, accessibility, performance, and continuous improvement of Marketplace services.

a.   Cookies and Session Management

Explore Health uses essential cookies and session technologies to support the operation of its website and secure online services. These technologies help:

• Maintain secure user sessions.
• Support authentication and account access.
• Remember user preferences and settings, where applicable.
• Protect against unauthorized access and maintain website security.

Essential cookies are necessary for the website to function properly and generally cannot be disabled without affecting the availability or functionality of certain services.

b.   Analytics and Website Improvement

Explore Health uses website analytics and performance tools to better understand how visitors interact with the website, improve accessibility and usability, identify technical issues, and enhance the delivery of Marketplace services.

Explore Health currently uses the following website technologies to support website operations, analytics, accessibility, and performance:

• Google Analytics 4 (GA4) to measure website traffic, visitor interactions, and overall website performance.
• Google Tag Manager (GTM) to manage and deploy website tags and analytics technologies without modifying website code for each update.
• SiteImprove to monitor website quality, accessibility, usability, broken links, and content performance, and to support compliance with digital accessibility standards.

These technologies may collect information such as:

• Browser type and version.
• Device type and operating system.
• Internet Protocol (IP) address or a truncated or masked version of the IP address, where applicable.
• Pages visited and navigation paths.
• Date and time of visits.
• Referring websites.
• General geographic location derived from IP address.
• Website performance metrics and aggregated usage patterns.

Explore Health uses this information to evaluate website performance, improve accessibility, enhance the user experience, maintain website security, identify technical issues, and improve Marketplace services. Analytics information is reviewed in aggregate and is not used to identify individual visitors or to make eligibility, enrollment, or coverage decisions.

Information entered into Explore Health applications, consumer accounts, or other secure transactions is not collected for website analytics purposes and remains subject to the privacy and security protections described elsewhere in this Privacy Policy.

c.   Managing Cookies

Most web browsers allow individuals to manage cookie preferences, including blocking or deleting cookies. Users should be aware that disabling essential cookies may affect the functionality or availability of certain features of the Explore Health website.

Individuals who wish to prevent information from being collected through Google Analytics may install the Google Analytics Opt-out Browser Add-on, available from Google for supported web browsers.

For additional information about how Google collects and processes information through Google Analytics, please refer to Google's Privacy Policy and information about Google Analytics.

For additional information about how Explore Health collects, uses, protects, and shares information, please refer to the applicable sections of this Privacy Policy.

17.  Operational, Technical, Administrative, and Physical Safeguards

Explore Health has taken several steps intended to safeguard the integrity of PII and PHI. Security measures have been integrated into the design, implementation, and day-to-day practices of the entire Explore Health operating environment as part of its continuing commitment to risk management. PII and PHI are protected with reasonable operational, administrative, technical, and physical safeguards to ensure confidentiality, integrity, and availability and to prevent unauthorized or inappropriate access, use, or disclosure. Explore Health utilizes industry standard methods and mechanisms for data protection, such as firewalls, intrusion monitoring, and passwords to protect electronic information. Multiple physical security methods, such as locking devices and premises monitoring, are also employed to protect information contained in documents. Explore Health's website is equipped with security measures intended to protect the information you provide us.

Consistent with all applicable laws and regulations, Explore Health will ensure that all information is protected through effective administrative and operational procedures. Explore Health does not guarantee the security of any information you transmit; however, Explore Health will take all reasonable steps to ensure the confidentiality, integrity, and availability of all PII and PHI that is created, collected, used, or disclosed by Explore Health.

PII and PHI will be used by, or disclosed to, only those authorized to receive or view it. In accordance with section 1411(g)(1) of the ACA, “[a]n applicant for insurance coverage or for a PTC or CSRs shall be required to provide only the information strictly necessary to authenticate identity, determine eligibility, and determine the amount of the credit or reduction."

The ACA prohibits the use of the information unless it is for Explore Health operations (such as verification of eligibility for enrollment, PTC, or CSRs). Any person who knowingly and willfully uses or discloses information in violation of the ACA may be subject to civil penalties, in addition to other penalties that may be prescribed by law or contract (42 U.S.C. § 18081).

Tax return information will be kept confidential in accordance with section 6103 of the Internal Revenue Code (26 U.S.C. § 6103). The IRS will disclose certain available items of federal tax return information to the Federal Data Services Hub after an individual applies for financial assistance in connection to obtaining coverage with Explore Health or ODHS, which administers OHP programs (Medicaid, CHIP, and basic health program). The items that will be disclosed through the Federal Data Services Hub are described in section 6103(l)(21)(A) of the Internal Revenue Code and the regulations issued thereunder. Section 6103 of the Internal Revenue Code protects the confidentiality of federal tax return information.

Disclosure of federal tax return information to the United States DHHS is allowed to implement eligibility determinations for health insurance affordability programs within the confidentiality requirements of section 6103.4 of the Internal Revenue Code.

PII and PHI will be protected against any reasonably anticipated threats or hazards to the confidentiality, integrity, and availability of such information.

PII and PHI will be protected against any reasonably anticipated uses or disclosures that are not permitted or required by law. PII and PHI will be kept long enough to achieve the specified objectives for which the data was collected and then securely destroyed or disposed of in an appropriate and reasonable manner in accordance with federal and state laws, regulations, and Explore Health retention schedules.

18.  Data Retention and Destruction

Explore Health retains PII and PHI only for as long as necessary to support Marketplace operations, comply with federal and state requirements, and fulfill legally mandated audit, reporting, and program integrity obligations. Retention periods vary depending on the type of data and regulatory requirements under the ACA, HIPAA, federal tax laws, and Oregon public records and privacy statutes.

PII and PHI may be retained for purposes including, but not limited to, eligibility determinations, enrollment processing, appeals, verification activities, fraud prevention, quality control, and required reporting to federal and state agencies. Records required for compliance with CMS, IRS, and ODHS program oversight are maintained for the full duration required by those agencies.

When information is no longer needed for operational, regulatory, or legal purposes, Explore Health securely destroys the data in accordance with federal and state standards. Destruction methods include:

• Secure digital deletion using industry‑standard techniques that prevent recovery
• Encryption‑based disposal for electronic records stored in controlled environments
• Shredding or secure destruction of physical documents containing sensitive information

Explore Health requires all contractors, vendors, enrollment partners, and service providers who create, receive, maintain, or transmit PII/PHI on behalf of Explore Health to follow equivalent retention and destruction requirements. These entities must certify secure destruction once data is no longer needed to fulfill contractual or regulatory obligations.

19.  Security Controls

• Explore Health uses a comprehensive set of administrative, technical, and physical safeguards to protect the confidentiality, integrity, and availability of PII and PHI. These controls meet federal and state requirements, including ACA privacy standards, HIPAA security rules, National Institute of Standards and Technology (NIST) best practices, and Oregon information security policies.

a.   Technical and Operational Controls

• Encryption (In Transit and At Rest): All PII/PHI transmitted electronically is encrypted using industry‑standard protocols. Stored information — including databases, backups, and archived data — is encrypted to prevent unauthorized access.
• Access Controls and Authentication: Access to PII/PHI is limited to authorized users with a legitimate business need. Explore Health uses multifactor authentication, role‑based access controls, and periodic access reviews.
• Audit Logging and Monitoring: Systems that handle PII/PHI maintain audit logs documenting access, use, transmission, and changes. Logs are actively monitored to detect unauthorized activity or anomalies.
• Incident Response Procedures: Explore Health maintains a formal incident response process to identify, contain, investigate, and remediate security incidents.
• Breach Notification Protocols: When a breach is confirmed, Explore Health will notify individuals and regulators as required by federal and state law. Notifications include details about the incident, the type of information involved, and recommended protective actions.

b.   Administrative and Workforce Controls

• Workforce Training and Oversight: Employees, contractors, and enrollment partners must complete required privacy and security training, including fraud awareness, secure communication practices, and reporting procedures. Annual refresher training is required.
• Workforce Compliance: All workforce members must comply with Explore Health security controls and privacy safeguards. Noncompliance may result in corrective or disciplinary action.

c.   Vendor and Partner Oversight

• Contractual Safeguards: Contractors, vendors, assisters, and agents/brokers who access PII/PHI must comply with Explore Health privacy and security standards. Contracts require safeguards, monitoring, breach reporting, and secure disposal.
• ODHS and Data Sharing Requirements: Explore Health ensures all data matching and data sharing arrangements with ODHS meet ACA, Medicaid/CHIP, and Oregon-specific requirements. Secure electronic interfaces are used in accordance with Section 1413 of the ACA and Section 1942 of the Social Security Act.

d.   Monitoring and Governance

• Continuous Assessment: Explore Health regularly monitors, evaluates, and updates security controls to ensure their ongoing effectiveness.
• Secure Interfaces: Secure electronic interfaces are required for all data exchanges involving state health subsidy programs and other partners.

These combined controls ensure that sensitive information is protected throughout its lifecycle and that risks to confidentiality, integrity, and availability are quickly identified and addressed.

20.  Oregon Privacy and Information Security Policies and Standards

Explore Health follows standards, policies, and procedures designed to safeguard PII, PHI, financial information, and plan information entrusted to Explore Health. Explore Health's portal and support systems adhere to federal security mandates and standards, specifically:

• HIPAA Security and Privacy Rules;
• NIST guidelines, industry practices for security, confidentiality and auditing; and
• Oregon specific security requirements to secure data and information.

21.  Privacy Act Statement

The https://www.congress.gov/111/plaws/publ148/PLAW-111publ148.pdfhttps://www.congress.gov/bill/111th-congress/house-bill/4872ACA and the Social Security Act authorize Explore Health to collect the information on your application and any necessary supporting documentation, including SSNs, to determine whether you and the listed people on your application are eligible for coverage or help paying for coverage.

Explore Health needs the information you provide to us on your application about yourself and the other people included in your household to determine eligibility for: (1) enrollment in a QHP/QDP through Explore Health, (2) insurance affordability programs (such as OHP, PTC, and CSRs), and (3) certifications of exemption. As part of that process, Explore Health will electronically verify the information you provide on your application; communicate with you or your authorized representative, if you choose to have one; and eventually provide the information to the insurance company you select so that they can enroll any eligible individuals in a qualified health/dental plan or insurance affordability program. Explore Health will also use the information in the future to conduct activities such as verifying your continued eligibility for coverage or help paying for coverage, processing appeals, reporting on and managing insurance affordability programs for eligible individuals, performing oversight and quality control activities, combatting fraud, and responding to any concerns about the security or confidentiality of the information.

While providing the information we ask you for on the application (including SSNs and documentation of your immigration status) is voluntary, failing to provide the information may delay or prevent you from obtaining coverage or help paying for coverage through Explore Health. If you don't provide correct information on this form or knowingly and willfully provide false or fraudulent information, you may be subject to a penalty and other law enforcement action.

To determine if you or the people on your application are eligible for coverage, or for help paying for coverage, and to operate Explore Health, we will electronically check the information you provide in your application with the information in other electronic data sources. Such data sources include:

1. Federal and state government agencies, such as the IRS, SSA, United States DHS, United States DHHS, and ODHS;
2. Other electronic data sources, including customer reporting agencies;
3. Employers identified on applications for eligibility determinations;
4. Applicants/enrollees;
5. The authorized representatives of applicants/enrollees;
   
6. Insurance agents/brokers, and insurance company-issuers of QHP/QDPs, as applicable, who are certified by Explore Health to assist applicants/enrollees and who have been authorized to help applicants/enrollees;
7. Contractors we engage to help run Explore Health; and
8. Anyone else as required by law.

This statement provides the notice required by the Privacy Act of 1974 (5 U.S.C. § 552a(e)(4)).

22.  Your Privacy Rights

You have specific rights regarding the PII or PHI that Explore Health collects and maintains. These rights are established under federal and state laws, including the ACA, HIPAA, and Oregon privacy regulations. Your rights include:

• Right to Access Your Information: You may access the information you have provided to Explore Health at any time through your online account or by contacting the Customer Assistance Center.
• Right to Correct Your Information: If you believe the information we maintain about you is incorrect, you may request corrections through your online account, through your assigned enrollment partner, or by contacting Explore Health.
• Right to Request Information About Data Use: You may request an explanation of how your information is used, shared, stored, and protected.
• Right to Withdraw Consent: You may choose not to provide certain information. However, withholding required information may delay or prevent eligibility determinations for coverage or financial assistance.
• Right to File a Privacy Complaint: If you believe your privacy rights have been violated, you may submit a complaint to Explore Health. You will not face any retaliation for submitting a complaint.
• Right to Learn About Policy Changes: Explore Health will notify you when material changes are made to this Privacy Policy by publishing the updated policy on ExploreHealthOR.gov.

23.  Privacy Questions and Complaints

Explore Health is committed to protecting the privacy and security of PII and PHI. Individuals who have questions about this Privacy Policy or who believe their privacy rights have been violated are encouraged to contact Explore Health as soon as possible.

Privacy questions, concerns, or complaints may be submitted using the contact information provided in this policy. When submitting a complaint, individuals should provide sufficient detail to allow Explore Health to review and respond appropriately, including a description of the concern, the approximate date of the incident, and any other relevant information.

All complaints will be reviewed by Explore Health and Explore Health's Director promptly and, when appropriate, investigate in accordance with applicable laws, regulations, and Marketplace policies. Where a privacy or security incident is confirmed, Explore Health will take appropriate corrective action and comply with any applicable legal or regulatory notification requirements. If it is determined that a complaint warrants a revision to Explore Health's Privacy Policy, then a revision will be made promptly.

If an individual is not satisfied with Explore Health's response or believes the matter has not been appropriately resolved, they may submit a complaint to the Oregon Health Authority's Information Security and Privacy Office or other appropriate oversight authority, as applicable. Nothing in this policy limits an individual's right to file a complaint with a state or federal agency responsible for enforcing applicable privacy laws.

24.  Contact Information

Explore Health

If you have questions about this Privacy Policy, wish to access or correct your information, or want to file a privacy complaint, you may contact Explore Health using any of the following methods:

        Email: explorehealth@oha.oregon.gov

        Phone: 855‑268‑3767 (relay calls welcome)

        Mailing Address: Explore Health
                                      Oregon Health Insurance Marketplace
                                      PO Box 191
                                      Salem, OR 97308

        Website: ExploreHealthOR.gov

Explore Health will review all privacy inquiries and complaints promptly and take action as appropriate as required by federal and state law.

Federal Trade Commission

Individuals who suspect identity theft or believe their personal information has been compromised may also report concerns to the Federal Trade Commission through its Identity Theft reporting resources.

        Phone: 877-438-4338 (1-877-ID-THEFT)

        Online Reporting: IdentityTheft.gov

Oregon Secretary of State Office of the Inspector General

Individuals who prefer to report concerns outside of Explore Health or who believe reporting internally may not be appropriate, may also contact the Oregon Secretary of State Office of the Inspector General:

        Phone: 800-336-8218

        Online Reporting: https://orhim.info/4uDMgND

Reports submitted to OSCIG may be made confidentially in accordance with applicable law and OSCIG procedures.

U.S. Department of Health and Human Services (HHS)

If you have concerns about how your health information has been handled, you may file a privacy complaint with the U.S. Department of Health and Human Services (HHS).

        Phone: 800-368-1019

        Online Reporting: https://orhim.info/3SFhvtW

Oregon Health Authority's Information Security and Privacy Office

You may also contact the Oregon Health Authority's Information Security and Privacy Office with concerns about OHA's privacy practices.

        Phone: 844-882-7889

        Email: dhs.privacyhelp@dhsoha.state.or.us

25.  Accessibility Statement

Explore Health is committed to ensuring its programs, services, communications, and digital platforms are accessible to all individuals, including people with disabilities, in accordance with the Americans with Disabilities Act (ADA) and applicable state accessibility requirements. Explore Health provides information in alternative formats upon request, including large print, braille, audio, and translated materials. Individuals who need accommodations, accessible formats, or assistance using ExploreHealthOR.gov may contact Explore Health using the contact information provided in this Privacy Policy. Alternative formats are provided at no cost to the requester.

26.  Nondiscrimination Notice

Explore Health does not discriminate against any individual on the basis of race, color, national origin, ethnicity, language, age, disability, sex, gender identity, sexual orientation, religion, citizenship status, immigration status, or any other characteristic protected under federal or state law. All individuals have equal access to Marketplace services, programs, and assistance, including eligibility determinations, enrollment support, communications, and appeals.

Explore Health also requires its contractors, vendors, enrollment partners, and service providers to comply with all applicable nondiscrimination laws when assisting consumers or handling Marketplace information.

27.  Policy Review

This policy shall be reviewed at least annually by the Explore Health Compliance Officer, or designee, to ensure continued compliance with applicable federal and state laws, regulations, contractual requirements, and Marketplace operational needs.

The policy may be revised at any time to reflect changes in legal or regulatory requirements, organizational responsibilities, operational processes, identified risks, audit findings, or other program integrity considerations.

Approved revisions shall be communicated to affected staff, contractors, enrollment partners, and other individuals or organizations subject to this policy, as appropriate.