Trust Center

1. Overview

This page sets out how Get Covered, operated by Snow AI, protects the information people and agencies trust it with, so that clients, agencies, carriers and partners can review it. It describes what is in place today.

2. Compliance

• HIPAA: Get Covered is built to HIPAA's administrative, physical and technical safeguards. Health information is kept only in AWS services that are eligible under AWS's Business Associate Addendum.
• Marketplace standards: Get Covered follows the privacy and security standards of 45 CFR §155.260 and the web-broker standards of §155.220 that apply to websites helping people with Marketplace coverage.
• State privacy laws: the rights under California's and New Jersey's privacy laws are honored for everyone, as our Privacy Policy explains, including Global Privacy Control.
• Independent audits: Get Covered has not yet completed an independent audit such as SOC 2. When one is completed, its report will be offered here.

3. How Get Covered is protected

• Separation: the website that serves pages holds no health information. Health information lives only behind an interface in AWS that checks who is asking on every request.
• Encryption: the database, its backups, stored documents and logs are encrypted with a key Get Covered controls; connections use TLS.
• Private network: the database and the service that reads it sit in private subnets that cannot be reached from the internet.
• Access: agents and the people they serve sign in through separate accounts. Each agent sees only their own clients and each agency only its own. Sign-in can be protected with an authenticator app.
• Least exposure in logs: request logs record the route, result and timing only, never what was sent, so a log cannot become a store of personal information.
• Backups and recovery: the database is backed up automatically and kept for 14 days, and is protected against deletion.
• Audit trail: security logs are kept, encrypted, for one year.
• Abuse limits: the public forms are rate-limited and record signs of automated use.
• Deletion on request: people may ask for their information to be deleted, as our Privacy Policy describes.

4. Services Get Covered relies on

These are the outside services that handle information for Get Covered, and what each does:

• Amazon Web Services: hosting, database, file storage, sign-in, email delivery and message translation.
• Centers for Medicare & Medicaid Services (healthcare.gov): plan and price information, and the public list used to check agent registration. Plan searches send only what pricing needs, never a name or contact details.
• HealthSherpa: plan and price information for all states, on the same terms: no name or contact details are sent.

5. Documents on request

Agencies and partners can ask for the following by writing to support@getcovered.cloud:

• a summary of Get Covered's security controls, as set out on this page;
• Get Covered's business associate agreement for agencies, once it is final;
• answers to a security questionnaire.

6. Report a security concern

If you believe you have found a security problem, or that information has been exposed, write to support@getcovered.cloud or call (305) 564-4050. Please give enough detail for us to find it, and do not access or change information that is not yours. We will acknowledge your report and keep you informed.