(a) Enrollee identification numbers. An issuer of a risk adjustment covered plan or a reinsurance-eligible plan in a State in which HHS is operating the risk adjustment or reinsurance program, as applicable, must -
(1) Establish a unique masked enrollee identification number for each enrollee; and
(2) Maintain the same masked enrollee identification number for an enrollee across enrollments or plans within the issuer, within the State, during a benefit year.
(b) Prohibition on personally identifiable information. An issuer of a risk adjustment covered plan or a reinsurance-eligible plan in a State in which HHS is operating the risk adjustment or reinsurance program on behalf of the State, as applicable, may not -
(1) Include enrollee's personally identifiable information in the masked enrollee identification number; or
(2) Use the same masked enrollee identification number for different enrollees enrolled with the issuer.