It could depend on whether healthcare.gov signed Business Associate Agreements (BAAs) with the insurers that it's connecting to. If it did have to sign BAAs, then heathcare.gov would be covered under the scope of those BAAs, and would likely have to be complying with the security rule and the privacy rule.