Agency Information Collection Activities: Proposed Request and Comment Request

The Social Security Administration (SSA) publishes a list of information collection packages requiring clearance by the Office of Management and Budget (OMB) in compliance with Public Law 104-13, the Paperwork Reduction Act of 1995, effective October 1, 1995. This notice includes revisions of OMB-approved information collections.

SSA is soliciting comments on the accuracy of the agency's burden estimate; the need for the information; its practical utility; ways to enhance its quality, utility, and clarity; and ways to minimize burden on respondents, including the use of automated collection techniques or other forms of information technology. Mail, email, or fax your comments and recommendations on the information collection(s) to the OMB Desk Officer and SSA Reports Clearance Officer at the following addresses or fax numbers.

(OMB) Office of Management and Budget, Attn: Desk Officer for SSA, Fax: 202-395-6974, Email address: OIRA_Submission@omb.eop.gov.

(SSA) Social Security Administration, OLCA, Attn: Reports Clearance Director, 3100 West High Rise, 6401 Security Blvd., Baltimore, MD 21235, Fax: 410-966-2830, Email address: OR.Reports.Clearance@ssa.gov.

Or you may submit your comments online through www.regulations.gov,, referencing Docket ID Number [SSA-2020-0056].

I. The information collections below are pending at SSA. SSA will submit them to OMB within 60 days from the date of this notice. To be sure we consider your comments, we must receive them no later than January 4, 2021. Individuals can obtain copies of the collection instruments by writing to the above email address.

1. Help America Vote Act—0960-0706. Public Law 107-252, the Help America Vote Act of 2002, mandates that States verify the identities of newly registered voters. When newly registered voters do not have driver's licenses or State-issued ID cards, they must supply the last four digits of their Social Security number to their local State election agencies for verification. The election agencies forward this information to their State Motor Vehicle Administration (MVA), and the State MVA inputs the data into the American Association of MVAs, a central consolidation system that routes the voter data to SSA's Help America Vote Verification (HAVV) system. Once SSA's HAVV system confirms the identity of the voter, the information returns along the same route in reverse until it reaches the State election agency. The respondents are the State MVAs seeking to confirm voter identities.

Type of Request: Revision of an OMB-approved information collection.

2. Incoming and Outgoing Intergovernmental Personnel Act Assignment Agreement—5 CFR part 334—0960-0792. The Intergovernmental Personnel Act (IPA) mobility program provides for the temporary assignment of civilian personnel between the Federal Government and State and local governments; colleges and universities; Indian tribal governments; federally funded research and development centers; and other eligible organizations. The Office of Personnel Management (OPM) created a generic form, the OF-69, for agencies to use as a template when collecting information for the IPA assignment. The OF-69 collects specific information about the agreement including: (1) The enrolled employee's name, Social Security number, job title, salary, classification, and address; (2) the type of assignment; (3) the reimbursement arrangement; and (4) an explanation as to how the assignment benefits both SSA and the non-federal organization involved in the exchange. OPM directs agencies to use their own forms for recording these agreements. So, SSA modified the OF-69 to meet our needs, creating the SSA-187 for incoming employees and the SSA-188 for outgoing employees. SSA collects information on the SSA-187 and SSA-188 to document the IPA assignment, and to act as an agreement between the agencies. Respondents are personnel from State and local governments; colleges and universities; Indian tribal governments; federally funded research and development centers; and other eligible organizations who participate in the IPA exchange with SSA.

Type of Request: Revision of an OMB-approved information collection.

II. SSA submitted the information collections below to OMB for clearance. Your comments regarding these information collections would be most useful if OMB and SSA receive them 30 days from the date of this publication. To be sure we consider your comments, we must receive them no later than December 4, 2020. Individuals can obtain copies of these OMB clearance packages by writing to OR.Reports.Clearance@ssa.gov.

1. Statement Regarding Contributions—20 CFR 404.360-404.366 and 404.736—0960-0020. SSA uses Form SSA-783 to collect information regarding a child's current sources of support when determining the child's entitlement to Social Security benefits. We request this information from adults acting on behalf of the child claimants who can provide SSA with any sources of support or substantial contributions for the child. These adults inform the claims representative as part of the initial benefits process. If the individual capable of providing the information does not accompany the child claimant, we mail the SSA-783 to the individual for completion, or if the person has access to a computer, we will refer them to SSA's website. The respondents are individuals providing information about a child's sources of support.

Type of Request: Revision of an OMB-approved information collection.

2. Statement of Income and Resources—20 CFR 416.207, 416.301-416.310, 416.704, and 416.708—0960-0124. SSA collects information about income and resources for Supplemental Security Income (SSI) claims and redeterminations on the SSA-8010-BK. SSA uses the information to make initial or continuing eligibility determinations for SSI claimants or recipients who are subject to deeming. The respondents are people whose income and resources SSA may deem (consider to be available) to SSI applicants or recipients.

Type of Request: Revision of an OMB-approved information collection.

3. Medical Permit Parking Application—41 CFR 102-71.20 & 102-74.305—0960-0624. SSA employees and contractors with a qualifying medical condition who park at SSA-owned and leased facilities may apply to receive a medical parking permit. SSA uses three forms for this program: (1) SSA-3192, the Application and Statement, which an individual completes when first applying for the medical parking space; (2) SSA-3193, the Physician's Report, which the applicant's physician completes to verify the medical condition; and (3) SSA-3194, Renewal Certification, which medical parking permit holders complete to verify their continued need for the permit. The respondents are SSA employees and contractors seeking medical parking permits, and their physicians.

Note:

Because SSA employees are Federal workers exempt from the requirements of the Paperwork Reduction Act, the burden below is only for SSA contractors and physicians (of both SSA employees and contractors).

Type of Request: Revision of an OMB-approved information collection.

4. Request for Evidence from Doctor and Request for Evidence from Hospital—20 CFR 404 Subpart P and 20 CFR 416 Subpart I—0960-0722. Sections 223(d)(5) and 1614(a)(3)(H)(i) of the Social Security Act require claimants to furnish medical evidence of their disability when filing a disability claim. SSA uses Forms HA-66 and HA-67 to request evidence from medical sources, which claimants identify as having information relative to their impairments, or ability to do work-related activities. In addition to accepting manual paper responses, SSA sends a barcode with the HA-66 and HA-67, allowing respondents to fax the information directly into the electronic claims folder rather than submitting it manually. SSA uses the information to determine eligibility for benefits, and to pay medical sources for furnishing the information. The respondents are medical sources, doctors, and hospitals that evaluate the claimants.

Type of Request: Revision of an OMB-approved information collection.

5. Social Security's Public Credentialing and Authentication Process—20 CFR 401.45 and Part 402—0960-0789.

Background

Authentication is the foundation for secure, online transactions. Identity authentication is the process of determining, with confidence, that someone is who he or she claims to be during a remote, automated session. It comprises three distinct factors: Something you know; something you have; and something you are. Single-factor authentication uses one of the factors, and multi-factor authentication uses two or more of the factors.

SSA's Public Credentialing and Authentication Process

SSA offers consistent authentication across SSA's secured online services. We allow our users to request and maintain only one User ID, consisting of a self-selected username and password, to access multiple Social Security electronic services. Designed in accordance with the OMB Memorandum M-04-04 and the National Institute of Standards and Technology (NIST) Special Publication 800-63, this process provides the means of authenticating users of our secured electronic services and streamlines access to those services.

SSA's public credentialing and authentication process:

• Issues a single User ID to anyone who wants to do business with the agency and meets the eligibility criteria;
• Partners with an external Identity Services Provider (ISP) to help us verify the identity of our online customers;
• Complies with relevant standards;
• Offers access to some of SSA's heaviest, but more sensitive, workloads online while providing a high level of confidence in the identity of the person requesting access to these services;
• Offers an in-person process for those who are uncomfortable with or unable to use the internet process;
• Balances security with ease of use; and
• Provides a user-friendly way for the public to conduct extended business with us online instead of visiting local servicing offices or requesting information over the phone. Individuals have real-time access to their Social Security information in a safe and secure web environment.

Public Credentialing and Authentication Process Features

We collect and maintain the users' personally identifiable information (PII) in our Central Repository of Electronic Authentication Data Master File Privacy Act system of records, which we published in the Federal Register (75 FR 79065). The PII may include the users' name; address; date of birth; Social Security number (SSN); phone number; and other types of identity information [e.g., address information of persons from the W-2 and Schedule Self Employed forms we receive electronically for our programmatic purposes as permitted by 26 U.S.C. 6103(l)(1)(A)]. We may also collect knowledge-based authentication data, which is information users establish with us or that we already maintain in our existing Privacy Act systems of records.

We retain the data necessary to administer and maintain our e-Authentication infrastructure. This includes management and profile information, such as blocked accounts; failed access data; effective date of passwords; and other data allowing us to evaluate the system's effectiveness. The data we maintain also may include archived transaction data and historical data.

We use the information from this collection to identity proof and authenticate our users online, and to allow them access to their personal information from our records. We also use this information to provide second factor authentication. We are committed to expanding and improving this process so we can grant access to additional online services in the future.

Offering online services is not only an important part of meeting SSA's goals, but is vital to good public service. In increasing numbers, the public expects to conduct complex business over the internet. Ensuring SSA's online services are both secure and user-friendly is our priority.

We awarded a competitively bid contract to an ISP, Equifax, to help us verify the identity of our online customers. We use this ISP, in addition to our other authentication methods, to help us prove, or verify, the identity of our customers when they are completing online or electronic transactions with us.

Social Security's Authentication Strategy

We remain committed to enhancing our online services using authentication processes that balance usability and security. We will continue to research and develop new authentication tools while monitoring the emerging threats.

The following are key components of our authentication strategy:

• Enrollment and Identity Verification—Individuals who meet the following eligibility requirements may enroll:

○ Must have a valid email address;

○ Must have a valid Social Security number (SSN);

○ Must have a domestic address of record (includes military addresses); and

○ Must be at least 18 years of age.

We collect identifying data and use SSA and ISP records to verify an individual's identity. Individuals have the option of obtaining an enhanced, stronger, User ID by providing certain financial information (e.g., Medicare wages, self-employed earnings, or the last eight digits of a credit card number) for verification. We also ask individuals to answer out-of-wallet questions so we can further verify their identities. Individuals who are unable to complete the process online can present identification at a field office to obtain a User ID.

• Establishing the User Profile—The individual self-selects a username and password, both of which can be of variable length and alphanumeric. We provide a password strength indicator to help the individual select a strong password. We also ask the individual to choose challenge questions for use in restoring a lost or forgotten username or password.
• Provide a Second Factor—We ask the individual to provide a text message enabled cell phone number or an email address. We consider the cell phone number or email address the second factor of authentication. We send a security code to the individual's selected second factor. We require the individual to confirm its receipt by entering the security code online. Subsequently, each time the individual attempts to sign in to his or her online account, we will also send a message with a one-time security code to the individual's selected second factor. The individual must enter the security code along with his or her username and password. The code is valid for only 10 minutes. If the individual does not enter the code within 10 minutes, the code expires, and the individual must request another code.
• Enhancing the User ID—If individuals opt to enhance or upgrade their User IDs, they must provide certain financial information for verification. We mail a one-time-use upgrade code to the individual's verified residential address. When the individual receives the upgrade code in the mail, he or she can enter this code online to enhance the security of the account. With extra security, we continue to require the individuals to sign in using their username, password, and a one-time security code we send to their second factor email address or cell phone number (whichever the users listed in their account).
• Sign in and Use—Our authentication process provides an individual with a User ID for access to our sensitive online Social Security services. Second factor authentication requires the individual to sign in with a username, password, and a one-time security code sent to the individual's selected second factor. SSA expanded its existing capabilities to require second factor authentication for every online sign in. We also allow for maintenance of the second factor options. An individual who forgets the password can reset it automatically without contacting SSA.

Social Security's Enrollment Process

The enrollment process is a one-time only activity. SSA requires the individuals to agree to the “Terms of Service” detailed on our website before we allow them to begin the enrollment process. The “Terms of Service” inform the individuals what we will and will not do with their personal information, and the privacy and security protections we provide on all data we collect. These terms also detail the consequences of misusing this service.

To verify the individual's identity, we ask the individual to give us minimal personal information, which may include:

• Name;
• SSN;
• Date of birth;
• Address—mailing and residential;
• Telephone number;
• Email address;
• Financial information;
• Cell phone number; and
• Selecting and answering password reset questions.

We send a subset of this information to the ISP, who then generates a series of out-of-wallet questions back to the individual. The individual must answer all or most of the questions correctly before continuing in the process. The exact questions generated are unique to each individual.

This collection of information, or a subset of it, is mandatory for respondents who want to do business with SSA via the internet. We collect this information via the internet on SSA's public-facing website. We also offer an in-person identification verification process for individuals who cannot, or are not willing, to register online. For this process, the individual must go to a local SSA field office and provide identifying information. We do not ask for financial information with the in-person process.

We only collect the identity verification information one time, when the individual registers for a credential. We ask for the User ID (username and password) every time an individual signs in to our automated services. If individuals opt for the enhanced or upgraded account, they also either receive an email message or a text message on their cell phones (this serves as the second factor for authentication) each time they sign in.

The respondents are individuals who choose to use the internet or Automated Telephone Response System to conduct business with SSA.

Type of Request: Revision of an OMB-approved information collection.