Privacy Act of 1974

AGENCY:

Department of Health and Human Services (HHS), Centers for Medicare & Medicaid Services (CMS).

ACTION:

Notice of Computer Matching Program (CMP).

SUMMARY:

In accordance with the requirements of the Privacy Act of 1974, as amended, this notice announces the re-establishment of a CMP that CMS plans to conduct with the Social Security Administration (SSA).

DATES:

Effective Dates: Comments are invited on all portions of this notice. Public comments are due 30 days after publication. The matching program will become effective no sooner than 40 days after the report of the matching program is sent to the Office of Management and Budget (OMB) and Congress, or 30 days after publication in the Federal Register, whichever is later.

ADDRESSES:

The public should send comments to: CMS Privacy Officer, Division of Security, Privacy Policy & Governance, Information Security & Privacy Group, Office of Enterprise Information, CMS, Room N1-24-08, 7500 Security Boulevard, Baltimore, Maryland 21244-1850. Comments received will be available for review at this location, by appointment, during regular business hours, Monday through Friday from 9:00 a.m.-3:00 p.m., Eastern Time zone.

FOR FURTHER INFORMATION CONTACT:

Elizabeth Kane, Acting Director, Verifications Policy & Operations Division, Eligibility and Enrollment Policy and Operations Group, Center for Consumer Information and Insurance Oversight, CMS, 7501 Wisconsin Avenue, Bethesda, MD 20814, Office Phone: (301) 492-4418, Facsimile: (443) 380-5531, E-Mail: Elizabeth.Kane@cms.hhs.gov.

SUPPLEMENTARY INFORMATION:

The Computer Matching and Privacy Protection Act of 1988 (Public Law (Pub. L.) 100-503), amended the Privacy Act (5 U.S.C. 552a) by describing the manner in which computer matching involving Federal agencies could be performed and adding certain protections for individuals applying for and receiving Federal benefits. Section 7201 of the Omnibus Budget Reconciliation Act of 1990 (Pub. L. 101-508) further amended the Privacy Act regarding protections for such individuals. The Privacy Act, as amended, regulates the use of computer matching by Federal agencies when records in a system of records (SOR) are matched with other Federal, state, or local government records. It requires Federal agencies involved in computer matching programs to:

1. Negotiate written agreements with the other agencies participating in the matching programs;

2. Obtain the Data Integrity Board approval of the match agreements;

3. Furnish detailed reports about matching programs to Congress and OMB;

4. Notify applicants and beneficiaries that the records are subject to matching; and,

5. Verify match findings before reducing, suspending, terminating, or denying an individual's benefits or payments.

This matching program meets the requirements of the Privacy Act of 1974, as amended.

CMS Computer Match No. 2016-12

HHS Computer Match No. 1604

SSA Computer Match No. 1097-1899

Name:

“Computer Matching Agreement between the Department of Health and Human Services, Centers for Medicare & Medicaid Services and the Social Security Administration for Determining Enrollment or Eligibility for Insurance Affordability Programs under the Patient Protection and Affordable Care Act”

Security Classification:

Unclassified

Participating Agencies:

Department of Health and Human Services (HHS), Centers for Medicare & Medicaid Services (CMS), and the Social Security Administration (SSA)

Authority For Conducting Matching Program:

Sections 1411 and 1413 of the Patient Protection and Affordable Care Act of 2010 (Pub. L. 111-148), as amended by the Health Care and Education Reconciliation Act of 2010 (Pub. L. 111-152) (collectively, the ACA) require the Secretary of HHS to establish a program for determining eligibility for certain state health subsidy programs, and certifications of Exemption; and authorize use of secure, electronic interfaces and an on-line system for the verification of eligibility.

Purpose(S) Of The Matching Program:

The purpose of the Computer Matching Agreement (CMA) is to re-establish the terms, conditions, safeguards, and procedures under which SSA will disclose information to CMS in connection with the administration of state health subside programs under the ACA and its implementing regulations. SSA will provide data to CMS, and CMS will use SSA data needed to make initial eligibility determinations, eligibility redeterminations and renewal decisions, including appeal determinations, for state health subsidy programs and certifications of exemption. State health subsidy programs include:

1. Qualified Health Plan through an Exchange established under the ACA,

2. Advance payments of the premium tax credit and cost sharing reductions,

3. Medicaid,

4. Children's Health Insurance Program, and

5. Basic Health Program.

As set forth in the CMA, SSA will provide CMS the following information when relevant: (1) Social Security number (SSN) verifications, (2) a death indicator, (3) an indicator of a finding of disability by SSA under title II of the Social Security Act, (4) prisoner data, (5) monthly and annual Social Security benefit information under title II of the Social Security Act, (6) quarters of coverage, and (7) confirmation that an allegation of citizenship is consistent with SSA records.

Description Of Records To Be Used In The Matching Program:

The matching program will be conducted with data maintained by CMS in the Health Insurance Exchanges System (HIX), CMS System No. 09-70-0560, as amended, published at 78 FR 8538 (Feb. 6, 2013), 78 FR 32256 (May 29, 2013) and 78 FR 63211 (October 23, 2013).

The matching program will also be conducted with data maintained by SSA in the following SORs:

• Master Files of SSN Holders and SSN Applications, SSA/OEEAS, 60-0058, 75 FR 82121 (December 29, 2010), as amended 78 FR 40542 (July 5, 2013);
• Prisoner Update Processing System (PUPS), SSA/OPB, 60-0269, 64 FR 11076 (March 8, 1999), as amended 72 FR 69723 (December 10, 2007) and 78 FR 40542 (July 5, 2013);
• Master Beneficiary Record, SSA/ORSIS, 60-0090, 71 FR 1826 (January 11, 2006), as amended 72 FR 69723 (December 10, 2007) and 78 FR 40542 (July 5, 2013);
• Earnings Recording and Self-Employment Income System, SSA/OEEAS, 60-0059, 71 FR 1819(January 11, 2006), as amended 78 FR 40542 (July 5, 2013).

Inclusive Dates Of The Match:

The CMP will become effective no sooner than 40 days after the report of the matching program is sent to OMB and Congress, or 30 days after publication in the Federal Register, whichever is later. The matching program will continue for 18 months from the effective date and may be extended for an additional 12 months thereafter, if certain conditions are met.