USVI Public Records

Document text

COMPUTER MATCHING AND PRIVACY PROTECTION ACT AGREEMENT BETWEEN THE SOCIAL SECURITY ADMINISTRATION AND THE DEPARTMENT OF HUMAN SERVICES OF THE VIRGIN ISLANDS Purpose and Legal Authority A. Purpose This Computer Matching and Privacy Protection Act (CMPPA) Agreement (Agreement) between the Social Security Administration (SSA) and the Department of Human Services of the Virgin Islands (Recipient Agency) sets forth the terms and conditions governing disclosures of records, information, or data (collectively referred to herein as “data”) made by SSA to the Recipient Agency that administers federally funded benefit programs, including those under various provisions of the Social Security Act (Act), such as section 1137 of the Act (42 U.S.C. § 1320b-7), as well as the state-funded state supplementary payment programs under Title XVI of the Act. The terms and conditions of this Agreement ensure that SSA makes such disclosures of data, and the Recipient Agency uses such disclosed data, in accordance with the requirements of the Privacy Act of 1974, as amended by the CMPPA of 1988, 5 U.S.C. § 552a. Under section 1137 of the Act, the Recipient Agency is required to use an income and eligibility verification system to administer specified federally funded benefit programs, including the state-funded state supplementary payment programs under Title XVI of the Act. To assist the Recipient Agency in determining entitlement to and eligibility for benefits under those programs, as well as other federally funded benefit programs, SSA verifies the Social Security number (SSN) and discloses certain data about applicants (and in limited circumstances, members of an applicant’s household), for state-administered benefits from SSA Privacy Act Systems of Records (SOR). B. Legal Authority SSA’s authority to disclose data and the Recipient Agency’s authority to collect, maintain, and use data protected under SSA SORs for specified purposes is: e Sections 453, 1106(b), and 1137 of the Act (42 U.S.C. §§ 653, 1306(b), and 1320b-7) (income and eligibility verification data); ® 26U.S.C. § 6103(1)(7) and (8) (Federal tax information); e Sections 202(x)(3)(B)(iv) and 1611(e)(1)(DGii) of the Act (42 U.S.C. §§ 402(x)(3)(B)(iv) and 1382(e)(1)(DGii)) (prisoner data); GOOS5DHST20 il. e Section 205(r)(3) of the Act (42 U.S.C. § 405(r)(3)) and the Intelligence Reform and Terrorism Prevention Act of 2004, Pub. L. 108-458, § 7213(a)(2) (death data); ® Sections 402, 412, 421, and 435 of Pub. L. 104-193 (8 U.S.C. §§ 1612, 1622, 1631, and 1645) (quarters of coverage data); e Section 1902(ee) of the Act (42 U.S.C. § 1396a(ee)); Children’s Health Insurance Program Reauthorization Act of 2009 (CHIPRA), Pub. L. 111-3 (citizenship data); and e Routine use exception to the Privacy Act, 5 U.S.C. § 552a(b)(3) (data necessary to administer other programs compatible with SSA programs). This Agreement further carries out section 1106(a) of the Act (42 U.S.C. § 1306), the regulations promulgated pursuant to that section (20 C.F.R. Part 401), the Privacy Act of 1974 (5 U.S.C. § 552a), as amended by the CMPPA, related Office of Management and Budget (OMB) guidelines, the Federal Information Security Management Act of 2002 (FISMA) (44 U.S.C. § 3551, et seq.), as amended by the Federal Information Security Modernization Act of 2014 (Pub. L. 113-283); and related National Institute of Standards and Technology (NIST) guidelines, which provide the requirements that the Recipient Agency must follow with regard to use, treatment, and safeguarding of data. Scope A. The Recipient Agency will comply with the terms and conditions of this Agreement and the Privacy Act, as amended by the CMPPA. The Recipient Agency will execute an Information Exchange Agreement (IEA) with SSA, documenting additional terms and conditions applicable to those specific data exchanges, including the particular benefit programs administered by the Recipient Agency, the data elements that will be disclosed, and the data protection requirements implemented to assist the Recipient Agency in the administration of those programs. The Recipient Agency will use the SSA data governed by this Agreement to determine entitlement and eligibility of individuals for one or more of the following programs, which are specifically identified in the IEA: 1. Temporary Assistance to Needy Families (TANF) program under Part A of Title IV of the Act; 2. Medicaid provided under an approved State plan or an approved waiver under Title XTX of the Act; 3. State Children’s Health Insurance Program (CHIP) under Title XXI of the Act; 4. Supplemental Nutritional Assistance Program (SNAP) under the Food Stamp Act of 1977 (7 U.S.C. § 2011, et seq.); GOO5DHST2Z0 Ii. 5. Women, Infants and Children Program (WIC) under the Child Nutrition Act of 1966 (42 U.S.C. § 1771, et seq.); 6. Medicare Savings Programs (MSP) under 42 U.S.C. § 1396a(10)(E); 7. Unemployment Compensation programs provided under a state law described in section 3304 of the Internal Revenue Code of 1954; 8. Low Income Heating and Energy Assistance (LIHEAP or home energy grants) program under 42 U.S.C. § 8621; 9. State-administered supplementary payments of the type described in section 1616(a) of the Act; 10. Programs under a plan approved under Titles I, X, XIV, or XVI of the Act; 11. Foster Care and Adoption Assistance under Title IV of the Act; 12. Child Support Enforcement programs under section 453 of the Act (42 U.S.C. § 653); 13. Other applicable federally funded programs administered by the Recipient Agency under Titles 1, IV, X, XIV, XVI, XVIII, XIX, XX, and XXI of the Act; and 14. Any other federally funded programs administered by the Recipient Agency that are compatible with SSA’s programs. D. The Recipient Agency will ensure that SSA data disclosed for the specific purpose of administering a particular federally funded benefit program is used only to administer that program. Justification and Expected Results A. Justification This Agreement and related data exchanges with the Recipient Agency are necessary for SSA to assist the Recipient Agency in its administration of federally funded benefit programs by providing the data required to accurately determine entitlement and eligibility of individuals for benefits provided under these programs. SSA uses computer technology to transfer the data because it is more economical, efficient, and faster than using manual processes. B. Expected Results The Recipient Agency will use the data provided by SSA to improve public service and program efficiency and integrity. The use of SSA data expedites the application process and ensures that benefits are awarded only to applicants that satisfy the Recipient Agency program criteria. A cost-benefit analysis for the exchange made under this Agreement is not required in accordance with the determination by the SSA Data Integrity Board (DIB) to waive such analysis pursuant to 5 U.S.C. § 552a(u)(4)(B). GOOSDHST20 IV. Record Description A. Systems of Records (SOR) SSA SORs used for purposes of the subject data exchanges include: 60-0058 -- Master Files of SSN Holders and SSN Applications; 60-0059 -- Earnings Recording and Self-Employment Income System; 60-0090 -- Master Beneficiary Record; 60-0103 -- Supplemental Security Income Record (SSR) and Special Veterans Benefits (SVB); e 60-0269 -- Prisoner Update Processing System (PUPS); and e 60-0321 -- Medicare Part D and Part D Subsidy File. The Recipient Agency will only use the Federal tax information (FTI) contained in SOR 60-0059 (Earnings Recording and Self-Employment Income System) in accordance with 26 U.S.C. § 6103. B. Data Elements Data elements disclosed in computer matching governed by this Agreement are Personally Identifiable Information (PID from specified SSA SORs, including names, SSNs, addresses, amounts, and other information related to SSA benefits and earnings information. Specific listings of data elements are available at: http://www.ssa.cov/dataexchange/ C. Number of Records Involved The maximum number of records involved in this matching activity is the number of records maintained in SSA’s SORs listed above in Section IV.A. Vv. Notice and Opportunity to Contest Procedures A. Notice to Applicants The Recipient Agency will notify all individuals who apply for federally funded, state-administered benefits that any data they provide are subject to verification through computer matching with SSA. The Recipient Agency and SSA will provide such notice through appropriate language printed on application forms or separate handouts. B. Notice to Beneficiaries/Recipients/Annuitants The Recipient Agency will provide notice to beneficiaries, recipients, and annuitants under the programs covered by this Agreement informing them of GCPWO5DHST20 VI. ongoing computer matching with SSA. SSA will provide such notice through publication in the Federal Register and periodic mailings to all beneficiaries, recipients, and annuitants describing SSA’s matching activities. C. Opportunity to Contest The Recipient Agency will not terminate, suspend, reduce, deny, or take other adverse action against an applicant for or recipient of federally funded, state- administered benefits based on data disclosed by SSA from its SORs until the individual is notified in writing of the potential adverse action and provided an opportunity to contest the planned action. “Adverse action” means any action that results in a termination, suspension, reduction, or final denial of eligibility, payment, or benefit. Such notices will: 1. Inform the individual of the match findings and the opportunity to contest these findings; 2. Give the individual until the expiration of any time period established for the relevant program by a statute or regulation for the individual to respond to the notice. Ifno such time period is established by a statute or regulation for the program, a 30-day period will be provided. The time period begins on the date on which notice is mailed or otherwise provided to the individual to respond; and 3. Clearly state that, unless the individual responds to the notice in the required time period, the Recipient Agency will conclude that the SSA data are correct and will effectuate the planned action or otherwise make the necessary adjustment to the individual's benefit or entitlement. Records Accuracy Assessment and Verification Procedures Pursuant to 5 U.S.C. § 552a(p)(1)(A) (i), SSA’s DIB has determined that the Recipient Agency may use SSA’s benefit data without independent verification. SSA has independently assessed the accuracy of its benefits data to be more than 99 percent accurate when the benefit record is created. The SSA Enumeration System used for SSN matching is 100 percent accurate based on SSA’s Office of Quality Review (FY 2015 Enumeration Accuracy Report, April, 2016). SSA does not have an accuracy assessment specific to SOR 60-0059 (Earnings Recording and Self-Employment Income System). The correctness of the FTI provided to SSA, as an agent for the Internal Revenue Service (IRS), is generally contingent upon the correctness of the information provided by the payer of the income. GOOSDHST20 Vil. VU. Prisoner and death data, some of which is not independently verified by SSA, does not have the same degree of accuracy as SSA’s benefit data. Therefore, the Recipient Agency must independently verify these data through applicable verification procedures and the notice and opportunity to contest procedures specified in Section V of this Agreement before taking any adverse action against any individual. Individuals applying for SSNs report their citizenship status at the time they apply for their SSNs. There is no obligation for an individual to report to SSA a change in his or her immigration status until he or she files for a Social Security benefit. The Recipient Agency must independently verify citizenship data through applicable verification procedures and the notice and opportunity to contest procedures specified in Section V of this Agreement before taking any adverse action against any individual. Disposition and Records Retention of Matched Items A. The Recipient Agency will retain all data received from SSA to administer programs governed by this Agreement only for the required processing times for the applicable federally funded benefit programs and will then destroy all such data. B. The Recipient Agency may retain SSA data in hardcopy to meet evidentiary requirements, provided that they retire such data in accordance with applicable state laws governing the Recipient Agency’s retention of records. C. The Recipient Agency may use any accretions, deletions, or changes to the SSA data governed by this Agreement to update their master files of federally funded, state-administered benefit program applicants and recipients and retain such master files in accordance with applicable state laws governing the Recipient Agency’s retention of records. D. The Recipient Agency may not create separate files or records comprised solely of the data provided by SSA to administer programs governed by this Agreement. E. SSA will delete electronic data input files received from the Recipient Agency after it processes the applicable match. SSA will retire its data in accordance with the Federal Records Retention Schedule (44 U.S.C. § 3303a). Security Procedures SSA and the Recipient Agency will comply with the security and safeguarding requirements of the Privacy Act, as amended by the CMPPA, related OMB guidelines, FISMA, related NIST guidelines, and the current revision of IRS Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies, available at http://www.irs.gov. In addition, SSA and the Recipient Agency will have in place administrative, technical, and physical safeguards for the GOO5DHST20 IX. matched data and results of such matches. Additional administrative, technical, and physical security requirements governing all data SSA provides electronically to the Recipient Agency, including SSA’s Electronic Information Exchange Security Requirements and Procedures for State and local Agencies Exchanging Electronic Information with SSA, as well as specific guidance on safeguarding and reporting responsibilities for PII, are set forth in the IEAs. SSA has the right to monitor the Recipient Agency's compliance with FISMA, the terms of this Agreement, and the IEA and to make onsite inspections of the Recipient Agency for purposes of auditing compliance, if necessary, during the lifetime of this Agreement or of any extension of this Agreement. This right includes onsite inspection of any entity that receives SSA information from the Recipient Agency under the terms of this Agreement, if SSA determines it is necessary. Controlled Unclassified Information (CUI) Requirements Pursuant to 32 C.F.R. § 2002.16(a)(6), the Recipient Agency must handle any CUI in accordance with Executive Order 13556, 32 C.F.R. Part 2002, and the CUI Registry. The Recipient Agency acknowledges that misuse of CUI is subject to penalties established in applicable law, regulations, or Government-wide policies. The Recipient Agency will report any non-compliance with handling requirements to SSA using methods approved by SSA. Records Usage, Duplication, and Redisclosure Restrictions A. The Recipient Agency will use and access SSA data and the records created using that data only for the purpose of verifying eligibility for the specific federally funded benefit programs identified in the IEA. B. The Recipient Agency will comply with the following limitations on use, duplication, and redisclosure of SSA data: 1. The Recipient Agency will not use or redisclose the data disclosed by SSA for any purpose other than to determine eligibility for, or the amount of, benefits under the state-administered income/health maintenance programs identified in the IEA. 2. The Recipient Agency will not extract information concerning individuals who are neither applicants for, nor recipients of, benefits under the state- administered income/health maintenance programs identified in this Agreement. In limited circumstances that are approved by SSA, the Recipient Agency may extract information about an individual other than the applicant/recipient when the applicant/recipient has provided identifying information about the individual and the individual’s income or resources affect the applicant’s/recipient’s eligibility for such program. GOO5DHSTZ0 . The Recipient Agency will not disclose to an applicant/recipient information about another individual (i.e., an applicant’s household member) without the written consent from the individual to whom the information pertains. The Recipient Agency will use the FTI disclosed by SSA only to determine individual eligibility for, or the amount of, assistance under a state plan pursuant to section 1137 programs and child support enforcement programs in accordance with 26 U.S.C. § 6103(1)(7) and (8). The Recipient Agency receiving FTI will maintain all FTI from IRS in accordance with 26 U.S.C. § 6103(p)(4) and the IRS Publication 1075. Contractors and agents acting on behalf of the Recipient Agency will only have access to tax return data where specifically authorized by 26 U.S.C. § 6103 and the current revision IRS Publication 1075. The Recipient Agency will use the citizenship status data disclosed by SSA only to determine entitlement of new applicants to: (a) the Medicaid program and CHIP pursuant to CHIPRA, Pub. L. 111-3; or (b) federally funded, state-administered health or income maintenance programs approved by SSA. The Recipient Agency will further comply with additional terms and conditions regarding use of citizenship data, as set forth in the Recipient Agency’s JEA. . The Recipient Agency will restrict access to the data disclosed by SSA to only those authorized agency employees, contractors, and agents who need such data to perform their official duties in connection with the purposes identified in this Agreement. The Recipient Agency will enter into a written agreement with each of its contractors and agents who need SSA data to perform their official duties whereby such contractor or agent agrees to abide by all relevant Federal laws, restrictions on access, use, and disclosure, and security requirements in this Agreement. The Recipient Agency will provide its contractors and agents with copies of this Agreement, related IEAs, and all related attachments before initial disclosure of SSA data to such contractors and agents. Prior to signing this Agreement, and thereafter at SSA’s request, the Recipient Agency will obtain from its contractors and agents a current list of the employees of such contractors and agents with access to SSA data and provide such lists to SSA. . Ifthe Recipient Agency is authorized or required — pursuant to an applicable law, regulation, or intra-governmental documentation — to provide SSA data to another State or local government entity for the administration of the federally funded, state-administered programs covered by this Agreement, the Recipient Agency must ensure that the State or local government entity, including its employees, abides by all relevant Federal laws, restrictions on access, use, and disclosure, and security requirements in this Agreement and GOO5DHST20 the IEA. At SSA’s request, the Recipient Agency will provide copies of any applicable law, regulation, or intra-governmental documentation that authorizes the intra-governmental relationship with the State or local government entity. Upon request from SSA, the Recipient Agency will also establish how it ensures that State or local government entity complies with the terms of this Agreement and the IEA. 9, The Recipient Agency’s employees, contractors, and agents who access, use, or disclose SSA data in a manner or purpose not authorized by this Agreement may be subject to civil and criminal sanctions pursuant to applicable Federal statutes. 10. The Recipient Agency will conduct triennial compliance reviews of its contractor(s) and agent(s) no later than three years after the initial approval of the security certification to SSA. The Recipient Agency will share documentation of its recurring compliance reviews with its contractor(s) and agent(s) with SSA. The Recipient Agency will provide documentation to SSA during its scheduled compliance and certification reviews or upon request. C. The Recipient Agency will not duplicate in a separate file or disseminate, without prior written permission from SSA, the data governed by this Agreement for any purpose other than to determine entitlement to, or eligibility for, federally funded benefits. The Recipient Agency proposing the redisclosure must specify in writing to SSA what data are being disclosed, to whom, and the reasons that justify the redisclosure. SSA will not give permission for such redisclosure unless the redisclosure is required by law or essential to the conduct of the matching program and authorized under a routine use. To the extent SSA approves the requested redisclosure, the Recipient Agency will ensure that any entity receiving the redisclosed data will comply with the procedures and limitations on use, duplication, and redisclosure of SSA data, as well as all administrative, technical, and physical security requirements governing all data SSA provides electronically to the Recipient Agency including specific guidance on safeguarding and reporting responsibilities for PII, as set forth in this Agreement and the accompanying JEAs. XI. Comptroller General Access The Government Accountability Office (Comptroller General) may have access to all records of the Recipient Agency and its Agencies that the Comptroller General deems necessary to monitor or verify compliance with this Agreement in accordance with 5 U.S.C. § 552a(0)(1)(K). GOO5DHST20 10 XII. Duration, Modification, and Termination of the Agreement A. Duration 1. This Agreement is effective from January 1, 2020 (Effective Date) through June 30, 2021 (Expiration Date). 2. In accordance with the CMPPA, SSA will: report the proposal to re- establish this matching program to the Congressional committees of jurisdiction and OMB in accordance with 5 U.S.C. § 552a(o0)(2)(A) and OMB Circular A-108 (December 23, 2016), and publish notice of the matching program in the Federal Register in accordance with 5 U.S.C. § 552a(e)(12). 3. Within 3 months before the Expiration Date, the SSA DIB may, without additional review, renew this Agreement for a period not to exceed 12 months, pursuant to 5 U.S.C. § 552a(0)(2)(D), if: ° the applicable data exchange will continue without any change; and ° SSA and the Recipient Agency certify to the DIB in writing that the applicable data exchange has been conducted in compliance with this Agreement. 4. Ifeither SSA or the Recipient Agency does not wish to renew this Agreement, it must notify the other party of its intent not to renew at least 3 months prior to the Expiration Date. B. Modification Any modification to this Agreement must be in writing, signed by both parties, and approved by the SSA DIB. C. Termination The parties may terminate this Agreement at any time upon mutual written consent of both parties. Either party may unilaterally terminate this Agreement upon 90 days advance written notice to the other party; such unilateral termination will be effective 90 days after the date of the notice, or at a later date specified in the notice. SSA may immediately and unilaterally suspend the data flow or terminate this Agreement if SSA determines, in its sole discretion, that the Recipient Agency has violated or failed to comply with this Agreement. GoOO5DHSTZN 11 XIII. Reimbursement In accordance with section 1106(b) of the Act, the Commissioner of SSA has determined not to charge the Recipient Agency the costs of furnishing the electronic data from the SSA SORs under this Agreement. XIV. Disclaimer SSA is not liable for any damages or loss resulting from errors in the data provided to the Recipient Agency under any IEAs governed by this Agreement. Furthermore, SSA is not liable for any damages or loss resulting from the destruction of any materials or data provided by the Recipient Agency. The performance or delivery by SSA of the goods and/or services described herein and the timeliness of said delivery are authorized only to the extent that they are consistent with proper performance of the official duties and obligations of SSA and the relative importance of this request to others. If for any reason SSA delays or fails to provide services, or discontinues the services or any part thereof, SSA is not liable for any damages or loss resulting from such delay or for any such failure or discontinuance. GOO5DHST20 XV. Points of Contact A. SSA Point of Contact Regional Office Andrew D. Young, Program Specialist Center for Disability and Program Support 26 Federal Plaza, Room 4060 New York, NY 10278 Phone: (212) 264-1117 Fax: (212) 264-2071 Email: Andrew. Young@ssa.gov Shueh Fan, Program Analyst Center for Disability and Program Support 26 Federal Plaza, Room 4060 New York, NY 10278 Phone: (212) 264-1291 Fax: (212) 264-2071 Email: Shueh.Fan@ssa.gov B. Recipient Agency Point of Contact Marcia Jones, Acting Contracts Administrator The Virgin Islands Department of Human Services 1303 Hospital Ground, Suite 1 St. Thomas, U.S. Virgin Islands 00802 Phone: (340) 774-0930, Ext. 4152 Email: Marcia.Jones@dhs.vi.gov GOO5DHST2Z0 12 XVI. 13 SSA and Data Integrity Board Approval of Model CMPPA Agreement The signatories below warrant and represent that they have the competent authority on behalf of SSA to approve the model of this CMPPA Agreement. The signatories may sign this document electronically by using an approved electronic signature process. Each signatory electronically signing this document agrees that his/her electronic signature has the same legal validity and effect as his/her handwritten signature on the document, and that it has the same meaning as his/her handwritten signature. SOCIAL SECURITY ADMINISTRATION Aco Monica Chyn Acting Deputy Executive Director Office of Privacy and Disclosure Office of the General Counsel ZA \A Date I certify that the SSA Data Integrity Board approved the model of this CMPPA Agreement. Acting Chair SSA Data Integrity Board A |3lao0io Date ) GOO5DHST20 14 XVIF. Authorized Signatures The signatories below warrant and represent that they have the competent authority on behalf of their respective agency to enter into the obligations set forth in this Agreement. The signatories may sign this document electronically by using an approved electronic signature process. Each signatory electronically signing this document agrees that his/her electronic signature has the same legal validity and effect as his/her handwritten signature on the document, and that it has the same meaning as his/her handwritten signature. Social Security Administration Raymond Egan Regional Commissioner New York Date DEPARTMENT OF HUMAN SERVICES A KirhberldyCause¥Go Commissioner Ahthony D. Thomas Commissioner, Virgin Islands Department of Property and Procurement Date: TD WA S Approved for Legal Sufficiency Virgin jelands Department of Justice GQ 0 5 D H S T2 0 , Assistant Attorn Date: 14