Privacy Act of 1974; Matching Program, 38696-38697 [2018-16821]

Agencies

• Centers for Medicare & Medicaid Services
• DEPARTMENT OF HEALTH AND HUMAN SERVICES

[Federal Register Volume 83, Number 152 (Tuesday, August 7, 2018)]
[Notices]
[Pages 38696-38697]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2018-16821]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Centers for Medicare & Medicaid Services


Privacy Act of 1974; Matching Program

AGENCY: Centers for Medicare & Medicaid Services, Department of Health 
and Human Services.

ACTION: Notice of a new matching program.

-----------------------------------------------------------------------

SUMMARY: In accordance with the Privacy Act of 1974, as amended, the 
Department of Health and Human Services (HHS), Centers for Medicare & 
Medicaid Services (CMS) is providing notice of a re-established 
matching program between CMS and the Social Security Administration 
(SSA), ``Determining Enrollment or Eligibility for Insurance 
Affordability Programs Under the Patient Protection and Affordable Care 
Act (ACA).'' The matching program provides CMS with SSA data to use in 
determining individuals' eligibility to enroll in a qualified health 
plan through an exchange established under the ACA and for insurance 
affordability programs and certificates of exemption, and to make 
eligibility redeterminations and renewals, including appeal 
determinations.

DATES: The deadline for comments on this notice is September 6, 2018. 
The re-established matching program will commence not sooner than 30 
days after publication of this notice, provided no comments are 
received that warrant a change to this notice. The matching program 
will be conducted for an initial term of 18 months (from approximately 
September 2018 to March 2020) and within 3 months of expiration may be 
renewed for one additional year if the parties make no change to the 
matching program and certify that the program has been conducted in 
compliance with the matching agreement.

ADDRESSES: Interested parties may submit written comments on this 
notice, by mail or email, to the CMS Privacy Officer, Division of 
Security, Privacy Policy & Governance, Information Security & Privacy 
Group, Office of Information Technology, Centers for Medicare & 
Medicaid Services, Location: N1-14-56, 7500 Security Blvd., Baltimore, 
MD 21244-1850, [email protected].

FOR FURTHER INFORMATION CONTACT: If you have questions about the 
matching program, you may contact Jack Lavelle, Senior Advisor, 
Marketplace Eligibility and Enrollment Group, Centers for Consumer 
Information and Insurance Oversight, CMS, at (410) 786-0639, or by 
email at [email protected], or by mail at 7501 Wisconsin Ave., 
Bethesda, MD 20814.

SUPPLEMENTARY INFORMATION: The Privacy Act of 1974, as amended (5 
U.S.C. 552a) provides certain protections for individuals applying for 
and receiving Federal benefits. The law governs the use of computer 
matching by Federal agencies when records in a system of records 
(meaning, federal agency records about individuals retrieved by name or 
other personal identifier) are matched with records of other federal or 
non-federal agencies. The Privacy Act requires agencies involved in a 
matching program to:
    1. Enter into a written agreement, which must be prepared in 
accordance with the Privacy Act, approved by the Data Integrity Board 
of each source and recipient Federal agency, provided to Congress and 
the Office of Management and Budget (OMB), and made available to the 
public, as required by 5 United States Code (U.S.C.) 552a(o), 
(u)(3)(A), and (u)(4).
    2. Notify the individuals whose information will be used in the 
matching program that the information they provide is subject to 
verification through matching, as required by 5 U.S.C. 552a(o)(1)(D).
    3. Verify match findings before suspending, terminating, reducing, 
or making a final denial of an individual's benefits or payments or 
taking other adverse action against the individual, as required by 5 
U.S.C. 552a(p).
    4. Report the matching program to Congress and the OMB, in advance 
and annually, as required by 5 U.S.C. 552a(o)(2)(A)(i), (r), and 
(u)(3)(D).
    5. Publish advance notice of the matching program in the Federal 
Register as required by 5 U.S.C. 552a(e)(12).
    This matching program meets these requirements.

    Dated: August 1, 2018.
Walter Stone,
CMS Privacy Act Officer, Division of Security Privacy Policy and 
Governance, Information Security and Privacy Group, Office of 
Information Technology, Centers for Medicare & Medicaid Services.
PARTICIPATING AGENCIES
    Department of Health and Human Services (HHS), Centers for Medicare 
& Medicaid Services (CMS) is the recipient agency, and the Social 
Security Administration (SSA) is the source agency.

AUTHORITY FOR CONDUCTING THE MATCHING PROGRAM:
    The matching program is authorized under 42 U.S.C. 18001.

PURPOSE(S):
    The purpose of the matching program is to provide CMS with SSA data 
that CMS needs to determine individuals' eligibility to enroll in a 
qualified health plan through an exchange established under the ACA and 
for insurance affordability programs and certificates of exemption, and 
to make eligibility redetermination and renewal decisions, including 
appeal determinations. The

[[Page 38697]]

program enables CMS to compare its data to SSA data to confirm an 
applicant's or other relevant individual's identity, citizenship, 
status as deceased or imprisoned, and Title II disability benefit 
quarters of coverage (QC) and monthly and annual income. The data is 
used by CMS to authenticate identity, determine eligibility, and 
determine the amount of an advance payment of the premium tax credit 
(APTC) or cost sharing reduction (CSR).

CATEGORIES OF INDIVIDUALS:
    The categories of individuals whose information is involved in the 
matching program are consumers who apply for any of the following 
eligibility determinations, and other relevant individuals (e.g., an 
applicant's household members) who have eligibility to enroll in a 
qualified health plan through an exchange established under the ACA, 
eligibility for insurance affordability programs and certificates of 
exemption, and subsequent eligibility redeterminations and renewals, 
including appeal determinations.

CATEGORIES OF RECORDS:
    The categories of records used in the matching program are 
identity, citizenship, birth, death, disability coverage and income, 
and imprisonment status records. The data elements are as follows:
    1. For each applicant and for relevant individuals, CMS will submit 
a request file to SSA that contains the following mandatory specified 
data elements in a fixed record format: Last name, first name, date of 
birth, social security number (SSN), and citizenship indicator.
    2. For each applicant, SSA will provide CMS with a response file in 
a fixed record format. Depending on CMS' request, SSA's response may 
include the following data elements: Last name, first name, date of 
birth, death indicator, disability indicator, prisoner information, 
Title II (annual and monthly) income information, and confirmation of 
attestations of citizenship status and SSN. SSA may also provide QC 
data when CMS requests it.
    3. For relevant individuals, CMS will request a limited amount of 
SSA information. Based on CMS' request, SSA will verify a relevant 
individual's SSN with a death indicator and may provide a relevant 
individual's QC data or Title II (annual and monthly) income 
information. CMS will not request citizenship or immigration status 
data for a relevant individual.
    4. For renewals and redeterminations, CMS will request and SSA will 
verify SSN with a death indicator, disclose Title II income 
information, and provide the disability indicator.
    5. For self-reported redeterminations, CMS will provide SSA with 
the following: Updated or new information reported by the enrollee or 
enrolled individual, last name, first name, date of birth, and SSN. 
Depending on CMS' request, SSA's response will include each of the 
following data elements that are relevant and responsive to CMS' 
request: Last name, first name, date of birth, death indicator, 
disability indicator, prisoner information, Title II (annual and 
monthly) income information, and confirmation of new attestations of 
citizenship status, verification of SSN, and QC data.
    6. For individuals seeking an exemption, CMS will provide last 
name, first name, date of birth, citizenship indicator, and SSN to SSA. 
SSA will provide CMS with a response including: Last name, first name, 
date of birth, confirmation of attestations of citizenship status, 
verification of SSN, death indicator, disability indicator, prisoner 
information, and Title II (annual and monthly) income information.

SYSTEM(S) OF RECORDS:
    The records used in this matching program are disclosed from the 
following systems of records, as authorized by routine uses published 
in the System of Records Notices (SORNs) cited below:
    CMS System of Records:
    [ballot] The CMS SOR that supports this matching program is the 
``CMS Health Insurance Exchanges System (HIX)'', CMS System No. 09-70-
0560, last published in full at 78 FR 63211 (October 23, 2013), as 
amended at 83 FR 6591 (February 14, 2018).
    SSA Systems of Records:
    [ballot] Master Files of SSN Holders and SSN Applications, 60-0058, 
75 FR 82121 (Dec. 29, 2010), as amended at 78 FR 40542 (July 5, 2013), 
and 79 FR 8780 (Feb. 13, 2014);
    [ballot] Prisoner Update Processing System (PUPS), 60-0269, 64 FR 
11076 (Mar. 8, 1999), as amended at 72 FR 69723 (Dec. 10, 2007) and 78 
FR 40542 (July 5, 2013);
    [ballot] Master Beneficiary Record, 60-0090, 71 FR 1826 (Jan. 1, 
2006), as amended at 72 FR 69723 (Dec. 10, 2007) and 78 FR 40542 (July 
5, 2013); and
    [ballot] Earnings Recording and Self-Employment Income System, 60-
0059, 71 FR 1819 (Jan. 11, 2006), as amended at 78 FR 40542 (July 5, 
2013).

[FR Doc. 2018-16821 Filed 8-6-18; 8:45 am]
BILLING CODE 4120-03-P