2018-20510. Privacy Act of 1974; Matching Program

AGENCY:

Centers for Medicare & Medicaid Services (CMS), Department of Health and Human Services (HHS).

ACTION:

Notice of New Matching Program.

SUMMARY:

In accordance with subsection (e)(12) of the Privacy Act of 1974, as amended, the Department of Health and Human Services (HHS), Centers for Medicare & Medicaid Services (CMS) is providing notice of a new computer matching program between CMS and the Department of Homeland Security (DHS)/United States Citizenship and Immigration Services (USCIS), “Verification of United States Citizenship and Immigration Status Data for Eligibility Determinations.” In this matching program, DHS/USCIS provides CMS with immigrant, nonimmigrant, and naturalized or derived citizenship status information needed to make enrollment and exemption eligibility determinations as required by the Patient Protection and Affordable Care Act (ACA).

DATES:

The deadline for comments on this notice is October 22, 2018. The re-established matching program will commence not sooner than 30 days after publication of this notice, provided no comments are received that warrant a change to this notice. The matching program will be conducted for an initial term of 18 months (from approximately October 2018 to April 2020) and within 3 months of expiration may be renewed for one additional year if the parties make no change to the matching program and certify that the program has been conducted in compliance with the matching agreement.

ADDRESSES:

Interested parties may submit comments on the new matching program to the CMS Privacy Officer by mail at: Division of Security, Privacy Policy & Governance, Information Security & Privacy Group, Office of Information Technology, Centers for Medicare & Medicaid Services, Location: N1-14-56, 7500 Security Blvd., Baltimore, MD 21244-1850, or [e-mail]. Comments received will be available for review without redaction unless otherwise advised by the commenter at this location, by appointment, during regular business hours, Monday through Friday from 9:00 a.m. to 3:00 p.m.

FOR FURTHER INFORMATION CONTACT:

If you have questions about the matching program, you may contact Jack Lavelle, Senior Advisor, Marketplace Eligibility and Enrollment Group, Centers for Consumer Information and Insurance Oversight, CMS, at [phone], by email at [e-mail], or by mail at 7501 Wisconsin Ave., Bethesda, MD 20814.

SUPPLEMENTARY INFORMATION:

The Privacy Act of 1974, as amended (5 U.S.C. 552a) provides certain protections for individuals applying for and receiving federal benefits. The law governs the use of computer matching by federal agencies when records in a system of records (meaning, federal agency records about individuals retrieved by name or other personal identifier) are matched with records of other federal or non-federal agencies. The Privacy Act requires agencies involved in a matching program to:

1. Enter into a written agreement, which must be prepared in accordance with the Privacy Act, approved by the Data Integrity Board of each source and recipient federal agency, provided to Congress and the Office of Management and Budget (OMB), and made available to the public, as required by 5 U.S.C. 552a(o), (u)(3)(A), and (u)(4).

2. Notify the individuals whose information will be used in the matching program that the information they provide is subject to verification through matching, as required by 5 U.S.C. 552a(o)(1)(D).

3. Verify match findings before suspending, terminating, reducing, or making a final denial of an individual's benefits or payments or taking other adverse action against the individual, as required by 5 U.S.C. 552a(p).

4. Report the matching program to Congress and the OMB, in advance and annually, as required by 5 U.S.C. 552a(o) (2)(A)(i), (r), and (u)(3)(D).

5. Publish advance notice of the matching program in the Federal Register as required by 5 U.S.C. 552a(e)(12).

This matching program meets these requirements.

Barbara Demopulos,

CMS Privacy Advisor, Division of Security, Privacy Policy and Governance, Information Security and Privacy Group, Office of Information Technology, Centers for Medicare & Medicaid Services.

PARTICIPATING AGENCIES:

The Department of Health and Human Services (HHS), Centers for Medicare & Medicaid Services (CMS) is the recipient agency, and the Department of Homeland Security (DHS), United States Citizenship and Immigration Services (USCIS) is the source agency.

AUTHORITY FOR CONDUCTING THE MATCHING PROGRAM:

The statutory authority for the matching program is 42 U.S.C. 18001.

PURPOSE(S):

The matching program will provide CMS with USCIS data, including immigrant, nonimmigrant, and naturalized or derived citizenship status information from USCIS's SAVE program and VIS system. This data will indicate whether an applicant or enrollee is lawfully present, a qualified non-citizen, a naturalized or derived citizen, and whether the five-year waiting period for many non-citizens applies and has been met. CMS and state administering entities will use the data to determine the individual's eligibility for enrollment in a qualified health plan through a federally-facilitated exchange (FFE) and for insurance affordability programs and certificates of exemption, and to make eligibility redetermination and renewal decisions, including appeal determinations. USCIS will provide the data from USCIS's SAVE program and VIS system about individuals whose identifying information matches identifying information that CMS submits to USCIS. CMS will make the USCIS data available to requesting state administering entities through a data services hub (Hub).

CATEGORIES OF INDIVIDUALS:

The individuals whose information will be used in the matching program are consumers who apply for any of the following eligibility determinations: eligibility to enroll in a qualified health plan through an exchange established under the ACA, eligibility for insurance affordability programs and certificates of exemption, and subsequent eligibility redeterminations and renewals, including appeal determinations

CATEGORIES OF RECORDS:

The categories of records used in the matching program are identity and citizenship status records. The data elements are described below.

• From the CMS to USCIS. CMS will submit data elements pertaining to applicants and enrollees through SAVE to the USCIS VIS. These data elements may include the following: identification number (e.g., foreign passport number, I-94 number, alien registration number/USCIS number); immigration document type; last name; middle initial; first name; date of birth; document expiration date (if applicable); and information contained in the comment field, such as USCIS benefit application receipt numbers, maiden names, nicknames, and additional immigration document numbers.
• From USCIS to CMS. USCIS through SAVE will send the Hub responses that contain data from records provided to VIS and databases VIS accesses. These responses may include the following data elements: alien registration number/USCIS number; I-94 number; last name; first name; date of birth; date of entry; status grant date, if available; and immigration status data.

SYSTEM OF RECORDS:

The records used in this matching program are disclosed from the following systems of records, as authorized by routine uses published in the System of Records Notices (SORNs) cited below:

A. CMS System of Records:

• CMS Health Insurance Exchanges System (HIX), CMS System No. 09-70-0560, last published in full at 78 FR 63211 (Oct. 23, 2013), as amended at 83 FR 6591 (Feb. 14, 2018). Routine use 3 supports CMS's disclosures to USCIS.

B. USCIS System of Records:

• DHS/USCIS-004 Systematic Alien Verification for Entitlements Program, 81 FR 78619 (Nov. 8, 2016). Routine use H permits USCIS' disclosures to CMS.