2023-19174. Privacy Act of 1974; Matching Program

AGENCY:

Center for Consumer Information and Insurance Oversight (CCIIO), Centers for Medicare & Medicaid Services (CMS), Department of Health and Human Services (HHS).

ACTION:

Notice of a new matching program.

SUMMARY:

In accordance with the Privacy Act of 1974, as amended, the Department of Health and Human Services (HHS), Centers for Medicare & Medicaid Services (CMS) is providing notice of the re-establishment of a data exchange program between CMS and the Department of Homeland Security (DHS), United States Citizenship and Immigration Services (USCIS), “Verification of United States Citizenship and Immigration Status Data for Eligibility Determinations.”

DATES:

The deadline for comments on this notice is October 6, 2023. The program will commence not sooner than 30 days after publication of this notice, provided that no comments are received that warrant a change to this notice. The program will be conducted for an initial term of 18 months (from approximately October 20, 2023, to April 19, 2025) and within three months of expiration may be renewed for one additional year if the parties make no change to the program and certify that the program has been conducted in compliance with the agreement.

ADDRESSES:

Interested parties may submit comments on the new program to the CMS Privacy Act Officer by mail at: Division of Security, Privacy Policy & Governance, Information Security & Privacy Group, Office of Information Technology, Centers for Medicare & Medicaid Services, 7500 Security Blvd., Baltimore, MD 21244–1850, Mailstop: N1–14–56, or by email at [e-mail].

FOR FURTHER INFORMATION CONTACT:

If you have questions about the program, you may contact Anne Pesto, Senior Advisor, Marketplace Eligibility and Enrollment Group, Center for Consumer Information and Insurance Oversight, Centers for Medicare & Medicaid Services, at 443–844–9966, by email at [e-mail], or by mail at 7500 Security Blvd., Baltimore, MD 21244.

SUPPLEMENTARY INFORMATION:

The Privacy Act of 1974, as amended (5 U.S.C. 552a) provides certain protections for individuals applying for and receiving federal benefits. The law governs the use of computer matching by federal agencies when records in a system of records (meaning, federal agency records about individuals retrieved by name or other personal identifier) are matched with records of other federal or non-federal agencies. In carrying out this Agreement, both Parties will follow requirements that apply to System of Records, and HHS will carry out all of the requirements that apply to matching programs—under the Privacy Act as amended (5 U.S.C. 552a) and the regulations and guidance promulgated thereunder, including Office of Management and Budget (OMB) Circular A–108 “Federal Agency Responsibilities for Review, Reporting, and Publication under the Privacy Act” published at 81 FR 94424 (Dec. 23, 2016) and other OMB guidelines. The DHS Data Integrity Board has not approved this program, but DHS/USCIS has approved the data exchange agreement.

The Privacy Act requires agencies involved in a program that meets the definition of a “matching program” in 5 U.S.C. 552a(a)(8) to comply with the below requirements. HHS will provide all of the required protections to:

1. Enter into a written agreement, provide a copy of the agreement to Congress and the Office of Management and Budget (OMB), and make it available to the public, as required by 5 U.S.C. 552a(o), (u)(3)(A), and (u)(4).

2. Notify the individuals whose information will be used in the matching program that the information they provide is subject to verification through matching, as required by 5 U.S.C. 552a(o)(1)(D).

3. Verify match findings before suspending, terminating, reducing, or making a final denial of an individual's benefits or payments or taking other adverse action against the individual, as required by 5 U.S.C. 552a(p).

4. Report the matching program to Congress and the OMB, in advance and annually, as required by 5 U.S.C. 552a(o) (2)(A)(i), (r), and (u)(3)(D).

5. Publish advance notice of the matching program in the Federal Register as required by 5 U.S.C. 552a(e)(12).

Barbara Demopulos,

Privacy Act Officer, Division of Security, Privacy Policy and Governance, Office of Information Technology, Centers for Medicare & Medicaid Services.

Participating Agencies

The Department of Health and Human Services (HHS), Centers for Medicare & Medicaid Services (CMS) is the recipient agency, and the Department of Homeland Security (DHS), United States Citizenship and Immigration Services (USCIS) is the source agency.

Authority for Conducting the Matching Program

The principal authority for conducting the program is 42 U.S.C. 18001 et seq.

Purpose(s)

The program will provide CMS with USCIS data which CMS and state-based administering entities will use to determine individuals' eligibility for:

• initial enrollment in a Qualified Health Plan through an Exchange established under the Patient Protection and Affordable Care Act as amended by the Health Care and Education Reconciliation Act (42 U.S.C. 18001 et seq.);

• Insurance Affordability Programs (IAPs);
• certificates of exemption from the shared responsibility payment; and
• redeterminations and renewal decisions, including appeal determinations.

IAPs include advance payments of the premium tax credit and cost sharing reductions; Medicaid; Children's Health Insurance Program; and Basic Health Program.

Categories of Individuals

The individuals whose information will be used in the program are consumers (applicants and enrollees) who receive the eligibility determinations and redeterminations described in the preceding PURPOSE(S) section.

Categories of Records

The categories of records used in the program are identity, citizenship, and immigration status records. The data elements are described below.

To request information from USCIS, CMS will query USCIS' Systematic Alien Verification for Entitlements (SAVE) system using these data elements: Last Name; First Name; Middle Name; Date of Birth; One or More Immigration Number(s) ( e.g., Alien Registration/USCIS Number, Arrival-Departure Record I–94 Number, SEVIS ID Number, Certificate of Naturalization Number, Certificate of Citizenship Number, or Unexpired Foreign Passport Number); and Other Information from Immigration Documentation ( e.g. Country of Birth, Date of Entry, Employment Authorization Category).

When the above-listed data that CMS uses to query the SAVE system matches USCIS data in SAVE, USCIS will return query results to CMS that include these additional data elements about each individual, as relevant: Verification Case Number; Citizenship or Immigration Data ( e.g., immigration status/category, immigration class of admission, and/or employment authorization); and Sponsorship Data ( e.g., name, address, and Social Security number of Form I–864/I–864EZ sponsors and Form I–864A household members, when applicable).

System(s) of Records

The records used in this program will be disclosed from the following systems of records, as authorized by routine uses published in the System of Records Notices (SORNs) cited below:

• CMS Health Insurance Exchanges System (HIX), System No. 09–70–0560, last published in full at 78 FR 63211 (Oct. 23, 2013) and amended at 83 FR 6591 (Feb. 14, 2018). Routine use 3 permits CMS' disclosures to USCIS.
• DHS/USCIS–004 Systematic Alien Verification for Entitlements Program, 85 FR 31798 (May 27, 2020). Routine use I permits USCIS' disclosures to CMS.