Appendix 1 (Effective February 14, 2011)
Agreement Among State Public Assistance Agencies (SPAAs) Listed In Attachment A
Computer Matching Agreement Among The Defense Manpower Data Center, The Department Of Defense, The State Public Assistance Agencies And The Administration for Children and Families U.S. Department of Health & Human Services
I. Introduction and Background
This computer matching agreement supersedes all existing data exchange agreements or memoranda of understanding between the Department of Health and Human Services and the Department of Defense applicable to the exchange of personal data for purposes of identifying individuals who are receiving Federal compensation or pension payments and also are receiving payments pursuant to Federal benefit programs being administered by States.
This agreement is executed to comply with the Privacy Act of 1974, as amended, 5 U.S.C. § 552a; Office of Management and Budget (OMB) Guidelines interpreting the provisions of the Privacy Act pertaining to computer matching at 54 FR 25818 (June 19, 1989) and 56 FR 18599 (April 23, 1991); and the computer matching portions of Appendix I to OMB Circular No. A-130 as amended at 61 Fed. Reg. 6428, February 20, 1996.
C. Abbreviations and Definitions
- ACF: Administration for Children and Families, HHS.
- DIB: Data Integrity Board.
- HHS: Department of Health and Human Services.
- DISCLOSE and DISCLOSURE: The release outside of Federal or State agencies of information or data, with or without consent of the individual or individuals to whom the data pertains.
- DMDC: Defense Manpower Data Center, DoD.
- DOD: Department of Defense.
- FACILITATING AGENCY: Administration for Children and Families.
- MATCHING PROGRAM: As defined in subsection (a) (8) of the Privacy Act.
- OMB: Office of Management and Budget.
- OPM: Office of Personnel Management.
- PARIS: Public Assistance Reporting Information System.
- PUBLIC ASSISTANCE: State administered Federal benefit programs, including Temporary Assistance for Needy Families (TANF), Medicaid, and the Supplemental Nutrition Assistance Program(SNAP), formerly known as Food Stamps.
- PRIVACY ACT: The Privacy Act of 1974, as amended, 5 U.S.C §552a.
- RECIPIENT AGENCIES: As defined by the Privacy Act at 5 U.S.C. §552a(a)(9) will mean DMDC, the agency receiving the records and actually performing the computer match, i.e., the matching agency.
- SOURCE AGENCIES: As defined by the Privacy Act at 5 U.S.C. §552a(a)(11), will mean SPAA, the agencies initially disclosing their records, via the facilitating agency, for the purpose of a computer match.
- SPAAs: State Public Assistance Agencies (Attachment 1).
- SSN: Social Security Number.
Since 1993, ACF has been working with SPAAs and with other Federal agencies to develop information-sharing projects that have proven useful in verifying the income of individuals receiving public assistance. ACF has sought to identify information-sharing opportunities, and to lead and coordinate the activities required to take advantage of these opportunities.
Congress recognized ACF’s successful efforts in this regard by enacting Pub. L. 110-379, which amended section 1903(r) of the Social Security Act (the Act) to require that States have eligibility determination systems that provide for data matching through the Public Assistance Reporting Information System (PARIS) or a successor system. The provision took effect on October 1, 2009.
The matching program described in this agreement is similar to matching programs undertaken in prior years, and will result in the identification of individuals who are receiving both Federal compensation or pension benefits and public assistance benefits under Federal programs being administered by the States.
II. Purpose and Legal Authority
This agreement establishes an arrangement for a periodic computer matching program between DoD as the matching agency, ACF as the facilitating agency, and the SPAAs as the source agencies who will use the data in their public assistance programs. The purpose of this matching program is to provide the SPAAs with data from DoD military and civilian pay files, the military retired pay files, survivor pay files and the OPM civilian retired pay files to determine eligibility and to ensure fair and equitable treatment in the delivery of benefits attributable to funds provided by the Federal Government. The SPAAs will use the matched data to verify the continued eligibility of individuals to receive public assistance benefits and, if ineligible, to take such action as may be authorized by law and regulation.
ACF, in its role as match facilitator, will support each SPAA’s efforts to ensure appropriate delivery of benefits by assisting with drafting the necessary agreements, helping arrange signatures to the agreements and acting as a central shipping point as necessary.
This agreement sets forth the responsibility of the SPAAs with respect to information obtained pursuant to this agreement. Each SPAA match is expected to comply with pertinent requirements of the Privacy Act, including its implementing regulations and guidance.
B. Legal Authority
The legal authority for conducting the matching program is contained in sections 402, 1137, and 1903(r) of the Social Security Act (42 U.S.C. sections 602, a 1320b-7, and 1396b(r) ).
III. Justification and Expected Results
States are required to verify client circumstances when determining an applicant's eligibility for public assistance benefits. The parties to this agreement have determined that a computer matching program is the most efficient, expeditious, and effective means of obtaining and processing the information needed to identify individuals who may be ineligible for public assistance benefits, i.e., to verify client declarations of income circumstances. The principal alternative to using a computer matching program for identifying such individuals would be to conduct a manual comparison of all DoD pay/retirement/ survivor pay files and the OPM civilian retired pay records with SPAA records of those individuals currently receiving public assistance under a Federal benefit program being administered by the State. Conducting a manual match, however, would clearly impose a considerable administrative burden, constitute a greater intrusion of the individual's privacy, and would result in additional delay in the eventual recovery of any outstanding debts. By contrast, when using the computer matching program, information on successful matches (hits) can be provided within 30 days of receipt of an electronic file of SPAA beneficiaries.
B. Expected Results
The GAO report PARIS PROJECT CAN HELP STATES REDUCE IMPROPER PAYMENT BENEFIT PAYMENTS, projects that if States include TANF, Medicaid and SNAP activities in their matching projects, the gross savings will result in a savings to cost ratio of 11:1 (GAO 01-935, pp. 14, 15). All savings are in program dollars, since there is no cost paid to either ACF or DMDC to participate in the match program.
The cost-benefit analysis (Attachment 2) demonstrates that the benefits to be obtained from the match will exceed the costs incurred in conducting the matching program.
IV. Description of the Match and Records Involved
A. Description of the Match
Each participating SPAA will send ACF an electronic file of eligible public assistance client information. These files are non-Federal computer records maintained by the States. ACF will then send this information on to DMDC. In the alternative, participating SPAAs can submit files to DMDC via the Social Security Administration’s (SSA) “Connect Direct” portal. After DMDC receives the SPAA files, it will match the SPAA files against the DMDC database. The DMDC database consists of pay of DoD personnel and retirement records of non-postal Federal civilian employees and military members, both active and retired and survivor annuitants. The matching activity will take place at DMDC and will use all nine digits of the SSN. Resulting "hits" or matches will be disclosed to the relevant SPAAs.
B. Number of Records and Data Elements Involved
- The electronic files provided by each participating SPAA will contain data elements of the client's name, SSN, date of birth, address, sex, marital status, number of dependents, information regarding the specific public assistance benefit being received, and such other data as considered necessary on no more than 10,000,000 public assistance beneficiaries (Attachment 3).
- The DMDC computer database file contains approximately 4.85 million records of active duty and retired military members, including the Reserve and Guard, and approximately 3.68 million records of active and retired non-postal Federal civilian employees. Employee or retiree records may include information on benefits payable to employee or retiree dependents and/or survivors.
- DMDC will match the SSN on the SPAA file by computer against the DMDC database. Matching records, "hits" based on SSNs, will produce data elements of the individual's name; SSN; active or retired; if active, military service or employing agency, and current work or home address, and such other data as considered necessary (Attachment 3).
C. Privacy Act Systems of Records
Federal, but not State, agencies must publish system notices for "systems of records" pursuant to subsection (e) (4) of the Privacy Act and must identify "routine uses" pursuant to subsection (b) (3) of the Privacy Act for those systems of records from which they intend to disclose this information. The DoD system of records described below contains an appropriate routine use proviso which permits disclosure of information by DMDC as described in this Agreement.
DoD will use personal data from the record system identified as DMDC 01, entitled "Defense Manpower Data Center Base", 74 Federal Register at 39666, August 7, 2009. Attachment 4 is a copy of the published record system notice with the appropriate routine use (i.e., RU # 4) identified. Attachment 5 is a copy of the published system record notice 58VA21/22. As previously noted, the DoD records will be matched electronically against records supplied by the SPAAs. No information will be disclosed from any systems of records maintained by ACF.
V. Records Accuracy Assessment
A. Matching Agency
DMDC records are extracts of Federal personnel records with data provided by the employee/service member/retiree. Experience with matching programs and analyses performed by DMDC show these records to be at least 95 percent accurate. DMDC has been diligent in withholding or flagging any records which might appear problematic and any information on records that do not match on two data elements (i.e., name and SSN). The Civil Service Retirement and Insurance File (CSRIF), which are provided by OPM, contain information on approximately 1.78 million on non-postal Federal civilian annuitants respectively. The CSRIF has been determined, through periodic verification of the accuracy of the social security numbers, to be accurate, complete, and reliable for more than 99% of the retirees identified in the records.
B. Source Agency
Information used by SPAAs in matching programs is provided by the individual when applying for public assistance benefits. Experience by SPAAs shows these records to be at least 82% accurate.
VI. Starting and Completion Dates
A. Transmittal Letter Begins Review Time
When this agreement is approved and signed by the Chairpersons of the respective Data Integrity Board, the DoD, as the matching agency, will submit this agreement and the proposed public notice of the match as attachments in duplicate via a transmittal letter to OMB and Congress for review. The time period for review begins as of the date of the transmittal letter.
B. Matching Notice Publication
DOD will forward a public notice of the proposed matching program for publication in the Federal Register, as required by subsection (e) (12) of the Privacy Act, at the same time the transmittal letter is forwarded to OMB and Congress. The matching notice will clearly identify the record systems and categories of records being used and state that the program is subject to review by OMB and Congress. DoD will furnish copies of the published notice to ACF.
C. Effective Date of Agreement
The effective date of the matching agreement and date when matching may actually begin shall be at the expiration of the 40-day review period for OMB and Congress, or 30 days after publication of the matching notice in the Federal Register, whichever date is later. The parties to this agreement may assume OMB and Congressional concurrence if no comments are received within 40 days of the date of the transmittal letter. The 40-day 0MB and Congressional review period and the mandatory 30-day public comment period for the Federal Register publication of the notice will run concurrently.
D. Duration of the Agreement
This agreement shall be valid for 18 months from the effective date of the agreement and may be extended by the agencies for a period of time not to exceed 12 months, if each agency's program manager certifies to its respective Data Integrity Board that:
- The matching program will be conducted without change; and
- The matching program has been conducted in compliance with the original agreement.
It shall be the responsibility of DoD to draft the extension document(s). If either agency does not wish to extend this agreement, it will follow the termination processes described in section VI.F. This agreement may be modified at any time with the consent of each agency. The modification must be in writing, satisfy the requirements of the Privacy Act, and be approved by each Agency's respective Data Integrity Board.
E. Frequency of Matching
Matching will be conducted when the review/publication requirements have been satisfied and thereafter no more frequently than on a quarterly basis. On a quarterly basis, one or more of the SPAAs may elect not to participate in a scheduled match.
This agreement may be terminated at any time with the consent of both agencies. Either agency may unilaterally terminate this agreement upon written notice to the other agency requesting termination, in which case, the termination shall be effective 90 days after the date of the notice, or at a later date specified in the notice so long as either date does not exceed the original or the extended completion date of the match.
VII. Notice Procedures to Record Subjects
A. Individual Notice
Subsection (O) (1) (D) of the Privacy Act requires an agency to implement procedures for providing individualized notice at the time of application, and notice periodically thereafter, to applicants for and recipients of financial assistance or payments under Federal benefit programs. The SPAAs agree to notify all individuals who apply for public assistance benefits that the information provided on the application is subject to computer matching with other agencies. The SPAAs will accomplish this by way of a notice printed on their application forms or, when necessary, by providing separate handouts containing appropriate language. Since 1988, the application for Federal civilian employment includes a notice advising the applicant that records of Federal civilian employees are subject to computer matching. The SPAAs will provide subsequent notice to their respective benefit recipients by notifying each recipient of the computer matching at the time a redetermination for eligibility is made.
B. Constructive Notice
Any deficiencies as to direct notice to the individual for the matching program in paragraph VII. A. are cured by the indirect or constructive notice that is afforded record subjects by agency publication in the Federal Register of both the (1) DMDC routine use notice, as required by subsection (e) (11) of the Privacy Act, permitting disclosures of Federal personnel information to ACF/SPAAs and (2) the proposed match notice, as required by subsection (e) (12) of the Privacy Act, announcing the agency's intent to conduct computer matching for purposes of determining an individual's continued eligibility for public assistance under Federal benefit programs being administered by the States.
VIII. Verification Procedures and Opportunity to Contest
A. Independent Investigation
The SPAAs agree that the occurrence of a match is not conclusive evidence that Federal personnel identified are in fact the individual receiving public assistance benefits, but merely an indication that further examination is warranted.
SPAAs are responsible for verifying and determining if the data in the DMDC reply file are consistent with the data in SPAA public assistance files and for resolving any discrepancies or inconsistencies as to positive identification on an individual basis.
SPAAs will screen the initial data to verify that the matched individual is in fact the recipient of public assistance. SPAAs will do this by separately comparing the "hit" file with the SPAA public assistance files to verify the individual's identity and will conduct independent inquiries to resolve questionable identities.
Any discrepancies or inconsistencies in SPAA files, based on information furnished by DMDC, or developed as the result of the match, will be independently investigated and verified by SPAAs prior to their taking any adverse action against the individual.
B. Due Process and Opportunity to Contest
- Before taking any adverse action based on the information received from the match, SPAAs agree to provide written notice with specific details to each individual for whom SPAAs decide adverse action may be necessary.
- Written notices provided by the SPAAs will inform the individual that the SPAA has received information from DMDC, which indicates that the individual is receiving a Federal salary/payment/benefit, which may result in either an adjustment or termination of his or her public assistance benefit; possible collection action being initiated for any overpayment made; and/or possible other administrative/judicial action as authorized by Federal and/or State law or regulation. The notice must clearly explain the information the agency has its relevance to the individual's eligibility or benefit, and what action the agency will take in the event the individual fails to respond to the letter.
- If SPAAs intend to reduce, suspend, terminate or deny benefits as a result of information provided from the match, the SPAAs must provide notice and the opportunity to respond at a hearing in accordance with 42 CFR 431.200-250 for the Medicaid Program, 7 CFR 273.15 for the Supplemental Nutrition Assistance Program, and State established procedures for the Temporary Assistance for Needy Families Program.
- Written notices provided by the SPAAs to each public assistance recipient who may be the subject of adverse action will advise that he or she has 30 days in which to respond to the information being provided by the SPAA. However, where relevant program statute(s) or regulation(s) establish a time period shorter than 30 days for an individual to respond to a notice proposing an adverse action, SPAAs may substitute such shorter time period. In addition, each individual who may be the subject of adverse action will be further advised that unless a response is received within 30 days of the date on which the written notice is mailed or otherwise provided to the individual, (or within a specified time period shorter than 30 days provided by program statute(s) or regulation(s)), the SPAA will infer that the information provided the individual is accurate and correct and will take appropriate action. Appropriate action may include adjustment to, or termination of, the public assistance benefit; initiation of action to collect any overpayments made; and/or possible instituting administrative and/or judicial action against the individual.
C. Final Authority
After independent verification and notice under subsection (p) of the Privacy Act, the SPAA will be the agency to make all final determinations and to take action as is considered warranted and appropriate.
IX. Security Procedures
A. The ACF/SPAAs and DMDC will safeguard each other's information as follows:
- Each agency shall establish appropriate administrative, technical, and physical safeguards to ensure the security and confidentiality of records; to protect against any anticipated threats or hazards to their security or integrity, which could result in substantial harm, embarrassment, inconvenience, or unfairness to any individual on whom information is maintained; and to preclude remote terminal access by SPAA employees to the information being transferred under the terms of this agreement.
- Access to the records matched and to any records created by the match will be restricted only to those authorized employees and officials who require them to perform their official duties in connection with the uses of the information authorized in this agreement.
- The records matched and any records created by the match will be stored in an area that is physically safe from access by unauthorized persons during duty hours as well as non-duty hours or when not in use.
- The records matched and any records created by the match will be transported and processed under the immediate supervision and control of authorized personnel in a manner which will protect the confidentiality of the records, and in such a manner that unauthorized persons cannot retrieve any such records by means of computer, remote terminal or other means.
- Information systems used to store, access, process, or transmit records matched and information produced by the match will employ security controls consistent with those recommended by the U.S. Department of Commerce, National Institute of Standards and Technology (NIST), or will utilize a comparable risk management program. NIST-recommended security controls are described in the latest version of NIST Special Publication 800-53, "Recommended Security Controls for Federal Information Systems”.
- All personnel who will have access to the records matched and to any records created by the match will be advised of the confidential nature of the information and the civil and criminal sanctions for noncompliance contained in the applicable Federal laws.
B. ACF and DMDC may make on-site inspections or make other provisions to ensure that adequate safeguards are being maintained by both agencies and/or participating SPAAs.
X. Records Usage, Duplication, and Redisclosure Restrictions
A. Each agency agrees to the following limitations on access to, and disclosure and use of, electronic files, e.g., tapes, and information provided by the other agency:
- That the electronic files provided as part of the matching program will remain the property of the agency furnishing the files and will be destroyed after the matching program is completed, but not more than 6 months after receipt of the electronic files. Destruction will be accomplished by shredding, burning or electronic erasure.
- That the data supplied by each agency and the records created by the match will be used solely for the purposes of, and to the extent necessary in the administration of, the matching program covered by this agreement and any applicable laws.
- That the files provided by each agency will not be used to extract information concerning individuals therein for any purpose not specified in this agreement.
- That the files provided by each agency will not be duplicated or disseminated within or outside the agency without the written authority of the agency which furnished the data. No agency shall give such permission unless the redisclosure is required by law or essential to the conduct of the matching program.
- That information resulting from the matching program may be disclosed for follow-up and verification or for civil or criminal law enforcement investigation or prosecution if the match uncovers activity that warrants such action.
B. DMDC will not create a separate permanent file consisting of Information regarding those individuals involved in the matching program covered by this agreement except as necessary to monitor the results of the matching program. ACF/SPAAs will retain the identifiable records (hits) received from DMDC only for the period of time required for any processing related to the matching program and will then destroy the records unless the information must be retained in individual file folders to meet evidentiary requirements. In the latter instance, SPAAs will retire identifiable records in accordance with State law or regulation. Information about individuals verified as "non-hits" (record subjects are not both Federal personnel and public assistance beneficiaries) will be destroyed immediately upon such verification.
C. DMDC and SPAAs will keep an accurate accounting of disclosures from an individual's record as required by subsection (c) of the Privacy Act so as to permit record subjects to know how their personal information is being used; to enable the agency to inform past recipients of disputed or corrected information; and to provide an audit trail for any subsequent reviews of agency compliance with subsection (b) of the Privacy Act pertaining to conditions of disclosure.
D. If records are to be disclosed to a ACF/SPAA contractor in order to accomplish the matching program's purpose, the ACF/SPAA will obtain the written agreement of the contractor to abide by the terms of this agreement, including the provisions of the Privacy Act (i.e., subsection (m), as implemented by Part 24 of the Federal Acquisition Regulation) before receiving records relating to the matching program.
XI. Access by the Comptroller General
The General Accountability Office (Comptroller General) may have access to any records as necessary to monitor and verify compliance with this agreement.
XII. Reimbursement for Matches
DMDC currently does not intend to seek reimbursement, but reserves the right to recover future personnel and computer costs for conducting the quarterly match. In such cases, ACF will be notified 90 days in advance so that it may initiate, should it wish to do so, action to terminate the agreement because of the proposed future charges.
XIII. Points of Contact
A. DMDC contact for program issues is:
Defense Manpower Data Center
DOD Center, Monterey Bay
400 Gigling Road
Seaside, CA 93955-6771
(831) 583-2400, FAX (831) 583-2340
B. ACF contact for program issues is:
Administration for Children and Families
370 L'Enfant Promenade, S.W.
Washington, D.C. 20447
A. Program Official(s) for DoD
The authorized program officials, whose signatures appear below, agree to the terms and conditions as set forth herein, affirm that no verbal agreements of any kind shall be binding or recognized, and hereby commit their respective organizations to the provisions of this agreement.
Defense Manpower Data Center
DoD Center Monterey Bay
1600 North Wilson Blvd
Arlington, VA 22209 -2593
(703) 696 - 5816
Michael L. Rhodes
Defense Data Integrity Board
Department of Defense
B. Program Official(s) for HHS
The authorized program officials, whose signatures appear below, agree to the terms and conditions as set forth herein, affirm that no verbal agreements of any kind shall be binding or recognized, and hereby commit their respective organizations to the provisions of this agreement. 12/13/2010
Administration for Children and Families
370 L'Enfant Promenade, S.W.
Washington, D.C. 20447
C. Data Integrity Board
The respective Data Integrity Boards having reviewed this agreement and finding that it complies with applicable statutory and regulatory guidelines signify their respective approval thereof by the signature of the officials appearing below.
E. J. Holland
Data Integrity Board
Department of Health and Human Services
- Participating SPAAs
- Cost-Benefit Analysis
- Data Elements
- DMDC System notice DMDC 01
- VA System notice 58VA21/22