Q
100-
FOR
and
data
the
a
Federal
are to
and
secure
the
is
in
the
Law
Verifier
a
the
Lifeline
and
that
in
conditions
Agreement
permanent
Health Medicaid
Services
using
subscriber
matching
Regulations
(Public
and
of
of
establish
applicants
USF’s
the
or
this
subscribers
Eligibility
(CMS),
this
to
of
as
to
program
participating
the
is
and
by
terms
in
CMPPA.
federal
1906
Universal
responses
participation
SERVICES
DETERMINATION
FCC
19-20
of
(CMPPA) the
PROGRAM
the
disclosure
applicant
Lifeline
Parties
Parties
Services
SERVICES
for
20
2019, Department
Lifeline
No.
the
The
in
eligibility
2021
the
1,
1988
Code
The
by
the
the
generated
1,
COMMISSION
No.
applicants
negative
of
(Agreement) 47
HUMAN
require
participation
program
July or
verify
National
specifying
Services
in
defined
to
Medicaid
LIFELINE
Act
to
Program.
results
AGREEMENT
for
the
as
ELIGIBILITY
&
AND
between
governing
MEDICAID
program
January
including
forth
designated
determinations
conducted.
552a)
The
&
Lifeline
Agreement
Human
program.
points
§
using
set
Agreement
be
DEFIMTIONS
Lifeline
agreement
affirmative
(FCC)
been
FOR
AND
as
Protection
and
FEDERAL
program”
Lifeline
data
Medicare
match
will
(API).
and
SUPPORT
HEALTH
has
procedures
BETWEEN
Approximately
programs,
U.S.C.
Lifeline
eligibility
for
Fund)
MATCHING
that
determinations
program
Matching
written
will
THE
(5
TO
provide
benefit
OF
Matching
and
or
a
the
Health
Privacy
COMMUNICATIONS
Approximately
several
USF
to
MEDICARE
IN
of
of
Act
program
of
Interface
“matching
(USAC)
Commission
the and
ensure
support
Centers
Effective
a
(USF
USAC
data
Lifeline
to
of
to
one
FOR
Lifeline
eligibility
execute
be
Computer
Expiring
Computer
as
to
seq.
Privacy
the
fund
safeguards,
USF
integrity
To
COMPUTER
that
AUTHORITIES,
(HHS),
FEDERAL
matching
seeks
et
Company
this
Matching
the
CMS
the
Agreement.
the
Department
constitute
Medicaid
serve
the
of
INFORMATION
DEPARTMENT
of
Programming
TIlE
receive
Service this
information
program
CENTERS
will
wi]l
54.400
OF
LEGAL
PARTICIPATION
to
Administrator
Communications Services
CM$
of
§
further
conditions,
which
THE
determined
amended
Agreement
Computer
to
purpose
R)
Program
503) have
matching
under Automated and The
subscribers
program
This against
(Cf
eligible
Federal
subject
Universal
Administrative
Federal
Human eligibility
terms,
The
Purpose
A.
PURPOSE,
DISCLOSIJRE I. 2
The terms and conditions of this Agreement will be carried out by authorized employees, users, and contractors of CM$, the FCC, and USAC. FCC and CMS are each a Party, and collectively the Parties to this Agreement. By entering into this Agreement, the Parties agree to comply with the terms and conditions set forth herein and the applicable law and implementing regulations.
B. Legal Authorities
The following statutes and regulations provide legal authority for the uses of data, including disclosures, under this Agreement:
1. This Agreement is executed pursuant to the Privacy Act (5 U.S.C. §552a) and the regulations and guidance promulgated thereunder, including Office of Management and Budget (0MB) Circular A-l08 “Federal Agency Responsibilities for Review, Reporting, and Publication under the Privacy Act” published at 81 FR 94424 (Dec. 23, 2016), and 0MB guidelines pertaining to computer matching published at 54 FR 25818 (June 19, 1989).
2. The Privacy Act (5 U.S.C. §552a(b)(3)), authorizes a federal agency to disclose information about an individual that is maintained by an agency in an agency system of records (SOR), without the prior written consent of the individual, when such disclosure is pursuant to a routine use published for that SOR. CM$ has a routine use in its system of records to authorize the disclosures under this Agreement.
3. The FCC is authorized to disclose the data utilized in this matching program by Section 254 of the Communications Act of 1934, as amended, 47 U.S.C. §254, and the rules it has promulgated to implement the Lifeline program in Subpart E of Part 54 of its rules, 47 CFR 54.400 et seq. Pursuant to those rules, USAC is the permanent Administrator of the Lifeline program, 47 CFR § 54.701-717.
C. Definitions
for the purposes of this Agreement:
1. “Applicant” means an individual who is seeking eligibility for him or herself through an application submitted to USAC to verify eligibility and receive benefits through the USF Lifeline program;
2 “Breach” is defined by 0MB Memorandum M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information, January 3, 2017, as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (a) a person other than an Authorized User accesses or potentially accesses personally identifiable information (P11);or (b) an Authorized User accesses or potentially accesses P11for an other than authorized purpose;
3. “CMS” means the Centers for Medicare & Medicaid Services;
3
a
is
a
or
of
of
that
to
source
means
means
number,
a use
policy,
which
January
herself
and
benefits
and
this
records,
individual
and
552a(a)(5)),
agency
2,
mother’s
or
access
in
which
§
from
education,
photograph;
an
an
a
instruction,
identifying
mechanisms.
matching
communications
(11)),
him
securIty
her
history
hardware,
a birth,
receive
or
from
SOR
identifying
M-17-1
and
trace or (a)
about
for
in
a
of
U.S.C.
agency
biometric
information
unauthorized
other
and
or
in
552a(a)(9))
(5
his
support
independent
or
§
system
some
implied the
552a
0MB
used
agency
interstate
unauthorized
place
to,
§
to
Act
or knowledge,
the
by
eligible
be
by
USF
voice
number,
recipient
employment
any
and
individual,
or
gain
to
or
U.S.C.
information
identifying
Services; eligibility
symbol,
or
of
contained
service,
the
to
distinguish
limited
the
U.S.C.
regu]ate (5
or
of
date
Privacy
is
explicit
owner’s
of
changes
SOR
deemed
defined
to
to
(5
Federal
to
security
as
not
a
finger
an
is verify
Act
the
the
a
and
Human
control
in
the
FCC
records
Agreement;
Act
individual
to
number,
Commission,
criminal
been but
used
by
denial
as
such
of
personal
social the
statute
grouping
be
and
successful,
the
or
this
The
has
data;
and
assigned
cable:
or
Privacy
by
or
of
without
in
such
violating
of
USAC
can
Privacy
other
defined
and under
who
name, of
contained
the
receiving
to
Health
including,
Information”
is
identifying
that
the
name
failed
by
history,
act
individual,
of
with
created
agency
program.
disruption
their
particular
storage
by
the
the
Administrator
the
collection,
records
as
or
records
program;
Communications
individual, thereof,
satellite,
or
either
“SOR”
by
agency,
individual
submitted
defined
source
medical
characteristics
any
specific
or
the
an
item,
such
an
is defined
Identifiable a
means
wire,
combined
of
information
to
matching
name,
the
unwanted
is
by
Department
to
federal
Lifeline
a
identifying
government
any
is
discloses
permanent
attempts
her
retrieved
contractor
in
processing
etc.;
the
the
when
means
group
data,
software
is
means
or
USF
or
identity,
the
Records”
that
other
application
a
the
Agency” or
use
CMS
States
or
its
assigned
Incident”
is
means
of
linkable transactions,
or
television,
his
Agency”
an
the
and
“Personally
name,
or
for
for
means
means
includes
maintained
or
or
means
alone,
agency
is
5”
agency,
United
radio,
2017,
CC”
information
symbol,
“USAC”
and
through “System
“Subscriber”
through
program.
any
consent; “Source
firmware,
which system
system
“Security
contains
financial particular
“Record”
that
agency
any Agreement;
“Recipient
linked
maiden
individual’s
etc.,
3,
“P11”
by “RH
the
“F
13.
1%
11.
10.
9,
8.
7.
6.
5. 4. 4
II. RESPONSIBILITIES Of THE PARTIES
A. CMS Responsibilities
CMS will use the FCC-submitted electronic file(s) to conduct a data match against Medicaid enrollment records maintained in the Transformed Medicaid Statistical Information System (T-MSIS) $OR, and return either a positive CMS match of enrollees, or a no-match-found response.
B. FCC/USAC Responsibilities
1. The FCC will provide CMS with electronic file(s) in a format defined by CMS, on a timeframe agreed upon by the FCC and CMS, on a daily basis. The FCC will provide CMS with FCC’s electronic files via the secure API interconnection. The electronic file(s) will include the data fields identified in Section IV.B. of this Agreement.
2. The FCC wilt review the electronic file(s) returned by CMS containing the matched enrollment-related data, perform additional validation, and if deemed appropriate, conduct further investigation. The FCC/USAC will grant access to a limited number of people who have a need for the data. The FCC will require USAC, including its employees, contractors, and agents, to follow all applicable federal privacy and security standards.
3. The FCC/USAC will use the data received from CMS to make eligibility determinations for participation in the USF Lifeline Program.
4. The FCC/USAC will ensure the receipt of appropriate consents from applicants or subscribers for use of P11collected, used, and disclosed for the purposes and programs outlIned in this Agreement.
5. The FCC/U$AC will transmit data to CMS via encrypted representational state transfer (RESTful) web service request.
6. The FCC will provide Congress and 0MB with advance notice of this matching program and, upon completion of their advance review period, will publish the required matching notice in the FR and address public comments that may result from publication in the FR.
Ill. COST BENEFIT ANALYSIS
A. Cost-Benefit Analysis
As directed by the Privacy Act at 5 U.S.C. §552a(u)(4)(A), the FCC has conducted a cost-benefit analysis of this matching program. This analysis, which is attached to this Agreement as Attachment 1, demonstrates that this program is likely to be cost effective, and includes a specific estimate of any savings.
5
of
Act
09-07-
time
12
a
name,
Program
3
2017).
the
for in
birth
No.
Privacy
at
who apply
Lifeline
of
first
15,
No.
program.
14,400,000
the
used
Approximately
Lifeline
by
date
Use
System
be
5630,
renewed
name,
(Aug.
benefits
if
and
year.
may
5629,
Agreement.
matching
individuals
Last
Form
3060-0819.)
Routine
required
38686
of
2022
each
the
this
1,
as
(T-M$IS),
Lifeline
form
Approximately FCC
of
FR Program
ber
provide
of
residence,
FR
82
2019).
under
and
Number
FCC
num
of
process
at
they
the
notice
System
16,
(January
the
in
(See
full
services.
data elements:
state
Matching
to
in
Control
of
(Feb.
subscribers
annually.
2021
the
basis.
3060-0819
eligibility
disclosures
1,
list
of
publish
Agreement.
(SSN),
information
subject 0MB
EXCHANGED
2019
program
2230
the
Information
constructive
Matching
daily agencies.
is
1,
will
this
current
a
the
Match
of
published
FR
BE
FCC’s
Dates
Number
recertified
January
on
form,
and
number
84
the
July
that
FCC
the following
TO
Lifeline
under
through
be
provide
federal
at
in
records
Statistical
the
the
for
of
Program
will
will
full
Control
on
Frequency
other
security
vetted
Used
DATA
in
Completion
supports
conducted
applicants
which
7
are
and
0MB
be
with
disclosures
and
approximately
based
number
Medicaid
Lifeline
(e)(12))
THE
social Recertification
recertification
approximately eligibility -
—
No. be
—
will
of
inform
notice
subscribers
Elements
OF
and
published
Form,
CMS’
552a
Use
Records
Date
Records.
will
§
program
Starting
will
Date
Annual
last
of
digits
Data
subscribers
of
match
estimated
recertify
PROCEDURES
FCC
matching
match
four
The 9,700,000
and
new
The
Routine
FCC/WCB-1:
supports
0541
CMS Transformed
U.S.C.
Program
matching
(5 certification Application
The
The
1.
months)
Expiration
Effective
Projected
2.
(DOB).
last
Number
Specific The
1.
2.FCC
Systems
B.
NOTICE A.
D.
C.
B.
A.
DESCRIPTION
V. IV. 6
C. The FCC will provide subsequent notices to both applicants and current subscribers as required. The FCC provides notice to the public about matching activities with publication of the SORN, by making a copy of this Agreement available to the public upon request, by providing a link to this Agreement on the Privacy program page of the FCC/USAC website, and by other means of communications (e.g. c-mails, direct mail).
VI. VERIFICATION PROCEDURES AND OPPORTUNITY TO CONTEST
A. General
The Parties acknowledge and agree that this matching program is not the sole basis through which a beneficiary’s eligibility for the Lifeline program may be determined. The Privacy Act requires that each agreement specify procedures for verifying information produced in the matching program as required by 5 U.S.C. §552a(p). This subsection requires agencies to independently verify the information produced by a matching program and to provide the individual an opportunity to contest the agency’s findings before an adverse action is taken against the individual because of the information.
Subsequent amendments and regulations allow for an agency to authorize a waiver of independent verification procedures when it finds high confidence in the accuracy of the data. See 0MB, “final Guidance Interpreting the Provisions of Public LawlOO-503, the Computer Matching and Privacy Protection Act,” (54 FR 25818 (June 19, 1989)).
B. Verification Procedures
1. The fCC/U$AC will be responsible for independently verifying the results of the match.
2. The FCC/USAC may not deny, terminate, or make a final decision of any benefit to an individual or take other adverse action against such individual solely as the result of the information produced by this matching program until the fCC/U$AC has independently verified such information.
3. This independent verification includes: (1) giving the applicant or subscriber the opportunity to present evidence of eligibility, (2) comparing automated data with manual files to verify applicant or subscriber identification, and (3) analyzing the confirmed information.
4. Denial of benefits will not be predicated on the result of an initial match between systems. Denial of benefits will be made upon an independent verification made by a federal employee or designated contractor validating the results of the match received from CMS.
C. Notice and Opportunity to Contest
e
7
to
for
the
tim
will
to
in
the
civil,
data
these
of
will
in
to
only
which
users
The
reduction,
such
and
data
adverse
program’s
adverse
programs
only
on
required
fCC/USAC,
action.
and
will:
course
contest
all
FCCIUSAC
provided
when
criminal,
on
reasons,
adjustment
to
the
the
as
date
the
other
and
correct
occurs.
any
database
in
to
iTEMS
benefit
Agreement
is
notices
before
based
potential
the
of
planned
destroy
matching
respond;
suspension,
take
on
Agreement
during
the
this
to
days,
verified
or
data
the
notice
and
such
necessary
dispute
then
of evidentiary
possible,
30
a
opportunity this
actions
the
benefits
the
if
been
Party
and
for
under
will
begins
FCC/USAC
deny,
to
the
served
completion
MATCHED
call
has
findings
matched
under
within
writing
termination,
and
each
individual
make
and
to
a federally-funded
OF
in
Lifeline
have
the
the
proposed
by
upon
MS
contest
reasonably
the
writing,
reduce,
in
required
C
to
responds
to
in to
is
that
and
they
submit, data.
authorized
FCC/USAC
schedule.
benefit.
when
findings number
as
to
contest
from
otherwise
notified
created
or
time
information
the
applicable
such
to
suspend,
or
resulting
requirements
destroyed
notices
calls
the
soon
The
provided
findings all
subscriber
been
itlement.
the
match
individual
be
conclude
from
RETENTION
retention
as
or
may be
information
resolution,
ent
such
receives
the
for
action telephone cases.
has
until the
action
the
these
payment,
will
will
it
or
for
auditing
opportunity
the
of
to
that
and
terminate,
and
any
if
opportunity
an
records
receives
data otherwise
unless
contest
provide
FCC
not
it
records
an
destroyed
required
or
then destroy
benefit
to
RECORDS
individual
apply
threatened
records
be
determination.
means
respond
actions
eligibility,
applicant
will
that,
will
retain
response
FCC/USAC
data
proper
will
individual
information
FCCIUSAC
CMS
under
the
times
of
the
an
writing.
will
will
will
individual
malted
the AND
final
the
will
the
the
and
the
provided
in
a
rapid
is
and
retain
to
action”
from
clearly
the
denial
individua[s
and
against
case,
required
data,
identifiable
will
FCCIUSAC Inform
FCC/USAC
the
State
effectuate
period,
notice
makes
documentation
Give
findings;
enable
provided
above,
exception
processing
final
administrative
requested,
FCCIUSAC
be
To
c.
b.
a.
or The
“Adverse investigation
disclosed action,
B.,
Other
action
An or
The
which
verify
the
FCC/USAC according CMS
extent
3.
2.
1.
C. D.
A. B.
DISPOSITION VII. $
purpose pursuant to records retention requirements established in conjunction with the National Archives and Records Administration (NARA).
E. CMS will erase the matching file generated through this matching operation as soon as the information has served the matching program’s purpose and all legal retention requirements established in conjunction with the NARA under applicable procedures have been met.
VIII. RECORDS ACCURACY ASSESSMENTS
The fCC/U$AC estimates that the FCC records to be used in this matching program are at least 99 percent accurate.
CMS estimates the CMS records to be used in this matching program are most accurate and complete as provided by the states.
IX. SECURITY PROCEDURES
CMS and the fCC/USAC agree to these information security procedures:
A. Administrative Safeguards
CMS and the FCC/USAC will comply with the requirements set forth by the Privacy Act (5 U.S.C. § 552a(e)(l0), (m), and (o)(1)(G)), Federal Information Security Management Act (FISMA), 44 U.S.C. Chapter 35, Subchapter II, as amended by the federal Information Security Modernization Act of 2014 (Pub. L. 113-283); related 0MB circulars and memoranda, such as 0MB Circular A-130, “Managing of federal Information as a Strategic Resource” (July 28, 2016), and National Institute of Standards and Technology (NIST) directives including any applicable amendments published after the effective date of this Agreement. These laws, directives, and regulations include requirements for safeguarding federal information systems and personally identifiable information used in business processes and related reporting requirements. Specifically, FISMA requirements apply to all federal contractors, organizations, or entities that possess or use federal information, or that operate, use, or have access to federal information systems on behalf of an agency (44 U.S.C. § 3554(a)).
CMS and the FCC/USAC will restrict access to the data matched and to any data created by the match to only those authorized employees, contractors, and officials who need it to perform their official duties for the uses of the data authorized in this Agreement. CMS and the FCC/USAC will also notify such authorized users of the civil and criminal sanctions for noncompliance contained in the applicable federal laws.
B. Technical Safeguards
9
of
be
or
data 140-
the
data
the
the
in
protect
will
by
by
a
official
System
so
to ensure
CMS
any
incident.
in
will
their
detection
individually
United
meet to
for
user’s
Desk
codes
that
the
accessing
recordkeeping
authorization
records
at
created
the
and
incidents
the
Publication
that
of
Upon
system.
them
changed
retrieve
records
of
incident
personnel
and
below:
perform
limit
when
data
access
ensure
Service
the
Those
other’s
to
the
need
(FIPS)
have
Agreement
of
IT
privacy
any
periodically.
will
cannot
password,
discovery
named
user
each notification
strictly
deletion
algorithms
this
use
who
matching
and
Security
and
numbers
guidelines.
access.
duties
of
CMS
in
and
authorized
authorized
will
and
after
or
Standard
of
using
ID
persons
the
of
timely
monitored
those
supervisor
experiencing
persons
security
via
hour
restrict
matched
RESPONSIBILITIES
Contact(s)
authorized
use
to
User
access
automated
Homeland
and
or
to
CMS:
(1)
control
ensure
inspections
departed
the
the
Party
(US-CERT)
of
by
all
data
track
at
user’s
identification
encrypted
beyond
to
Processing
FCC/USAC
one
and
for
the
means. has
access
the
and
Security
be
(PKI))
The
unauthorized
tracked
the
Team
on-site
contact
user
includes
will
other
that maintain
within
system,
identified
a
personal
and
unauthorized
exchanged.
report
restrict
process
or
saved, to
so
Department
this
System
provisions
make
he that
necessary
to
the
1-800-562-1963
the
Information
NOTIFICATION
be
supervision
that
enter
transit
when
to
CMS
will
Readiness
or
will
data,
may
agree
to
in
records
make
infrastructure
notify
areas
agree
will
current
interconnection,
Party’s
AND
of
the
or
terminal,
against
Federal
key
access
data
users
have
of data
matching process,
this
notified
most
other
systems.
environment
immediate
the
conditions
to
786-2580
All
actions
the
are
promptly
Emergency
the
of
remote
FCC/USAC
needs
the
public
the
fCC/U$AC
to
FCC/USAC
system
practices,
password.
uer
safeguard
FCC/USAC
or
under
the
(410)
will
personnel
with
the
related
the
electronic
to
safeguarding
duties.
all
at
the
and
agencies’
notify
under computer
Safeguards
longer
REPORTING
Inspections
and
of
related
and
and
confidentiality
Computer
no
the
computer,
and
security
these
FCC/USAC
logs
tracked
Authorized
2
official
requirements
Systems to
on
CMS
by
the incident
match
adequate
and
CMS
user
the account
(passwords duties
secured
CM$
maintained
On-Site
Physical
cms_itservicc_desk(t)cms.hhs.ov
States
CM$ telephone
promptly FCC/USAC
an
accordance
3.
1.
2.
D.
C.
A.
INCIDENT X. 10
CM$ will promptly notify the FCC/USAC by sending an email to inciden((dusac.org to activate USAC’s Incident Response Team and notifying simultaneously one of these contacts at the fCC/USAC: U$AC Privacy Officer, Laurence Schecker, (202) 263-1646 or USAC Director of Information Security, John Jackson (202) 423-2670.
As soon as possible after receiving a notification of an incident from CMS, USAC will report the incident to the FCC’s Network Security Operations Center (NSOC) at nsoe(alcc.gov or (202) 418-4011.
If the Party experiencing the incident cannot speak with the other Party’s System Security Contacts within one (1) hour) or if contacting the System Security Contact is not practical (e.g., outside of normal business hours), then the following contact information shall be used: USAC Director of Information Security, John Jackson) (202) 423-2670 and e-mail to incidentusac.org.
B. If either CMS or the FCC/USAC experiences a loss of PITprovided under this Agreement, the Party that experienced the loss incident will also comply with the P11 breach reporting and security requirements set forth by 0MB M-17-12, “Preparing Responding to a Breach of Personally Identifiable Information” (January 3, 2017).
C. CMS and the FCC/USAC agree to notify all the Security Contact(s) named in this Agreement as soon as possible, but no later than one (1) hour, after the discovery of a breach (or suspected breach) involving P11. The Party that experienced the incident will also be responsible for following its internal established procedures, including:
• Notifying the proper organizations (e.g., United States Computer Emergency Readiness Team (US-CERT), the Information Systems Security Officers (ISSOs), and other contacts listed in this document);
Conducting a breach and risk analysis, and making a determination of the need for notice and/or remediation to individuals affected by the loss; and
• Providing such notice and credit monitoring at no cost to the other Party, if the analysis conducted by the Party having experienced the loss incident indicates that individual notice and credit monitoring are appropriate.
D. In the event of any incident arising from or in connection with this Agreement, each Party will be responsible only for costs and/or litigation arising from a breach of the Party’s own sy’stems.FCC/USAC is responsible only for costs and litigation associated with breaches to FCC/USAC systems and CMS is responsible only for breaches associated with CMS systems.
FCC/USAC shall not be liable to CMS or to any third person for any cause of action arising from the possession, control, or use by CMS of applicant or subscriber P11,or for any loss, claim, damage or liability, of whatever kind or nature, which may arise from or in connection with this Agreement or the use of applicant or subscriber P11.
C)
Q
a
II
to
law
the of
of
this
P11,
of
of
will
or
to
the
by
by
arise
required
ure
either or
so
as
program,
the
P11.
action as
this
be
Party
Agreement.
information
conduct
by
do back-up
by
may
federal
in
of
use,
agency,
purposes
returned
disclose
to
subscriber not
disclos
the
this
for
permission
except
each
or
or
or record
authorized
to
the
administration
to
or
matching
which
local
will
and
cause
the
request
access,
subscriber
not
for
the disclosed
or
the
comprising
applicable
any
or
RESTRICTIONS
or
stipulations
for
Parties
compelled
purpose,
upon
who
natch
programs
obtain
nature,
essential
state
for file
applicant
destroyed
damaged
match
all
All
or
the
used
under
of
individual’s purpose
derivativety,
be
will
to
conduct
of
duplication,
be
or
by agents
an
Unless
applicant
to
unless
kind
obtained person
data federal,
available
shall
separate
used
matching
use, become
not
Party
a
and
a
from
the
be
program.
on
using
consent
to
sanctions
third
and
file
created
manner
will
regulation.
request.
Each
records
a
fCC/U$AC
purpose.
use
essential
or
the
will
or
any
whatever
create
specific
REDISCLOSURE
duplicated
in
by
or
be
the
matching program’s
to
not
of
accounting
or
written
law.
be
law
the
criminal
other
original
disc]osure
matching
or
contractors,
use data
the
Congress,
the
in
AND
may
the
by
by
agreement
restrictions
will
no
not
of
disclosure
the
program disclosure.
or
individuals
to
and
the
as
for
this
of
liability,
Agreement,
the
will
make
duplicate
Party:
these
such
Agreement
civil
of
or
duplication.
without
and
to should
required
involved
this
to
not
authorization,
records
except
control,
wilt
employees,
this
accomplish
compelled
matching
FCCIUSAC
or
FCC/U$AC,
other
results
any
accounting
FCC/USAC
and
to
or
will
to
(e.g.,
and
agree
to
making
outside
regarding
the
these an
the
the
this
Party
damage
with
exchanged
subject
and
Party.
DUPLICATION
“non-matching”
by
statutory
for
the
externally,
be
Agreement
liable
apply individuals keep
Party
before
possession,
or and/or
552a(c)
claim,
FCC/USAC
program, CMS
other
be
program
purpose
permissible
monitor
disclose
purposes)
§
contractor
this
about
may
will
will
the
or
Party.
to
to those
other the
FCC/USAC
be
outside
not
FCC/USAC
Party
connection
any
loss,
USAGE,
CMS
obtained
furnished
information
additional
in
the
under
and
and
the
from
Party
for
or
may
U.S.C.
any
internally
shall
or
matching
matching
other
5
as
regulation,
and
required
for
statutes.
Agreement
individual disclose
CMS
Each
CMS necessary
regarding
by
Agreement government
notify
Data contingency
the
or
Records the
stated Information respective disclosed
Party
data
or
Absent
this
If
or
arising
CM$ from
G.
F.
F.
D.
C.
B.
RECORDS
information
CMS A. XL 12
H. The restrictions listed above in this section do not apply to data, information and reports that USAC is required to submit to the FCC to allow the FCC to carry out its oversight duties, including but not limited to, the National Verifier Annual Report required by the Lifeline Reform Order, 31 FCC Red at 4021, para. 160 (2016).
XII. COMPTROLLER GENERAL ACCESS
Pursuant to 5 U.S.C. §552(o)(1)(K), the Government Accountability Office (Comptroller General) may have access to all CMS, FCC, and USAC records, as necessary, in order to verif’ compliance with this Agreement. This Agreement also authorizes the Comptroller General to inspect any records used in the matching process covered by this matching agreement under 31 U.S.C. §717 and 5 U.S.C. §552a(b)(lO).
XIII. INSPECTOR GENERAL ACCESS
CMS, FCC, and USAC authorize the FCC Office of Inspector General to use results from the data match conducted under this matching program, for investigation, audits, or evaluation matters under the Inspector General Act of 1978, as amended.
XIV. REIMBURSEMENT
USAC will pay CMS for the API development and on-going operations necessary for the matching services described in the Agreement pursuant to a separate fee agreement. Other than the costs covered by such fee agreement, each Party will be responsible for all other expenses it may incur in connection with the preparation, negotiation, and execution of this Agreement and performance of the activities described in the Agreement.
XV. DURATION, MODIFICATION, AND TERMINATION
A. Effective Date: The Effective Date of this Agreement will be July 1, 2019, provided that the FCC has first provided the proposed matching program report to the Congressional committees ofjurisdiction and 0MB in accordance with 5 U.S.C. § 552a(o)(2)(A) and (r) and 0MB Circular A-108, and upon completion of’their advance review period, the FCC has published notice of the matching program in the FR for a 30 day public comment period as required by 5 U.S.C. §552a(e)(12).
B, Duration: This Agreement will be in effect for a period of 18 months subject to renewal as provided in section XV.C.
C. Renewal: The Parties may, within three (3) months prior to the expiration of this Agreement, renew this Agreement for a period not to exceed twelve (12) months if CMS and the FCC certify the following to their respective DIBs:
1. The matching program will be conducted without change; and
(J
13
is
agency
ninety
upon
written
XV.B.
other
this
modification
of
written
mutual
the
effective
notice.
a
the
with
be
Agreement
the
by
term
the
that
notify
in
this will
upon
time
month
must
finding
compliance
18
it
time
a
at any
in
specified
terminate
the
any
termination
at
upon
date
the
before
program
later
Agreement,
Agreement
a
case
parties,
agreement.
unilaterally
days
at
this
Privacy
this
terminated
or
90
both
new
for
may
which
be
matching
a
900
by
renew
in
Commission
Commission
least
the
modify
to
to
may
notice,
Party
at
are:
Suite
Official
require
party,
the
may
Counsel
want
418-1919
20554
20005
of
agreed
Either
NW,
not
SW,
SW
Lifeline
Issues:
not
other
conducted
contacts
DC .stephensfce.gov.
DC
c
Agency
date
Agreement
parties
(202)
does
discontinue
Director
the
General
Street
Street
Street,
Garber
does
Issues:
the
have
Communications
to so mark
FCC
Communications
parties.
to
The
CONTACf
mutually
of
This
Stephens
Senior
Williams
President,
202-772-5251
12th
12th
12th
the
and
after
TO
agency
of
parties
notice
Privacy
FCC
Washington, E-mail: Office federal
445
John
Washington,
Mark
Federal Telephone:
700 Email:
445
Managing
U$AC Tel.:
Programmati
Michelle
Vice
intention
days
significant
Agreement.
The
USAC
2.
1.
its
either
written
(90)
consent
Termination:
Modification:
not
modification,
expires.
If
of
2.
A.
PERSONS
F.
E
D. XVI. 14
Washington, DC 20554 Telephone: (202) 418-1747 E—mail:]C)hfl.\ViUintflS2(c1CC.()V.
B. The CM$ contacts are:
1. Medicaid/CHIP Issues:
Julie Bougim Director Data and Systems Group Center for Medicaid and CHIP Services Centers for Medicare & Medicaid Services 7500 Security Boulevard Mail Stop: 52-22-27 Location: $2-23-06 Baltimore, MD 2 1244-1850 Telephone: (410) 786-9361
E-mail: julIe.tjoughnJcms.hhs.gov
2. Privacy and Agreement Issues:
Walter Stone CMS Privacy Act Officer Division of Security, Privacy Policy & Governance Information Security & Privacy Group Office of Information Technology Centers for Medicaid & Medicare Services Mail Stop: N1-14-56 Phone: 410-786-5357 E-Mail: walter.stonecms.hhs.gov.
Barbara Demopulos, Privacy Advisor Division of Security, Privacy Policy & Governance Information Security & Privacy Group Office of Information Technology Centers for Medicare & Medicaid Services Location: N1-14-40 7500 Security Boulevard Baltimore, MD 21244-1850 Telephone: (410) 786-6340 E—maIl:l3arbaia.Demoputosftvcrns,hhs,gov.
Scott Blumberg, Privacy Advisor Division of Security, Privacy Policy & Governance Information Security & Privacy Group Office of Information Technology Centers for Medicare & Medicaid Services Location: Nl-15-25 15
7500 Security Boulevard Baltimore, MD 21244-1850 Telephone: (410)786-7329 E-mail: ScotLh1urnbercrns.hhs.gov.
0
0 16
XVII. APPROVALS ANDSIGNATURES
A. FEDERAL COMMUNICATIONS COMMISSION
The signatories betow warrant and represent that they have the competent authority to approve the model of this Computer Matching Agreement, and enter into the obligations set forth in this Agreement, on behalf of the FCC.
Mark Stephens Date Managing Director Federal Communications Commission
Q
a
17
the
authority
into
enter
competent
tate
and
the
have
CMS.
(CMS)
and
of
Agreement,
they
that
behalf
on
Matching
Governance,
MEDICAID
represent
and
AND
and
Computer
Agreement,
Policy
this
this
warrant
Services
Group,
of
in
Privacy
MEDICARE
below
forth
model
Privacy,
Privacy
Medicaid
set
FOR
the
for
Technology
&
and
Security,
of
signatories
approve
Official
Security
obligations
to
The
Medicare
CENTERS
Information
Division
Pagels
for
Senior
B.
of
Centers
Office
Information Acting
Director, MichaeJ 18
XVIII. DATA INTEGRITY BOARDS
A. FCC DATA INTEGRITY BOARD
FCC Data Integrity Board has reviewed and approved this Computer Matching Agreement and has found it to comply with the Privacy Act of 1974, as amended (5 U.S.C. §552a).
9 Joh, Wi1Iiam Date k? Chairperson, Data Integrity Board federal Communications Commission 19
B. HH$ DATA INTEGRITY BOARD
HHS Data Integrity Board has reviewed and approved this Computer Matching 0 Agreement and has found it to comply with the Privacy Act of 1974, as amended (5 U.S.C. §552a).
Date
Scott W. Rowell Assistant Secretary for Administration, and Chairperson, Data Integrity Board U.S. Department of Health and Human Services
C
Attachment 1: Cost Benefit Analysis 20
Attachment 1
Cost Benefit Analysis for the Computer Match between the Centers for Medicare & Medicaid Services and the Federal Communications Commission for Verification of Eligibility for the Lifeline Program for Low-Income Consumers
Match Objective
This matching program will provide the Federal Communication Commission’s (FCC or Commission) Lifeline program, as administered by the Universal Service Administrative Company (USAC), with information about whether a particular individual is enrolled in the Medicaid program. Because participation in Medicaid qualifies individuals for Lifeline benefits, matching a Lifeline applicant or subscriber to his or her Medicaid record confirms that person’s eligibility for Lifeline. Verifying Lifeline eligibility through an automated computer matching process reduces the time and expense of program enrollment and recertification for both consumers and the eligible telecommunications carriers that provide Lifeline services. It will also reduce program costs by preventing ineligible consumers from enrolling in the Lifeline program and will advance the goal of implementing the Lifeline National Eligibility Verifier (National Verifier) system adopted by the FCC in 2016. Background
As part of the universal service authority Congress gave the FCC in section 254 of the Communications Act of 1934, as amended,1 the FCC created the Lifeline program. Lifeline is administered by USAC under FCC direction and supervision.2
The Lifeline program provides support for discounted broadband and voice services to low income consumers. Consumers qualify for Lifeline through proof of income or participation in a qualifying program, such as Medicaid, the Supplemental Nutritional Assistance Program (SNAP), Federal Public Housing Assistance, Supplemental Security Income (S$I), Veterans and Survivors Pension Benefit, or Tribal-specific programs.3
In a Report and Order the FCC adopted on March 31, 2016, after completing a rulemaking proceeding in accordance with section 4 of the Administrative Procedure Act,4the Commission directed USAC to create the National Verifier, including the National Lifeline Eligibility Database (LED).5 The purpose of the National Verifier was to match data about Lifeline applicants and subscribers with other federal and state data sources to verif’ the eligibility of an applicant or subscriber. The stated goal of this new system was “to increase the integrity and improve the performance of the Lifeline program for the benefit of a variety of Lifeline
47 U.S.C. §254. 2 47 CFR § 54.400 ci seq. 47 CFR § 54.409(a). 5 U.S.C. § 553. Q L/1ine and Link Up Reform and Modernization, ei at., Third Report and Order et al., 31 FCC Rcd 3962 (2016).
tD
is
21
or
will
rely
the
and
work
the
or
and
system
the
for
analysis:
and
computer
in
between
costs
will
for
enrollee
subscriber
bi
program
benefits,
agencies.
and
Lifeline
been
a estimates
eligibility 2017
purposes.
estimated
and
carriers overall
(CMS)
the
rate
benefit abuse
service
organizations,
state
subscriber
the The
imposed
subscribers
have
verify
Year
other
and
sure
These
cost
matching program
receive
Medicaid
Commission
through
and
and
Medicaid
a
for
Service
that
personnel
will
to
the
consumer
the
Lifeline
payment
agreement
the
enroll
is
costs.
newly
fiscal
interconnection
of
make
fraud,
of
of
CMS.
building
for
USAC.
to
CMS
for
the
the
federal
they
from
eligibility.
by
through
and
applicant
eligible
Verifier
term
by
program.
applicant
sharing
use waste,
Medicaid
checking
costs
is
improper
companies
applicant
community-based
build
telecommunications
other
primarily
vendors
that
when
Report
for
We
and
proceeding,
(NLAD)
data
to
the
initial
the
by
USAC,
the
development
incurred
reduce
confirming
Lifeline
on
the
National
eligibility separately
collected
states,
about
matching
the
in
by
in
such
consist
of
consumer
CMS.
(eligible
and
FCC,
“yes,”
costs
for
compliance
The
a
this
data
Financial
to
one
based
Medicare
Database
necessary
claims
the
of
maintained
record
for
compares
responsibility providers
documentation
either
by
quantified
provided
program
reduce
review
system
USAC.
subscribers,
the
information
Agency
the
telecommunications
benefits
assumptions
that
are
consumers
Medicaid
changes
the
subscribers,
by
estimated
on benefits
service
in
applicant
to
documents
systems
Centers
send
would
verifying that
respond
use
are
net
provided
FCC’s
eligibility
estimates
matching
assist
the
Accountability
eligibility
process
for
data
result
system
Based
to
will
will
program
provIders,
to
the
Lifeline
following
maintain
in
operated
this
Lifeline
were
services
procedures,
not
in
Verifier
a
to
implemented,
for
the
review
program.
for
program
Plan.
Agreement
calculate
initial
if
manual
is
Lifeline
including
system
will
the processes
to
Lifeline
in
program automatically
costs
the
automated
interface
matching
current
responsible
Lifeline
Verifier, in
costs
estimates
service
an
National
not. identified
CMS
will
and
information
Verifier
this
manually
with 126.
manner:
created
Verifier
matching
is
Matching
Commission.”6
sources,
National
the
program
USAC used
Cost
for
The
estimates
of
including
matching
with reduction
provide
have
this
she
the
enrolled
imposed
computer
National
generally
that ETCs
improve
USAC
through
program’s and
to
Verifier
or
program
the
for
National
The
and
the
are National
states
the
following
USAC’s
and
he
associated
savings
variety
Computer savings
to
FCC
matching
newly
at4006,para.
the
months).
already
a
the
the Some
‘
61d.
Lifeline
cost
Cost The
savings The
CMS and through
(18 on
costs
Methodo1oy
“no,”
The
verification.
in directional
information
eligibility This
shift National
As
not
ETCs)
check
services.7
approved
Under
concluded
program.
providers,
USAC, participants, 22
• USAC will obtain and store a “yes” or “no” response from CMS that indicates whether an individuat participates in Medicaid based on personally identified information (P11) provided by USAC. . Errors in data through this matching program should be rare and affected individuals can contest adverse findings. • USAC is building the National Verifier system regardless of whether this matching program exists; however, USAC would be required to perform costly manual reviews for these subscribers without the matching program. o Only initial implementation costs and costs of routine maintenance and operation of the interconnection system during the initial term of the matching program (18 months) are included in the CBA. Any system changes following the initial matching period are not considered in the estimates.
Newly Imposed Costs
Total newly imposed costs for the matching program are estimated to be $1,136,765 in the initial matching period (18 months).8 Costs included in this amount consist of personnel and computer costs for the source and recipient agencies and cost savings due to the avoidance of manual eligibility verification reviews by USAC. Key elements of the overall costs of this matching program are discussed in more detail below.
Key Element 1: Personnel Costs • Source Agency (CMS)
We expect most of the costs will be incurred prior to using the matching program, to implement system changes, and subsequent years will have little to no personnel costs associated with system changes. CMS’ costs are counted as FCC/USAC costs, because USAC will reimburse CMS for them.
• Recipient Agency (FCC/IJSAC)
tJSAC’s Information Technology staff and its contractors will spend $250,000 developing the interface with CMS and $25,000 per year to maintain the connection once it is operational. Therefore we expect to incur $12,500 on maintenance for the initial life of this matching program since the connection will not be made until sometime within the 18-month period.
Key Element 2: Agencies’ Computer Costs • Source Agency (CMS)
USAC is compensating CMS for computer costs of $874,265 associated with analysis, planning and development of the interconnection.
$250,000 (USAC Development Cost) + $12,500 (Maintenance) + $874,265 (CMS Development Cost) Q SI, 136,765 23
Recipient Agency (FCCIUSAC)
FCC/USAC will not incur specific computer costs for this matching program.
Cost Savings
Total cost savings to the Lifeline program resulting from the matching program are estimated to be $23.3 million in the initial matching period (1$ months).9 Key elements of the overall cost savings of this matching program are discussed in more detail below.
Key Element 3: Avoidance of Improper Payments • Source Agency (CMS)
The matching program will not result in savings to CMS.
• Recipient Agency (FCCIUSAC)
‘I’otalimproper payments for the Lifeline program were estimated to be $227 million in fY2018.’° Overpayments due to ineligible subscribers were $3.1 million of the overall total.” Since approximately 60% of subscribers demonstrate eligibility for Lifeline through participation in Medicaid, we estimate that an interconnection with CMS would result in the avoidance of $2.4 million in future improper payments over the initial life of this matching program (18 months).’2
Key Element 4: Recovery of Improper Payments and Debts
As overpayments due to ineligible subscribers were $3.1 million in 2018, we anticipate we could have avoided about 60% of those improper payments by having an interconnection with CMS, or $2.8 million over the life of the matching program (18 months)’3 . This recovery amount is larger than the amount in the Avoidance of Improper Payments because the National Verifier currently obtains cost savings benefits from other interconnections it has with state agencies. ‘fliese connections did not exist prior to the National Verifier.
Avoidance of Manual Eligibility Verification Reviews • Source Agency (CMS)
$2,414,880 (Avoidance of Improper Payments) F $2,808,000 (Recovery of tmproper Payments) + $18,126,462 (Avoidance of Manual Eligibility Verification Reviews) = $23,349,342. ‘° Federal Communications Commission, Agency Financial Report Fiscal Year 2018, p. $2 (Nov. 15,2018), https:I/docs.fcc.gov/pubtic/attachmentsfDOC-355122A1.pdf. “Idat p. 83. ‘2As shown in Key Element 4: Recovery of tmproper Payments and Debts, we anticipate we could have historically avoided about $2.8 million in improper payments over an 1$-month period. Currently, 86% of the program is not otherwise covered by state automated connections to prevent improper payments. 86% of $2.808,000 equals $2,414,880. federal Communications Commission, Agency financial Report Fiscal Year 2018, p. 83 (Nov. 15, 2018), https:lldocs.fcc.gov/public/attachments/DOC-355I22AI.pdf.
C
subscribers
subscribers
following
we
subscriber
(e.g.,
these
remaining
remaining
CMS
states databases
excludes additional
‘
MS,
MO,
into
recommend of
$22
Verifying
‘ This
FCC’s
6 Conclusion
recovery
of
an
benefit
The
on
Benefits
cost
million.
eligibility
qualify
By
The
$23,349,342 The
We
apply
7.3
7.3
approximately
the
the
NC,
establishing
NC,
request
million
up
for
matching
that
matching
to
estimate
matching
cost
million
National
million
to
benefits
Lifeline
automated
reverification,
the
review
and
of
Recipient
for
6
PA,
with
currently
‘
six
(which
months
15%
get
per
comes
(2,353,831
of
months,
Lifeline
approximately
blended
documentation
for
TN
months,
Lifeline
and
overpayrnents
an
one in
(Total approval
overlapping
that
of
additional
Verifier
applications
applications,
have
expected
program
the
also
program
these
program
to
subscriber
give
TN
provided
program,
manual
60%
have
a
state
reverification
$18,126,462
$2.89
Savings)
$18 database
initial
have
we
Agency
accounts
x
eligibility
connections
us
we
through
$1.68
of
subscribers
an
subscribers)
or
48%,
expect
of
review
million
number documentation
get
subscriber’s
eligibility
per
rolled
automated
that
will
will
will
eligibility.
this
18-month
directly
as $22
=
-$1,136,765
a
subscriber
for
therefore
for
caused
and
total
(FCC/USAC)
have
$3,954,437).
connection
an
together
administered
($14,172,026
not
by
into
will
not Medicaid
matching
improve
through
to
of
failed
an
million
8%
in
the
decrease
program
expected
times
only
manual
rolled
result
the
not
result
connection
manually
estimated
cost
to
monthly
eligibility
The
call
by
about
applications).
period
to NV
due
be
Lifeline
SNAP
60%
with
(Total
in
the
waste,
percentage an
eligibility
savings
center
in
a
reviews
in
activity.
over
in
with
to
The
information.
with
without
subscriber
factor,
2,353,83
+
4,903,81
the
mrprpayments improper
automated
enroll,
(8,038,206 additional
reverification)
additional
$3,954,437).
by
a
databases.
will
(539,277)
of
Costs)
over
total
7.3
an
is $5.3
the
first
CMS,
fraud,
recipients.
USAC,
the
$1.68,
(4,903,815
therefore
automated
be
to
connections
move million14
estimated
Because
in
1
initial
the
Ssubscribers
determinations
validated
SCdue USAC
count million
matching
(4,903,815
18
the
$22,212,577.
x
With
USAC
and
times
but
In period
benefits
interconnection
months
savings
and
60%
initial
through
we
of
these
so
life
not
reverification
connection
+
abuse.
a
cost transfer
4,903,815
USAC
We
15%
apply
applications
savings
through
2,353,831)
current
to
all
states
of
will
4,822,924)
x
states,
of
program.’6
(4,903,518
state
to
48%
of
to
to
subscribers
to
nonetheless
(539,770
resutting
the
particIpation
18
manually
the
calculates
of
its
CMS.
operation.
avoid
CMS.
is
Lifeline
databases.
CMS for
=
we
months
matching
to
due
$1.68
subscribers,
for
lower
avoidance
2,353,83
in
would
a
estimate
individuals
the
plus
will
state
x
an
x
in
to
the
for
review
$2.89
per Nor
in
will
population
because
15%
states
Accordingly,
first
a
18-month
the
the
take
blended
is
database. avoid
a
expect manual
subscribers
To
review
1)
only
This
net program.
=
will
that
in
approximately
remaining
12
avoidance
so
for
date,
that
the
80,892)
place
of
$14,172,026).
Medicaid.
months.
we
8%
savings
require
CMS
that
the
enrolling
it
7.3
amount
a
for
$2.89
have
period
of
it
MS,
have
review
times
manual
have
Of
in
to
period.
8,038,206
the
million
manual
run
the will
population
not
those
NM,
produce
one
we
who
per
The access
For
2,353,83
of
the
and
of
through
first
any
provide
yet
consists
7,257,646.
enrolled
review
of
the
in
UT,
about
states,
six
review
Summing
total
For may
$18
year,
tolled
review
to
effect
(sum
the
CO,
state
the
I
a
in
an
net
of 24