prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 1.



Report 2: Risk management, as applied to security of federal facilities, entails a continuous process of applying a series of mitigating actions—assessing risk through the evaluation of threats, vulnerabilities, and consequences; responding to risks with appropriate countermeasures; and monitoring risks using quality information (see fig  1)  In 1995, Executive Order 12977 established the ISC after the bombing of the Oklahoma City Alfred P  Murrah Federal Building in April 1995  The ISC’s mandate is to enhance the quality and effectiveness of security in and protection of federal facilities in the United States occupied by federal employees for nonmilitary activities  The order directs the ISC to develop and evaluate security standards for federal facilities, develop a strategy to ensure executive agencies and departments comply with such standards, and oversee the implementation of appropriate security measures in federal facilities  The ISC has released a body of standards, including the ISC Standard, designed to apply to the physical security efforts of all federal, non-military agencies  The ISC Standard prescribes a process for agencies to follow in developing their risk assessment methodologies (see fig  2)  Most federal departments and agencies are generally responsible for protecting their own facilities and have physical security programs in place to do so  The ISC Standard requires executive departments and agencies to follow the risk-management process when conducting risk assessments for each of their facilities  That process begins with determining the facility security level, ranging from level I (lowest risk) for facilities generally having 100 or fewer employees to level V (highest risk) for the most critical facilities and generally having greater than 750 employees  The security level designation determines the facility’s baseline countermeasures  For each facility, departments and agencies are required to (a) consider all of the “undesirable events” that could pose a risk to their facilities— such as active shooters, vandalism, and explosions—and (b) assess three factors of risk (threats, vulnerabilities, and consequences) to specific undesirable events  Subsequently, agencies are to combine all three factors to yield a measurable level of risk for each undesirable event (see app  III)  Based on the results of these assessments, agencies should customize (either increase or decrease) the countermeasures to adequately reflect the assessed level of risk  In addition, as part of planning for physical security resources within an agency’s budget process, the ISC has identified the need to balance allocations for countermeasures with other operational needs and with competing priorities  The ISC Best Practices have some similarities with leading practices in capital decision-making  For example, both state that the allocation of resources should be integrated into the agency’s mission, objectives, goals, and budget process  However, beyond the ISC Best Practices, the Office of Management and Budget and we have developed more comprehensive leading practices in capital decision- making that provide agencies with guidance for prioritizing budget decisions such as for countermeasure projects  The Office of Management and Budget and our guidance also emphasize evaluating a full range of alternatives, informed by agency asset inventories that contain condition information, to bridge any identified performance gap  Furthermore, the guidance calls for a comprehensive decision-making framework to review, rank, and select from among competing project proposals  Such a framework should include the appropriate levels of management review, and selections should be based on the use of established criteria  The following describes the mission and physical security program characteristics for the agencies in our review: CBP, the nation’s largest law enforcement agency, has responsibility for securing the country’s borders  It also has responsibility for conducting security assessments at about 1,200 facilities, including approximately 215 federally owned and agency-controlled higher-level facilities (facility security levels III and IV)  These facilities include border patrol stations with holding cells for people detained at the border, office buildings, and canine-training centers  CBP conducts these assessments  FAA’s mission is to provide a safe and efficient aerospace system for the country  According to agency data, FAA has 55 federally owned and agency-controlled higher-level facilities—including critical air traffic control towers  According to FAA officials, FAA specialists conduct security assessments  ARS conducts research related to agriculture and disseminates information to ensure high-quality safe food and to sustain a competitive agricultural economy  According to agency data, ARS has security responsibility for four domestic federally owned and agency- controlled higher-level facilities—including laboratories for research to improve food and crop quality, office buildings, and warehouses  ARS security personnel have responsibility for conducting security assessments  The Forest Service sustains the health, diversity, and productivity of the nation’s forests and grasslands  According to agency officials, the Forest Service has one federally owned and agency-controlled higher- level facility—a regional headquarters office building  The Forest Service’s security officials have responsibility for conducting security assessments, but at the time of our review, USDA security officials conducted the assessment at Forest Service’s one higher-level facility  None of the four selected agencies’ security assessment methodologies fully aligned with the ISC Standard  The ISC gives agencies some flexibility to design their own security-assessment methodologies for identifying necessary countermeasures as long as the chosen methodology adheres to fundamental principles of a sound risk- management methodology  Specifically, methodologies must: consider all of the undesirable events identified in the ISC Standard as possible risks to federal facilities, and assess three factors of risk (threats, vulnerabilities, and consequences) for each of the events  Furthermore, the ISC Standard requires executive departments and agencies to document decisions that deviate from the ISC Standard  Agencies’ policies and methodologies reference the ISC Standard  However, none of the agencies’ methodologies considered all of the undesirable events during assessments although they used some type of risk assessment methodology  In addition, the agencies did not always adhere to these principles of risk management (see table 1)  At the time of our review, CBP’s methodology did not fully align with the ISC Standard because it did not consider all of the 33 undesirable events nor assess threat and consequence  CBP security specialists assessed vulnerabilities at building entrances and exits, in interior rooms, and around the perimeter using a yes/no checklist during the assessment process  However, assessment reports showed that specialists did not assess the threats and consequences of undesirable events at each facility  According to security officials, the gap occurred because they designed the checklist to meet requirements in the 2009 CBP Security Policy and Procedures Handbook, which predates the first edition of the ISC Standard issued in 2010  CBP officials told us that as of January 2017, they began using an improved methodology to assess the threats, vulnerabilities, and consequences for 30 of 33 undesirable events— omitting three now identified in the November 2016 revision to the ISC Standard  However, CBP has not yet updated its handbook to align with the ISC Standard, even though it started this effort over 3 years ago in December 2013  CBP officials did not provide a draft of its updated handbook, but they provided a plan with milestone dates for issuing the handbook by September 2018  CBP officials also told us that updates to the handbook may have to wait due to competing priorities, including efforts to address the backlog of assessments (which we discuss later in this report)  Delays in updating the handbook mean that CBP’s policy will continue to not align with the ISC Standard  Furthermore, although CBP security officials told us that all of the agency’s security specialists have been trained to use the improved assessment methodology, without documentation of the methodology in agency policy, there may be greater risk of its inconsistent application  Standards for Internal Control emphasize the importance of agencies developing and documenting policies to ensure agency-wide objectives are met  Documentation serves to retain institutional knowledge over time when questions about previous decisions arise  Without an updated policy handbook that requires a methodology that assesses all undesirable events consistent with the ISC Standard, CBP cannot reasonably ensure that its facilities will have levels of protection commensurate to their risk  FAA’s methodology does not fully align with the ISC Standard because it does not consider all of the 33 undesirable events nor does it assess all three factors of risk  FAA security specialists assess vulnerabilities to the site perimeter, entryways, and interior rooms using a yes/no checklist, but the checklist does not assess the consequences from each of the undesirable events at each facility  With respect to threat, FAA applies the ISC’s baseline threat—a general federal facilities threat level that relates directly to a set of baseline countermeasures—across all its higher-level facilities because FAA policy states that there is no agency-specific threat that exceeds the current baseline threat  According to FAA officials, the baseline threat standardizes the security needs across their facilities rather than addressing the security needs of individual facilities from specific threats  When necessary, FAA policy allows specialists to modify countermeasures based on an evaluation of conditions at the facility  FAA realized that this approach was no longer appropriate given the agency-wide goal to make risk-based decisions, a review of the assessment process after a 2014 Chicago fire incident that destroyed critical FAA equipment, and an awareness of ISC initiatives to assess compliance  To address the resulting methodological gaps, FAA hired a contractor to design, develop, test, and validate an improved risk- assessment methodology  Subsequently, FAA improved its methodology in January 2017 to assess the threats, vulnerabilities, and consequences for 30 of the 33 undesirable events identified in the November 2016 revision to the ISC Standard —and tested the methodology at lower- and higher-level facilities  This revised methodology addresses the need to assess individual facility needs rather than using a standardized baseline approach  In April 2017, FAA officials told us of their plan for implementing this methodology and provided tentative milestone dates to conduct further testing, training, and analysis before deciding to use the improved methodology, which they expect to complete by January 2018  However, their plan lacks the necessary information to ensure successful implementation, such as detail on how many facilities they will test and how they will use the results of testing, training, and analysis to implement the improved methodology within the identified 9-month time frame  Furthermore, the improved methodology does not address undesirable events for which ISC issued countermeasures in May 2017  Without a detailed implementation plan to assess the methodology’s impact on its security program, FAA cannot reasonably ensure that its facilities have the proper countermeasures  With ongoing changes to its security program, FAA has an opportunity to fully align its improved methodology with the ISC Standard by including all 33 undesirable events and to update its policy requiring the use of such a methodology  Unlike CBP and FAA—which developed their own methodologies separate from their parent departments (Department of Homeland Security (DHS) and Department of Transportation (DOT), respectively)— ARS and the Forest Service follow an assessment methodology developed by USDA  USDA’s methodology does not fully align with the ISC Standard because it does not consider all of the 33 undesirable events for which ISC issued countermeasures in May 2017  Security specialists from USDA headquarters typically assess ARS’s and the Forest Service’s higher-level facilities using a risk-based methodology that considers the 31 undesirable events listed in the previous version of the ISC Standard dated August 2013  However, until recently, USDA did not assign ratings to each of the three risk factors—threat, vulnerability, and consequence—and then combine these ratings to yield a measurable level of risk for each undesirable event  USDA security officials said that they have revised the assessment-reporting format to include this risk calculation and trained their specialists to measure risk in this way  USDA officials provided us with a new assessment template that addresses all 33 undesirable events and includes measuring risk  Additionally, USDA officials said that they are revising their outdated physical security manual and expect to complete it by April 2018  With a revised manual and application of the new assessment template, USDA should be better positioned to assess risk at its facilities  When agencies do not use methodologies that fully align with the ISC Standard, they could face deleterious effects, ranging from facilities having inappropriate levels of protection to agencies having an inability to make informed resource allocation decisions for their physical security needs  Specifically, the ISC Standard states that facilities may face the effect of either having (1) less protection than needed resulting in inadequate security or (2) more protection than needed resulting in an unnecessary use of resources  The ISC Standard also states that these effects can be negated by determining the proper protection according to a risk assessment  Identified excess resources in one risk area then can be reallocated to underserved areas, thus ensuring the most cost- effective security program is implemented  As an illustration of such potential effects, we found that two agencies assessing two higher-level facilities came to two different conclusions in terms of their need for X-ray machines to screen for guns, knives, and other prohibitive items in federal facilities  Specifically, one agency based its decision on a policy that does not deviate from the ISC’s baseline set of countermeasures, and the other agency based its decision on professional judgement that deviated from the ISC’s baseline set of countermeasures  Neither agency based its decision on a risk assessment nor documented its decision—both ISC requirements, specifically: Without conducting a risk assessment, FAA recently expanded a policy requirement calling for all higher-level facilities to have X-ray machines and magnetometers  This new requirement poses a potentially sizeable investment for the agency with an estimated cost of X-ray machines of about $24,000 and magnetometers of about $4,000 each  FAA may need such equipment at all its higher-level facilities  However, the ISC Standard requires that agencies conduct risk assessments first to justify their needs  Without conducting risk assessments, FAA managers could unnecessarily use resources by installing such equipment in all higher-level air traffic facilities when there may be higher priority needs A USDA security specialist decided, despite an ISC baseline requirement that higher–level facilities have X-ray machines, not to recommend an X-ray machine at a higher-level Forest Service facility  The specialist reasoned that unlike other federal buildings with numerous unknown visitors, this facility receives mostly known individuals and a limited number of visitors  The ISC Standard allows for professional judgement; however, the ISC requires that agencies document deviations from the baseline set of countermeasures  Reducing the facility’s level of protection without documenting an assessment of risk could result in no record of the basis of the decision for current and future facility managers and security officials to review or use as justification in the case of a question of compliance  In another case, we found that one higher-level facility did not have access control for employees or visitors nor did it have armed guard patrols  The facility manager told us that intelligence and a history without incidents gave leadership reason to believe that these measures were not needed and that therefore the agency did not require and would not fund such protective measures for this facility—in effect, accepting the risks to the facility  Security officials said they also had the same understanding and did not document the matter in the assessment report even though agency policy and the ISC Standard require written documentation when officials deviate from the baseline requirement  Without security assessments that fully align with the ISC Standard and provide measureable levels of risk, agencies do not have the information they need to determine priorities and make informed resource allocation decisions  For example, they may not be able to assess whether to acquire or forego costly physical-security countermeasures—such as, X- ray machines, access control systems, and closed-circuit television systems—for facilities  Additionally, after determining the need to acquire a countermeasure, agencies must fund the countermeasure  As previously discussed, leading practices in capital decision-making include a comprehensive framework to review, rank, and select from competing project proposals for funding  In conducting risk assessments that do not fully align with the ISC Standard (i e , not assessing threats, vulnerabilities, and consequences and measuring risks), agencies miss the opportunity for more informed funding decisions  Three of the four agencies (CBP, ARS, and the Forest Service) currently prioritize funding for operational needs over physical security needs (see table 2) when agencies’ priorities might be different if they based their decisions on an aligned risk assessment  Standards for Internal Control state that agencies should use quality information on an ongoing basis as a means to monitor program activities and take corrective action, as necessary  The ISC requires that agencies assess higher-level facilities at least once every 3 years—an interval requirement to identify and address evolving risks  We found that three of the four agencies (CBP, ARS, and the Forest Service) did not meet this requirement  Officials reported various challenges including (1) assessments competing with other security activities, (2) an insufficient number of qualified staff to conduct assessments when compared to the number of facilities, or (3) not knowing of the required assessment schedule  An “information system” is the people, processes, data, and technology that management organizes to obtain, communicate, or dispose of information  that had not been reassessed since 2010  CBP security officials attributed the backlog to (1) having too few security specialists assigned to assess about 1,200 facilities and (2) the specialists working on competing priorities, such as revising the security handbook, conducting technical inspections, and reviewing new construction designs and renovation projects  According to CBP security officials, they have developed a plan to eliminate the backlog by the end of fiscal year 2018 by prioritizing the completion of assessments  While we found the plan comprehensive, the schedule did not seem feasible  For example, the plan assumes that one specialist can complete six assessments in 3 consecutive days and that another specialist can complete three assessments in 1 day  In contrast, security officials told us specialists take about 20 work hours (or 2½ days) to conduct an on-site assessment of one facility  CBP officials said that they believe they can meet the time frames of the plan because they have set aside other priorities and have a thorough understanding of the scope of work involved at the facilities  They added that it will not be easy to meet the timeline, but they can accomplish it with a motivated and committed workforce, adequate financial resources, and absent activities that would otherwise require shifting of resources  We question the feasibility of setting aside important priorities, such as updating the policy manual and reviewing physical security elements in new construction designs, as well as the workload assumptions for completing the assessments  Further, these other priorities are also key to securing facilities  Without balancing assessments with competing priorities, CBP’s time frames for completing the assessments by the end of fiscal year 2018 may not be feasible and may also result in the agency’s not addressing other important physical security responsibilities  Since the ISC issued its standard in 2010, ARS and the Forest Service have assessed their higher-level facilities at least once  However, these agencies have not reassessed all of their higher-level facilities within the 3-year interval requirement  Specifically, security specialists have not conducted required reassessments of two ARS and one Forest Service higher-level facilities  The ARS headquarters official explained that the agency had not reassessed the two facilities due to competing priorities and insufficient internal resources  During the course of our review, ARS headquarters officials said they began assessing one of the two ARS facilities in May 2017 and will begin assessing the second facility in October 2017  The Forest Service official explained that the agency missed its security reassessment of the regional office because the facility staff had not requested one  During our visit, facility staff responsible for security told us that they were not aware of the ISC’s 3- year interval requirement  Facility staff requested a reassessment, and security officials told us that they expected to complete it by mid-June 2017  Completing this one-time assessment may address the facility’s security needs temporarily  However, ARS and the Forest Service have not implemented a long-term schedule with key milestones and lack a means to monitor completion of assessments of higher-level facilities at least once every 3 years  Consequently, these agencies cannot reasonably ensure that they have full knowledge of the risks to their facilities  FAA data from 2010 through 2016 show that FAA has assessed its 55 higher-level facilities at least once every 3 years  FAA policy requires that specialists schedule assessments of higher-level facilities every 12– 18 months depending on whether the facility has met FAA physical security standards  The ISC Standard states that to make appropriate resource decisions, agencies need information, such as what is being accomplished, what needs management attention, and what is performing at expected levels  We found that agencies’ methods of collecting and storing security information had limitations that affected agency and facility officials’ oversight of the physical security of their facilities (see table 3)  Without having long-term, agency-wide information to monitor whether assessments are conducted on schedule, ARS and the Forest Service may not meet the ISC Standard, resulting in not adequately protecting their facilities and employees  The ISC Standard also states that agencies should measure their security program’s capabilities and effectiveness to demonstrate the need to fund facility security and to make appropriate decisions for allocating resources  However, the agencies in our review were unable to demonstrate appropriate oversight of their physical security programs because: CBP’s handbook does not include requirements for data collection and analysis for monitoring physical-security program activities  Facility managers and security officials do not enter assessment results, such as the countermeasures recommended for facilities, in the real property database  Consequently, they do not have comprehensive data to manage their security program, assess overall performance, and take any necessary corrective actions  A CBP official told us that a comprehensive database would allow CBP to set priorities for addressing countermeasures  Without including data collection and analysis requirements in its updated handbook, CBP may be unable to monitor the performance of its physical security program  FAA’s policy does not require ongoing monitoring of physical security information, such as the status of recommended countermeasures or assessment schedules  As a result, FAA officials do not proactively use physical security information to assess the overall performance of its physical security program and take corrective actions before an incident occurs  Without a policy requiring ongoing monitoring of information—an internal control activity, FAA may be unable to assess the overall performance of its security program and take necessary corrective actions  USDA has a decentralized security program and places the responsibility on agencies to create their physical security programs  Security officials from ARS and the Forest Service told us that USDA does not have a policy for collecting and managing agency-wide information; however, they said that USDA is drafting a new departmental regulation and manual that will specify (1) the roles and responsibilities of agency and facility managers and (2) electronic- data-reporting requirements for monitoring the performance of the physical security program  USDA officials provided a draft of USDA’s regulation and manual for our review  The draft regulation did not mention data reporting and monitoring, while the draft manual only contained a table of contents that included a section entitled “Facility Tracking Database ” USDA officials expect to issue new policies sometime between October 2017 and April 2018  In the absence of new departmental regulation and manual, USDA and Forest Service officials told us that they have begun to develop a Forest Service system for storing electronic copies of agency-wide assessments and that they plan to expand the use of this system to track site specific assessment dates and status of recommended countermeasures  Forest Service officials provided milestone dates and described the capabilities for a future information system, which they expect to complete in September 2017  However, we could not determine whether the manual will have information system requirements to monitor agencies’ physical security program, an internal control activity  Without USDA’s including data collection and analysis requirements in its manual, its agencies may not be able to monitor the performance of their physical security programs  Without agencies having information to monitor security activities, they were unable to provide us information on the status of countermeasures across their entire portfolio  In order to better understand the status of countermeasures implemented and facilities’ experiences when implementing countermeasures, we determined the status of countermeasures at 13 facilities we visited  As previously noted, risk management, as it pertains to physical security, involves agency officials monitoring their physical security programs  During our visits to 13 selected facilities, we found the four agencies differed in the number of countermeasures that they had not implemented  Facility officials provided us with some information on why countermeasures had not been implemented, specifically: CBP had a significant number of recommended countermeasures from 2010 through 2016 that remained open at the eight selected CBP facilities  CBP facility officials gave reasons why recommended countermeasures had not been implemented  At one facility, officials did not know about the recommended countermeasures from its last 2010 assessment because the individuals previously knowledgeable about the assessments left the organization without communicating the results  By taking action to improve facility security, they implemented some needed countermeasures  However, at the time of our review, a large number of the recommendations remained open  At another facility, officials told us that they too had not known (for the same reason mentioned above) of their 2010 assessment, which contained recommended countermeasures  However, these officials told us that they submitted a funding request a few weeks before our visit to address all except one of the open countermeasures  In other cases, facilities have not implemented needed countermeasures due to resource constraints or physical site limitations  FAA had a large number of recommended countermeasures from 2010 through 2016 that remained open at the time of our review for the two FAA facilities visited  In this case, the most recent security assessment, completed in late 2016, resulted in one facility’s having little time to implement countermeasures by the time we conducted our analysis  While ARS had closed almost all recommended countermeasures at two facilities at the time of our review, one Forest Service facility had not yet implemented a recommendation (to secure its entrance doors) that was identified in a 2013 security assessment (see bottom center photo, fig  3)  This countermeasure remained open because facility officials said they continued to explore alternatives to address the recommendation  Figure 3 shows examples of countermeasures not fully implemented at selected facilities we visited  During our site visits and discussions with facility staff, we found that physical site limitations or other priorities can make it difficult for facility managers to implement countermeasures  For example, a countermeasure might involve correcting a clear zone violation—that is, moving an object (such as a brick wall) a certain distance away from the facility’s perimeter fence to prevent a potential intruder from using the object to climb over the fence  However, when the object near the fence is a building and the property outside of the fence is not federally owned (see bottom right photo, fig  3), it may not be cost effective to correct the clear zone violation  In this situation, the agency bears the responsibility for exploring ways to address the vulnerability  In following the ISC Standard, as previously noted, managers are required to justify and document why they could not implement recommended countermeasures—what the ISC calls risk acceptance  Selected agencies carry a great responsibility for protecting facilities that support border protection activities, provide safe and efficient air traffic around the country, and protect the quality of the nation’s food supply  With this responsibility comes the need to appropriately assess risk to ensure the security of these agencies’ facilities  However, 7 years after the ISC issued its initial risk-management process standard, each of four selected agencies continued to use assessment methodologies that did not fully align with this standard  During our review, agencies improved their methodologies to better align with the ISC Standard, but the agencies had not yet incorporated the methodologies into their policies and procedures  Without updated policies and procedures requiring a methodology that adheres to the ISC Standard (including all 33 undesirable events now identified in the November 2016 revision to the ISC Standard), agencies may not collect the information needed to assess risk and determine priorities for improved security  This situation could hamper the agencies’ ability to make informed resource allocation decisions or to recommend countermeasures commensurate to the needs at specific facilities  To address challenges in conducting timely assessments, agencies that had a backlog developed plans to address them, but the assumptions used in CBP’s plans and time frames did not appear to fully reflect the agency’s competing priorities and actual experience  Additionally, ARS and Forest Service have not implemented a long-term assessment schedule with key milestones to ensure that higher-level facilities are reassessed at least once every 3 years  Further, in cases where the agencies may have had risk assessment information, CBP, ARS, and the Forest Service lack the means to collect, store, and analyze this information in order to monitor the status of a facility’s security  Without these key aspects of a comprehensive security program—a methodology that meets the standard, policies, and procedures that incorporate that methodology; the ability to complete assessments on time; and information to perform monitoring—agencies remain vulnerable to substantial security risks  To improve agencies’ physical security programs’ alignment with the ISC Risk Management Process for Federal Facilities and Standards for Internal Control in the Federal Government for information and monitoring, we recommend that the Commissioner of U S  Customs and Border Protection take the following three actions: with regard to the updated Security Policy and Procedures Handbook, the ISC’s Risk Management Process for Federal Facilities requirement to assess all undesirable events, consider all three factors of risk, and document deviations from the standard, and data collection and analysis requirements for monitoring the performance of CBP’s physical security program  revise the assumptions used in the plan to address the backlog to balance assessments with competing priorities, such as updating the policy manual and reviewing new construction design, to develop a feasible time frame for completing the assessment backlog  Secretary of Transportation direct the FAA Administrator to take the following three actions: develop a plan that provides sufficient details on the activities needed and time frames within the date when FAA will implement an improved methodology; update FAA’s policy to require the use of a methodology that fully aligns with the ISC’s Risk Management Process for Federal Facilities for assessing all undesirable events, considering all three factors of risk, and documenting all deviations from the standard countermeasures; and update FAA’s policy to include ongoing monitoring of physical security information  Secretary of Agriculture take the following two actions: include data collection and analysis requirements for monitoring the performance of agencies’ physical security programs, in the department’s revised physical-security manual, and direct the Administrator of the Agricultural Research Service and the Chief of the Forest Service to implement and monitor a long-term assessment schedule with key milestones to ensure that higher-level facilities are reassessed at least once every 3 years  We provided a draft of this report to the Departments of Homeland Security, Transportation, and Agriculture for review and comment  All three departments agreed with the findings and recommendations for their respective agencies  DHS agreed with our recommendations and provided actions and timeframes for completion  With regard to our recommendation to update the Security Policy and Procedures Handbook, DHS stated that CBP is updating the handbook to include: (1) a discussion and diagram of the ISC risk management process and its application within CBP’s assessment processes; (2) specific guidance for conducting risk assessments in accordance with the ISC’s Risk Management Process for Federal Facilities; and (3) a requirement and guidance for data collection and analysis in support of a robust physical security program  With regard to our recommendation to revise the assumptions used in the plan to address the assessment backlog, DHS stated that CBP has reevaluated current priorities and believes the current plan to eliminate the risk assessment backlog by the end of fiscal year 2018 is achievable  DHS also provided technical comments, which we incorporated as appropriate  DHS’s official written response is reprinted in appendix IV  DOT also agreed with our recommendations and by e-mail requested that we publish the response to the sensitive version of this report  DOT stated that FAA continues to refine its policy and develop processes that address the ISC threats, vulnerabilities, and consequences  Further, DOT stated that FAA would either validate that current mitigation strategies address those risks or apply additional appropriate countermeasures  DOT stated that it will provide a detailed response to each recommendation within 60 days from the date of this report  DOT’s official written response is reprinted in appendix V  USDA agreed with our recommendations and provided the agency-wide actions for completion  USDA provided a plan to ensure compliance with the ISC’s Risk Management Process for Federal Facilities by development of a standard physical-security assessment process and by initiation of a compliance program to track assessments and monitor the installation of countermeasures  In an e-mail, USDA provided milestone dates and planned completion by January 2019  USDA’s official written response is reprinted in appendix VI  If you or your staff has any questions about this report, please contact me at (202) 512-2834 or RectanusL@gao gov  GAO staff who made key contributions to this report are listed in appendix VI  This report examines: (1) how selected agencies’ assessment methodologies align with the Interagency Security Committee’s (ISC) risk management standard for identifying necessary countermeasures and (2) what management challenges, if any, selected agencies reported facing in conducting physical security assessments and monitoring the results  To determine how selected agencies’ assessment methodologies align with ISC standards for identifying the necessary countermeasures, we identified federal executive branch departments and agencies reported by the Department of Homeland Security (DHS) to have received delegations of authority to protect their own buildings  We reviewed the Federal Real Property Council’s data on the Federal Real Property Profile to identify federally owned and agency-controlled buildings  We determined that these data were sufficiently reliable for the purpose of our reporting objectives based upon our recent report that reviewed these data fields  We selected four agencies based upon their large quantity of reported federally owned and agency-controlled buildings: DHS, U S  Customs and Border Protection (CBP); Department of Transportation (DOT), Federal Aviation Administration (FAA); United States Department of Agriculture (USDA), Agricultural Research Service (ARS) and USDA’s United States Forest Service (Forest Service)  This methodology purposely does not include federal buildings protected by FPS and under the control of the General Services Administration as well as other agencies that we reported on in our previous work  We obtained and reviewed one particular ISC standard, The Risk Management Process for Federal Facilities (the ISC Standard) and its related appendices for assessing physical security and providing recommended countermeasures at federal facilities  We obtained and analyzed the selected departments’ and agencies’ facility-security policies and procedures for a risk assessment methodology  According to the ISC Standard, agencies’ risk assessment methodologies must: consider all of the undesirable events identified in the ISC Standard as possible risks to federal facilities as listed in appendix III; assess the threat, consequences, and vulnerability to specific produce similar or identical results when applied by various security provide sufficient justification for deviations from the ISC-defined security baseline  We limited the scope of this review to the first two standards above because agencies’ adherence to these standards could be objectively verified by reviewing and analyzing agency documentation and interviewing agency officials, and their adherence to the two additional standards could not be verified in this manner  We did not conduct risk assessments with independent security professionals to evaluate: 1) the results from prior agency evaluations and 2) the sufficiency of justifications for deviations from the ISC-defined security baseline, as both evaluations were outside of the scope of the engagement  Therefore, for the purposes of this report, risk assessment policies, procedures and resulting methodology that align with ISC standards are those that consider all of the undesirable events and assess the threats, consequences, and vulnerabilities to specific undesirable events  We reviewed and analyzed information to answer the following five questions: 1  Do the policies and procedures mention the ISC standards? 2  Do the policies and procedures consider all of the undesirable events? 3  Do the policies and procedures assess the threat of specific undesirable events? 4  Do the policies and procedures assess the consequences of specific undesirable events? 5  Do the policies and procedures assess the vulnerability to specific undesirable events? We answered each of these questions as either a “Yes” or “No” for our selected agencies  The “No” answer to questions 3, 4, and 5 includes the following two possibilities: (a) the agency’s threat, consequence, or vulnerability ratings are not tied to specific undesirable events, or (b) the agency does not have a framework or formalized steps within which it collects and analyzes threat-, consequence-, or vulnerability-related information  If the answer to each of the five questions was “Yes,” then the agency’s overall risk assessment methodology aligns with ISC risk assessment standards for the purposes of this report  If the answer to one or more of the five questions was “No”, then the agency’s methodology does not to align with ISC standards for the purposes of this report  We interviewed security officials at ISC; three departments (DHS, DOT, and USDA); and four agencies (CBP, FAA, ARS, and the Forest Service)  We obtained and analyzed agency guidance on prioritizing physical security needs and interviewed agencies’ facility maintenance and budget officials  We reviewed the ISC’s best practices for planning for physical security resources within an agency budget process  Additionally, we reviewed the Office of Management and Budget’s and our leading practices in capital decision-making that provide agencies with guidance for prioritizing budget decisions such as “countermeasure projects ” We also reviewed Standards for Internal Control in the Federal Government because internal controls play a significant role in helping agencies achieve their mission-related responsibilities  Our findings from our review of the selected agencies are not generalizable to all ISC member agencies, but provide insight into and illustrative examples about selected agencies’ facility risk-assessment methodologies  To determine what management challenges selected agencies reported facing in conducting physical security assessments and monitoring results, we interviewed agencies’ security, maintenance, and budget officials  We requested agency security officials to provide portfolio- wide data on facility security assessments for our review in order to select sites to visit and analyze data for dates of assessments and the status of findings  We assessed the reliability of this data through interviews with knowledgeable agency staff and a review for completeness and any unexpected values  We compiled information from physical security assessments when no portfolio-wide agency data were available  We determined that these data were sufficient for the purpose of our reporting objectives and selected geographically dispersed sites with buildings with higher reported security levels per the ISC Standard, as these higher security levels have greater requirements and therefore the potential for greater resource needs  See appendix II for the 13 sites we selected  For these selected sites, we interviewed agency staff concerning the assessment process, site-specific findings, recommendations, justification for deviations from ISC’s baseline standards, and management challenges faced in addressing physical security needs  We observed and photographed the status of the findings from the site physical security assessments  We did not independently determine what constitutes a management challenge or a physical security finding  Rather, we relied on these stakeholders to determine these physical security concerns as defined in their own standards and guidance  The information from our selected sites is illustrative and cannot be generalized to sites agency- wide  The performance audit upon which this report is based was conducted from June 2016 to August 2017 in accordance with generally accepted government auditing standards  Those standards require that we plan and perform the audit to obtain sufficient, appropriate, evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives  We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives  We subsequently worked with DHS, DOT and USDA from August 2017 to October 2017 to prepare this version of the original report for public release  This public version was also prepared in accordance with these standards  Error! No text of specified style in document  Error! No text of specified style in document  Appendix VII: GAO Contact and Staff Acknowledgments Error! No text of specified style in document  In addition to the contact named above, Amelia Shachoy (Assistant Director), Steve Martinez (Analyst-in-Charge), Jennifer Clayborne, George Depaoli, Geoffrey Hamilton, Joshua Ormond, Alison Snyder, Amelia Michelle Weathers, and Elizabeth Wood made key contributions to this report 
Report 2:  The national limits were set at a percentage (74%) of the median of all local fee schedule amounts for each laboratory test code; therefore, fee schedule amounts may differ by region  In general, annual increases in clinical lab fees have been based on the percentage change in the CPI-U  However, since 1987, Congress has specified lower updates  Beginning in 2014, with certain exceptions, laboratory tests provided in hospital outpatient departments are no longer paid separately under the CLFS and are instead included in the OPPS payments  PAMA introduced a new method for determining clinical laboratory payments and required CMS to base Medicare CLFS reimbursement on reported private insurance payment amounts  Medicare has been using weighted median private insurer rates to calculate Medicare payment rates for laboratory tests paid under the CLFS since January 1, 2018  These payment rates are national and do not vary by geographic area  Part B also covers diagnostic nonlaboratory x-ray tests and other diagnostic tests, as well as x-ray, radium, and radioisotope therapy  Generally, these services are paid for under the physician fee schedule, with beneficiaries responsible for a 20% coinsurance payment  Medicare covers a wide variety of equipment and devices under the heading of durable medical equipment (DME), prosthetics, and orthotics (PO) if they are medically necessary and are prescribed by a physician  DME is defined as equipment that (1) can withstand repeated use, (2) has an expected life of at least three years (effective for items classified as DME after January 1, 2012), (3) is used primarily to serve a medical purpose, (4) is not generally useful in the absence of an illness or injury, and (5) is appropriate for use in the home  DME includes such items as hospital beds, wheelchairs, blood glucose monitors, and oxygen and oxygen equipment  It also includes related supplies (S), such as drugs and biologics that are necessary for the effective use of the product  Prosthetics (P) are items that replace all or part of a body organ or its function, such as colostomy bags, pacemakers, and artificial eyes, arms, or legs  Orthotics (O) are braces that support a weak or deformed body member, such as leg or back braces  Except in competitive bidding areas (CBAs, described below), Medicare pays for most durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS) based on fee schedules  Medicare pays 80% of the lower of the supplier's charge for the item or the fee schedule amount  The beneficiary is responsible for the remaining 20%  In general, fee schedule amounts are updated each year by a (1) measure of price inflation, and (2) a measure of economy-wide productivity, which may result in lower fee schedule amounts from one year to the next  Since 2016, the fee schedule rates that applied outside of competitive bidding areas for certain DMEPOS have been reduced based on price information from the competitive bidding program  The reductions were phased in during 2016, and fully phased in starting in January 2017  In response to concerns that the adjusted rates were too low, the Secretary again applied the phase-in rate for rural and noncontiguous areas not subject to competitive bidding starting in June 2018  Currently, two different fee schedules apply outside of CBAs  First, in rural or noncontiguous areas, the fee schedule is a 50/50 blend of the fee schedule with and without the reductions based on information from competitive bidding (i e , the phase-in methodology)  Second, in nonrural and contiguous areas, the fee schedule amounts are fully adjusted by information from the competitive bidding program  Numerous studies and investigations indicated that Medicare paid more for certain items of DME and PO than some other health insurers and some retail outlets  Such overpayments were attributed, in part, to the fee schedule mechanism of payment  MMA required the Secretary to establish a Competitive Acquisition Program for certain DMEPOS in specified areas  Instead of paying for medical equipment based on a fee schedule established by law, payment for items in competitive bidding areas was based on the supplier bids  The program started in 9 metropolitan areas in January 2011 and had expanded to 130 competitive bidding areas in 2018  However, the program has been suspended while a new bidding methodology is established  During the gap, the payments for previously competitively bid items in competitive bidding areas will be the amounts that applied on December 31, 2018, increased, yearly, by a measure of inflation  Certain specified outpatient prescription drugs and biologics are covered under Medicare Part B  (However, most outpatient prescription drugs are covered under Part D, discussed below ) Covered Part B drugs and biologics include drugs furnished incident to physician services, immunosuppressive drugs following a Medicare-covered organ transplant, erythropoietin for treatment of anemia for individuals with ESRD when not part of the ESRD composite rate, oral anticancer drugs (provided they have the same active ingredients and are used for the same indications as chemotherapy drugs that would be covered if furnished incident to physician services), certain vaccines under selected conditions, and drugs administered through DME  Generally, Medicare reimburses physicians and other providers, such as hospital outpatient clinics, for covered Part B drugs and biologics at 106% of the volume weighted average sales price of all drugs billed under the same billing code, although some Part B drugs, such as those administered through DME, are reimbursed at 95% of the drug's average wholesale price  Health care providers also are paid separately for administering Medicare Part B drugs  Medicare pays 80% of the amount paid to providers, and beneficiaries are responsible for the remaining 20%  A hospital outpatient is a person who has not been admitted by the hospital as an inpatient but is registered on the hospital records as an outpatient  Generally, payments under the hospital outpatient prospective payment system (OPPS) cover the operating and capital-related costs that are directly related and integral to performing a procedure or furnishing a service on an outpatient basis  These payments cover services such as the use of an operating suite, treatment, procedure, or recovery room; use of an observation bed as well as anesthesia; certain drugs or pharmaceuticals; incidental services; and other necessary or implantable supplies or services  Payments for services such as those provided by physicians and other professionals as well as therapy and clinical diagnostic laboratory services, among others, are separate  Under the OPPS, the unit of payment for acute care hospitals is the individual service or procedure as assigned to an ambulatory payment classification (APC)  To the extent possible, integral services and items (excluding physician services paid under the physician fee schedule) are bundled within each APC  Specified new technologies are assigned to "new technology APCs" until clinical and cost data are available to permit assignment into a "clinical APC " Medicare's hospital outpatient payment is calculated by multiplying the relative weight associated with an APC by a conversion factor  For most APCs, 60% of the conversion factor is geographically adjusted by the wage index used for the inpatient prospective payment system  Except for new technology APCs, each APC has a relative weight that is based on the median cost of services in that APC  The OPPS also includes pass-through payments for new technologies (specific drugs, biologicals, and devices) and payments for outliers  The Medicare Payment Advisory Commission (MedPAC) has recommended site-neutral payment policies that base payments on the resources needed to provide high-quality care in the most efficient setting  The Bipartisan Budget Act of 2015 (BBA 15; P L  114-74 ) gave CMS the authority to add new restrictions on Medicare payments for services furnished in provider-based off-campus hospital outpatient departments (HOPDs) to address discrepancies between payments under the MPFS and the OPPS for similar services  In its 2019 OPPS Final Rule, CMS explicitly applies the site-neutral policy to clinic visits, the most commonly billed service in hospital outpatient departments  An ambulatory surgical center (ASC) is a distinct entity that furnishes outpatient surgical procedures to patients who do not require an overnight stay after the procedure  According to MedPAC, most ASCs are freestanding facilities rather than part of a larger facility, such as a hospital  Medicare covers surgical and medical services performed in an ambulatory surgical center that are (1) commonly performed on an inpatient basis but may be safely performed in an ASC; (2) not of a type that are commonly performed or that may be safely performed in physicians' offices; (3) limited to procedures requiring a dedicated operating room or suite and generally requiring a postoperative recovery room or short-term (not overnight) convalescent room; and (4) not otherwise excluded from Medicare coverage  Medicare pays for surgery-related facility services provided in ASCs using a prospective payment system based on the OPPS  (Associated physician fees are paid for separately under the physician fee schedule ) Each of the approximately 3,500 procedures approved for payment in an ASC is classified into an APC group on the basis of clinical and cost similarity  The ASC system primarily uses the same payment groups as the OPPS; however, ASC payment rates are generally lower  The ASC weights are scaled (reduced) to account for the different mix of services in an ASC, and the ASC conversion factor (the base payment amount) is lower  A different payment method is used to set ASC payment for office-based procedures, separately payable radiology services, separately payable drugs, and device-intensive procedures  In addition, separate payments are made for certain ancillary items and services when they are integral to surgical procedures, including corneal tissue acquisition, brachytherapy sources, certain radiology services, many drugs, and certain implantable devices  The application of the site-neutral payment policy to clinic visits also affects such payments to ASCs (see discussion above)  Medicare Part B covers emergency and nonemergency ambulance services to or from a hospital, a critical access hospital, a skilled nursing facility, or a dialysis facility for End-Stage Renal Disease (ESRD) beneficiaries who require dialysis when other modes of transportation could endanger the Medicare beneficiary's health  In most cases, the program covers 80% of the allowed amount for the service, and the beneficiary is responsible for the remaining 20%  Generally, ambulance services are covered if (1) transportation of the beneficiary occurs; (2) the beneficiary is taken to an appropriate location (generally, the closest appropriate facility); (3) the ambulance service is medically necessary (other forms of transportation are contraindicated); (4) the ambulance provider or supplier meets state licensing requirements; and (5) the transportation is not part of a Medicare Part A covered stay  Medicare covers both scheduled and nonscheduled nonemergency transports if the beneficiary is bed-confined or meets other medical necessity criteria  Medicare may also cover emergency ambulance transportation by airplane or helicopter if the beneficiary's location is not easily reached by ground transportation or if long distance or obstacles, such as heavy traffic, would prevent the individual from obtaining needed care  Medicare pays for ambulance services according to a national fee schedule  The fee schedule establishes seven categories of ground ambulance services and two categories of air ambulance services  Medicare pays for different levels of ambulance services, which reflect the staff training and equipment required to meet the patient's medical condition or health needs  Generally, basic life support is provided by emergency medical technicians (EMTs)  Advanced life support is provided by EMTs with advanced training or by paramedics  Some rural ground and air ambulance services may qualify for increased payments  Also, ambulance providers that are CAHs, or that are entities that are owned and operated by a CAH, are paid on a reasonable-cost basis rather than the fee schedule if they are the only ambulance provider within a 35-mile radius  Medicare covers Part B services in rural health clinics (RHCs) and federally qualified health centers (FQHCs) provided by (1) physicians and specified nonphysician practitioners; (2) visiting nurses for homebound patients in home health shortage areas; (3) registered dieticians or nutritional professionals for diabetes training and medical nutrition therapy; and (4) others, as well as certain drugs administered by a physician or nonphysician practitioner  RHCs are paid based on an "all-inclusive" cost-based rate per beneficiary visit subject to a per visit upper limit, adjusted annually for inflation  For cost-reporting periods that began on or after October 1, 2014, FQHCs are paid a base payment rate per visit (with a limit, in most cases, of one billable visit per day) under a PPS methodology  Each FQHC's PPS rate is adjusted based on the location where the service is furnished using geographic adjustment factors, which are the geographic practice cost indices (GPCI) used in Medicare's physician fee schedule (MPFS)  This rate is increased by 34% for new patients (those not seen in the FQHC organization within the past three years)  The 34% increase also applies when a beneficiary receives a comprehensive initial Medicare visit (an initial preventive physician examination or an initial annual wellness visit) or a subsequent annual wellness visit  Effective January 1, 2017, the FQHC PPS base rate is updated annually using an FQHC-specific market basket  Medicare's payment to the FQHC is equal to 80% of the lesser of the adjusted PPS rate or the FQHC's actual charges associated with the visit, and the beneficiary is responsible for a 20% coinsurance  Medicare Advantage (MA) is an alternative way for Medicare beneficiaries to receive covered benefits  Under MA, private health plans are paid a per-person amount to provide all Medicare covered benefits (except hospice) to beneficiaries who enroll in their plan  Medicare beneficiaries who are eligible for Part A, enrolled in Part B, and do not have ESRD are eligible to enroll in an MA plan if one is available in their area  Some MA plans may choose their service area (local MA plans), while others agree to serve one or more regions defined by the Secretary (regional MA plans)  In 2019, nearly all Medicare beneficiaries have access to an MA plan and approximately a third of beneficiaries are enrolled in one  Private plans may use different techniques to influence the medical care used by enrollees  Some plans, such as health maintenance organizations (HMOs), may require enrollees to receive care from a restricted network of medical providers; enrollees may be required to see a primary care physician who will coordinate their care and refer them to specialists as necessary  Other types of private plans, such as private fee-for-service (PFFS) plans, may look more like original Medicare, with fewer restrictions on the providers an enrollee can see and minimal coordination of care  In general, MA plans offer additional benefits or require smaller co-payments or deductibles than original Medicare  Sometimes beneficiaries pay for these additional benefits through a higher monthly premium, but sometimes they are financed through plan savings  The extent of extra benefits and reduced cost sharing varies by plan type and geography  However, MA plans are seen by some beneficiaries as an attractive alternative to more expensive supplemental insurance policies found in the private market  By contract with CMS, a plan agrees to provide all required services covered in return for a capitated monthly payment adjusted for the demographics and health history of their enrollees  The same monthly payment is made regardless of how many or few services a beneficiary actually uses  In general, the plan is at-risk if costs, in the aggregate, exceed program payments; conversely, the plan can retain savings if aggregate costs are less than payments  Payments to MA plans are based on a comparison of each plan's estimated cost of providing Medicare covered services (a bid) relative to the maximum amount the federal government will pay for providing those services in the plan's service area (a benchmark)  If a plan's bid is less than the benchmark, its payment equals its bid plus a rebate  The size of the rebate is dependent on plan quality and ranges from 50% to 70% of the difference between the bid and the benchmark  The rebate must be returned to enrollees in the form of additional benefits, reduced cost sharing, reduced Part B or Part D premiums, or some combination of these options  If a plan's bid is equal to or above the benchmark, its payment will be the benchmark amount and each enrollee in that plan will pay an additional premium, equal to the amount by which the bid exceeds the benchmark  The MA benchmarks are determined through statutorily specified formulas that have changed over time  Since BBA 97, formulas have increased the benchmark amounts, in part, to encourage plan participation in all areas of the country  As a result, however, the benchmark amounts (and plan payments) in some areas have been higher than the average cost of original FFS Medicare  The ACA changed the way benchmarks are calculated by tying them closer to (or below) spending in FFS Medicare, and adjusting them based on plan quality  In a recent analysis, MedPAC found that "over the past few years, plan bids and payments have come down in relation to FFS spending while MA enrollment continues to grow  The pressure of lower benchmarks has led to improved efficiencies and more competitive bids that enable MA plans to continue to increase enrollment by offering benefits that beneficiaries find attractive " In 2006, the MA program began to offer MA regional plans  Regional MA plans must agree to serve one or more regions designated by the Secretary  There are 26 MA regions consisting of states or groups of states  Regional plan benchmarks include two components: (1) a statutorily determined amount (comparable to benchmarks described above) and (2) a weighted average of plan bids  Thus, a portion of the benchmark is competitively determined  Similar to local plans, plans with bids below the benchmark are given a rebate, while plans with bids above the benchmark require an additional enrollee premium  In general, MA eligible individuals may enroll in any MA plan that serves their area  However, some MA plans may restrict their enrollment to beneficiaries who meet additional criteria  For example, employer-sponsored MA plans are generally only available to the retirees of the company sponsoring the plan  In addition, Medicare Special Needs Plans (SNPs) are a type of coordinated care MA plan that exclusively enrolls, or enrolls a disproportionate percentage of, special needs individuals  Special needs individuals are any MA eligible individuals who are either institutionalized as defined by the Secretary, eligible for both Medicare and Medicaid, or have a severe or disabling chronic condition and would benefit from enrollment in a specialized MA plan  Medicare Part D provides coverage of outpatient prescription drugs to Medicare beneficiaries who choose to enroll in this optional benefit  (As previously discussed, Part B provides limited coverage of some outpatient prescription drugs ) In 2019, about 47 million (about 77%) of eligible Medicare beneficiaries are estimated to be enrolled in a Part D plan  Prescription drug coverage is provided through private prescription drug plans (PDPs), which offer only prescription drug coverage, or through Medicare Advantage prescription drug plans (MA-PDs), which offer prescription drug coverage that is integrated with the health care coverage they provide to Medicare beneficiaries under Part C  Plans must meet certain minimum requirements; however, there are significant variations among them in benefit design, including differences in premiums, drugs included on plan formularies, and cost sharing for particular drugs  Part D prescription drug plans are required to offer either "standard coverage" or alternative coverage that has actuarially equivalent benefits  In 2019, "standard coverage" has a $415 deductible and a 25% coinsurance for costs between $415 and $3,820  From this point, there is reduced coverage until the beneficiary has out-of-pocket costs of $5,100 (an estimated $8,139 54 in total spending); this coverage gap has been labeled the "doughnut hole " Once the beneficiary reaches the catastrophic limit, the program pays all costs except for the greater of 5% coinsurance or $3 40 for a generic drug and $8 50 for a brand-name drug  As required by the ACA, in 2010, Medicare sent a tax-free, one-time $250 rebate check to each Part D enrollee who reached the doughnut hole  Additionally, starting in 2011, the coverage gap is being gradually reduced each year  Under the ACA, the coverage gap for both brand-name and generic drugs was to be eliminated in 2020, but Congress moved up the date to 2019 for brand-name drugs as part of BBA 18  In 2019, a 70% discount is provided by drug manufacturers and Medicare pays an additional 5% of the cost of brand-name drugs dispensed during the coverage gap  In 2019, Medicare also pays 63% of the cost of generic drugs dispensed during the coverage gap and enrollees pay 37%  (See Figure 2  ) By 2020, through a combination of manufacturer discounts and increased Medicare coverage, Part D enrollees will be responsible for 25% of the costs for brand-name and generic drugs in the coverage gap (the same as during the initial coverage period)  Most plans offer actuarially equivalent benefits rather than the standard package, including alternatives such as reducing or eliminating the deductible, or using tiered cost sharing with lower cost sharing for generic drugs  Medicare's payments to plans are determined through a competitive bidding process, and enrollee premiums are tied to plan bids  Plans are paid a risk-adjusted monthly per capita amount based on their bids during a given plan year  Part D plan sponsors determine payments for drugs and are expected to negotiate prices  The federal government is prohibited from interfering in the price negotiations between drug manufacturers, pharmacies, and plans (the so-called "non-interference clause")  Part D also provides enhanced coverage for low-income enrolled individuals, such as persons who previously received drug benefits under Medicaid (known as "dual eligibles"—enrollees in both Medicare and Medicaid)  Additionally, certain persons who do not qualify for Medicaid, but whose incomes are below 150% of poverty, may also receive assistance for some portion of their premium and cost-sharing charges  The MMA included significant incentives for employers to continue to offer coverage to their retirees by providing a 28% federal subsidy  In 2019, the maximum potential subsidy per covered retiree is $2,264 for employers or unions offering drug coverage that is at least actuarially equivalent (called "creditable" coverage) to standard coverage  Employers or unions may select an alternative option (instead of taking the subsidy) with respect to Part D, such as electing to pay a portion of the Part D premiums  They may also elect to provide enhanced coverage, though this has some financial consequences for the employer or union  Alternatively, employers or unions may contract with a PDP or MA-PD to offer the coverage or become a Part D plan sponsor themselves for their retirees  A variety of public and private entities are involved in carrying out Medicare administrative and oversight functions  CMS, an agency within HHS, has primary operational responsibilities  Such responsibilities include managing program finances, developing policies and regulations, setting payment rates, and developing the program's information-technology infrastructure  CMS conducts its activities through its headquarters and 10 regional offices  The Social Security Administration, however, enrolls beneficiaries into the program and issues Medicare beneficiary cards  CMS also contracts with various private entities, including private health insurance companies, to help administer the program  For example, Medicare Administrative Contractors (MACs) process and pay Parts A and B reimbursement claims, enroll providers and suppliers, educate providers and suppliers on billing requirements, support appeal processes, and answer provider and supplier inquiries through call centers, as well as other activities  Qualified Independent Contractors (QICs) perform second-level reviews on appeals initially reviewed by MACs  Medicare's quality assurance activities are primarily handled by State Survey Agencies and Quality Improvement Organizations (QIOs), which operate in all states and the District of Columbia, Puerto Rico, and the U S  Virgin Islands  The State Survey Agencies are responsible for inspecting Medicare provider facilities (e g , nursing homes, home health agencies, and hospitals) to ensure that they are in compliance with federal safety and quality standards referred to as Conditions (or Requirements) of Participation  Alternatively, some types of providers, including hospitals, may receive certification through private accrediting agencies, such as the Joint Commission  QIOs are mostly private, not-for-profit organizations that monitor the quality of care delivered to Medicare beneficiaries and educate providers on the latest quality-improvement techniques  Medicare program integrity activities, such as audits, provider education, medical review, and predictive data analysis, also are carried out by a variety of government and private entities  For example, the Center for Program Integrity within CMS works together with the U S  Department of Justice (DOJ) and the HHS Office of Inspector General (OIG) to identify and prevent fraud, waste, and abuse in Medicare  CMS also works with private contractors to carry out certain program-integrity functions  Unified Program Integrity Contractors (UPICs) perform integrity-related activities including data analysis to identify potentially fraudulent claims (bills) for Medicare Parts A and B, home health and hospice services, and DME  Similarly, the National Benefit Integrity Medicare Drug Integrity Contractor (MEDIC) is responsible for identifying and investigating fraud, waste, and abuse in Medicare Advantage and Part D  When appropriate, the UPICs and MEDIC work with and refer cases to law enforcement, including OIG and DOJ  In addition, Recovery Audit Contractors (RACs) are responsible for identifying improper Medicare payments, including both underpayments and overpayments, and for recouping any overpayments made to providers  Each year, the Comprehensive Error Rate Testing (CERT) program quantifies a national improper Medicare payment rate by examining a random sample of claims  In turn, the Supplemental Medical Review Contractor targets medical reviews in areas where OIG, RACs, and CERT have identified vulnerabilities and/or questionable billing patterns to identify ways to lower improper payment rates  As required by the ACA, the Center for Medicare and Medicaid Innovation (CMMI) was established in January 2011 to test and evaluate innovative payment and service delivery models to reduce program expenditures under Medicare  Examples of these models include providing payment incentives for groups of doctors, hospitals, and other health care providers (Accountable Care Organizations, or ACOs) to coordinate the services they provide to Medicare beneficiaries; bundling payments for services provided in different settings during a beneficiary's episode of care; and reimbursing health providers based on the quality of care rather than on the volume of services  CMMI also plays an important role in developing and implementing the new physician payment models required by MACRA  Medicare beneficiary education and outreach duties are shared between CMS and the Social Security Administration  Each year, CMS mails out a "Medicare and You" handbook to beneficiaries, which provides information on their benefits for the upcoming year  Additional educational materials and responses to frequently asked questions may be found on the CMS-maintained "Medicare gov" website, and beneficiaries may call a CMS-operated 1-800 number for assistance with specific questions and help with selecting and enrolling in a Medicare Advantage and/or Part D plan  A Medicare beneficiary ombudsman is also available to provide assistance to Medicare consumers with their complaints, grievances, and requests  The Social Security Administration is responsible for notifying low-income Medicare beneficiaries about programs that may be able to assist them with their medical and prescription drug expenses  The Social Security Administration also provides general Medicare eligibility and enrollment information on its webpage and on Social Security benefit statements  Finally, CMS partners with community-based organizations, such as State Health Insurance Assistance Programs, in every state to provide educational resources and personalized assistance to Medicare beneficiaries  Medicare's financial operations are accounted for through two trust funds maintained by the Department of the Treasury—the Hospital Insurance (HI) trust fund for Part A and the Supplementary Medical Insurance (SMI) trust fund for Parts B and D  For beneficiaries enrolled in Medicare Advantage (Part C), payments are made on their behalf in appropriate portions from the HI and SMI trust funds  HI is primarily funded by payroll taxes, while SMI is primarily funded through general revenue transfers and premiums  (See Figure 3  ) The HI and SMI trust funds are overseen by a Board of Trustees that provides annual reports to Congress  The trust funds are accounting mechanisms  Income to the trust funds is credited to the fund in the form of interest-bearing government securities  Expenditures for services and administrative costs are recorded against the fund  These securities represent obligations that the government has issued to itself  As long as a trust fund has a balance, the Department of the Treasury is authorized to make payments for it from the U S  Treasury  Medicare expenditures are primarily paid for through mandatory spending—generally Medicare pays for all covered health care services provided to beneficiaries  Aside from certain constraints in HI described below, the program is not subject to spending limits  Additionally, most Medicare expenditures (aside from premiums paid by beneficiaries) are paid for by current workers through income taxes and dedicated Medicare payroll taxes, that is, current income is used to pay current expenditures  Medicare taxes paid by current workers are not set aside to cover their future Medicare expenses  The primary source of funding for Part A is payroll taxes paid by employees and employers  Each pays a tax of 1 45% on the employee's earnings; the self-employed pay 2 9%  Beginning in 2013, some higher-income employees pay higher payroll taxes  Unlike Social Security, there is no upper limit on earnings subject to the tax  Other sources of income include (1) interest on federal securities held by the trust fund, (2) a portion of federal income taxes that individuals pay on their Social Security benefits, and (3) premiums paid by voluntary enrollees who are not automatically entitled to Medicare Part A  Income for Part A is credited to the HI trust fund  Part A expenditures for CY2019 are estimated to reach approximately $330 billion  Revenue to the trust fund is expected to consist of about $285 billion in payroll tax income and another $38 billion in interest and other income  The Medicare Trustees project that in CY2019, the HI trust fund will incur a deficit of approximately $7 billion  As long as the HI trust fund has a balance, the Treasury Department is authorized to make payments for Medicare Part A services  To date, the HI trust fund has never run out of money (i e , become insolvent), and there are no provisions in the Social Security Act that govern what would happen if that were to occur  Part A expenditures exceeded HI income each year from 2008 through 2015, and the assets credited to the trust fund were drawn down to make up the deficit in those years  Although the HI trust fund accumulated small surpluses in 2016 and 2017, the Medicare Trustees estimate that, beginning in 2018, expenditures will outpace income in all future years, and project that the HI trust fund will become insolvent in 2026 (i e , the balance of the trust fund will reach $0)  At that time there would no longer be sufficient funds to fully cover Part A expenditures  Medicare Part B is financed primarily from federal general revenues and from beneficiary premiums, which are set at 25% of estimated per capita program costs for the aged  (The disabled pay the same premium as the aged ) Income for Part B is credited to the SMI trust fund  Total spending for Part B is estimated to reach about $368 billion in CY2019, with premiums financing about $98 billion of that amount and general revenues financing most of the rest  Most beneficiaries who enroll in Medicare Part B pay a monthly premium  Individuals receiving Social Security benefits have their Part B premium payments automatically deducted from their Social Security benefit checks  Due to a "hold-harmless" provision in the Social Security Act, an individual's Social Security check cannot decrease from one year to the next as a result of the annual Part B premium increase (except in the case of higher-income individuals subject to income-related premiums)  The 2019 monthly Part B premium is $135 50  However, about 3 5% of Medicare enrollees are protected by the hold-harmless provision and pay lower premium amounts because the dollar amount of the 2019 cost-of-living increase in their Social Security benefits was not sufficient to cover the full premium increase  Since 2007, higher-income Part B enrollees have paid higher premiums  In 2019, individuals whose modified adjusted gross income (AGI) exceeds $85,000 and each member of a couple filing jointly whose modified AGI exceeds $170,000 are subject to higher premium amounts  These higher-income premiums range from 35% to 85% of the value of Part B and affect about 5% of Medicare enrollees  (See Appendix B for 2019 Part B premiums and high-income thresholds ) Payments for spending under the Medicare Advantage program are made in appropriate portions from the HI and SMI trust funds  There is no separate trust fund for Part C  Medicare Part D is financed through a combination of beneficiary premiums and federal general revenues  In addition, certain transfers are made from the states  These transfers, referred to as "clawback payments," represent a portion of the amounts states could otherwise have been expected to pay for drugs under Medicaid if drug coverage for the dual eligible population had not been transferred to Part D  Part D revenues are credited to a separate Part D account within the SMI trust fund  In CY2019, total spending for Part D is estimated to reach approximately $98 billion, with about $71 billion of that amount paid for by general revenues, $16 billion from beneficiary premiums, and $12 billion from state transfers  In 2019, the base beneficiary premium is $33 19; however, beneficiaries pay different premiums depending on the plan they have selected and whether they are entitled to low-income premium subsidies  Additionally, beginning in 2011, higher income Part D enrollees pay higher premiums  (The income thresholds are the same as for Part B, as described above ) On average, beneficiary premiums are set at 25 5% of expected total Part D costs for basic coverage  The Budget Control Act of 2011 (BCA; P L  112-25 ) provided for increases in the debt limit and established procedures designed to reduce the federal budget deficit, including the creation of a Joint Select Committee on Deficit Reduction  The failure of the Joint Committee to propose deficit reduction legislation by its mandated deadline triggered automatic spending reductions ("sequestration" of mandatory spending and reductions in discretionary spending) in fiscal years 2013 through 2021  The American Taxpayer Relief Act of 2012 (ATRA; P L  112-240 ) delayed the automatic reductions by two months, while the Bipartisan Budget Act of 2013 (BBA; P L  113-67 ) extended sequestration for mandatory spending for an additional two years—through FY2023  In 2014, the President signed into law an amended version of S  25 ( P L  113-82 ), which included a provision to extend BCA's sequester of mandatory spending through FY2024  BBA 15 extended the sequestration of mandatory spending another year, through FY2025  Most recently, BBA 18 extended the BCA mandatory spending sequester through FY2027  Section 256(d) of the Balanced Budget and Emergency Deficit Control Act of 1985 (BBEDCA; P L  99-177 ) contains special rules for the Medicare program in the event of a sequestration  Among other things, it specifies that for Medicare, sequestration is to begin the month after the sequestration order has been issued  Therefore, as the sequestration order was issued March 2013, Medicare sequestration began April 1, 2013, and will continue through March 31, 2028  Under sequestration, Medicare's benefit structure generally remains unchanged; however, benefit related payments are subject to 2% reductions  In other words, most Medicare payments to health care providers, as well as to MA and Part D plans, are being reduced by 2%  Certain Medicare payments are exempt from sequestration and therefore not reduced  These exemptions include (1) Part D low-income subsidies, (2) the Part D catastrophic subsidy, and (3) Qualified Individual (QI) premiums  Some non-benefit related Medicare expenses, such as administrative and operational spending, are subject to higher reductions, 6 2% in 2019  While Medicare provides broad protection against the costs of many, primarily acute care, services, the program does not cover all services that may be used by its aged and disabled beneficiaries  In general, Medicare does not cover eyeglasses, hearing aids, dentures, or most long-term care services  Further, unlike most private insurance policies, it does not include an annual "catastrophic" cap on out-of-pocket spending on cost-sharing charges for services covered under Parts A and B (except for persons enrolled in Medicare Advantage plans)  Most Medicare beneficiaries have some coverage in addition to Medicare  The following are the main sources of additional coverage for Medicare enrollees: Medicare Advantage  Many MA plans offer services in addition to those covered under original Medicare, reduced cost sharing, or reduced Part B or D premiums  All MA plans have a catastrophic cap  Employer Coverage  Coverage may be provided through a current or former employer  In recent years, a number of employers have cut back on the scope of retiree coverage  Some have dropped such coverage entirely, particularly for future retirees  As noted earlier, the MMA attempted to stem this trend, at least for prescription drug coverage, by offering subsidies to employers who offer drug coverage, at least as good as that available under Part D  Medigap  Individual insurance policies that supplement fee-for-service Medicare are referred to as Medigap policies  Beneficiaries with Medigap insurance typically have coverage for a portion of Medicare's deductibles and coinsurance; they may also have coverage for some items and services not covered by Medicare  Individuals select from a set of standardized plans, though not all plans are offered in all states  Medicaid  Certain low-income Medicare beneficiaries also may be eligible for full or partial benefits under their state's Medicaid program  Individuals eligible for both Medicare and Medicaid are referred to as dual eligibles  The lowest-income dual eligibles qualify for full Medicaid benefits, so that the majority of their health care expenses are paid by either Medicare or Medicaid; Medicare pays first, with Medicaid picking up most of the remaining costs  In addition to full-benefit dual eligibles, state Medicaid programs pay Medicare premiums and some cost sharing for other partial dual eligibles, who have higher income than full-benefit dual eligibles but are still considered to have low income  Other Public Sources  Individuals may have additional coverage through the Department of Veterans Affairs, or TRICARE for military retirees eligible for Medicare (and enrolled in Part B)  In 2015, about 87% of Medicare beneficiaries had some form of additional coverage  Some persons may have had more than one type of additional coverage  Appendix A  Abbreviations Appendix B  2019 Medicare Beneficiary Costs

ground_truth: Recent high-profile data breaches and other concerns about how third parties protect the privacy of individuals in the digital age have raised national concerns over legal protections of Americans' electronic data. Intentional intrusions into government and private computer networks and inadequate corporate privacy and cybersecurity practices have exposed the personal information of millions of Americans to unwanted recipients. At the same time, internet connectivity has increased and varied in form in recent years. Americans now transmit their personal data on the internet at an exponentially higher rate than in the past, and their data are collected, cultivated, and maintained by a growing number of both "consumer facing" and "behind the scenes" actors such as data brokers. As a consequence, the privacy, cybersecurity and protection of personal data have emerged as a major issue for congressional consideration. Despite the rise in interest in data protection, the legislative paradigms governing cybersecurity and data privacy are complex and technical, and lack uniformity at the federal level. The constitutional "right to privacy" developed over the course of the 20th century, but this right generally guards only against government intrusions and does little to shield the average internet user from private actors. At the federal statutory level, there are a number of statutes that protect individuals' personal data or concern cybersecurity, including the Gramm-Leach-Bliley Act, Health Insurance Portability and Accountability Act, Children's Online Privacy Protection Act, and others. And a number of different agencies, including the Federal Trade Commission (FTC), the Consumer Finance Protection Bureau (CFPB), and the Department of Health and Human Services (HHS), enforce these laws. But these statutes primarily regulate certain industries and subcategories of data. The FTC fills in some of the statutory gaps by enforcing a broad prohibition against unfair and deceptive data protection practices. But no single federal law comprehensively regulates the collection and use of consumers' personal data. Seeking a more fulsome data protection system, some governments—such as California and the European Union (EU)—have recently enacted privacy laws regulating nearly all forms of personal data within their jurisdictional reach. Some argue that Congress should consider creating similar protections in federal law, but others have criticized the EU and California approaches as being overly prescriptive and burdensome. Should the 116th Congress consider a comprehensive federal data protection law, its legislative proposals may involve numerous decision points and legal considerations. Points of consideration may include the conceptual framework of the law (i.e., whether it is prescriptive or outcome-based), the scope of the law and its definition of protected information, and the role of the FTC or other federal enforcement agency. Further, if Congress wants to allow individuals to enforce data protection laws and seek remedies for the violations of such laws in court, it must account for standing requirements in Article III, Section 2 of the Constitution. Federal preemption also raises complex legal questions—not only of whether to preempt state law, but what form of preemption Congress should employ. Finally, from a First Amendment perspective, Supreme Court jurisprudence suggests that while some privacy, cybersecurity, or data security regulations are permissible, any federal law that restricts protected speech, particularly if it targets specific speakers or content, may be subject to more stringent review by a reviewing court.

prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 2.

Report 1: R ecent high-profile data breaches and privacy violations have raised national concerns over the legal protections that apply to Americans' electronic data  While some concern over data protection stems from how the government might utilize such data, mounting worries have centered on how the private sector controls digital information, the focus of this report  Inadequate corporate privacy practices and intentional intrusions into private computer networks have exposed the personal information of millions of Americans  At the same time, internet connectivity has increased and varied in form in recent years, expanding from personal computers and mobile phones to everyday objects such as home appliances, "smart" speakers, vehicles, and other internet-connected devices  Americans now transmit their personal data on the internet at an exponentially higher rate than the past  Along with the increased connectivity, a growing number of "consumer facing" actors (such as websites) and "behind the scenes" actors (such as data brokers and advertising companies) collect, maintain, and use consumers' information  While this data collection can benefit consumers—for instance, by allowing companies to offer them more tailored products—it also raises privacy concerns, as consumers often cannot control how these entities use their data  As a consequence, the protection of personal data has emerged as a major issue for congressional consideration  Despite the increased interest in data protection, the legal paradigms governing the security and privacy of personal data are complex and technical, and lack uniformity at the federal level  The Supreme Court has recognized that the Constitution provides various rights protecting individual privacy, but these rights generally guard only against government intrusions and do little to prevent private actors from abusing personal data online  At the federal statutory level, while there are a number of data protection statutes, they primarily regulate certain industries and subcategories of data  The Federal Trade Commission (FTC) fills in some of the statutory gaps by enforcing the federal prohibition against unfair and deceptive data protection practices  But no single federal law comprehensively regulates the collection and use of personal data  In contrast to the "patchwork" nature of federal law, some state and foreign governments have enacted more comprehensive data protection legislation  Some analysts suggest these laws, which include the European Union's (EU's) General Data Protection Regulation (GDPR) and state laws such as the California Consumer Privacy Act (CCPA), will create increasingly overlapping and uneven data protection regimes  This fragmented legal landscape coupled with concerns that existing federal laws are inadequate has led many stakeholders to argue that the federal government should assume a larger role in data protection policy  However, at present, there is no consensus as to what, if any, role the federal government should play, and any legislative efforts at data protection are likely to implicate unique legal concerns such as preemption, standing, and First Amendment rights, among other issues  This report examines the current U S  legal landscape governing data protection, contrasting the current patchwork of federal data protection laws with the more comprehensive regulatory models in the CCPA and GDPR  The report also examines potential legal considerations for the 116th Congress should it consider crafting more comprehensive federal data protection legislation  The report lastly contains an Appendix , which contains a table summarizing the federal data protection laws discussed in the report  Historically, the common law in the United States had little need to protect privacy—as one commentator has observed, "[s]olitude was readily available in colonial America " Although common law had long protected against eavesdropping and trespass, these protections said little to nothing about individual rights to privacy, per se  Over time, gradual changes in the technological and social environment caused a shift in the law  In 1890, Louis Brandeis and Samuel Warren published a groundbreaking article in the Harvard Law Review entitled The Right to Privacy   Reacting to the proliferation of the press and advancements in technology such as more advanced cameras, the article argued that the law should protect individuals' "right to privacy" and shield them from intrusion from other individuals  The authors defined this emergent right as the "right to be let alone " Scholars have argued that this article created a "revolution" in the development of the common law  In the century that followed Brandeis's and Warren's seminal article, most states recognized the so-called "privacy torts"—intrusion upon seclusion, public disclosure of private facts, false light or "publicity," and appropriation  These torts revolve around the central idea that individuals should be able to lead, "to some reasonable extent, a secluded and private life " The Supreme Court described this evolution of privacy tort law as part of a "strong tide" in the twentieth century toward the "so-called right of privacy" in the states  Despite this "strong tide," some scholars have argued that these torts, which were developed largely in the mid-twentieth century, are inadequate to face the privacy and data protection problems of today  Furthermore, some states do not accept all four of these torts or have narrowed and limited the applicability of the torts so as to reduce their effectiveness  As discussed in greater detail below, state common law provides some other remedies and protections relevant to data protection, via tort and contract law  However, while all of this state common law may have some influence on data protection, the impact of this judge-made doctrine is unlikely to be uniform, as courts' application of these laws will likely vary based on the particular facts of the cases in which they are applied and the precedents established in the various states  As reflected in the common law's limited remedies, at the time of the founding, concerns about privacy focused mainly on protecting private individuals from government intrusion rather than on protecting private individuals from intrusion by others  Accordingly, the Constitution's Bill of Rights protects individual privacy from government intrusion in a handful of ways and does little to protect from non-governmental actors  Some provisions protect privacy in a relatively narrow sphere, such as the Third Amendment's protection against the quartering of soldiers in private homes or the Fifth Amendment's protection against self-incrimination  The most general and direct protection of individual privacy is contained in the Fourth Amendment, which states that "[t]he right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated      " For more than 100 years, the Fourth Amendment was generally read to prohibit only entry into private places rather than to provide general right to privacy  However, alongside the developments in the common law, constitutional law evolved over time to place a greater emphasis on protecting an individual's personal privacy  In particular, in 1967, the Supreme Court in Katz v  United States explained that the Fourth Amendment, while not creating a general "right to privacy," nonetheless protected "people, not places," and guarded individual privacy against certain types of governmental intrusion  This principle has continued to evolve over time, and has come to protect, to some extent, individuals' interest in their digital privacy  For example, in the 2018 case of Carpenter v  United States , the Supreme Court concluded that the Fourth Amendment's protection of privacy extended to protecting some information from government intrusion even where that information was shared with a third party  In Carpenter , the Court concluded that individuals maintain an expectation of privacy, protected by the Fourth Amendment, in the record of their movements as recorded by their cellular provider  Carpenter distinguished earlier cases which had relied upon the principle that information shared with third parties was generally not subject to Fourth Amendment scrutiny, concluding that "an individual maintains a legitimate expectation of privacy in the record of his physical movements as captured through [his cellular phone] " The Court's holding means that, in the future, the government must obtain a warrant supported by probable cause to obtain this information  The Fourth Amendment thus provides a limited bulwark against government intrusion into digital privacy  In addition to the protection provided by the Fourth Amendment, in the 1960s and 1970s, the Court concluded that the Fourteenth Amendment's guarantee of "liberty" implied the existence of a more general right of privacy, protecting individuals from government intrusion even outside the "search and seizure" context  In the 1977 case Whalen v  Roe , the Supreme Court explained that this constitutional right of privacy "in fact involve[s] at least two different kinds of interests  One is the individual interest in avoiding disclosure of personal matters, and another is the interest in independence in making certain kinds of important decisions " The second of these interests relates primarily to individual rights concerning the "intimacies of [persons'] physical relationship," as well as the right to abortion, and has little connection to data protection  However, the first of the interests listed in Whalen could potentially relate to data protection  This interest, the right to avoid certain disclosures, has come to be known as the right to "informational privacy " Despite its broad expression in Whalen , every Supreme Court case to consider the informational privacy right has rejected the constitutional claim and upheld the government program alleged to have infringed on the right  In Whalen itself, physicians and patients challenged a New York law that required the recording of the names and addresses of all persons who had obtained certain drugs for which there was both a lawful and unlawful market  Although the Court acknowledged that the statute "threaten[ed] to impair       [the plaintiffs'] interest in the nondisclosure of private information," the Court observed that the disclosures were an "essential part of modern medical practice" and the New York law had protections in place against unwarranted disclosure that showed a "proper concern" for the protection of privacy  Together, the Court found these factors sufficient to uphold the law  In the wake of Whalen and Nixon v  Administrator of General Services —a case decided the same year as Whalen that also considered the right to informational privacy—courts have struggled to articulate the precise contours of the right  The most recent Supreme Court case to consider the right to informational privacy, NASA v  Nelson , went so far as to suggest that the right might not exist, "assuming without deciding" that the right existed in the course of rejecting the constitutional claim challenge to a government background check program for hiring  Despite the Supreme Court's lack of clarity about the right to informational privacy, "most federal circuit courts" recognize the right to various extents  All of the constitutional rights involving privacy, like the common law privacy torts, focus on public disclosure of private facts  This focus limits their potential influence on modern data privacy debates, which extends beyond the disclosure issue to more broadly concern how data is collected, protected, and used  Perhaps more importantly, whatever the reach of the constitutional right to privacy, the "state action doctrine" prevents it from being influential outside the realm of government action  Under this doctrine, only government action is subject to scrutiny under the Constitution, but purely private conduct is not proscribed, "no matter how unfair that conduct may be " As a result, neither the common nor constitutional law provides a complete framework for considering many of the potential threats to digital privacy and consumer data  Rather, the most important data protection standards come from statutory law  Given the inherent limitations in common law and constitutional protections, Congress has enacted a number of federal laws designed to provide statutory protections of individuals' personal information  In contrast with the scheme prevalent in Europe and some other countries, rather than a single comprehensive law, the United States has a "patchwork" of federal laws that govern companies' data protection practices  These laws vary considerably in their purpose and scope  Most impose data protection obligations on specific industry participants—such as financial institutions, health care entities, and communications common carriers—or specific types of data, such as children's data  Other laws, however, supplement the Constitution's limited privacy protections and apply similar principles to private entities  The Stored Communications Act (SCA), for instance, generally prohibits the unauthorized access or disclosure of certain electronic communications stored by internet service providers  Lastly, some laws prohibit broad categories of conduct that, while not confined to data protection, limit how companies may handle personal data  Most notably, the Federal Trade Commission Act (FTC Act) prohibits "unfair or deceptive acts or practices " As some scholars have pointed out, the FTC has used its authority under the FTC Act to develop norms and principles that effectively fill in the gaps left by other privacy statutes  These laws are organized below, beginning with those most narrowly focused on discrete industries and moving toward more generally applicable laws  In light of its gap-filling function, this section lastly discusses the FTC Act—along with the Consumer Financial Protection Act (CFPA), which covers similar types of conduct  The Appendix to this report contains a table summarizing the federal data protection laws discussed  The Gramm-Leach-Bliley Act (GLBA) imposes several data protection obligations on financial institutions  These obligations are centered on a category of data called "consumer" "nonpublic personal information" (NPI), and generally relate to: (1) sharing NPI with third parties, (2) providing privacy notices to consumers, and (3) securing NPI from unauthorized access  First, unless an exception applies, GLBA and its implementing regulations prohibit financial institutions from sharing NPI with non-affiliated third parties unless they first provide the consumers with notice and an opportunity to "opt-out " Furthermore, financial institutions are prohibited altogether from sharing account numbers or credit card numbers to third parties for use in direct marketing  Second, financial institutions must provide "clear and conspicuous" initial and annual notices to customers describing their privacy "policies and practices " These notices must include, among other things, the categories of NPI collected and disclosed, the categories of third parties with which the financial institution shares NPI, and policies and practices with respect to protecting the confidentiality and security of NPI  Third, GLBA and its implementing regulations (often referred to as the "Safeguards Rule" ) require financial institutions to maintain "administrative, technical, and physical safeguards" to "insure the security and confidentiality" of "customer" (as opposed to "consumer") NPI, and to protect against "any anticipated threats or hazards" or "unauthorized access" to such information  Financial institutions regulated by federal banking agencies are further required to implement a program for responding to the unauthorized access of customer NPI  The Consumer Financial Protection Bureau (CFPB), FTC, and federal banking agencies share civil enforcement authority for GLBA's privacy provisions  However, the CFPB has no enforcement authority over GLBA's data security provisions  Under the data security provisions, federal banking regulators have exclusive enforcement authority for depository institutions, and the FTC has exclusive enforcement authority for all non-depository institutions  GLBA does not specify any civil remedies for violations of the Act, but agencies can seek remedies based on the authorities provided in their enabling statutes, as discussed below  GLBA also imposes criminal liability on those who "knowingly and intentionally" obtain or disclose "customer information" through false or fraudulent statements or representations  Criminal liability can result in fines and up to five years' imprisonment  GLBA does not contain a private right of action that would allow affected individuals to sue violators  Under the Health Insurance Portability and Accountability Act (HIPAA), the Department of Health and Human Services (HHS) has enacted regulations protecting a category of medical information called "protected health information" (PHI)  These regulations apply to health care providers, health plans, and health care clearinghouses (covered entities), as well as certain "business associates" of such entities  The HIPAA regulations generally speak to covered entities': (1) use or sharing of PHI, (2) disclosure of information to consumers, (3) safeguards for securing PHI, and (4) notification of consumers following a breach of PHI  First, with respect to sharing, HIPAA's privacy regulations generally prohibit covered entities from using PHI or sharing it with third parties without patient consent, unless such information is being used or shared for treatment, payment, or "health care operations" purposes, or unless another exception applies  Covered entities generally may not make treatment or services conditional on an individual providing consent  Second, with respect to consumer disclosures, covered entities must provide individuals with "adequate notice of the uses and disclosures of [PHI] that may be made by the covered entity, and of the individual's rights and the covered entity's legal duties with respect to [PHI] " These notices must be provided upon consumer request, and covered entities maintaining websites discussing their services or benefits must "prominently post" the notices on their websites  Furthermore, an individual has the right to request that a covered entity provide him with a copy of his PHI that is maintained by the covered entity  In some cases, an individual may also request that the covered entity provide information regarding specific disclosures of the individual's PHI, including the dates, recipients, and purposes of the disclosures  Third, with respect to data security, covered entities must maintain safeguards to prevent threats or hazards to the security of electronic PHI  Lastly, HIPAA regulations contain a data breach notification requirement, requiring covered entities to, among other things, notify the affected individuals within 60 calendar days after discovering a breach of "unsecured" PHI  Violations of HIPAA's privacy requirements can result in criminal or civil enforcement  HHS possesses civil enforcement authority and may impose civil penalties, with the amount varying based on the level of culpability  The Department of Justice has criminal enforcement authority and may seek fines or imprisonment against a person who, in violation of HIPAA's privacy requirements, "knowingly" obtains or discloses "individually identifiable health information" or "uses or causes to be used a unique health identifier " HIPAA does not, however, contain a private right of action that would allow aggrieved individuals to sue alleged violators  The Fair Credit Reporting Act (FCRA) covers the collection and use of information bearing on a consumer's creditworthiness  FCRA and its implementing regulations govern the activities of three categories of entities: (1) credit reporting agencies (CRAs), (2) entities furnishing information to CRAs (furnishers), and (3) individuals who use credit reports issued by CRAs (users)  In contrast to HIPAA or GLBA, there are no privacy provisions in FCRA requiring entities to provide notice to a consumer or to obtain his opt-in or opt-out consent before collecting or disclosing the consumer's data to third parties  FCRA further has no data security provisions requiring entities to maintain safeguards to protect consumer information from unauthorized access  Rather, FCRA's requirements generally focus on ensuring that the consumer information reported by CRAs and furnishers is accurate and that it is used only for certain permissible purposes  With respect to accuracy, CRAs must maintain reasonable procedures to ensure the accuracy of information used in "consumer reports " CRAs must further exclude adverse information, such as "accounts placed in collection" or civil judgements, from consumer reports after a certain amount of time has elapsed  Furnishers must similarly establish reasonable policies and procedures to ensure the accuracy of the information reported to CRAs and may not furnish to a CRA any consumer information if they have reasonable cause to believe that information is inaccurate  Consumers also have the right to review the information CRAs have collected on them to ensure such information is accurate  CRAs must disclose information contained in a consumer's file upon the consumer's request, as well as the sources of the information and the identity of those who have recently procured consumer reports on the consumer  Should a consumer dispute the accuracy of any information in his file, CRAs and furnishers must reinvestigate the accuracy of the contested information  In addition to the accuracy requirements, under FCRA consumer reports may be used only for certain permissible purposes such as credit transactions  Accordingly, a CRA may generally furnish consumer reports to a user only if it "has a reason to believe" the user intends to use it for a permissible purpose  Likewise, users may "use or obtain a consumer report" only for a permissible purpose  Along with the permissible purpose requirement, users must further notify consumers of any "adverse action" taken against the consumer based on the report  Adverse actions include refusing to grant credit on substantially the terms requested, reducing insurance coverage, and denying employment  The FTC and the CFPB share civil enforcement authority over FCRA, with each agency possessing enforcement authority over entities subject to their respective jurisdictions  In addition to government enforcement, FCRA provides a private right of action for consumers injured by willful or negligent violations of the Act  Consumers bringing such actions for negligent violations of the Act may recover actual damages, attorney's fees, and other litigation costs  For willful violations, consumers may recover either actual damages or statutory damages ranging from $100 to $1,000, attorney's fees, other litigation costs, and "such amount of punitive damages as the court may allow " FCRA also imposes criminal liability on any individual who knowingly and willfully obtains consumer information from a CRA under false pretenses and on any officer or employee of a CRA who knowingly and willfully provides consumer information to a person not authorized to receive that information  The Communications Act of 1934 (Communications Act or Act), as amended, established the Federal Communications Commission (FCC) and provides a "comprehensive scheme" for the regulation of interstate communication  Most relevant to this report, the Communications Act includes data protection provisions applicable to common carriers, cable operators, and satellite carriers  The Telecommunications Act of 1996 amended the Communications Act to impose data privacy and data security requirements on entities acting as common carriers  Generally, common carrier activities include telephone and telegraph services but exclude radio broadcasting, television broadcasting, provision of cable television, and provision of broadband internet  The privacy and security requirements imposed on entities acting as common carriers are primarily centered on a category of information referred to as "customer proprietary network information (CPNI) " CPNI is defined as information relating to the "quantity, technical configuration, type, destination, location, and amount of use of a telecommunications service subscribed to by any customer of a telecommunications carrier," and is "made available to the carrier by the customer solely by virtue of the carrier-customer relationship " Section 222(c) of the Communications Act and the FCC's implementing regulations set forth carriers' obligations regarding CPNI  These provisions cover three main issues  First, carriers must comply with certain use and disclosure rules  Section 222(c) imposes a general rule that carriers may not "use, disclose, or permit access to" "individually identifiable" CPNI without customer approval, unless a particular exception applies  Before a carrier may solicit a customer for approval to use or disclose their CPNI, it must notify customers of their legal rights regarding CPNI and provide information regarding the carrier's use and disclosure of CPNI  Second, carriers must implement certain safeguards to ensure the proper use and disclosure of CPNI  These safeguards must include, among other things, a system by which the "status of a customer's CPNI approval can be clearly established" prior to its use, employee training on the authorized use of CPNI, and "reasonable measures" to discover and protect against attempts to gain unauthorized access to CPNI " Lastly, carriers must comply with data breach requirements  Following a "breach" of customers' CPNI, a carrier must disclose such a breach to law enforcement authorities no later than seven days following a "reasonable determination of the breach " After it has "completed the process of notifying law enforcement," it must notify customers whose CPNI has been breached  In addition to the CPNI requirements, the Communications Act contains three other potentially relevant data privacy and security provisions pertaining to common carriers  First, Section 222(a) of the Act states that carriers must "protect the confidentiality of proprietary information" of "customers " Second, Section 201(b) of the Act declares unlawful "any charge, practice, classification, and regulation" in connection with a carrier's communication service that is "unjust or unreasonable " Lastly, Section 202(a) provides that it shall "be unlawful for any common carrier to make any unjust or unreasonable discrimination in charges, practices, classification, regulations, facilities, or services        " In a 2016 rule, which was subsequently overturned pursuant to the Congressional Review Act, the FCC attempted to rely on these three provisions to regulate a broad category of data called "customer proprietary information" (customer PI)  While customer PI is not defined in the statute, the FCC's 2016 rule defined it broadly to include CPNI, as well as other "personally identifiable information" and the "content of communications " The FCC reasoned that Section 222(a) imposes a general duty, independent from Section 222(c), on carriers to protect the confidentiality of customer PI  It further maintained that Sections 201(b) and 202(a) provide independent "backstop authority" to ensure that no gaps are formed in commercial data privacy and security practices, similar to the FTC's authority under the FTC Act  However, given that Congress overturned the 2016 rule, the FCC may be prohibited under the CRA from relying on these three provisions to regulate data privacy and security  Under the CRA, the FCC may not reissue the rule in "substantially the same form" or issue a "new rule that is substantially the same" as the overturned rule "unless the reissued or new rule is specifically authorized by a law enacted after the date of the joint resolution disapproving the original rule " The FCC is empowered to enforce civil violations of the Communications Act's provisions, including its common carrier provisions  The FCC may impose a "forfeiture penalty" against any person who "willfully or repeatedly" violates the Act or the FCC's implementing regulations  The Communications Act further imposes criminal penalties on those who "willfully and knowingly" violate the statute or the FCC's implementing regulations  Along with its general civil and criminal provisions, the Communications Act provides a private right of action for those aggrieved by violations of its common carrier provisions; in such actions, plaintiffs may seek actual damages and reasonable attorney's fees  In addition to common carriers, the Communications Act imposes a number of data privacy and security requirements on how "cable operators" and "satellite carriers" (i e , covered entities) treat their subscribers' "personally identifiable information" (PII)  These requirements relate to: (1) data collection and disclosure; (2) subscribers' access to, and correction of, their data; (3) data destruction; (4) privacy policy notification; and (5) data security  First, covered entities must obtain the "prior written or electronic consent" of a subscriber before collecting the subscriber's PII or disclosing it to third parties  There are several exceptions to this consent requirement  Among other things, covered entities may collect a subscriber's PII in order to obtain information necessary to render service to the subscriber, and they may disclose a subscriber's PII if the disclosure is necessary to "render or conduct a legitimate business activity" related to the service they provide  Second, covered entities must provide subscribers, at "reasonable times and a convenient place," with access to all of their PII "collected and maintained," and they must further provide subscribers a reasonable opportunity to correct any error in such information  Third, covered entities are obligated to destroy PII if it is "no longer necessary for the purpose for which it is was collected" and there are "no pending requests or orders for access to such information " Fourth, covered entities must provide subscribers with a privacy policy notice at the "time of entering into an agreement" for services and "at least once a year thereafter " These notices must describe, among other things: (1) the nature of the subscriber's PII that has been, or will be, collected, (2) the nature, frequency, and purpose of any disclosure of such information and the types of persons to whom the disclosure is made, and (3) the times and place at which the subscriber may have access to such information  Lastly, the Communications Act imposes a general data security requirement on covered entities; they must "take such actions as are necessary to prevent unauthorized access to [PII] by a person other than the subscriber" or the covered entity  The Communications Act provides a private right of action for "[a]ny person aggrieved by any act" of a covered entity in violation of these requirements  In such actions, a court may award actual damages, punitive damages, and reasonable attorneys' fees and other litigation costs  Additionally, covered entities violating these provisions may be subject to FCC civil enforcement and criminal penalties that, as previously noted, are generally applicable to violations of the Communications Act  The Video Privacy Protection Act (VPPA) was enacted in 1988 in order to "preserve personal privacy with respect to the rental, purchase, or delivery of video tapes or similar audio visual materials " The VPPA does not have any data security provisions requiring entities to maintain safeguards to protect consumer information from unauthorized access  However, it does have privacy provisions restricting when covered entities can share certain consumer information  Specifically, the VPPA prohibits "video tape service providers" —a term that includes both digital video streaming services and brick-and-mortar video rental stores —from knowingly disclosing PII concerning any "consumer" without that consumer's opt-in consent  The VPPA provides several exceptions to this general rule  In particular, video tape service providers may disclose PII to "any person if the disclosure is incident to the ordinary course of business " Providers may also disclose PII if the disclosure solely includes a consumer's name and address and does not identify the "title, description, or subject matter of any video tapes or other audio visual material," and the consumer has been provided with an opportunity to opt out of such disclosure  The VPPA does not empower any federal agency to enforce violations of the Act and there are no criminal penalties for violations, but it does provide for a private right of action for persons aggrieved by the Act  In such actions, courts may award actual damages, punitive damages, preliminary and equitable relief, and reasonable attorneys' fees and other litigation costs  The Family Educational Rights and Privacy Act of 1974 (FERPA) creates privacy protections for student education records  "Education records" are defined broadly to generally include any "materials which contain information directly related to a student" and are "maintained by an educational agency or institution " FERPA defines an "educational agency or institution" to include "any public or private agency or institution which is the recipient of funds under any applicable program " FERPA generally requires that any "educational agency or institution" (i e , covered entities) give parents or, depending on their age, the student (1) control over the disclosure of the student's educational records, (2) an opportunity to review those records, and (3) an opportunity to challenge them as inaccurate  First, with respect to disclosure, covered entities must not have a "policy or practice" of permitting the release of education records or "personally identifiable information contained therein" without the consent of the parent or the adult student  This consent requirement is subject to certain exceptions  Among other things, covered entities may disclose educational records to (1) certain "authorized representatives," (2) school officials with a "legitimate educational interest," or (3) "organizations conducting studies" for covered entities "for the purpose of developing, validating, or administering predictive tests, administering student aid programs, and improving instructions " Covered entities may also disclose the information without consent if it constitutes "directory information" and the entity has given notice and a "reasonable period of time" to opt out of the disclosure  Second, in addition to the disclosure obligations, covered entities must not have a "policy of denying" or "effectively prevent[ing]" parents or an adult student from inspecting and reviewing the underlying educational records  Covered entities must further "establish appropriate procedures" to grant parents' review requests "within a reasonable period of time, but in no case more than forty-five days after the request has been made " Lastly, covered entities must provide an "opportunity for a hearing" to challenge the contents of the student's education records as "inaccurate, misleading, or otherwise in violation of the privacy rights of students " Covered entities must further "provide an opportunity for the correction or deletion of any such inaccurate, misleading or otherwise inappropriate data contained therein and to insert into such records a written explanation of the parents respecting the content of such records " Parents or adult students who believe that their rights under FERPA have been violated may file a complaint with the Department of Education  FERPA authorizes the Secretary of Education to "take appropriate actions," which may include withholding federal education funds, issuing a "cease and desist order," or terminating eligibility to receive any federal education funding  FERPA does not, however, contain any criminal provisions or a private right of action  While federal securities statutes and regulations do not explicitly address data protection, two requirements under these laws have implications for how companies prevent and respond to data breaches  First, federal securities laws may require companies to adopt controls designed to protect against data breaches  Under Section 13(b)(2)(B) of the Securities and Exchange Act of 1934 (Exchange Act), public companies and certain other companies are required to "devise and maintain a system of internal accounting controls sufficient to provide reasonable assurances" that "transactions are executed in accordance with management's general or specific authorization," and that "access to assets is permitted only in accordance with management's general or specific authorization " In a recent report, the Securities and Exchange Commission (SEC) suggested that, in order to comply with this requirement, companies should consider "cyber-related threats" when formulating accounting controls  The report discussed the SEC's investigation of companies that wrongly transferred millions of dollars in response to fraudulent emails, generally noting that "companies should pay particular attention to the obligations imposed by Section 13(b)(2)(B)" in light of the "risks associated with today's ever expanding digital interconnectedness " Second, federal securities laws may require companies to discuss data breaches when making required disclosures under securities laws  The Exchange Act, Securities Act of 1933 (Securities Act), and their implementing regulations require certain companies to file a number of disclosures with the SEC  Specifically, the Securities Act requires companies issuing securities in a public offering to file detailed statements registering the offering (registration statements), and the Exchange Act requires public companies to file periodic reports on an annual, quarterly, and ongoing basis  These filings must contain certain categories of information, such as a description of the most significant factors that make investing in the company speculative or risky (known as "risk factors") and a description of any "events, trends, or uncertainties that are reasonably likely to have a material effect on its results of operations, liquidity, or financial condition        " Further, when making these filings, or any other statements in connection with the purchase or sale of a security, companies are required to include any "material" information necessary to make the statements made therein "not misleading " In interpretive guidance issued in February 2018, the SEC indicated that, pursuant to these obligations, companies may be required to disclose in their filings cyber incidents such as data breaches  The SEC can enforce violations of the Securities Act and the Exchange Act, including the accounting controls requirement and the disclosure requirements, through civil actions filed in court or administrative "cease and desist" proceedings  The SEC may seek civil penalties, disgorgement, and injunctive relief (in civil actions) or a cease and desist order (in administrative proceedings)  Furthermore, under both the Exchange Act and the Securities Act, individuals aggrieved by a company's misrepresentation or omission of a material fact in connection with the purchase or sale of a security may sue the company for actual damages incurred by the individual  There is not, however, a private right of action for violations of the Exchange Act's accounting controls requirement  Lastly, in addition to civil enforcement, both the Securities Act and the Exchange Act impose criminal liability; any person who "willfully" violates the acts or their implementing regulations may be subject to fines and imprisonment  The Children's Online Privacy Protection Act (COPPA) and the FTC's implementing regulations regulate the online collection and use of children's information  Specifically, COPPA's requirements apply to: (1) any "operator" of a website or online service that is "directed to children," or (2) any operator that has any "actual knowledge that it is collecting personal information from a child" (i e , covered operators)  Covered operators must comply with various requirements regarding data collection and use, privacy policy notifications, and data security  First, COPPA and the FTC's implementing regulations prohibit covered operators from collecting or using "personal information" from children under the age of thirteen without first obtaining parental consent  Such consent must be "verifiable" and must occur before the information is collected  Second, covered operators must provide parents with direct notice of their privacy policies, describing their data collection and sharing policies  Covered operators must further post a "prominent and clearly labeled link" to an online notice of its privacy policies at the home page of its website and at each area of the website in which it collects personal information from children  Lastly, covered operators that have collected information from children must establish and maintain "reasonable procedures" to protect the "confidentiality, security, and integrity" of the information, including ensuring that the information is provided only to third parties that will similarly protect the information  They must also comply with certain data retention and deletion requirements  Under COPPA's safe harbor provisions, covered operators will be deemed to have satisfied these requirements if they follow self-regulatory guidelines the FTC has approved  COPPA provides that violations of the FTC's implementing regulations will be treated as "a violation of a rule defining an unfair or deceptive act or practice" under the FTC Act  Under the FTC Act, as discussed in more detail below, the FTC has authority to enforce violations of such rules by seeking penalties or equitable relief  COPPA also authorizes state attorneys general to enforce violations affecting residents of their states  COPPA does not contain any criminal penalties or any provision expressly providing a private right of action  The Electronic Communications Privacy Act (ECPA) was enacted in 1986, and is composed of three acts: the Wiretap Act, the Stored Communications Act (SCA), and the Pen Register Act  Much of ECPA is directed at law enforcement, providing "Fourth Amendment like privacy protections" to electronic communications  However, ECPA's three acts also contain privacy obligations relevant to non-governmental actors  ECPA is perhaps the most comprehensive federal law on electronic privacy, as it is not sector-specific, and many of its provisions apply to a wide range of private and public actors  Nevertheless, its impact on online privacy practices has been limited  As some commentators have observed, ECPA "was designed to regulate wiretapping and electronic snooping rather than commercial data gathering," and litigants attempting to apply ECPA to online data collection have generally been unsuccessful  The Wiretap Act applies to the interception of a communication in transit  A person violates the Act if, among other acts, he "intentionally intercepts       any wire, oral, or electronic communication " The Wiretap Act defines an "electronic communication" broadly, and courts have held that the term includes information conveyed over the internet  Several thresholds must be met for an act to qualify as an unlawful "interception " Of particular relevance are three threshold issues  First, the communication must be acquired contemporaneously with the transmission of the communication  Consequently, there is no "interception" where the communication in question is in storage  Furthermore, the acquired information must relate to the "contents" of the communication, defined as information concerning the "substance, purport, or meaning of that communication " As a result, while the Act applies to information like the header or body of an email, the Act does not apply to non-substantive information automatically generated about the characteristics of the communication, such as IP addresses  Third, individuals do not violate the Wiretap Act if they are a "party to the communication" or received "prior consent" from one of the parties to the communication  The party-to-the-communication and consent exceptions have been subject to significant litigation; in particular, courts have often relied on the exceptions to dismiss suits alleging Wiretap Act violations due to online tracking, holding that websites or third-party advertisers who tracked users' online activity were either parties to the communication or received consent from a party to the communication  The SCA prohibits the improper access or disclosure of certain electronic communications in storage  With respect to improper access, a person violates the SCA if he obtains an "electronic communication" in "electronic storage" from "a facility through which an electronic communication service is provided" by either: (1) "intentionally access[ing] [the facility] without authorization" or (2) "intentionally exceed[ing] an authorization " Although the statute does not define the term "facility," most courts have held that the term is limited to a location where network service providers store communications  However, courts have differed over whether a personal computer is a "facility " Most courts have excluded personal computers from the reach of the SCA, but some have disagreed  With respect to improper disclosure, the SCA generally prohibits entities providing "electronic communication services" or "remote computing services" from knowingly divulging the contents of a communication while holding the communication in electronic storage  Similar to the Wiretap Act, the SCA's access and disclosure prohibitions are subject to certain exceptions  In particular, individuals do not violate the SCA if they are the sender or intended recipient of the communication or when a party to the communication consents to the access or disclosure  As with the Wiretap Act, courts have relied on these two exceptions to dismiss suits under the SCA related to online tracking  The Pen Register Act prohibits the installation of a "pen register" or "trap and trace device" without a court order  A pen register is a "device or process" that "records or decodes" outgoing "dialing, routing, addressing, or signaling information," and a trap and trace device is a "device or process" that "captures the incoming       dialing, routing, addressing, and signaling information " In contrast to the Wiretap Act, the Pen Register Act applies to the capture of non-content information, as the definitions of pen registers and trap and trace devices both exclude any device or process that captures the "contents of any communication " Furthermore, the Pen Register Act prohibits only the use of a pen register or trap and trace device and does not separately prohibit the disclosure of non-content information obtained through such use  The statute does, however, have several exceptions similar to those contained in the Wiretap Act and SCA  Among other things, providers of an electronic or wire communication service will not violate the Act when they use a pen register or trap and trace device in order to "protect their rights or property" or "where the consent of the user of that service has been obtained " The Wiretap Act and the SCA both provide for private rights of action  Persons aggrieved by violations of either act may bring a civil action for damages, equitable relief, and reasonable attorney's fees  For actions under the Wiretap Act, damages are the greater of: (1) actual damages suffered by the plaintiff, or (2) "statutory damages of whichever is the greater of $100 a day for each day of violation or $10,000 " For actions under the SCA, damages are "the sum of the actual damages suffered by the plaintiff and the profits made by the violator," provided that all successful plaintiffs are entitled to receive at least $1,000  Violations of the Wiretap Act and SCA are also subject to criminal prosecution and can result in fines and imprisonment  In contrast, the Pen Register Act does not provide for a private right of action, but knowing violations can result in criminal fines and imprisonment  The Computer Fraud and Abuse Act (CFAA) was originally intended as a computer hacking statute and is centrally concerned with prohibiting unauthorized intrusions into computers, rather than addressing other data protection issues such as the collection or use of data  Specifically, the CFAA imposes liability when a person "intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains       information from any protected computer " A "protected computer" is broadly defined as any computer used in or affecting interstate commerce or communications, functionally allowing the statute to apply to any computer that is connected to the internet  Violations of the CFAA are subject to criminal prosecution and can result in fines and imprisonment  The CFAA also allows for a private right of action, allowing aggrieved individuals to seek actual damages and equitable relief, such as an injunction against the defendant  As with ECPA, internet users have attempted to use this private right of action to sue companies tracking their online activity, arguing that companies' use of tracking devices constitutes an unauthorized access of their computers  In this vein, CFAA is theoretically a more generous statute than ECPA for such claims because it requires authorization from the owner of the computer (i e , the user), rather than allowing any party to a communication (i e , either the user or the website visited by the user) to give consent to the access  In practice, however, such claims have typically been dismissed due to plaintiffs' failure to meet CFAA's damages threshold  Specifically, as a threshold to bring a private right of action, a plaintiff must show damages in excess of $5,000 or another specific type of damages such as physical injury or impairment to medical care  The FTC Act has emerged as a critical law relevant to data privacy and security  As some commentators have noted, the FTC has used its authority under the Act to become the "go-to agency for privacy," effectively filling in gaps left by the aforementioned federal statutes  While the FTC Act was originally enacted in 1914 to strengthen competition law, the 1938 Wheeler-Lea amendment revised Section 5 of the Act to prohibit a broad range of unscrupulous or misleading practices harmful to consumers  The Act gives the FTC jurisdiction over most individuals and entities, although there are several exemptions  For instance, the FTC Act exempts common carriers, nonprofits, and financial institutions such as banks, savings and loan institutions, and federal credit unions  The key provision of the FTC Act, Section 5, declares unlawful "unfair or deceptive acts or practices" (UDAP) "in or affecting commerce " The statute provides that an act or practice is "unfair" only if it "causes or is likely to cause substantial injury to consumers which is not reasonably avoidable by consumers themselves and not outweighed by countervailing benefits to consumers or to competition " While the statute does not define "deceptive," the FTC has clarified in guidance that an act or practice is to be considered deceptive if it involves a material "representation, omission, or practice that is likely to mislead [a] consumer" who is "acting reasonably in the circumstances " Under the FTC Act, the agency may enact rules defining specific acts or practices as UDAPs, often referred to as "trade regulation rules" (TRRs) or "Magnuson-Moss" rulemaking  However, to enact TRRs the FTC must comply with several procedures that are not required under the notice-and-comment rulemaking procedures set forth in Section 553 of the Administrative Procedure Act (APA), which are the default rulemaking procedures for federal agencies  Among other things, these additional procedures require the FTC to publish an advance notice of proposed rulemaking (ANPRM), give interested persons an opportunity for an informal hearing, and issue a statement accompanying the rule regarding the "prevalence of the acts or practices treated by the rule " Consequently, the FTC rarely uses its TRR rulemaking authority and has not enacted any TRRs regarding data protection  Rather, as discussed further below, the agency largely uses enforcement actions to signal the types of acts and practices it considers to be impermissible UDAPs  The FTC has brought hundreds of enforcement actions against companies alleging deceptive or unfair data protection practices  Most of these actions result in companies entering into consent decrees requiring the companies to take certain measures to prevent any further violations  While these consent decrees are not legally binding on those who are not a party to them, they are significant because they reflect the type of practices that the FTC views as "unfair" or "deceptive " Indeed, some scholars view the principles arising from them as a type of "common law of privacy " Given the uniquely important role FTC enforcement plays in the U S  data protection landscape, it is worth noting the types of data protection practices the FTC has viewed as "unfair" or "deceptive " Perhaps the most settled principle of the FTC's "common law of privacy" is that companies are bound by their data privacy and data security promises  The FTC has taken the position that companies act deceptively when they gather, use, or disclose personal information in a way that contradicts their posted privacy policy or other statements, or when they fail to adequately protect personal information from unauthorized access despite promises that that they would do so  In addition to broken promises, the FTC has alleged that companies act deceptively when they make false representations in order to induce disclosure of personal information  For example, in FTC v  Sun Spectrum Commc'ns Org , Inc  , the FTC alleged that several telemarketers acted "deceptively" by misrepresenting themselves as a credit card company and requesting personal information from individuals, ostensibly for the purpose of providing non-existent credit cards to the individuals  The FTC has further maintained that companies act deceptively when their privacy policies or other statements provide insufficient notice of their privacy practices  For instance, in In the Matter of Sears Holdings Management Co  , the FTC alleged that Sears acted deceptively by failing to disclose the extent to which downloadable software would monitor users' internet activity, merely telling users that it would track their "online browsing " Along with "deceptive claims," the FTC has also alleged that certain data privacy or data security practices may be "unfair " Specifically, the FTC has maintained that it is unfair for a company to retroactively apply a materially revised privacy policy to personal data that it collected under a previous policy  The FTC has also taken the position that certain default privacy settings are unfair  In the case FTC v  Frostwire , for example, the FTC alleged that a peer-to-peer file sharing application had unfair privacy settings because, immediately upon installation, the application would share the personal files stored on users' devices unless the users went through a burdensome process of unchecking many pre-checked boxes  With respect to data security, the FTC has more recently maintained that a company's failure to safeguard personal data may be "unfair," even if the company did not contradict its privacy policy or other statements  While at least one court has agreed that such conduct may be "unfair" under the FTC Act, a recent U S  Court of Appeals for the Eleventh Circuit case, LabMD v  FTC , suggests that any FTC cease and desist order based on a company's "unfair" data security measures must allege specific data failures and specific remedies  In LabMD , the court noted that the FTC's order "contain[ed] no prohibitions" but "command[ed] [the company] to overhaul and replace its data-security program to meet an indeterminable standard of reasonableness " The court concluded that such an order was unenforceable, reasoning that the order "effectually charge[d] the district court [enforcing the order] with managing the overhaul " The court further suggested that penalizing a company for failing to comply with an imprecise standard "may constitute a denial of due process" because it would not give the company fair notice of the prohibited conduct  Ultimately, while LabMD did not decide whether inadequate data security measures may be "unfair" under the FTC Act, the decision is nevertheless a potentially significant limitation on the FTC's ability to remedy such violations of the statute  LabMD is also a notable case because it adds to the relatively sparse case law on the FTC Act's "unfair or deceptive" prohibition  As mentioned, the large majority of the FTC enforcement actions are settled, with parties entering into consent decrees  To the extent FTC allegations are contested, the FTC may either commence administrative enforcement proceedings or civil litigation against alleged violators  In an administrative enforcement proceeding, an Administrative Law Judge (ALJ) hears the FTC's complaint and may issue a cease and desist order prohibiting the respondent from engaging in wrongful conduct  In civil litigation, the FTC may seek equitable relief, such as injunctions or disgorgement, when a party "is violating, or is about to violate," the FTC Act  The FTC may only seek civil penalties, however, if the party has violated a cease and desist order, consent decree, or a TRR  The FTC Act does not provide a private right of action, and it does not impose any criminal penalties for violations of Section 5  Similar to the FTC Act, the CFPA prohibits covered entities from engaging in certain unfair, deceptive, or abusive acts  Enacted in 2010 as Title X of the Dodd-Frank Wall Street Reform and Consumer Protection Act, the CFPA created the Consumer Financial Protection Bureau (CFPB) as an independent agency within the Federal Reserve System  The Act gives the CFPB certain "organic" authorities, including the authority to take any action to prevent any "covered person" from "committing or engaging in an unfair, deceptive, or abusive act or practice" (UDAAP) in connection with offering or providing a "consumer financial product or service " The CFPB's UDAAP authority under the CFPA is very similar to the FTC's UDAP authority under the FTC Act; indeed, the CFPA contains the same definition of "unfair" as in the FTC Act, and the CFPB has adopted the FTC's definition of "deceptive" acts or practices  However, there are several important differences  First, the CFPA's UDAAP prohibition includes "abusive" practices, as well as unfair or deceptive ones  An act or practice is abusive if it either (1) "materially interferes with the ability of a consumer to understand a term or condition of a consumer financial product or service" or (2) "takes unreasonable advantage of" a consumer's (a) lack of understanding, (b) inability to protect her own interest in selecting or using a consumer financial product or service, or (c) reasonable reliance on a covered person to act in her interest  While abusive conduct may also be unfair or deceptive, abusiveness is a separate standard that may cover additional conduct  Second, the CFPA prohibits UDAAPs only in connection with offering or providing a "consumer financial product or service " A product or service meets this standard if it is one of the specific financial product or services listed in the CFPA and is offered or provided to consumers primarily for personal, family, or household purposes  Lastly, the CFPA applies only to "covered persons" or "service providers " The statute defines "covered persons" as persons who offer or provide a consumer financial product or service, and it defines "service providers" as those who provide a "material service" to a "covered person" in connection with offering or providing a consumer financial product or service  As some commentators have noted, the CFPB could follow in the FTC's footsteps and use its UDAAP authority to regulate data protection  However, the CFPB has generally been inactive in the data privacy and security space  Indeed, to date, it has brought only one such enforcement action, which involved allegations that an online payment platform, Dwolla, Inc , made deceptive statements regarding its data security practices and the safety of its online payments system  To the extent it does use its authority, the CFPB has some powerful procedural advantages in comparison with the FTC  In particular, the CFPB can enact rules identifying and prohibiting particular UDAAP violations through the standard APA rulemaking process, whereas the FTC must follow the more burdensome Magnuson-Moss rulemaking procedures  Regarding enforcement, the CFPA authorizes the CFPB to bring civil or administrative enforcement actions against entities engaging in UDAAPs  Unlike the FTC, the CFPB can seek civil penalties in all such enforcement actions, as well as equitable relief such as disgorgement or injunctions  However, as with the FTC Act, the CFPA does not provide a private right of action that would allow adversely affected individuals to sue companies violating the Act  The statute also does not impose any criminal penalties for UDAAP violations  Adding to the complex federal patchwork of data protection statutes are the laws of the fifty states  First and foremost, major regulators of privacy and data protection in the states include the courts, via tort and contract law  With respect to tort law, in addition to the "privacy" causes of action that developed at the state level during the early 20th century (discussed above), negligence and other state tort law claims serve as a means to regulate businesses that are injured from data security issues or otherwise fail to protect their customers from foreseeable harm  Contracts, implied contracts, and other commercial causes of action can also form important bulwarks for privacy  The common law, however, is not perfect: it is subject to variability from state to state, and within states, from judge to judge and jury to jury  In addition to the common law, most states have their own statutory framework which may affect data protection and the use of data by private entities  For example, many states have a consumer protection law, sometimes prohibiting unfair or deceptive practices, often referred to as "little FTC Acts " These laws, like the FTC Act, are increasingly being used to address privacy matters  In addition, each state has passed a data breach response law, requiring some form of response or imposing liability on companies in the event of a breach of their data security  While an examination of every state data security law is beyond the scope of this report, at least one state has undertaken a general and ambitious effort to regulate data security  Specifically, the California Consumer Privacy Act (CCPA), enacted in 2018, has captured significant attention  Unlike the federal patchwork provisions, neither the method of data collection nor the industry that the business operates in limits the potential application of the CCPA  Instead, the CCPA applies to any company that collects the personal information of Californians, is for-profit, does business in California, and satisfies a basic set of thresholds  Analysts have suggested that these thresholds are low enough that the law could reach a considerable number of even "relatively small" businesses with websites accessible in California  The CCPA also does not distinguish between the sources of the data that comes within its scope  Rather, the CCPA regulates all "personal information," which, by the CCPA's definition, covers nearly any information a business would collect from a consumer  The law does not require the presence of any individual identifier, such as a name or address, for data to fall within the meaning of personal information  Rather, the CCPA broadly defines personal information as "information that identifies, relates to, describes, or is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household " Following this definition, the CCPA provides some telling illustrations of what constitutes personal information, including any "electronic network activity [such as] browsing history, search history, and information regarding a consumer's interaction with an Internet Web site, application, or advertisement" and "inferences drawn from any of" this information  The CCPA provides consumers with three main "rights " The first of these is a " right to know " the information that businesses have collected or sold about them  This right requires that businesses must, in advance of any collection, "inform [by mail or electronically] consumers as to the categories of personal information to be collected and the purposes" to which the information will be put  Second, the CCPA provides consumers with the " right to opt out " of the sale of a consumer's information  Under the new law, businesses must inform consumers of this right, and if a consumer so affirmatively opts out, the business cannot again sell the consumer's information unless the consumer subsequently provides the business express authorization  Finally, the CCPA gives consumers the right, in certain circumstances, to request that a business delete any information collected about the consumer (i e , " right to delete ")  Under the law, a business that receives such a request must delete the information collected and direct its "service providers" to do the same  The primary means to enforce the CCPA are actions brought by the California Attorney General  According to the statute, businesses that fail to provide the protections required by the CCPA and fail to cure those violations within 30 days are liable for civil penalties of up to $7,500 per violation  Penalties or settlements collected under the CCPA are to be deposited with the newly created Consumer Privacy Fund, the funds for which are used only to offset costs incurred in connection with the administration of the CCPA  While the CCPA provides for a private cause of action, allowing for individual and class action lawsuits against businesses, this cause of action is only available in the case of a consumer whose "nonencrypted or nonredacted personal information" is subject to "unauthorized access and exfiltration, theft, or disclosure" as a result of a failure to "implement and maintain reasonable security procedures " Further, such actions can be brought only if a consumer provides a business with 30 days' written notice and provides the business with opportunity to cure the violation, unless the consumer suffered actual pecuniary damages  The statute does not specify how a business could "cure" a violation of this type  Consumers may obtain damages under this section of no less than $100 and no more than $750 "per incident," or actual damages, whichever is greater, as well as injunctive relief  Statements by some Members of Congress during Congressional hearings have already noted the CCPA's likely importance to future federal legislative efforts  Further, some outside commentators have argued explicitly that the CCPA should be preempted by a future federal law  These statements may be motivated by the likely fact that, if left intact, the California law could shape industry and consumer concerns both inside and outside California  First, the law is likely to be the "first in a long line of similar pieces of legislation," all of which may model themselves after the CCPA, or will have to respond to its impact  Second, even though the statute is the product of a single state, its broad jurisdictional reach would bring companies throughout the United States and from around the world into its sweep  These factors combined are likely to make the CCPA important to federal legislators  Furthermore, some of the provisions of the California law could form a model for future federal regulation—although along those lines, another potential model it has to compete with is Europe's GDPR  In addition to U S  states like California, some foreign nations have enacted comprehensive data protection legislation  The EU, in particular, has long applied a more wide-ranging data protection regulatory scheme  Whereas privacy principles in the U S  Constitution focus on government intrusions into private life and U S  data privacy statutes generally are sector-specific, European privacy regulations have generally concerned any entity's accumulation of large amounts of data  As a result, foundational EU treaties provide individuals with a general right to "protection of personal data" from all potential interferences  The objective of the EU's most recent data privacy legislation—the GDPR—is to safeguard this right to personal data protection, while ensuring that data moves freely within the EU  Beginning in the 1970s, individual European countries began enacting broad, omnibus national statutes concerning data protection, privacy, and information practices  Although these domestic laws shared certain features, their differing data privacy and protection standards occasionally impeded the free flow of information between European countries  As a consequence, the EU attempted to harmonize its various national privacy laws by adopting an EU-wide data privacy and protection initiative—the 1995 Directive on the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data (Data Protection Directive)  While the Data Protection Directive applied on an EU-wide basis, EU law authorized each member-nation to implement the directive's requirements into the country's national law  By 2012, the European Commission—the executive body of the EU —came to view differing implementations of the Data Protection Directive at the national level as problematic  The Commission concluded that a single regulation should be developed in order to eliminate the fragmentation and administrative burdens created by the directive-based system  The Commission also sought to bring EU law up to date with developments in technology and globalization that changed the way data is collected, accessed, and used  In pursuit of these goals, the EU developed and adopted the GDPR, which replaced the 1995 Data Protection Directive and went into effect on May 25, 2018  The GDPR regulates the processing of personal data that meet its territoriality requirements, discussed below  Processing includes collection, use, storage, organization, disclosure or any other operation or set of operations performed on personal data, unless an exception applies  Personal data is defined as any information relating to an identified or identifiable person, and it can include names, identification numbers, location data, IP addresses, cookies, and any other information through which an individual can be directly or indirectly identified  The GDPR applies different requirements for controllers and processors of personal data  In general, a controller determines the purposes and means of processing personal data, and a processor is responsible for processing data on behalf of a controller  From a territorial perspective, the GDPR applies to organizations that have an "establishment" in the EU and that process personal data in the context of the activities of that establishment  The GDPR does not define "establishment," but states that it "implies the effective and real exercise of activity through stable arrangements " In a pre-GDPR case, the Court of Justice of the European Union stated that the concept of establishment under the 1995 Data Protection Directive extended "to any real and effective activity—even a minimal one—exercised through stable arrangements " Entities that meet the establishment requirement are subject to the GDPR even if their data processing activities take place outside the EU  The GDPR also applies to non-EU-established entities that offer goods or services to individuals in the EU or monitor individuals' behavior in the EU  Because many businesses with an online presence offer goods and services to EU individuals, the GDPR applies to many businesses outside the EU  The GDPR lays out seven guiding principles for the processing of personal data  While these principles are not "hard and fast rules" themselves, they inform the interpretation of the GDPR and its more concrete requirements, discussed below  The GDPR requires data controllers and processors to have a lawful basis to process personal data  The regulation delineates six possible legal bases: (1) consent; (2) performance of contract; (3) compliance with a legal obligations; (4) protection of the "vital interests" (i e , the life) of the data subject or another individual; (5) tasks carried out in the public interest (e g , by a government entity); and (6) the "legitimate interests" of the controller or a third party, unless the fundamental rights and freedom of the data subject override those interests  Commentators describe the "legitimate interests" category as the most flexible and as the potential basis for a host of common activities, such as processing carried out in the normal course of business, provided that the processing is not unethical, unlawful, or otherwise illegitimate  When data processing is premised on consent, the consent must be freely given, specific, informed, and unambiguous, and it can be withdrawn at any time  Additional consent requirements and restrictions apply to especially sensitive data, such as children's information and data that reveals ethnic origins, political opinions, religious beliefs, union status, sexual orientation, health information, and criminal histories  The GDPR provides a series of rights to individuals and corresponding obligations for data controllers, unless an exception applies  The GDPR requires organizations to implement a range of measures designed to ensure and demonstrate that they are in compliance with the regulation  When proportionate in relation to the processing activities, such measures may include adopting and implementing data protection policies and taking a "data protection by design and default" approach whereby the organization implements compliance measures into all stages of data processing  Measures may also include the following: establishing GDPR-conforming contracts with data processors; maintaining records of processing activities; conducting impact assessments on personal data use that is likely to risk individual rights and freedoms; appointing a data protection officer; and adhering to relevant codes of conduct and compliance certification schemes  The GDPR also requires controllers and processors to implement technical and organizational measures to ensure a level of data security that is "appropriate to the risk" presented by the data processing  In implementing data security measures, organizations must consider the "state of the art, the costs of implementation," the nature, scope, and context, and purposes of processing, and the likelihood and potential severity of an infringement on individual rights if data security were to be violated  The GDPR does not impose a "one-size-fits-all" requirement for data security, and security measures that are "appropriate" (and therefore mandatory) will depend on the specific circumstances and risks  For example, a company with an extensive network system that holds a large amount of sensitive or confidential information presents greater risk, and therefore must install more rigorous data security protections than an entity that holds less data  When appropriate, organizations should consider encryption and pseudonymization —the processing of personal data such that the data can no longer be attributed to a specific individual  Security measures should ensure the confidentiality, integrity, and resilience of processing systems; be able to restore access to personal data in the event of an incident; and include a process for testing security effectiveness  In the event of a personal data breach, the GDPR requires controllers to notify the designated EU government authority "without undue delay" and no later than 72 hours after learning of the breach, unless the breach is "unlikely to result in a risk to the rights and freedoms of natural persons " For example, whereas a company must report the theft of a customer database that contains information that could be used for future identity fraud given the high level of risk to individuals, it may not need to report the loss of more innocuous data, such as a directory of staff office phone numbers  When notification to the government is required, the notification must describe the nature and likely consequences of the breach, identify measures to address the breach, and identify the employee responding to the incident  When data processors experience a breach, they must notify the controller without undue delay  In addition to governmental notification, controllers must notify the individuals whose data has been compromised if the breach is likely to result in a "high risk to the rights and freedoms" of individuals  The "high risk" threshold is higher than the threshold for notifying the government authority, but it could met in circumstances when individuals may need to take steps to protect themselves from the effects of a data breach  According to the United Kingdom's data protection regulatory authority, for example, a hospital that disclosed patient medical records as a result of a data breach may present a "high risk" to individuals, but a university that accidentally deleted, but was able to re-create, an alumni contact information database may not meet the mandatory individual reporting threshold  Notification to the individual must describe the breach in clear and plain language and contain at least the same information as provided in the governmental notifications  Notification to the individual is not required in the following cases: the controller implemented appropriate technical and organizational protection measures, such as encryption, that will render the data unintelligible; the controller took subsequent measures that will ensure that the high risk to individual rights and freedom are no longer likely to materialize; or individual notifications would involve disproportionate efforts, in which case the controller must provide public notice of the breach  Regardless of whether notification is required, controllers must document all data breaches so that government supervisory authorities can verify compliance at a later date  The EU has long regulated the transfer of data from EU member states to foreign countries, and the GDPR continues to restrict such international data transfers  Like the 1995 Data Protection Directive, the GDPR authorizes data transfer from within the EU to a non-EU country if the receiving country ensures an adequate level of protection for personal data  To meet this requirement, the non-EU country must offer a level of protection that is "essentially equivalent to that ensured" by the GDPR  If the European Commission previously made an adequacy decision under the Data Protection Directive's legal framework, that decision remains in force under the GDPR  U S  and EU officials previously developed a legal framework—the U S -EU Privacy Shield—for protecting transatlantic data flow into the United States  Under the Privacy Shield framework, U S -based organizations self-certify to the International Trade Administration in the Department of Commerce that they will comply with the framework's requirements for protecting personal data by complying with, among other provisions, notice requirements, data retention limits, security requirements, and data processing purpose principles  In 2016, the European Commission concluded that the Privacy Shield framework provided adequate protections under the Data Protection Directive  That adequacy determination continues to apply under the GDPR, although the European Commission annually reviews whether the Privacy Shield framework continues to provide an adequate level of protection  In the absence of an adequacy decision from the European Commission, the GDPR permits data transfers outside the EU when (1) the recipient of the data has itself established appropriate safeguards , and (2) effective legal remedies exist for individuals to enforce their data privacy and protection rights  Appropriate safeguards include: a legally binding agreement between public authorities or bodies; binding corporate rules; standard contract clauses adopted by the European Commission; and approved codes of conduct and certification mechanisms  U S  companies that do not participate in Privacy Shield often must rely on standard contract clauses to be able to receive data from the EU  The GDPR also identifies a list of circumstances in which data may be transferred outside the EU even without appropriate safeguards or an adequacy decision  These circumstances include, among other reasons, when: an individual has provided informed consent; transfer is necessary for the performance of certain contracts involving the data subject; or the transfer is necessary for important reasons of public interests  One of the most commented-upon aspects of the GDPR is its high ceiling for administrative fines  For the most serious infractions of the GDPR, regulatory bodies within individual EU countries may impose fines up to 20 million euro (approximately $22 million) or 4% of global revenue, whichever is higher, for certain violations of the GDPR  The GDPR also provides tools for individuals to enforce compliance with its terms  Individuals whose personal data is processed in a way that does not comport with the GDPR may lodge a complaint with regulatory authorities  Individuals also have the right to an "effective judicial remedy" (i e , to pursue a lawsuit) against the responsible data processor or controller, and individuals may obtain compensation for their damages from data processors or controllers  The GDPR may be relevant to the 116th Congress' consideration of data protection initiatives in several ways  Because the GDPR applies to U S  companies that offer goods and services to individuals in the EU, many U S  companies have developed new data protection practices in an effort to comply with its requirements  Other businesses reported that they withdrew from the European market rather than attempt to obtain compliance GDPR  For those companies that remained in the European market, some have stated that they will apply their GDPR-compliant practices on a company-wide basis rather than changing their model only when doing business in the EU  Consequently, the GDPR already directly impacts the data protection practices of some U S  companies  The GDPR also has served as a prototype for comprehensive data protection legislation in other governments  For example, commentators have described China's Personal Information Security Specification, which defines technical standards related to the collection, storage, use, transfer, and disclosure of personal information, as modeled on the GDPR  And the CCPA includes elements similar to the GDPR, such as an enumeration of individual rights related to data privacy  If this trend continues, GDPR-like data protection laws may become more commonplace internationally  Finally, some argue that Congress should consider enacting comprehensive federal data protection legislation similar to the GDPR  As discussed below, however, other observers and some officials in the Trump Administration have criticized the GDPR, describing the regulation as overly prescriptive and likely to result in negative unintended consequences  Regardless of the merits of these positions, the GDPR may remain a focal point of discussion in the debate over whether the United States should develop a more comprehensive data protection policy  Although some commentators argue that the federal government should supplement the current patchwork of federal data protection laws with more comprehensive legislation modeled on the CCPA or GDPR, some Trump Administration officials have criticized these legislative approaches and questioned whether they will improve data privacy outcomes  The Administration has argued that many comprehensive data privacy models have resulted in "long, legal, regulator-focused privacy policies and check boxes, which only help a very small number of users[ ]" Rather than pursuing a prescriptive model in which the government defines (or prescribes) data protection rules, the Trump Administration advocates for what it describes as an outcome-based approach whereby the government focuses on the "outcomes of organizational practices, rather than on dictating what those practices should be " In September 2018, the National Telecommunications and Information Administration (NTIA) in the Department of Commerce issued a request for public comments on the Trump Administration's efforts to develop an outcome-based approach to advancing consumer privacy that also protects prosperity and innovation  According to NTIA, changes in technology have led consumers to conclude that they are losing control over their personal information, while at the same time that foreign and state privacy laws have led to a fragmented regulatory landscape that disincentives innovation  Accordingly, NTIA is attempting to develop a set of "user-centric" privacy outcomes and goals that would underpin the protections that should be produced by any federal actions related to consumer privacy  NTIA's proposed policy focuses on a set of outcomes that the Trump Administration seeks to achieve: In addition to identifying desired outcomes, NTIA's request for public comments states that the Trump Administration is in the process of developing "high-level goals for Federal action" related to data privacy  NTIA's proposed privacy framework shares certain elements of prescriptive legal regimes like the GDPR and CCPA  Common features include a right to withdraw consent to certain uses of personal data; accountability for third-party vendors and servicers; and a right to access, amend, complete, correct, or delete personal data  But NTIA's request for public comments does not specifically describe how the Trump Administration intends to accomplish its outcomes and goals  Instead, it states that NTIA "understand[s] that there is considerable work to be done to achieve" the identified objectives  The comment period closed on November 9, 2018, and NTIA received input from more than 200 individuals and entities  The debate over whether Congress should consider federal legislation regulating data protection implicates numerous legal variables and options  "Data protection" itself is an expansive concept that melds the fields of data privacy (i e , how to control the collection, use, and dissemination of personal information) and data security (i e , how to protect personal information from unauthorized access or use and respond to such unauthorized access or use)  There is no single model for data protection legislation in existing federal, state, or foreign law  For example, some state laws focus solely on data security or address a particular security concern, such as data breach notifications  Other state laws isolate a single privacy-related issue, such as the transparency of data brokers—companies that aggregate and sell consumers' information, but that often do not have a direct commercial relationship with consumers  Recent data protection laws such as the CCPA and GDPR appear to indicate a trend toward combining data privacy and security into unified legislative initiatives  These unified data protection paradigms typically are structured on two related features: (1) an enumeration of statutory rights given to individuals related to their personal information and (2) the creation of legal duties imposed on the private entities that possess personal information  The specific list and nature of rights and duties differ depending on the legislation, and some have proposed to define new rights in federal legislation that do not have a clear analog in existing state or foreign law  Consequently, at present, there is no agreed-upon menu of data protection rights and obligations that could be included in federal legislation  Although data protection laws and proposals are constantly evolving, some frequently discussed legal rights include: the right to know what personal data is being collected, used, and disseminated, and how those activities are occurring; the right to control the use and dissemination of personal data, which may include the right to opt out or withhold consent to the collection or sharing of such data; the right to review personal data that has been collected and to delete or correct inaccurate information; the right to obtain a portable copy of personal data; the right to object to improper activities related to personal data; and the right to learn when a data breach occurs; Commonly discussed obligations for companies that collect, use, and disseminate personal data include rules defining: how data is collected from individuals; how companies use data internally; how data is disseminated or disclosed to third parties; what information companies must give individuals related to their data; how data is kept secure; when breaches of security must be reported; the accuracy of data; and reporting requirements to ensure accountability and compliance  Whether to enact federal data protection legislation that includes one or more of these rights and obligations has been the subject of a complex policy debate and multiple hearings in recent Congresses  Part of the legislative debate concerns how to enforce such rights and obligation and raises questions over the role of federal agencies, state attorneys general, and private citizen suits  In addition, some elements of the data protection proposals and models could implicate legal concerns and constitutional limitations  While the policy debate is outside the scope of this report, the following sections discuss legal considerations relevant to federal data protection proposals that the 116th Congress may choose to consider  These sections begin by analyzing legal issues related to the internal structure and definition of data protection-related rights and obligations and then move outward toward an examination of external legal constraints  A primary conceptual point of debate concerning data protection legislation is whether to utilize the so-called "prescriptive" method or an "outcome-based" approach to achieve a particular law's objectives  Under the prescriptive approach, the government defines data protection rules and requires regulated individuals and entities to comply with those rules  Both the GDPR and CCPA use a prescriptive approach, and some legislation proposed in the 116th Congress would use this method by delineating certain data protection requirements  The Trump Administration, however, has argued that a prescriptive approach can stymie innovation and result in compliance checklists without providing measurable privacy benefits  As an alternative methodology, the Administration advocated for what it described as an outcome-based approach whereby the government focuses on the outcomes of organizational practices, rather than defining the practices themselves  Some federal information technology laws, such as the Federal Information Security Management Act (FISMA), use an outcome-oriented approach to achieve federal objectives, although agency implementation of such laws may become prescriptive in nature  The Administration has not specified how it intends to achieve its desired data protection goals without prescribing data protection rules, but additional direction appears to be forthcoming, according to the NTIA's request for public comment  Another issue that may be considered in crafting federal data protection policy is how to define the contours of the data that the federal government proposes to protect or the specific entities or industries that it proposes to regulate  The patchwork of existing data protection statutes define protected information in a variety of ways, many of which depend on the context of the law  For example, HIPAA is limited to "protected health information" and GLBA governs "financial information" that is personally identifiable but not publicly available  By contrast, GDPR and CCPA regulate all "personal" information—a term defined in both laws as information that is associated with a particular individual or is capable of being associated with an individual  Some federal data proposals would apply a similar scope to those of the GDPR and CCPA  If enacted, such broad data protection laws have the potential to create multiple layers of federal data protection requirements: (1) general data protection requirements for "personal" information and (2) sector-specific requirements for data regulated by the existing "patchwork" of data protection laws  Other legislative proposals have sought to avoid dual layers of regulations by stating that the proposed data protection requirements would not apply to individuals or entities covered by certain existing federal privacy laws  Agency enforcement is another key issue to consider when crafting any future federal data protection legislation  As discussed, under the current patchwork of federal data protection laws, there are multiple federal agencies responsible for enforcing the myriad federal statutory protections, such as the FTC, CFPB, FCC, and HHS  Of these agencies, the FTC is often viewed—by industry representatives, privacy advocates, and FTC commissioners themselves —as the appropriate primary enforcer of any future national data protection legislation, given its significant privacy experience  There are, however, several relevant legal constraints on the FTC's enforcement authority  First, the FTC generally lacks the ability to issue fines for first-time offenses  In UDAP enforcement actions, the FTC may issue civil penalties only in certain limited circumstances, such as when a person violates a consent decree or a cease and desist order  Consequently, the FTC often enters into consent decrees addressing a broad range of conduct, such as a company's data security practices, seeking penalties for violations of those decrees  However, as the LabMD case discussed earlier in this report suggests, if the FTC imposes penalties based on imprecise legal standards provided in a rule or order, the Due Process Clause of the Fifth Amendment may constrain the agency's authority  Second, the plain text of the FTC Act deprives the FTC of jurisdiction over several categories of entities, including banks, common carriers, and nonprofits  Third, the FTC generally lacks authority to issue rules under the APA's notice-and-comment process that is typically used by agencies to issue regulations  Rather, the FTC must use a more burdensome—and, consequently, rarely used—process under the Magnuson-Moss Warranty Act  As some FTC Commissioners and commentators have noted, these legal limitations may be significant in determining the appropriate federal enforcement provisions in any national data security legislation  While Congress may not be able to legislate around constitutional constraints, future legislation could address some of these limitations—for instance, by allowing the FTC to seek penalties for first-time violations of rules, expanding its jurisdictions to include currently excluded entities, or providing the FTC notice-and-comment rulemaking authority under the APA  These current legal constraints on FTC authority may also be relevant in determining whether national legislation should allow private causes of action or enforcement authority for state attorneys general, as some commentators have suggested that private causes of action and enforcement by state attorneys general are essential supplements to FTC enforcement  Legislation involving privacy may propose to allow individuals to seek private remedy for violations in the courts  Congress may seek to establish a private right of action allowing a private plaintiff to bring an action against a third party based directly on that party's violation of a public statute  As it has done with many sector-specific privacy laws, Congress, in a data protection statute, could provide not only for this right, but also for specific remedies beyond compensatory damages, such as statutory damages or even treble damages for injured individuals  However, it may be very difficult to prove that someone has been harmed in a clear way by many of the violations that might occur under a hypothetical data protection and privacy regime  Victims of data breaches and other privacy violations, generally speaking, do not experience clear and immediate pecuniary or reputational harm  This obstacle might threaten not only a consumer's ability to obtain monetary relief, but also could run up against the limits of the federal courts' "judicial power" under Article III of the U S  Constitution  Article III extends the judicial power of the federal courts to only "cases" and "controversies " As part of that limitation, the Supreme Court has stated that courts may adjudicate a case only where a litigant possesses Article III standing  A party seeking relief from a federal court must establish standing  Specifically, the party must show that he has a genuine stake in the relief sought because he has personally suffered (or will suffer): (1) a concrete, particularized and actual or imminent injury; (2) that is traceable to the allegedly unlawful actions of the opposing party; and (3) that is redressable by a favorable judicial decision  These requirements, particularly the requirement of "imminence," form significant barriers for lawsuits based on data protection  Imminence, according to the Supreme Court in Clapper v  Amnesty International , requires that alleged injury be " certainly impending " to constitute injury-in-fact  Speculation and assumptions cannot be the basis of standing  This reasoning has caused courts to dismiss data breach claims where plaintiffs cannot show actual misuse of data, but can only speculate that future thieves may someday cause them direct harm  These requirements are constitutional in nature and apply regardless of whether a statute purports to give a party a right to sue  This constitutional requirement limits Congress' ability to use private rights of action as an enforcement mechanism for federal rights, as the recent Supreme Court case Spokeo, Inc  v  Robins illustrates  Spokeo involved a Federal Credit Reporting Act (FCRA) lawsuit brought by Thomas Robins against a website operator that allowed users to search for particular individuals and obtain personal information harvested from a variety of databases  Robins alleged that Spokeo's information about him was incorrect, in violation of the FCRA requirement that consumer reporting agencies "follow reasonable procedures to assure maximum possible accuracy" of consumer reports  As discussed earlier in this report, FCRA provides for a private right of action making any person who willfully fails to comply with its requirements liable to individuals for, among other remedies, statutory damages  The lower court understood that Robins did not specifically allege any actual damages he had suffered, such as the loss of money resulting from Spokeo's actions  Nonetheless, the court concluded that the plaintiff had standing to seek statutory damages because his injury was sufficiently particular to him—FCRA had created a statutory right for Robins and his personal interest was sufficient for standing  The Supreme Court disagreed with the lower court, however, explaining that the lower court had erred by eliding the difference between Article III's "concreteness" and "particularization" requirements  Specifically, the Court concluded that a plaintiff must demonstrate a concrete injury separate from a particularized injury, meaning that plaintiffs must show that their injury "actually exist[s] " While tangible injuries, like monetary loss, are typically concrete, a plaintiff with an "intangible injury" must show that it is "real" and not "abstract" in order to demonstrate concreteness  For example, the Spokeo Court suggested that the mere publication of an incorrect zip code, although it could violate FCRA, would not be a sufficiently concrete injury for standing purposes  As a result, the Court remanded the case to the lower court to determine if the injury alleged in the case was both particularized and concrete  Spokeo does not eliminate Congress' role in creating standing where it might not otherwise exist  The Supreme Court explained that the concreteness requirement is "grounded in historical practice" and, as a result, Congress' judgment on whether an intangible harm is sufficiently concrete can be "instructive " However, as Spokeo explained, Congress cannot elevate every privacy violation to the status of a concrete injury  Both before and after Spokeo , the lower courts have resolved standing disputes in lawsuits involving privacy and data protection, where parties argue about whether particular injuries are sufficiently concrete for purpose of Article III  Congress can possibly resolve some of these disputes by elevating some otherwise intangible injuries to concrete status  But Spokeo illustrates that there may be a residuum of harmless privacy violations for which Congress cannot provide a judicial remedy  Another legal issue Congress may need to consider with respect to any federal program involving data protection and privacy is how to structure the federal-state regime—that is, how to balance whatever federal program is enacted with the programs and policies in the states  Federal law, under the Supremacy Clause, has the power to preempt or displace state law  As discussed above, there are a host of different state privacy laws, and some states have begun to legislate aggressively in this area  The CCPA in particular represents a state law that is likely to have a national effect  Ultimately, unless Congress chooses to occupy the entire field of data protection law, it is likely that the state laws will end up continuing to have a role in this area  Further, given that the states are likely to continue to experiment with legislation, the CCPA being a prime example, it is likely that preemption will be a highly significant issue in the debate over future federal privacy legislation  As the Supreme Court has recently explained, preemption can take three forms: "conflict," "express," and "field " Conflict preemption requires any state laws that conflict with a valid federal law to be without effect  Conflict preemption can occur when it is impossible for a private party to simultaneously comply with both federal and state requirements, or when state law amounts to an obstacle to the accomplishment of the full purposes of Congress  Express preemption occurs when Congress expresses its intent in the text of the statute as to which state laws are displaced under the federal scheme  Finally, field preemption occurs when federal law occupies a 'field' of regulation "so comprehensively that it has left no room for supplementary state legislation " Ultimately, the preemptive scope of any federal data protection legislation will turn on the "purpose" of Congress and the specific language used to effectuate that purpose  If Congress seeks to adopt a relatively comprehensive system for data protection, perhaps the most obvious means to preempt a broad swath of state regulation would be to do so "expressly" within the text of the statute by including a specific preemption provision in the law  For example, several existing federal statutes expressly preempt all state law that "relate to" a particular subject matter  The Supreme Court has held that this "related to" language encompasses any state law with a "connection with, or reference to" the subject matter referenced  Similar language can be used to displace all state laws in the digital data privacy sphere to promote a more uniform scheme  Congress could alternatively take a more modest approach to state law  For example, Congress could enact a data protection framework that expressly preserves state laws in some ways and preempts them in others  A number of federal statutes preempt state laws that impose standards "different from" or "in addition to" federal standards, or allow the regulator in charge of the federal scheme some authority to approve certain state regulations  These approaches would generally leave intact state schemes parallel to or narrower than the federal scheme  For example, a statute could permit a state to provide for additional liability or different remedies for violation of a federal standard  Congress could do the same with federal data protection legislation, using statutory language to try to ensure the protection of the provisions of state law that it sought to preserve  Although legislation on data protection could take many forms, several approaches that would seek to regulate the collection, use, and dissemination of personal information online may have to confront possible limitations imposed by the First Amendment of the U S  Constitution  The First Amendment guarantees, among other rights, "freedom of speech " Scholars have split on how the First Amendment should be applied to proposed regulation in the data protection sphere  In one line of thinking, data constitutes speech, and regulation of this speech, even in the commercial context, should be viewed skeptically  Other scholars have argued that an expansive approach would limit the government's ability to regulate ordinary commercial activity, expanding the First Amendment beyond its proper role  This scholarly debate informs the discussion, but does not provide clear guidance on how to consider any particular proposed regulation  The Supreme Court has never interpreted the First Amendment as prohibiting all regulation of communication  Instead, when confronting a First Amendment challenge to a regulation, a court asks a series of questions in order to determine whether a particular law or rule runs afoul of the complicated thicket of case law that has developed in this area  The first question courts face when considering a First Amendment challenge is whether the challenged regulation involves speech or mere non-expressive conduct  As the Supreme Court has explained, simply because regulated activity involves "communication" does not mean that it comes within the ambit of the First Amendment  Where speech is merely a "component" of regulated activity, the government generally can regulate that activity without inviting First Amendment scrutiny  For example, "a law against treason…is violated by telling the enemy the Nation's defense secrets," but that does not bring the law within the ambit of First Amendment scrutiny  Assuming the regulation implicates speech rather than conduct, it typically must pass First Amendment scrutiny  However, not all regulations are subject to the same level of scrutiny  Rather, the Court has applied different tiers of scrutiny to different types of regulations  For example, the Court has long considered political and ideological speech at the "core" of the First Amendment—as a result, laws which implicate such speech generally are subject to strict scrutiny  Pursuant to this standard, the government must show that such laws are narrowly tailored to serve a compelling state interest  By contrast, the Court has historically applied less rigorous scrutiny to laws regulating "commercial speech " Commercial speech is subject to a lower level of scrutiny known as the Central Hudson test, which generally requires the government to show only that its interest is "substantial" and that the regulation "directly advances the governmental interest asserted" without being "more extensive than necessary to serve that interest " These principles have provided general guidance to lower courts in deciding cases that intersect with data protection, but implicit disagreements between these courts have repeatedly demonstrated the difficulty in striking the balance between First Amendment interests and data-protection regulation  For example, in 2001 in Trans Union Corp  v  FTC , the D C  Circuit upheld an FTC order that prohibited Trans Union from selling marketing lists containing the names and addresses of individuals  The court assumed that disclosing or using the marketing lists was speech, not conduct, but concluded that the FTC's restrictions on the sale of the marketing lists generally concerned "no public issue," and, as such, was subject to "reduced constitutional protection " The court derived its "no public issue" rule from the Supreme Court's case law on defamation, which generally views speech that is solely in the private interest of the speaker as being subject to lower First Amendment protection from defamation suits than speech regarding matters of a public concern  Applying this "reduced constitutional protection" to the context of Trans Union's marketing lists, the court determined that the regulations were appropriately tailored  While the Trans Union court did not cite to Central Hudson , other courts have gone on to apply similar reasoning to uphold data protection laws from constitutional challenge under the ambit of Central Hudson 's commercial speech test  In contrast with the relatively lenient approach applied to a privacy regulation in Trans Union , in U S  West v  FCC , the Tenth Circuit struck down FCC regulations on the use and disclosure of Consumer Proprietary Network Information (CPNI)  The regulations stated that telecommunications carriers could use or disclose CPNI only for the purpose of marketing products to customers if the customer opted in to this use  The court determined that these provisions regulated commercial speech because they limited the ability of carriers to engage in consumer marketing  Applying Central Hudson , the court held that although the government alleged a general interest in protecting consumer privacy, this interest was insufficient to justify the regulations  The panel ruled that the regulations did not materially advance a substantial state interest because the government failed to tie the regulations to specific and real harm, supported by evidence  The court also concluded that a narrower regulation, such as a consumer opt-out, could have served the same general purpose  After the Tenth Circuit's decision in U S  West , the FCC responded by making minor changes to its regulations, maintaining some elements of the opt-in procedure for the use of CPNI and reissuing them with a new record  After this reissuance, the D C  Circuit considered these modified-but-similar regulations in a 2009 case  In that case, the D C  Circuit upheld the regulations without attaching much significance to the FCC's changes, and apparently implicitly disagreeing with the Tenth Circuit about both the importance of the privacy interest at stake and whether the opt-in procedure was proportional to that interest  The Supreme Court's first major examination of the First Amendment in this context came in 2011  That year, the Court decided Sorrell v  IMS Health, Inc  , a case that is likely to be critical to understanding the limits of any future data protection legislation  In Sorrell , the Court considered the constitutionality of a Vermont law that restricted certain sales, disclosures, and uses of pharmacy records  Pharmaceutical manufacturers and data miners challenged this statute on the grounds that it prohibited them from using these records in marketing, thereby imposing what they viewed to be an unconstitutional restriction on their protected expression  Vermont first argued that its law should be upheld because the "sales, transfer, and use of prescriber-identifying information" was mere conduct and not speech  The Court explained that, as a general matter, "the creation and dissemination of information are speech within the meaning of the First Amendment," and thus there was "a strong argument that prescriber identifying information is speech for First Amendment purposes " Ultimately, however, the Court stopped short of fully embracing this conclusion, merely explaining that it did not matter whether the actual transfer of prescriber-identifying information was speech because the law nonetheless impermissibly sought to regulate the content of speech—the marketing that used that data, as well as the identities of speakers—by regulating an input to that speech  As the Court explained, the Vermont law was like "a law prohibiting trade magazines from purchasing or using ink " Second, Vermont argued that, even if it was regulating speech, its regulations passed the lower level of scrutiny applicable to commercial speech  The Court disagreed  The Court explained that the Vermont law enacted "content- and speaker-based restrictions on the sale, disclosure and use of prescriber identifying information" because it specifically targeted pharmaceutical manufacturers and prohibited certain types of pharmaceutical marketing  As the Court stated in a previous case, "[c]ontent-based regulations are presumptively invalid" because they "raise[] the specter that the Government may effectively drive certain ideas or viewpoints from the marketplace " Further, the Sorrell Court observed that the legislature's stated purpose was to diminish the effectiveness of marketing by certain drug manufacturers, in particular those that promoted brand-name drugs, suggesting to the Court that the Vermont law went "beyond mere content discrimination, to actual viewpoint discrimination " As a result, the Court concluded that some form of "heightened scrutiny" applied  Nevertheless, the Court reasoned that, even if Central Hudson 's less rigorous standard of scrutiny applied, the law failed to meet that standard because its justification in protecting physician privacy was not supported by the law's reach in allowing prescriber-identifying information's use "for any reason save" marketing purposes  Most of the lower courts outside the data protection and privacy context that have considered Sorrell have held that Sorrell 's reference to "heightened scrutiny" did not override the Central Hudson test in commercial speech cases, even where those cases include content- or speaker- based restrictions  Others, however, have held that content- and speaker-based restrictions must comport with something more rigorous than the traditional Central Hudson test, but it is not clear what this new standard requires or where it leads to a different outcome than Central Hudson   As a result, while Sorrell 's impact on privacy and data protection regulation has been considered by a few courts, no consensus exists on the impact it will have  However, a few commentators have observed that the case will likely have an important effect on the future of privacy regulation, if nothing else, by having all but concluded that First Amendment principles apply to the regulation of the collection, disclosure, and use of personally identifiable information as speech, not conduct  With respect to such future regulation, policymakers will likely want, at the minimum, to meet the Central Hudson requirement of ensuring that any restrictions on the creation, disclosure or use of information are justified by a substantial interest and that the regulations are no more extensive than necessary to further that interest  To illustrate, the Court in Sorrell identified HIPAA as a permissible "privacy" regulation because it allowed "the information's sale or disclosure in only a few narrow and well-justified circumstances " This dictum suggests that Congress is able to regulate in the data protection sphere as long as it avoids the pitfalls of the law in Sorrell   However, it may not always be easy to determine whether any given law involves speaker or content discrimination  In Sorrell itself, for instance, three dissenting Justices argued that the content and speaker discrimination that took place under the Vermont law was inevitable in any economic regulation  As a result, resolving these issues as data privacy legislation becomes more complex is likely to create new challenges for legislators  The current legal landscape governing data protection in the United States is complex and highly technical, but so too are the legal issues implicated by proposals to create unified federal data protection policy  Except in extreme incidents and cases of government access to personal data, the "right to privacy" that developed in the common law and constitutional doctrine provide few safeguards for the average internet user  Although Congress has enacted a number of laws designed to augment individual's data protection rights, the current patchwork of federal law generally is limited to specific industry participants, specific types of data, or data practices that are unfair or deceptive  This patchwork approach also extends to certain state laws  Seeking a more comprehensive data protection system, some governments—such as California and the EU—have enacted wide-ranging laws regulating many forms of personal data  Some argue that Congress should consider creating similar protections in federal law, but others have criticized the EU's and California's approach to data protection  Should the 116th Congress consider a comprehensive federal data protection program, its legislative proposals may involve numerous decision points and legal considerations  An initial decision point is the scope and nature of any legislative proposal  There are numerous data protection issues that could be addressed in any future legislation, and different possible approaches for addressing those issues (such as using a "prescriptive" or "outcome-based" approach)  Other decision points may include defining the scope of any protected information and determining the extent to which any future legislation should be enforced by a federal agency  Further, to the extent Congress wants to allow individuals to enforce data protection laws and seek remedies for the violations of such laws in court, it must account for Article III's standing requirements  Under the Supreme Court's 2016 Spokeo Inc  v  Robins decision, plaintiffs must experience more than a "bare procedural violation" of a federal privacy law to satisfy Article III and to sue to rectify a violation of that law  Federal preemption also raises complex legal questions—not only of whether to preempt state law, but what form of preemption Congress should employ  Finally, from a First Amendment perspective, Supreme Court jurisprudence suggests that while some "privacy" regulations are permissible, any federal law that restricts protected speech, particularly if it targets specific speakers or content, may be subject to more stringent review by a reviewing court 


Report 2:  The national limits were set at a percentage (74%) of the median of all local fee schedule amounts for each laboratory test code; therefore, fee schedule amounts may differ by region  In general, annual increases in clinical lab fees have been based on the percentage change in the CPI-U  However, since 1987, Congress has specified lower updates  Beginning in 2014, with certain exceptions, laboratory tests provided in hospital outpatient departments are no longer paid separately under the CLFS and are instead included in the OPPS payments  PAMA introduced a new method for determining clinical laboratory payments and required CMS to base Medicare CLFS reimbursement on reported private insurance payment amounts  Medicare has been using weighted median private insurer rates to calculate Medicare payment rates for laboratory tests paid under the CLFS since January 1, 2018  These payment rates are national and do not vary by geographic area  Part B also covers diagnostic nonlaboratory x-ray tests and other diagnostic tests, as well as x-ray, radium, and radioisotope therapy  Generally, these services are paid for under the physician fee schedule, with beneficiaries responsible for a 20% coinsurance payment  Medicare covers a wide variety of equipment and devices under the heading of durable medical equipment (DME), prosthetics, and orthotics (PO) if they are medically necessary and are prescribed by a physician  DME is defined as equipment that (1) can withstand repeated use, (2) has an expected life of at least three years (effective for items classified as DME after January 1, 2012), (3) is used primarily to serve a medical purpose, (4) is not generally useful in the absence of an illness or injury, and (5) is appropriate for use in the home  DME includes such items as hospital beds, wheelchairs, blood glucose monitors, and oxygen and oxygen equipment  It also includes related supplies (S), such as drugs and biologics that are necessary for the effective use of the product  Prosthetics (P) are items that replace all or part of a body organ or its function, such as colostomy bags, pacemakers, and artificial eyes, arms, or legs  Orthotics (O) are braces that support a weak or deformed body member, such as leg or back braces  Except in competitive bidding areas (CBAs, described below), Medicare pays for most durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS) based on fee schedules  Medicare pays 80% of the lower of the supplier's charge for the item or the fee schedule amount  The beneficiary is responsible for the remaining 20%  In general, fee schedule amounts are updated each year by a (1) measure of price inflation, and (2) a measure of economy-wide productivity, which may result in lower fee schedule amounts from one year to the next  Since 2016, the fee schedule rates that applied outside of competitive bidding areas for certain DMEPOS have been reduced based on price information from the competitive bidding program  The reductions were phased in during 2016, and fully phased in starting in January 2017  In response to concerns that the adjusted rates were too low, the Secretary again applied the phase-in rate for rural and noncontiguous areas not subject to competitive bidding starting in June 2018  Currently, two different fee schedules apply outside of CBAs  First, in rural or noncontiguous areas, the fee schedule is a 50/50 blend of the fee schedule with and without the reductions based on information from competitive bidding (i e , the phase-in methodology)  Second, in nonrural and contiguous areas, the fee schedule amounts are fully adjusted by information from the competitive bidding program  Numerous studies and investigations indicated that Medicare paid more for certain items of DME and PO than some other health insurers and some retail outlets  Such overpayments were attributed, in part, to the fee schedule mechanism of payment  MMA required the Secretary to establish a Competitive Acquisition Program for certain DMEPOS in specified areas  Instead of paying for medical equipment based on a fee schedule established by law, payment for items in competitive bidding areas was based on the supplier bids  The program started in 9 metropolitan areas in January 2011 and had expanded to 130 competitive bidding areas in 2018  However, the program has been suspended while a new bidding methodology is established  During the gap, the payments for previously competitively bid items in competitive bidding areas will be the amounts that applied on December 31, 2018, increased, yearly, by a measure of inflation  Certain specified outpatient prescription drugs and biologics are covered under Medicare Part B  (However, most outpatient prescription drugs are covered under Part D, discussed below ) Covered Part B drugs and biologics include drugs furnished incident to physician services, immunosuppressive drugs following a Medicare-covered organ transplant, erythropoietin for treatment of anemia for individuals with ESRD when not part of the ESRD composite rate, oral anticancer drugs (provided they have the same active ingredients and are used for the same indications as chemotherapy drugs that would be covered if furnished incident to physician services), certain vaccines under selected conditions, and drugs administered through DME  Generally, Medicare reimburses physicians and other providers, such as hospital outpatient clinics, for covered Part B drugs and biologics at 106% of the volume weighted average sales price of all drugs billed under the same billing code, although some Part B drugs, such as those administered through DME, are reimbursed at 95% of the drug's average wholesale price  Health care providers also are paid separately for administering Medicare Part B drugs  Medicare pays 80% of the amount paid to providers, and beneficiaries are responsible for the remaining 20%  A hospital outpatient is a person who has not been admitted by the hospital as an inpatient but is registered on the hospital records as an outpatient  Generally, payments under the hospital outpatient prospective payment system (OPPS) cover the operating and capital-related costs that are directly related and integral to performing a procedure or furnishing a service on an outpatient basis  These payments cover services such as the use of an operating suite, treatment, procedure, or recovery room; use of an observation bed as well as anesthesia; certain drugs or pharmaceuticals; incidental services; and other necessary or implantable supplies or services  Payments for services such as those provided by physicians and other professionals as well as therapy and clinical diagnostic laboratory services, among others, are separate  Under the OPPS, the unit of payment for acute care hospitals is the individual service or procedure as assigned to an ambulatory payment classification (APC)  To the extent possible, integral services and items (excluding physician services paid under the physician fee schedule) are bundled within each APC  Specified new technologies are assigned to "new technology APCs" until clinical and cost data are available to permit assignment into a "clinical APC " Medicare's hospital outpatient payment is calculated by multiplying the relative weight associated with an APC by a conversion factor  For most APCs, 60% of the conversion factor is geographically adjusted by the wage index used for the inpatient prospective payment system  Except for new technology APCs, each APC has a relative weight that is based on the median cost of services in that APC  The OPPS also includes pass-through payments for new technologies (specific drugs, biologicals, and devices) and payments for outliers  The Medicare Payment Advisory Commission (MedPAC) has recommended site-neutral payment policies that base payments on the resources needed to provide high-quality care in the most efficient setting  The Bipartisan Budget Act of 2015 (BBA 15; P L  114-74 ) gave CMS the authority to add new restrictions on Medicare payments for services furnished in provider-based off-campus hospital outpatient departments (HOPDs) to address discrepancies between payments under the MPFS and the OPPS for similar services  In its 2019 OPPS Final Rule, CMS explicitly applies the site-neutral policy to clinic visits, the most commonly billed service in hospital outpatient departments  An ambulatory surgical center (ASC) is a distinct entity that furnishes outpatient surgical procedures to patients who do not require an overnight stay after the procedure  According to MedPAC, most ASCs are freestanding facilities rather than part of a larger facility, such as a hospital  Medicare covers surgical and medical services performed in an ambulatory surgical center that are (1) commonly performed on an inpatient basis but may be safely performed in an ASC; (2) not of a type that are commonly performed or that may be safely performed in physicians' offices; (3) limited to procedures requiring a dedicated operating room or suite and generally requiring a postoperative recovery room or short-term (not overnight) convalescent room; and (4) not otherwise excluded from Medicare coverage  Medicare pays for surgery-related facility services provided in ASCs using a prospective payment system based on the OPPS  (Associated physician fees are paid for separately under the physician fee schedule ) Each of the approximately 3,500 procedures approved for payment in an ASC is classified into an APC group on the basis of clinical and cost similarity  The ASC system primarily uses the same payment groups as the OPPS; however, ASC payment rates are generally lower  The ASC weights are scaled (reduced) to account for the different mix of services in an ASC, and the ASC conversion factor (the base payment amount) is lower  A different payment method is used to set ASC payment for office-based procedures, separately payable radiology services, separately payable drugs, and device-intensive procedures  In addition, separate payments are made for certain ancillary items and services when they are integral to surgical procedures, including corneal tissue acquisition, brachytherapy sources, certain radiology services, many drugs, and certain implantable devices  The application of the site-neutral payment policy to clinic visits also affects such payments to ASCs (see discussion above)  Medicare Part B covers emergency and nonemergency ambulance services to or from a hospital, a critical access hospital, a skilled nursing facility, or a dialysis facility for End-Stage Renal Disease (ESRD) beneficiaries who require dialysis when other modes of transportation could endanger the Medicare beneficiary's health  In most cases, the program covers 80% of the allowed amount for the service, and the beneficiary is responsible for the remaining 20%  Generally, ambulance services are covered if (1) transportation of the beneficiary occurs; (2) the beneficiary is taken to an appropriate location (generally, the closest appropriate facility); (3) the ambulance service is medically necessary (other forms of transportation are contraindicated); (4) the ambulance provider or supplier meets state licensing requirements; and (5) the transportation is not part of a Medicare Part A covered stay  Medicare covers both scheduled and nonscheduled nonemergency transports if the beneficiary is bed-confined or meets other medical necessity criteria  Medicare may also cover emergency ambulance transportation by airplane or helicopter if the beneficiary's location is not easily reached by ground transportation or if long distance or obstacles, such as heavy traffic, would prevent the individual from obtaining needed care  Medicare pays for ambulance services according to a national fee schedule  The fee schedule establishes seven categories of ground ambulance services and two categories of air ambulance services  Medicare pays for different levels of ambulance services, which reflect the staff training and equipment required to meet the patient's medical condition or health needs  Generally, basic life support is provided by emergency medical technicians (EMTs)  Advanced life support is provided by EMTs with advanced training or by paramedics  Some rural ground and air ambulance services may qualify for increased payments  Also, ambulance providers that are CAHs, or that are entities that are owned and operated by a CAH, are paid on a reasonable-cost basis rather than the fee schedule if they are the only ambulance provider within a 35-mile radius  Medicare covers Part B services in rural health clinics (RHCs) and federally qualified health centers (FQHCs) provided by (1) physicians and specified nonphysician practitioners; (2) visiting nurses for homebound patients in home health shortage areas; (3) registered dieticians or nutritional professionals for diabetes training and medical nutrition therapy; and (4) others, as well as certain drugs administered by a physician or nonphysician practitioner  RHCs are paid based on an "all-inclusive" cost-based rate per beneficiary visit subject to a per visit upper limit, adjusted annually for inflation  For cost-reporting periods that began on or after October 1, 2014, FQHCs are paid a base payment rate per visit (with a limit, in most cases, of one billable visit per day) under a PPS methodology  Each FQHC's PPS rate is adjusted based on the location where the service is furnished using geographic adjustment factors, which are the geographic practice cost indices (GPCI) used in Medicare's physician fee schedule (MPFS)  This rate is increased by 34% for new patients (those not seen in the FQHC organization within the past three years)  The 34% increase also applies when a beneficiary receives a comprehensive initial Medicare visit (an initial preventive physician examination or an initial annual wellness visit) or a subsequent annual wellness visit  Effective January 1, 2017, the FQHC PPS base rate is updated annually using an FQHC-specific market basket  Medicare's payment to the FQHC is equal to 80% of the lesser of the adjusted PPS rate or the FQHC's actual charges associated with the visit, and the beneficiary is responsible for a 20% coinsurance  Medicare Advantage (MA) is an alternative way for Medicare beneficiaries to receive covered benefits  Under MA, private health plans are paid a per-person amount to provide all Medicare covered benefits (except hospice) to beneficiaries who enroll in their plan  Medicare beneficiaries who are eligible for Part A, enrolled in Part B, and do not have ESRD are eligible to enroll in an MA plan if one is available in their area  Some MA plans may choose their service area (local MA plans), while others agree to serve one or more regions defined by the Secretary (regional MA plans)  In 2019, nearly all Medicare beneficiaries have access to an MA plan and approximately a third of beneficiaries are enrolled in one  Private plans may use different techniques to influence the medical care used by enrollees  Some plans, such as health maintenance organizations (HMOs), may require enrollees to receive care from a restricted network of medical providers; enrollees may be required to see a primary care physician who will coordinate their care and refer them to specialists as necessary  Other types of private plans, such as private fee-for-service (PFFS) plans, may look more like original Medicare, with fewer restrictions on the providers an enrollee can see and minimal coordination of care  In general, MA plans offer additional benefits or require smaller co-payments or deductibles than original Medicare  Sometimes beneficiaries pay for these additional benefits through a higher monthly premium, but sometimes they are financed through plan savings  The extent of extra benefits and reduced cost sharing varies by plan type and geography  However, MA plans are seen by some beneficiaries as an attractive alternative to more expensive supplemental insurance policies found in the private market  By contract with CMS, a plan agrees to provide all required services covered in return for a capitated monthly payment adjusted for the demographics and health history of their enrollees  The same monthly payment is made regardless of how many or few services a beneficiary actually uses  In general, the plan is at-risk if costs, in the aggregate, exceed program payments; conversely, the plan can retain savings if aggregate costs are less than payments  Payments to MA plans are based on a comparison of each plan's estimated cost of providing Medicare covered services (a bid) relative to the maximum amount the federal government will pay for providing those services in the plan's service area (a benchmark)  If a plan's bid is less than the benchmark, its payment equals its bid plus a rebate  The size of the rebate is dependent on plan quality and ranges from 50% to 70% of the difference between the bid and the benchmark  The rebate must be returned to enrollees in the form of additional benefits, reduced cost sharing, reduced Part B or Part D premiums, or some combination of these options  If a plan's bid is equal to or above the benchmark, its payment will be the benchmark amount and each enrollee in that plan will pay an additional premium, equal to the amount by which the bid exceeds the benchmark  The MA benchmarks are determined through statutorily specified formulas that have changed over time  Since BBA 97, formulas have increased the benchmark amounts, in part, to encourage plan participation in all areas of the country  As a result, however, the benchmark amounts (and plan payments) in some areas have been higher than the average cost of original FFS Medicare  The ACA changed the way benchmarks are calculated by tying them closer to (or below) spending in FFS Medicare, and adjusting them based on plan quality  In a recent analysis, MedPAC found that "over the past few years, plan bids and payments have come down in relation to FFS spending while MA enrollment continues to grow  The pressure of lower benchmarks has led to improved efficiencies and more competitive bids that enable MA plans to continue to increase enrollment by offering benefits that beneficiaries find attractive " In 2006, the MA program began to offer MA regional plans  Regional MA plans must agree to serve one or more regions designated by the Secretary  There are 26 MA regions consisting of states or groups of states  Regional plan benchmarks include two components: (1) a statutorily determined amount (comparable to benchmarks described above) and (2) a weighted average of plan bids  Thus, a portion of the benchmark is competitively determined  Similar to local plans, plans with bids below the benchmark are given a rebate, while plans with bids above the benchmark require an additional enrollee premium  In general, MA eligible individuals may enroll in any MA plan that serves their area  However, some MA plans may restrict their enrollment to beneficiaries who meet additional criteria  For example, employer-sponsored MA plans are generally only available to the retirees of the company sponsoring the plan  In addition, Medicare Special Needs Plans (SNPs) are a type of coordinated care MA plan that exclusively enrolls, or enrolls a disproportionate percentage of, special needs individuals  Special needs individuals are any MA eligible individuals who are either institutionalized as defined by the Secretary, eligible for both Medicare and Medicaid, or have a severe or disabling chronic condition and would benefit from enrollment in a specialized MA plan  Medicare Part D provides coverage of outpatient prescription drugs to Medicare beneficiaries who choose to enroll in this optional benefit  (As previously discussed, Part B provides limited coverage of some outpatient prescription drugs ) In 2019, about 47 million (about 77%) of eligible Medicare beneficiaries are estimated to be enrolled in a Part D plan  Prescription drug coverage is provided through private prescription drug plans (PDPs), which offer only prescription drug coverage, or through Medicare Advantage prescription drug plans (MA-PDs), which offer prescription drug coverage that is integrated with the health care coverage they provide to Medicare beneficiaries under Part C  Plans must meet certain minimum requirements; however, there are significant variations among them in benefit design, including differences in premiums, drugs included on plan formularies, and cost sharing for particular drugs  Part D prescription drug plans are required to offer either "standard coverage" or alternative coverage that has actuarially equivalent benefits  In 2019, "standard coverage" has a $415 deductible and a 25% coinsurance for costs between $415 and $3,820  From this point, there is reduced coverage until the beneficiary has out-of-pocket costs of $5,100 (an estimated $8,139 54 in total spending); this coverage gap has been labeled the "doughnut hole " Once the beneficiary reaches the catastrophic limit, the program pays all costs except for the greater of 5% coinsurance or $3 40 for a generic drug and $8 50 for a brand-name drug  As required by the ACA, in 2010, Medicare sent a tax-free, one-time $250 rebate check to each Part D enrollee who reached the doughnut hole  Additionally, starting in 2011, the coverage gap is being gradually reduced each year  Under the ACA, the coverage gap for both brand-name and generic drugs was to be eliminated in 2020, but Congress moved up the date to 2019 for brand-name drugs as part of BBA 18  In 2019, a 70% discount is provided by drug manufacturers and Medicare pays an additional 5% of the cost of brand-name drugs dispensed during the coverage gap  In 2019, Medicare also pays 63% of the cost of generic drugs dispensed during the coverage gap and enrollees pay 37%  (See Figure 2  ) By 2020, through a combination of manufacturer discounts and increased Medicare coverage, Part D enrollees will be responsible for 25% of the costs for brand-name and generic drugs in the coverage gap (the same as during the initial coverage period)  Most plans offer actuarially equivalent benefits rather than the standard package, including alternatives such as reducing or eliminating the deductible, or using tiered cost sharing with lower cost sharing for generic drugs  Medicare's payments to plans are determined through a competitive bidding process, and enrollee premiums are tied to plan bids  Plans are paid a risk-adjusted monthly per capita amount based on their bids during a given plan year  Part D plan sponsors determine payments for drugs and are expected to negotiate prices  The federal government is prohibited from interfering in the price negotiations between drug manufacturers, pharmacies, and plans (the so-called "non-interference clause")  Part D also provides enhanced coverage for low-income enrolled individuals, such as persons who previously received drug benefits under Medicaid (known as "dual eligibles"—enrollees in both Medicare and Medicaid)  Additionally, certain persons who do not qualify for Medicaid, but whose incomes are below 150% of poverty, may also receive assistance for some portion of their premium and cost-sharing charges  The MMA included significant incentives for employers to continue to offer coverage to their retirees by providing a 28% federal subsidy  In 2019, the maximum potential subsidy per covered retiree is $2,264 for employers or unions offering drug coverage that is at least actuarially equivalent (called "creditable" coverage) to standard coverage  Employers or unions may select an alternative option (instead of taking the subsidy) with respect to Part D, such as electing to pay a portion of the Part D premiums  They may also elect to provide enhanced coverage, though this has some financial consequences for the employer or union  Alternatively, employers or unions may contract with a PDP or MA-PD to offer the coverage or become a Part D plan sponsor themselves for their retirees  A variety of public and private entities are involved in carrying out Medicare administrative and oversight functions  CMS, an agency within HHS, has primary operational responsibilities  Such responsibilities include managing program finances, developing policies and regulations, setting payment rates, and developing the program's information-technology infrastructure  CMS conducts its activities through its headquarters and 10 regional offices  The Social Security Administration, however, enrolls beneficiaries into the program and issues Medicare beneficiary cards  CMS also contracts with various private entities, including private health insurance companies, to help administer the program  For example, Medicare Administrative Contractors (MACs) process and pay Parts A and B reimbursement claims, enroll providers and suppliers, educate providers and suppliers on billing requirements, support appeal processes, and answer provider and supplier inquiries through call centers, as well as other activities  Qualified Independent Contractors (QICs) perform second-level reviews on appeals initially reviewed by MACs  Medicare's quality assurance activities are primarily handled by State Survey Agencies and Quality Improvement Organizations (QIOs), which operate in all states and the District of Columbia, Puerto Rico, and the U S  Virgin Islands  The State Survey Agencies are responsible for inspecting Medicare provider facilities (e g , nursing homes, home health agencies, and hospitals) to ensure that they are in compliance with federal safety and quality standards referred to as Conditions (or Requirements) of Participation  Alternatively, some types of providers, including hospitals, may receive certification through private accrediting agencies, such as the Joint Commission  QIOs are mostly private, not-for-profit organizations that monitor the quality of care delivered to Medicare beneficiaries and educate providers on the latest quality-improvement techniques  Medicare program integrity activities, such as audits, provider education, medical review, and predictive data analysis, also are carried out by a variety of government and private entities  For example, the Center for Program Integrity within CMS works together with the U S  Department of Justice (DOJ) and the HHS Office of Inspector General (OIG) to identify and prevent fraud, waste, and abuse in Medicare  CMS also works with private contractors to carry out certain program-integrity functions  Unified Program Integrity Contractors (UPICs) perform integrity-related activities including data analysis to identify potentially fraudulent claims (bills) for Medicare Parts A and B, home health and hospice services, and DME  Similarly, the National Benefit Integrity Medicare Drug Integrity Contractor (MEDIC) is responsible for identifying and investigating fraud, waste, and abuse in Medicare Advantage and Part D  When appropriate, the UPICs and MEDIC work with and refer cases to law enforcement, including OIG and DOJ  In addition, Recovery Audit Contractors (RACs) are responsible for identifying improper Medicare payments, including both underpayments and overpayments, and for recouping any overpayments made to providers  Each year, the Comprehensive Error Rate Testing (CERT) program quantifies a national improper Medicare payment rate by examining a random sample of claims  In turn, the Supplemental Medical Review Contractor targets medical reviews in areas where OIG, RACs, and CERT have identified vulnerabilities and/or questionable billing patterns to identify ways to lower improper payment rates  As required by the ACA, the Center for Medicare and Medicaid Innovation (CMMI) was established in January 2011 to test and evaluate innovative payment and service delivery models to reduce program expenditures under Medicare  Examples of these models include providing payment incentives for groups of doctors, hospitals, and other health care providers (Accountable Care Organizations, or ACOs) to coordinate the services they provide to Medicare beneficiaries; bundling payments for services provided in different settings during a beneficiary's episode of care; and reimbursing health providers based on the quality of care rather than on the volume of services  CMMI also plays an important role in developing and implementing the new physician payment models required by MACRA  Medicare beneficiary education and outreach duties are shared between CMS and the Social Security Administration  Each year, CMS mails out a "Medicare and You" handbook to beneficiaries, which provides information on their benefits for the upcoming year  Additional educational materials and responses to frequently asked questions may be found on the CMS-maintained "Medicare gov" website, and beneficiaries may call a CMS-operated 1-800 number for assistance with specific questions and help with selecting and enrolling in a Medicare Advantage and/or Part D plan  A Medicare beneficiary ombudsman is also available to provide assistance to Medicare consumers with their complaints, grievances, and requests  The Social Security Administration is responsible for notifying low-income Medicare beneficiaries about programs that may be able to assist them with their medical and prescription drug expenses  The Social Security Administration also provides general Medicare eligibility and enrollment information on its webpage and on Social Security benefit statements  Finally, CMS partners with community-based organizations, such as State Health Insurance Assistance Programs, in every state to provide educational resources and personalized assistance to Medicare beneficiaries  Medicare's financial operations are accounted for through two trust funds maintained by the Department of the Treasury—the Hospital Insurance (HI) trust fund for Part A and the Supplementary Medical Insurance (SMI) trust fund for Parts B and D  For beneficiaries enrolled in Medicare Advantage (Part C), payments are made on their behalf in appropriate portions from the HI and SMI trust funds  HI is primarily funded by payroll taxes, while SMI is primarily funded through general revenue transfers and premiums  (See Figure 3  ) The HI and SMI trust funds are overseen by a Board of Trustees that provides annual reports to Congress  The trust funds are accounting mechanisms  Income to the trust funds is credited to the fund in the form of interest-bearing government securities  Expenditures for services and administrative costs are recorded against the fund  These securities represent obligations that the government has issued to itself  As long as a trust fund has a balance, the Department of the Treasury is authorized to make payments for it from the U S  Treasury  Medicare expenditures are primarily paid for through mandatory spending—generally Medicare pays for all covered health care services provided to beneficiaries  Aside from certain constraints in HI described below, the program is not subject to spending limits  Additionally, most Medicare expenditures (aside from premiums paid by beneficiaries) are paid for by current workers through income taxes and dedicated Medicare payroll taxes, that is, current income is used to pay current expenditures  Medicare taxes paid by current workers are not set aside to cover their future Medicare expenses  The primary source of funding for Part A is payroll taxes paid by employees and employers  Each pays a tax of 1 45% on the employee's earnings; the self-employed pay 2 9%  Beginning in 2013, some higher-income employees pay higher payroll taxes  Unlike Social Security, there is no upper limit on earnings subject to the tax  Other sources of income include (1) interest on federal securities held by the trust fund, (2) a portion of federal income taxes that individuals pay on their Social Security benefits, and (3) premiums paid by voluntary enrollees who are not automatically entitled to Medicare Part A  Income for Part A is credited to the HI trust fund  Part A expenditures for CY2019 are estimated to reach approximately $330 billion  Revenue to the trust fund is expected to consist of about $285 billion in payroll tax income and another $38 billion in interest and other income  The Medicare Trustees project that in CY2019, the HI trust fund will incur a deficit of approximately $7 billion  As long as the HI trust fund has a balance, the Treasury Department is authorized to make payments for Medicare Part A services  To date, the HI trust fund has never run out of money (i e , become insolvent), and there are no provisions in the Social Security Act that govern what would happen if that were to occur  Part A expenditures exceeded HI income each year from 2008 through 2015, and the assets credited to the trust fund were drawn down to make up the deficit in those years  Although the HI trust fund accumulated small surpluses in 2016 and 2017, the Medicare Trustees estimate that, beginning in 2018, expenditures will outpace income in all future years, and project that the HI trust fund will become insolvent in 2026 (i e , the balance of the trust fund will reach $0)  At that time there would no longer be sufficient funds to fully cover Part A expenditures  Medicare Part B is financed primarily from federal general revenues and from beneficiary premiums, which are set at 25% of estimated per capita program costs for the aged  (The disabled pay the same premium as the aged ) Income for Part B is credited to the SMI trust fund  Total spending for Part B is estimated to reach about $368 billion in CY2019, with premiums financing about $98 billion of that amount and general revenues financing most of the rest  Most beneficiaries who enroll in Medicare Part B pay a monthly premium  Individuals receiving Social Security benefits have their Part B premium payments automatically deducted from their Social Security benefit checks  Due to a "hold-harmless" provision in the Social Security Act, an individual's Social Security check cannot decrease from one year to the next as a result of the annual Part B premium increase (except in the case of higher-income individuals subject to income-related premiums)  The 2019 monthly Part B premium is $135 50  However, about 3 5% of Medicare enrollees are protected by the hold-harmless provision and pay lower premium amounts because the dollar amount of the 2019 cost-of-living increase in their Social Security benefits was not sufficient to cover the full premium increase  Since 2007, higher-income Part B enrollees have paid higher premiums  In 2019, individuals whose modified adjusted gross income (AGI) exceeds $85,000 and each member of a couple filing jointly whose modified AGI exceeds $170,000 are subject to higher premium amounts  These higher-income premiums range from 35% to 85% of the value of Part B and affect about 5% of Medicare enrollees  (See Appendix B for 2019 Part B premiums and high-income thresholds ) Payments for spending under the Medicare Advantage program are made in appropriate portions from the HI and SMI trust funds  There is no separate trust fund for Part C  Medicare Part D is financed through a combination of beneficiary premiums and federal general revenues  In addition, certain transfers are made from the states  These transfers, referred to as "clawback payments," represent a portion of the amounts states could otherwise have been expected to pay for drugs under Medicaid if drug coverage for the dual eligible population had not been transferred to Part D  Part D revenues are credited to a separate Part D account within the SMI trust fund  In CY2019, total spending for Part D is estimated to reach approximately $98 billion, with about $71 billion of that amount paid for by general revenues, $16 billion from beneficiary premiums, and $12 billion from state transfers  In 2019, the base beneficiary premium is $33 19; however, beneficiaries pay different premiums depending on the plan they have selected and whether they are entitled to low-income premium subsidies  Additionally, beginning in 2011, higher income Part D enrollees pay higher premiums  (The income thresholds are the same as for Part B, as described above ) On average, beneficiary premiums are set at 25 5% of expected total Part D costs for basic coverage  The Budget Control Act of 2011 (BCA; P L  112-25 ) provided for increases in the debt limit and established procedures designed to reduce the federal budget deficit, including the creation of a Joint Select Committee on Deficit Reduction  The failure of the Joint Committee to propose deficit reduction legislation by its mandated deadline triggered automatic spending reductions ("sequestration" of mandatory spending and reductions in discretionary spending) in fiscal years 2013 through 2021  The American Taxpayer Relief Act of 2012 (ATRA; P L  112-240 ) delayed the automatic reductions by two months, while the Bipartisan Budget Act of 2013 (BBA; P L  113-67 ) extended sequestration for mandatory spending for an additional two years—through FY2023  In 2014, the President signed into law an amended version of S  25 ( P L  113-82 ), which included a provision to extend BCA's sequester of mandatory spending through FY2024  BBA 15 extended the sequestration of mandatory spending another year, through FY2025  Most recently, BBA 18 extended the BCA mandatory spending sequester through FY2027  Section 256(d) of the Balanced Budget and Emergency Deficit Control Act of 1985 (BBEDCA; P L  99-177 ) contains special rules for the Medicare program in the event of a sequestration  Among other things, it specifies that for Medicare, sequestration is to begin the month after the sequestration order has been issued  Therefore, as the sequestration order was issued March 2013, Medicare sequestration began April 1, 2013, and will continue through March 31, 2028  Under sequestration, Medicare's benefit structure generally remains unchanged; however, benefit related payments are subject to 2% reductions  In other words, most Medicare payments to health care providers, as well as to MA and Part D plans, are being reduced by 2%  Certain Medicare payments are exempt from sequestration and therefore not reduced  These exemptions include (1) Part D low-income subsidies, (2) the Part D catastrophic subsidy, and (3) Qualified Individual (QI) premiums  Some non-benefit related Medicare expenses, such as administrative and operational spending, are subject to higher reductions, 6 2% in 2019  While Medicare provides broad protection against the costs of many, primarily acute care, services, the program does not cover all services that may be used by its aged and disabled beneficiaries  In general, Medicare does not cover eyeglasses, hearing aids, dentures, or most long-term care services  Further, unlike most private insurance policies, it does not include an annual "catastrophic" cap on out-of-pocket spending on cost-sharing charges for services covered under Parts A and B (except for persons enrolled in Medicare Advantage plans)  Most Medicare beneficiaries have some coverage in addition to Medicare  The following are the main sources of additional coverage for Medicare enrollees: Medicare Advantage  Many MA plans offer services in addition to those covered under original Medicare, reduced cost sharing, or reduced Part B or D premiums  All MA plans have a catastrophic cap  Employer Coverage  Coverage may be provided through a current or former employer  In recent years, a number of employers have cut back on the scope of retiree coverage  Some have dropped such coverage entirely, particularly for future retirees  As noted earlier, the MMA attempted to stem this trend, at least for prescription drug coverage, by offering subsidies to employers who offer drug coverage, at least as good as that available under Part D  Medigap  Individual insurance policies that supplement fee-for-service Medicare are referred to as Medigap policies  Beneficiaries with Medigap insurance typically have coverage for a portion of Medicare's deductibles and coinsurance; they may also have coverage for some items and services not covered by Medicare  Individuals select from a set of standardized plans, though not all plans are offered in all states  Medicaid  Certain low-income Medicare beneficiaries also may be eligible for full or partial benefits under their state's Medicaid program  Individuals eligible for both Medicare and Medicaid are referred to as dual eligibles  The lowest-income dual eligibles qualify for full Medicaid benefits, so that the majority of their health care expenses are paid by either Medicare or Medicaid; Medicare pays first, with Medicaid picking up most of the remaining costs  In addition to full-benefit dual eligibles, state Medicaid programs pay Medicare premiums and some cost sharing for other partial dual eligibles, who have higher income than full-benefit dual eligibles but are still considered to have low income  Other Public Sources  Individuals may have additional coverage through the Department of Veterans Affairs, or TRICARE for military retirees eligible for Medicare (and enrolled in Part B)  In 2015, about 87% of Medicare beneficiaries had some form of additional coverage  Some persons may have had more than one type of additional coverage  Appendix A  Abbreviations Appendix B  2019 Medicare Beneficiary Costs

ground_truth: Protecting federal employees and facilities from security threats is of critical importance. Most federal agencies are generally responsible for their facilities and have physical security programs to do so. GAO was asked to examine how federal agencies assess facilities' security risks. This report examines: (1) how selected agencies' assessment methodologies align with the ISC's risk management standard for identifying necessary countermeasures and (2) what management challenges, if any, selected agencies reported facing in conducting physical security assessments and monitoring the results. GAO selected four agencies—CBP, FAA, ARS, and the Forest Service—based on their large number of facilities and compared each agency's assessment methodology to the ISC Standard; analyzed facility assessment schedules and results from 2010 through 2016; and interviewed security officials. GAO also visited 13 facilities from these four agencies, selected based on geographical dispersion and their high risk level. None of the four agencies GAO reviewed—U.S. Customs and Border Protection (CBP), the Federal Aviation Administration (FAA), the Agricultural Research Service (ARS), and the Forest Service—used security assessment methodologies that fully aligned with the Interagency Security Committee's Risk Management Process for Federal Facilities standard (the ISC Standard). This standard requires that methodologies used to identify necessary facility countermeasures—such as fences and closed-circuit televisions—must: 1. Consider all of the undesirable events (i.e., arson and vandalism) identified by the ISC Standard as possible risks to facilities. 2. Assess three factors—threats, vulnerabilities, and consequences—for each of these events and use these three factors to measure risk. All four agencies used methodologies that included some ISC requirements when conducting assessments. CBP and FAA assessed vulnerabilities but not threats and consequences. ARS and the Forest Service assessed threats, vulnerabilities, and consequences, but did not use these factors to measure risk. In addition, the agencies considered many, but not all 33 undesirable events related to physical security as possible risks to their facilities. Agencies are taking steps to improve their methodologies. For example, ARS and the Forest Service now use a methodology that measures risk and plan to incorporate the methodology into policy. Although CBP and FAA have updated their methodologies, their policies do not require methodologies that fully align with the ISC standard. As a result, these agencies miss the opportunity for a more informed assessment of the risk to their facilities. All four agencies reported facing management challenges in conducting physical security assessments or monitoring assessment results. Specifically, CBP, ARS, and the Forest Service have not met the ISC's required time frame of every 3 years for conducting assessments. For example, security specialists have not conducted required reassessments of two ARS and one Forest Service higher-level facilities. While these three agencies have plans to address backlogs, CBP's plan does not balance conducting risk assessments with other competing security priorities, such as updating its policy manual, and ARS and the Forest Service lack a means to monitor completion of future assessments. Furthermore, CBP, ARS, and the Forest Service did not have the data or information systems to monitor assessment schedules or the status of countermeasures at facilities, and their policies did not specify such data requirements. For example, ARS and the Forest Service do not collect and analyze security-related data, such as countermeasures' implementation. FAA does not routinely monitor the performance of its physical security program. Without improved monitoring, agencies are not well equipped to prioritize their highest security needs, may leave facilities' vulnerabilities unaddressed, and may not take corrective actions to meet physical security program objectives. This is a public version of a sensitive report that GAO issued in August 2017. Information that the agencies under review deemed sensitive has been omitted. GAO recommends: (1) that CBP and FAA update policies to require the use of methodologies fully aligned with the ISC Standard; (2) that CBP revise its plan to eliminate the assessments backlog; and (3) that all four agencies improve monitoring of their physical security programs. All four agencies agreed with the respective recommendations.