Computer Matching Act: OMB and Selected Agencies Need to Ensure Consistent Implementation
Released: 2014-02-12T00:00:00

Letter

Background

Sharing information is an important tool in improving the efficiency and integrity of government programs. By sharing data, agencies can often reduce errors, improve program efficiency, evaluate program performance, and reduce information collection burdens on the public. Technological advances have broadened the government’s ability to share data for these uses. Likewise, such advances have enhanced the government’s ability to use computerized analysis to identify and reduce fraud, waste, and abuse. One important analytical technique is computer matching, a term commonly used to refer to the computerized comparison of information, generally including personally identifiable information (PII), such as names and Social Security numbers, in two or more information systems.

Agencies use computer matching in a variety of ways to help ensure that federal benefits are distributed appropriately. For example, the National Directory of New Hires, established in 1996 under the Personal Responsibility and Work Opportunity Reconciliation Act, is used to match new-hire information from states with information from other states and federal programs to detect and prevent erroneous payments for the Temporary Assistance for Needy Families program, Supplemental Nutrition Assistance Program, unemployment insurance, Medicaid, and other benefit programs. In another example, according to the Chairman of the House Committee on Ways and Means, SSA collects prisoner data from states and local governments to identify incarcerated individuals who should not receive Supplemental Security Income benefits. The chairman stated that from 1997 to 2009 computer matching had helped SSA identify over 720,000 inmates who were improperly receiving benefits, contributing to billions of dollars in savings to the federal government. Due to the success of this program, prisoner data are now shared with child support enforcement and Supplemental Nutrition Assistance programs as well. Likewise, the chairman also reported that the Public Assistance Reporting Information System was being used to match state enrollment data for the Temporary Assistance for Needy Families program, Supplemental Nutrition Assistance Program, Medicaid, and child care programs with data from participating states and a selected group of federal databases to identify potentially inappropriate payments. According to the Subcommittee on Human Resources of the House Committee on Ways and Means, the State of Colorado realized a return on investment of 4000 percent from using the system, and the state of New York annually saves an average of $62 million through its participation in the system.

Much computer matching is done for program integrity purposes, but it has other uses as well. For example, Secure Flight, a program run by DHS’s Transportation Security Administration, matches information about passengers provided by the airlines against government watch lists to detect individuals on the No Fly List and prevent them from boarding aircraft and to identify individuals for additional screening. Another example is E-Verify, an Internet-based system developed by U.S. Citizenship and Immigration Services that allows businesses to determine the eligibility of potential employees to work in the United States.

While computer matching programs have been successful in identifying fraud, waste, and abuse in federal benefit programs, if proper controls are not in place, they can also adversely affect the privacy and due process rights of individuals whose records are being matched. The data that are exchanged through matching programs involve personal information such as Social Security numbers and income and employment data. Without adequate protection, individuals’ information could be compromised through inappropriate use, modification, or disclosure.

In addition, without effective due process protections, individuals could unfairly lose government benefits if decisions were made to reduce or terminate those benefits based on inaccurate or misleading computer matches. For example, according to a senior policy analyst of the Center of Law and Social Policy, a computer match authorized under the Children’s Health Insurance Program Reauthorization Act of 2009, which allowed states to verify the citizenship of Medicaid and Children’s Health Insurance Program applicants by matching Social Security records rather than using clients’ birth certificates, produced matches of questionable accuracy. Specifically, according to this analyst, in the first year of using this matching program, the state of Alabama incorrectly identified over 1,000 children who would have been denied benefits if the results had not been verified.

Key Laws That Address Computer Matching

The major requirements for computer matching and the protection of personal privacy by federal agencies come from two laws, the Privacy Act of 1974 and the privacy provisions of the E-Government Act of 2002. The Privacy Act places limitations on agencies’ collection, disclosure, and use of personal information maintained in systems of records. The act defines a “record” as any item, collection, or grouping of information about an individual that is maintained by an agency and contains his or her name or another individual identifier. It defines a “system of records” as a group of records under the control of any agency from which information is retrieved by the name of the individual or other individual identifier. The Privacy Act requires that when agencies establish or make changes to a system of records, they must notify the public through a system of records notice in the Federal Register that identifies, among other things, the categories of data collected, the categories of individuals about whom information is collected, the intended “routine” uses of data, and procedures that individuals can use to review and contest its content.

In 2002, Congress enacted the E-Government Act to, among other things, enhance protection for personal information in government information systems. Toward this end, the act requires agencies to conduct privacy impact assessments before developing or procuring information systems that will collect or process personal information. These assessments provide a means for agencies to analyze and document the privacy protections they have established for uses of automated data, such as computer matching and other data-sharing activities.

Because of concerns about agency use of personal information in computer matching programs, Congress passed the Computer Matching and Privacy Protection Act in 1988 as an amendment to the Privacy Act. The provisions were intended to create procedures that would require serious deliberation and prevent data “fishing expeditions” that could reduce or terminate benefits without verifying the information and notifying affected individuals of the matching program. In 1989 and 1990,Congress enacted further amendments to, among other things, require due process procedures for agency computer matching programs, including independent verification of “hits” and a 30-day notice for individuals affected by a matching program.

Under these sets of amendments, which we collectively refer to as the Computer Matching Act, computer matching is defined as the computerized comparison of records for the purpose of establishing or verifying eligibility or recouping payments for a federal benefit program or relating to federal personnel management. To ensure procedural uniformity in carrying out matching programs and to provide due process for potentially affected individuals, the law established a number of requirements for covered agency computer matching programs, including agencies must have computer matching agreements with participating agencies that specify, among other things, the purpose and legal authority of the program and a justification for the program, including a specific estimate of any savings;

Data Integrity Boards (DIB) must be established to approve and review all agency computer matching programs covered by the Computer Matching Act, including the costs and benefits of such programs; and

OMB must prescribe guidance for agencies on conducting computer matching programs as part of implementation of the Privacy Act.

These requirements do not, however, apply to all federal agency computer matching activities. For example, the law’s definitions exclude matches of federal agency information with commercial data and matches of federal agency payments, grants, or loans to entities other than individuals. Further, the law exempts a number of matching activities. For example, the initial 1988 amendments included exemptions for matches for statistical or research purposes, law enforcement investigations of specific individuals, and certain tax-related matches. In 1999, an exemption was added for Social Security Act-related matches of prisoner data. In addition, in 2010, the Patient Protection and Affordable Care Act exempted matches by HHS relating to potential fraud, waste, and abuse.

Most recently, in January 2013, the Improper Payments Elimination and Recovery Improvement Act (IPERIA) provided, among other things, that data-matching activities conducted by agencies and offices of inspectors general (OIG) that assist in the detection and prevention of improper payments would be subject to requirements that differ from those of the Computer Matching Act. These include a 60-day time limit on DIB review, approvals extended up to 3 years, and a waiver on the requirement for a specific estimate of savings in a computer matching agreement.

In addition, IPERIA established in law the Do Not Pay Initiative, coordinated by the Department of the Treasury, to require agencies to reduce improper payments by reviewing a number of databases, including the SSA Death Master File and the Department of Housing and Urban Development Credit Alert System, before issuing any payments. IPERIA also required OMB to ensure the establishment of a working system to provide agencies with access to these databases, and to report to Congress on the operations of the Do Not Pay Initiative. OMB’s August 16, 2013, guidance also contained instructions for agencies on implementing this initiative, including responsibilities for agency DIBs. For example, the guidance states that DIBs should be properly trained and should meet annually to evaluate agency matching programs.

OMB and Agencies Have a Variety of Responsibilities under the Computer Matching Act

OMB is responsible for developing guidelines and providing continuing assistance to agencies on the implementation of the Computer Matching Act, while agencies have a variety of implementation responsibilities. Agency responsibilities can be grouped into three major areas: (1) developing computer matching agreements containing specific elements for each proposed matching program and notifying Congress, OMB, and the public of computer matching activities; (2) conducting cost-benefit analyses for proposed computer matching programs; and (3) establishing DIBs to oversee computer matching programs, including reviewing and approving computer matching agreements.

OMB Has Primary Responsibility for Providing Assistance to Agencies for Privacy and Computer Matching

The Privacy Act gives OMB responsibility for developing guidelines and providing continuing assistance to agencies on the implementation of the Computer Matching Act. OMB has periodically published guidance for implementing the act, including documents issued in 1989, 1991, 2000, and 2013. In addition, Circular No. A-130 includes instructions to agencies for reporting on computer matching activities.

The 1989 guidance provided explanations for agencies on interpreting various provisions of the 1988 amendments, including examples of activities that should be treated as computer matching programs covered by the act, types of information that should be in computer matching agreements (CMAs), and responsibilities for fulfilling reporting requirements. The 1989 guidance also addressed required cost-benefit analyses and the responsibilities of DIBs.

The 1991 guidance was intended to help implement changes made in the 1990 computer matching amendments to simplify several due process requirements after agencies experienced difficulties implementing the requirements established in 1988.

OMB Circular No. A-130, Management of Federal Information Resources, includes guidance on implementation of a number of information and information technology laws. According to OMB staff, the Circular A-130 requirements provide guidance to agencies on meeting the reporting requirements for computer matching activities. The circular’s Appendix I, “Federal Agency Responsibilities for Maintaining Records about Individuals,” provides specific instructions for agencies on reporting requirements relating to computer matching.

OMB’s 2000 memorandum reinforced existing Privacy Act requirements, while its 2013 memorandum on reducing improper payments provided guidance on implementing the requirements in IPERIA as well as some additional clarifications on computer matching programs.

Agencies Are Required to Develop and Report on Formal Agreements to Conduct Computer Matches

Agencies are required to establish computer matching programs when conducting any computer matches, which are defined as a “computerized comparison of records for the purpose of establishing or verifying eligibility or recouping payments for a federal benefit program or relating to federal personnel management.” Agencies first need to determine whether their planned activity falls within the scope of the law under this definition. If a proposed match is covered by the Computer Matching Act, a CMA must be developed and approved by all participating agencies.Among other things, the act requires that CMAs include the purpose and legal authority for conducting the program; the justification for the program and the anticipated results, including a specific estimate of any savings; a description of the records that will be matched, including each data element that will be used, the approximate number of records that will be matched, and the projected starting and completion dates of the matching program; procedures for providing individual notice at the time of application, and notice periodically thereafter as directed by the DIB (subject to OMB guidance), to applicants or recipients of federal benefits; procedures for verifying information produced in the matching program as required to ensure that no benefits action is taken before the information acquired through computer matching is verified and potentially affected individuals are notified and have an opportunity to contest findings; procedures for the retention and timely destruction of identifiable records created by a recipient agency or nonfederal agency in the matching program; procedures for ensuring the administrative, technical, and physical security of the records matched and the results of the matching programs; and information on assessments that have been made on the accuracy of the records that will be used in the program.

After the CMA has been approved by all participating agencies, the agency that receives the data and derives benefit from the matching program is responsible for publishing a notice describing the details of the CMA in the Federal Register and must notify Congress and OMB prior to implementation. The act requires agencies to annually review each ongoing matching program in which the agency has participated during the year and submit a copy of every CMA to the House Committee on Oversight and Government Reform and the Senate Committee on Homeland Security and Governmental Affairs.

Agencies Are Required to Perform a Cost-Benefit Analysis

The Computer Matching Act also requires that agencies conduct cost- benefit analyses in conjunction with the development of CMAs. The act states that agency CMAs must include a specific estimate of any savings from the matching program and that DIBs shall not approve any CMA without a cost-benefit analysis of the proposed program that demonstrates that the program is likely to be cost-effective.

According to OMB’s 1989 guidance, the intent of this requirement is to ensure that sound management practices are followed when agencies use records from Privacy Act systems of records in matching programs. According to OMB, cost-effectiveness must be established before a CMA is approved and matching can occur, the goal being to ensure that when agencies are conducting matching programs they do not drain agency resources that could be better spent elsewhere. OMB guidance states that the cost-benefit information from CMAs helps Congress evaluate the effectiveness of statutory matching requirements.

The act does not specify the elements of the required cost-benefit analyses, and OMB’s guidance provides only a general outline of the costs and benefits that should be considered. In its 1989 guidance, OMB referred agencies to a GAO report published in 1986costs and benefits of computer matching programs as one source for conducting a computer matching cost-benefit analysis, and stated that it would issue a checklist providing a step-by-step methodology for such analyses at a later date. However, according to OMB staff, it has not issued such a checklist. Officials at three agencies we reviewed stated that they used our report as a source of guidance on the expected contents of cost-benefit analyses for computer matching. Without more recent guidance, our 1986 report is the only guidance available to on assessing the agencies specifically for developing cost-benefit analyses for computer matching programs.

While different computer matching programs may have unique costs and benefits, our 1986 report identified the following key elements as common types of costs and benefits associated with computer matching:

Personnel costs, such as salaries and fringe benefits, for personnel involved in the matching process, including staff time dedicated to performing the match.

Computer costs related to the processing of computer matching programs, such as the maintenance and use of computers at facilities.

Avoidance of future improper payments: the prevention of future overpayments by identifying and correcting an error.

Recovery of improper payments and debts: the detection of an overpayment or debt already made and the collection of the money owed to an agency.

Agencies Are Required to Establish a Data Integrity Board with Specific Responsibilities

The Computer Matching Act also requires that each agency participating in a computer matching program establish a DIB to oversee computer matching activities. The act requires that the DIBs be composed of senior officials designated by the head of each agency. According to the act, duties of the DIBs include the following:

Reviewing, approving, and maintaining all written agreements for receipt or disclosure of agency records under computer matching programs.

Determining the agency’s compliance with applicable laws, regulations, guidelines, and agency agreements.

Assessing the costs and benefits of matching programs and approving only those for which a cost-benefit analysis demonstrates that the program is likely to be cost-effective.

Reviewing all recurring matching programs for continued justification.

Annually reviewing all matching programs in which the agency participated during the year, either as source or recipient.

Compiling an annual report describing the matching activities of the agency, which is to be submitted to the head of the agency and OMB and made available to the public. The annual report should include a description of matching programs, matching agreements disapproved by the DIB, waivers of a cost-benefit analysis, and any violations of matching agreements.

In addition, OMB’s1989 guidance specifies that DIBs are to include the inspector general and a senior official responsible for the implementation of the Privacy Act. The inspector general may not serve as the chairman of the DIB. OMB recommended, but did not require, that the Privacy Act officer serve as the board secretary.

According to OMB’s 1989 guidance, reviewing computer matching agreements is the foremost responsibility of the DIBs, and they are required to meet often enough to ensure that the agency’s matching programs are carried out efficiently, expeditiously, and in conformance with the Privacy Act.

More generally, OMB’s 1989 guidance noted that the DIBs should serve as an information resource on matching for agencies, be placed at the top of the agency’s organization, be staffed with senior personnel, and ensure that their reasons for either approving or denying a matching program are well documented. Among other things, the guidance also explained that the law’s requirement for annual DIB review of agency matching programs was to (1) determine whether the matches have been, or are being, conducted in accordance with appropriate authorities and under the terms of the matching agreements and (2) assess the utility of the programs in terms of their costs and benefits. The act and OMB guidance also state that if a matching agreement is disapproved by the DIB, any party to such agreement may appeal the disapproval to the Director of OMB.

OMB Circular No. A-130 also instructs agencies to submit a biennial report (rather than an annual report, as required by the act) to OMB summarizing the agency’s computer matching activities. The report is to include the names of the DIB members and a list of each matching program, including its purpose, the participating agency, and a brief description of the program. For each matching program, the report is to state whether a cost-benefit analysis provided a favorable ratio or if the cost-benefit analysis was waived, the reason why.

Agencies We Reviewed Have Established Procedures for Implementing the Computer Matching Act, but Implementation Has Been Inconsistent

The agencies we reviewed have taken a number of steps to implement the requirements of the act. All seven agencies had established processes for creating and approving computer matching agreements, and the agreements they implemented generally included the elements required by the act. However, implementation among these seven agencies was inconsistent in several ways:

Agencies differed in their understanding of what circumstances and types of data-sharing the act applied to, such as whether CMAs were required for “front-end” data queries.

While these agencies generally developed cost-benefit analyses for their computer matching agreements, they did not consistently address key costs and benefits needed to assess the value of their computer matching programs.

Agency DIBs, which are required to review and approve computer matching agreements, did not always regularly meet or thoroughly review proposed CMAs or cost-benefit analyses. DIBs have also not consistently reported to OMB on agencies’ computer matching activities, as required by the act, leading to reduced transparency of these programs.

Further, OMB has provided little assistance to agencies in implementing the act, which may contribute to inconsistent implementation.

Agencies We Reviewed Have Established Computer Matching Programs but Have Interpreted the Scope of the Act Inconsistently

For the matching programs that the agencies believe are covered by the act, the seven agencies we reviewed had 82 CMAs in place that addressed the act’s requirements. All seven agencies also issued agency-wide policies and guidance that address compliance with the act, and the CMAs these agencies had in place met basic requirements, including stating the purpose and legal authority for conducting the match, justification for the program and anticipated results, descriptions of records to be matched, procedures for providing individual notice, procedures for verifying information, procedures for retention and timely destruction of records, procedures for ensuring the physical security of the records, and assessments of the accuracy of the records used.

Figure 1 shows the number of active CMAs at each of these agencies.

While the seven selected agencies were in compliance with the basic requirements of the act with regard to developing CMAs for activities they identified as covered by the act, they differed in how they interpreted the scope and application of the act to their data-sharing activities.

Specifically, three agencies interpreted the law to apply only to the matching of an entire system of records against another database, but not to other types of comparisons. For example:

Officials from DHS and VA stated that they interpret the act to apply only to automated comparisons of two complete systems of records (e.g., a batch comparison of two entire databases identified under the Privacy Act as “systems of records”). They believe that single-record comparisons, such as checks performed by front-end verification systems or individual queries of information within a system of records, are exempt.

Similarly, no CMAs were established for certain data-sharing arrangements between SSA and VA. Specifically, SSA established information exchange agreements with VA by which it provides information via online queries about individuals for program integrity and benefit accuracy purposes. According to SSA officials, a CMA with VA was not necessary because VA employees directly accessed SSA data using a computer terminal. An SSA official also commented that they preferred using information exchange agreements because they were quicker to process and approve than CMAs.

Likewise, DHS offers a web-based service that federal, state, and local benefit-issuing agencies, institutions, and licensing agencies use to verify the immigration status of benefit applicants so that only those entitled to benefits receive them. According to DHS officials, this service is also not covered by the act because it does not involve comparison of two complete systems of records.

In contrast, officials from USDA’s Food and Nutrition Service noted that a CMA was established between the states and SSA for performing front- end verification of Supplemental Nutrition Assistance Program eligibility. Similarly, ED officials stated that they require CMAs for front-end queries that establish eligibility for federal student aid. In addition, HHS officials stated that they believe the Computer Matching Act requires CMAs to cover front-end queries. Labor officials indicated that they do not use front-end verification to establish benefits eligibility.

Moreover, the Do Not Pay Working System, an online portal run by the Department of the Treasury that can conduct online queries similar to computer matching, is not currently covered by any CMAs. The system is run as part of the Do Not Pay Initiative, which was established by law in IPERIA on January 10, 2013. IPERIA requires federal agencies to use certain databases, which are to be available through the Do Not Pay Working System, for prepayment review of eligibility for payments and awards. Agencies use the portal to perform online queries to verify records related to specific individuals, a process known as front-end verification. Treasury officials stated that the initiative currently has no computer matching agreements in place because the portal operates only as a query system, which they believe does not require CMAs. They stated that in the future, upon establishment of a system of records, they plan to add batch matching for Privacy Act records, at which time they will secure computer matching agreements.

Varying agency interpretations of the scope of the act are partially due to unclear guidance from OMB on this subject. OMB’s 1989 matching guidance includes examples of front-end verification programs that are covered by the act, but none of OMB’s guidance documents indicate specifically whether queries are subject to the act. OMB’s 2013 IPERIA guidance addressed the subject indirectly by stating that matches involving “subsets” of systems of records are covered by the act. However, it did not clarify whether front-end verification queries qualify as subsets of systems of records or are otherwise covered, thus continuing to leave the subject unclear.

According to OMB, it is up to agencies to adhere to the act and official guidance. OMB staff stated that the types of data-sharing covered by the act are determined on a case-by-case basis, and OMB’s IPERIA guidance states that the act applies to matches involving a “subset” of records from a system of records. However, OMB has not clarified whether the law applies to front-end verification, which generally involves just one record, or only to the matching of larger sets of records against another database. Without clear guidance on the scope of the act, agencies are likely to continue to interpret what the act covers in varying ways, and its privacy protections are likely to continue to be inconsistently applied.

Agencies We Reviewed Did Not Always Include Key Elements for Cost- Benefit Analyses

While agency CMAs generally included cost-benefit analyses, the completeness of their analyses varied. Of the 82 CMAs from the seven agencies we reviewed, 68 included cost-benefit analyses. Eleven CMAs from the seven agencies were for statutorily required programs that did For the other 3 CMAs, SSA did not not require cost-benefit analyses.conduct cost-benefit analyses because, according to officials, it was the source agency for these matching programs. According to OMB’s 1989 guidance, while recipient agencies are suggested to take the lead in developing cost-benefit analyses, such analyses should be provided to source agencies to assist in their decision to approve or deny a CMA.

While most agencies submitted a cost-benefit analysis with their CMAs, they did not always address all four key elements identified by GAO’s 1986 report. More specifically, of the 68 cost-benefit analyses from the seven agencies that we reviewed, 2 included all the key elements, 63 included some but not all key elements, and 3 did not address any of the key elements. Fourteen cost-benefit analyses did not include personnel costs, and 14 did not include computer costs. Additionally, 13 did not include the avoidance of future improper payments, and 33 did not include an estimate of the recovery of improper payments and debts. The DIBs approved all CMAs even though most cost-benefit analyses did not include all key information.

Table 1 provides more detail on the seven selected agencies’ inclusion of key elements in their cost-benefit analyses.

The act requires that agencies conduct cost-benefit analyses in conjunction with the development of CMAs. The act states that agency CMAs must include a specific estimate of any savings from the matching program and that DIBs shall not approve any CMA without a cost-benefit analysis of the proposed program that demonstrates that the program is likely to be cost-effective. According to OMB guidance, the goal is to ensure that sound management practices are followed when agencies conduct matching programs and that they do not drain agency resources that could be better spent elsewhere.

OMB’s general guidance for conducting cost-benefit analyses for federal programs is contained in Circular A-94. However, specific guidance for cost-benefit analyses on computer matching programs, which was promised in OMB’s1989 guidance, has never been developed. In the absence of specific OMB guidance, three agencies developed their own interim guides for cost-benefit analyses, while the others had no established methodology. Specifically, VA, ED, and SSA had policies and procedures on developing cost-benefit analyses: VA had guidance that included formulas staff should use to calculate each of the key elements, and SSA used OMB Circular No. while ED used the prior GAO report;A-94. The other four agencies—DHS, USDA, HHS, and Labor—did not develop or document guidance for conducting cost-benefit analyses. Without guidance from OMB that specifically addresses the necessary elements of cost-benefit analyses for computer matching, agencies are likely to continue to inconsistently assess the costs and benefits of their proposed matches and may be unable to demonstrate that such matches are a cost-effective use of resources.

Agency Data Integrity Boards Did Not Always Comply with Requirements

While they varied in size and composition, all seven agencies we reviewed established DIBs as required by the act. As required by the act, all of the DIBs included senior officials and the inspector general, as shown in table 2.

All seven agencies also have issued agency-wide policy and guidance that addresses DIB membership and responsibilities, in compliance with the act. According to these agency policies, the DIBs’ primary purpose is to review and provide final approval of CMAs and associated cost-benefit analyses. Each of the 82 CMAs from the seven agencies we reviewed showed evidence that they were reviewed and approved by the DIBs.

However, as noted previously, DIBs approved cost-benefit analyses that did not always include all key data elements. For example, the DIB at USDA approved one cost-benefit analysis that did not include any estimate of cost or benefits and provided no estimated value. In addition, DIBs at the seven agencies we selected for review approved 13 cost- benefit analyses that did not identify an estimate of the avoidance of future improper payments, as well as 33 cost-benefit analyses that did not identify an estimate of the recovery of improper payments and debts.

Without the DIBs ensuring that cost-benefit analyses include key costs and benefits, agencies will have less assurance that their computer matching programs are a cost-effective use of resources.

In addition to reviewing specific proposed CMAs and their associated cost-benefit analyses, the Computer Matching Act requires DIBs to conduct an annual review of agency matching programs. These annual reviews are an important element of the act’s privacy protections and are intended to (1) determine whether matches have been or are being conducted in accordance with appropriate authorities and under the terms of the matching agreements and (2) assess the utility of the programs in terms of their costs and benefits. Appendix I to OMB Circular No. A-130, on the management of federal information resources, includes guidance for implementing the reporting requirements for computer matching agreements.

However, the DIBs have not always followed the review and reporting requirements of the act or OMB guidance. Of the seven agencies, only VA provided evidence of an annual DIB review and report of computer matching activities. According to officials at HHS and ED, they do not submit such a report because OMB guidance only requires the submission of a biennial report. Without annual reviews, agencies and OMB have less assurance that matches are being conducted in accordance with the terms of matching agreements and that the programs are justified and viable in terms of cost and benefits. In addition, the transparency of agency computer matching programs may be limited if annual reviews are not conducted.

OMB staff agreed that they have required agencies to submit only biennial reports rather than the annual reports required by the act: OMB guidance requires DIBs to report on computer matching activity every 2 years. This guidance is inconsistent with the Computer Matching Act, which requires an annual reporting of computer matching activity. OMB did not revise its guidance to reflect amendments to the act in 1995 and 1998. to conduct annual reviews of all computer matching programs, even if it does not require them to report on those reviews annually as required by the act.

However, OMB staff stated that OMB guidance still requires DIBs While only VA submitted annual reports, other agencies submitted the OMB-required biennial reports only intermittently:

While the DIBs at VA, ED, and SSA have submitted biennial reports over the last 5 years, HHS did not submit one in 2012.

Appendix I of OMB Circular No. 130 (as reflected in 1993, 1996, and 2000 revisions), states that the act requires DIB reporting on computer matching activity every 2 years; however, this is inconsistent with the Computer Matching Act (specifically, 5 U.S.C. § 552a(u) and (s)), as amended by sec. 1301 of Pub. L. No. 105-362 (Nov. 10, 1998), and sec. 3003 of Pub. L. No. 104-66 (Dec. 21, 1995).

Labor’s DIB did not submit biennial reports in 2008 or 2012. Officials stated they were waiting for instructions from OMB to send their latest one.

USDA did not submit two of the last three biennial reports. USDA officials stated that they were not able to send past reports due to resource constraints.

DHS’s DIB has not submitted any biennial reports. However, it reports summary information on computer matching programs annually in the privacy portion of its Federal Information Security Management Act (FISMA) report to OMB. According to DHS officials, this reporting meets the requirements of the act.

Table 3 shows submission of biennial reports from 2008 through 2012 by the seven agencies we reviewed.

In addition, while the law does not specifically require agencies to publish reports on their websites, it does require they be made publicly available. However, existing reports were not always accessible on six agencies’ websites. Only one agency, VA, had a recent biennial report posted online. DHS had posted its annual privacy report, which includes information on new CMAs, on its website. ED officials stated they are in the process of upgrading their website and plan to post the reports at a future date. SSA and USDA require that individual requests be submitted to gain access to their biennial reports. Labor does not post any reports, and officials said they are not aware of any public requests for them.

Also, we found that the agencies submitting biennial reports (USDA, ED, HHS, Labor, VA, and SSA) did not always include all the information required by OMB guidance. For example, VA was the only agency included in our review that submitted biennial reports with cost-benefit analysis ratios; however, for certain programs it was not able to determine cost savings information or whether the program had a favorable cost- benefit ratio. Labor did not include in its biennial report whether the CMAs approved or conducted during the 2 years covered by the report had a favorable cost-benefit ratio. Other agencies (USDA, ED, HHS, and SSA) stated in their biennial reports that all their matching programs had favorable ratios but did not provide specific cost-benefit information for any of the programs. As stated previously, not all CMAs included cost- benefit analyses or savings information; therefore, statements in agency biennial reports that all their matching programs had favorable cost- benefit ratios could be unjustified.

Without consistent DIB review and reporting, agencies’ computer matching programs are not being regularly evaluated for effectiveness by agencies and are less transparent to OMB, Congress, and the public.

OMB Has Provided Little Assistance to Agencies

The Computer Matching Act gave OMB responsibility for providing continuing assistance to agencies in their implementation of the act and the other provisions of the Privacy Act. However, agency officials stated that they have not received consistent assistance from OMB. According to USDA, DHS, Labor, VA, and SSA officials, OMB has not provided assistance to them on conducting CMAs or submitting biennial reports. However, officials at ED stated that OMB had briefed them on the CMA process, and HHS officials have not received any specific instruction from OMB on conducting CMAs. In addition, officials at the HHS OIG and SSA stated they had no knowledge of actions taken by OMB with regard to CMAs, notices, or related reports submitted to OMB.

According to OMB, it is up to agencies to adhere to the act and OMB guidance. When asked what happens if an agency does not submit a biennial report as required by OMB guidance, OMB staff said they may reach out and discuss it with the agency. However, OMB staff gave no evidence of knowing the extent to which agencies have not submitted the biennial reports or following up with any of the agencies. For example, USDA did not submit a report between 2000 and 2013. Further, Labor officials stated that one reason for not submitting the 2012 biennial report is that they have been waiting for OMB to provide specific reporting instructions. The Labor officials also stated that they do not even know where to send the biennial reports at OMB. When informed of this, OMB staff said that is not consistent with the requirement to submit a report biennially to OMB. Without taking steps to follow up on reporting requirements or to provide assistance to agencies, OMB may be allowing agencies to implement the act inconsistently.

Several Factors May Discourage Implementation of CMAs at Selected Agencies

Agency officials at six of the seven agencies we reviewed told us that the act’s rigorous requirements and the CMA review processes within and among agencies were lengthy and resource-intensive and that statutory time frames for conducting matching activities were too short, discouraging implementation of CMAs. Similarly, OIG officials at four agencies stated that, given the short duration of CMAs, the typical length of the CMA approval process discouraged them from computer matching, as did the requirement that their proposed agreements be approved by agency DIBs.

For example, officials at DHS told us they avoid attempting to implement CMAs because the internal review processes are lengthy and resource- intensive and because of the relatively short duration of approved CMAs. Officials at ED, HHS, Labor, SSA, and VA agreed that the CMA review process is lengthy and resource-intensive. They said that the fact that proposed CMAs must be reviewed by both the source and recipient agencies created extensive review processes that often took a long time to complete. In contrast, officials at USDA did not think the review process was overly lengthy or resource-intensive.

To implement the requirements of the act, agencies we reviewed typically adhere to the following CMA process, which involves an extensive sequence of multiple reviews:

Development of the Computer Matching Agreement: The agency that wants to run a match on its program records (the recipient) develops a proposed CMA to receive records from another agency (the source) to match against its records. The proposed CMA must include a cost- benefit analysis that adheres to all the act’s requirements, which can add to the time and cost of developing a CMA. Reaching agreement on the CMA frequently involves negotiation between the agencies over what data will be matched and how the data will be transferred. Upon reaching a draft agreement, the proposed CMA is reviewed and approved by multiple offices, including separate legal and privacy office reviews, in each agency. Officials said that the negotiation process and legal and privacy reviews often took many months to complete.

Data Integrity Board Review: The proposed CMA is reviewed and must be approved by DIBs at both the source and recipient agencies.

Agency Head Approval: Following DIB approval, the proposed CMA must also be approved by both agency heads, requiring that the draft agreement be vetted through officials at additional offices within each agency.

Notice to Congress: Recipient agencies must allow an additional 40 days to notify the Senate Committee on Homeland Security and Governmental Affairs, the House Committee on Oversight and Government Reform, and OMB to provide an opportunity for review and comments prior to implementation of the match.

Public Notice: A notice of the computer matching program must be published in the Federal Register at least 30 days prior to implementation to provide an opportunity for interested persons to submit comments. (This public notice period can occur at the same time as notice is given to OMB and Congress.)

Figure 2 provides an overview of the typical CMA approval process.

According to agency officials, following these steps can be a lengthy process, often taking 3 months or longer to complete. For example:

An ED official stated that new CMAs usually take 9-10 months and renewals take 6 months to complete.

According to officials from the HHS Administration for Children and Families, CMAs with Supplemental Nutrition Assistance Program agencies typically take 6 to 9 months, while those with state workforce programs take up to a year.

According to officials from the DHS privacy office, the CMA process at DHS can take up to 6 months.

According to officials from VA’s Veterans Benefits Administration, CMAs can take 3 months to 1 year.

According to officials from the SSA privacy office, on average, CMAs take about a year to process or to be renewed; however, the process can take longer. Officials at VA and HHS stated that CMAs with SSA must be planned a year in advance.

Not all agency officials reported that the CMA process was lengthy. For example, USDA officials stated that the CMA process could take up to 45 days to complete.

In addition, agency officials generally believed that CMAs do not last long enough. Given the lengthy internal review processes, agency officials from ED, HHS, DHS, VA, and SSA indicated that the statutory requirement that agreements be effective for only 18 months with a possible extension for 12 additional months was too short. Given such constraints, the approval process can last nearly as long as the proposed matching program itself. These officials said that when they have a continuing need to maintain permanent matching programs they have to restart the approval process nearly as soon as a CMA is approved in order to get either a 12-month extension or to reinstate the CMA as a new agreement after an existing 12-month extension has expired. As a result of the lengthy administrative process, agencies could be discouraged from pursuing CMAs.

Similarly, DHS privacy office officials stated that the review requirements and limited duration of CMAs discouraged implementation in the department. They said that the department’s other review processes provided protections that were as good as those afforded by the act. For example, they stated that privacy protections were examined in privacy impact assessments and were assessed for all data-sharing agreements, including those that fell outside of the act. In addition, DHS privacy impact assessments are publicly available on the agency’s website and thus contribute to the transparency of the programs.

OIG officials also had concerns with the approval process for CMAs. Specifically, OIG officials at ED, DHS, SSA, and Labor stated that they were reluctant to make the effort to establish CMAs because it could take 6 months to several years to get them approved, which could overly delay their planned audit and investigative work. OIGs that did not have active CMAs, including those at USDA, ED, DHS, and Labor, said they perform computer matches only when they do not need to seek new CMAs, such as when they can use data already obtained by other entities within their departments or gathered by the states. In both such cases, separate CMAs are not required. ED OIG officials also added that although the lengthy computer matching approval process may be acceptable for agency programs that may last for multiple years, OIG's needs generally are confined to investigations and audits with limited time frames, and CMAs are less practical in those circumstances. An OIG official at HHS stated that the HHS OIG was exempt by law from having to prepare CMAs.

OIG officials at ED and representatives from the Council of the Inspectors General on Integrity and Efficiency (CIGIE) and Recovery Accountability and Transparency Board (Recovery Board) also expressed concerns about their independence in initiating and conducting computer matching programs. Specifically, they said that because agency management officials sit on the Data Integrity Boards that approve CMAs, the agency is informed of OIG investigations that intend to use computer matching, which could compromise certain investigations. Lastly, an official from the DHS OIG expressed the opinion that because the OIG’s role is advisory in nature and does not involve making official eligibility determinations based on computer matching results, the OIG should be exempt from having to establish CMAs in order to do computer matching.

Not all OIG officials agreed that CMAs were problematic. For example, OIG officials from Labor and USDA said they had not experienced independence issues at their agencies. In addition, an official from the VA OIG stated that while the computer matching process usually takes 6 to 9 months, she did not feel the requirements posed a problem for investigative projects that were adequately planned in advance. For example, the VA OIG official pointed out that the act allowed for pilot data matches (under its exemption for statistical matching) that provide an opportunity for investigative methods to be tested in advance of developing a CMA. The official stated that in one case the VA OIG had conducted pilot matches using a small data subset to determine whether it would be productive to perform a match of the entire dataset. After the pilot showed the value of conducting the match, the VA OIG initiated a CMA with the source agency, and matching under this CMA is currently under way. In this case, the length of time required to get the CMA approved was not problematic because the OIG had planned for it in advance.

Further, officials from privacy offices in several agencies, such as USDA, ED, and SSA, stated that requirements of the Computer Matching Act were valuable to their agencies as privacy protections and did not discourage use. For example, an official in the USDA Privacy Office stated that USDA ensures that mechanisms similar to those in the Computer Matching Act are incorporated in policies and practices relating to all applicable computer matching and data-sharing activities regardless of whether they are statutorily covered by the act. Similarly, officials from ED said they have applied the CMA process to data-sharing agreements not covered by the act, including a data-sharing agreement with SSA, to ensure that that program had privacy protections comparable to those provided by the act. Furthermore, officials from SSA stated that the provisions play an important role for members of the public by providing protections for their information.

Conclusions

The seven agencies we reviewed have responded to the Computer Matching Act by developing policies and procedures that comply with its requirements; however these agencies have also implemented the act inconsistently. Interpretations of the act’s scope have varied, cost-benefit analyses have not always addressed key elements, and DIBs have not always met requirements. Inconsistent implementation has led to reduced transparency of computer matching programs and raises questions of whether privacy is being protected consistently for these agencies’ computer matching activities. OMB has also not taken steps to ensure consistent implementation of the act. For example, OMB guidance does not resolve questions about what types of matching are covered by the act, as well as how to assess costs and benefits, resulting in confusion among the agencies. Without clearer guidance and assistance from OMB, the agencies we reviewed are likely to continue implementing the act inconsistently and potentially conducting computer matching programs that are neither cost-effective nor protective of privacy, as provided for by the act.

Further, the act contains a number of provisions that pose challenges for agencies, such as the act’s definitions and limited time frames for conducting computer matches. To the extent that agencies avoid performing matches because of the extensive and time-consuming process for establishing CMAs, they may be losing opportunities to identify improper payments that could result in savings to the government.

Recommendations for Executive Action

To make government-wide computer matching program planning efforts more consistent, we recommend that the Director of OMB take the following four actions: revise guidance on computer matching to clarify whether front-end verification queries are covered by the Computer Matching Act, direct agencies to address all key elements when preparing cost- ensure that DIBs prepare and submit annual reports of agency-wide computer matching activities, and ensure that agencies receive assistance in implementing computer matching programs as envisioned by the act.

We are also making specific recommendations for the seven agencies in our review to improve the implementation of the act as follows.

We recommend that the Secretary of Agriculture develop and implement policies and procedures for cost-benefit analyses related to computer matching agreements to include key elements such as personnel and computer costs, as well as avoidance of future improper payments and recovery of improper payments and debts; ensure the DIB reviews cost-benefit analyses to make certain cost savings information for the computer matching program is included before approving CMAs; and ensure the DIB performs annual reviews and submits annual reports on the agency’s computer matching activities, as required by the act.

We recommend that the Secretary of Education develop and implement policies and procedures for cost-benefit analyses related to computer matching agreements to include key elements such as personnel and computer costs, as well as avoidance of future improper payments and recovery of improper payments and debts; ensure the DIB reviews cost-benefit analyses to make certain cost savings information for the computer matching program is included before approving CMAs; and ensure the DIB performs annual reviews and submits annual reports on agency computer matching activities, as required by the act.

We recommend that the Secretary of Health and Human Services develop and implement policies and procedures for cost-benefit analyses related to computer matching agreements to include key elements such as personnel and computer costs, as well as avoidance of future improper payments and recovery of improper payments and debts; ensure the DIB reviews cost-benefit analyses to make certain cost savings information for the computer matching program is included before approving CMAs; and ensure the DIB performs annual reviews and submits annual reports on agency computer matching activities, as required by the act.

We recommend that the Secretary of Homeland Security develop and implement policies and procedures for cost-benefit analyses related to computer matching agreements to include key elements such as personnel and computer costs, as well as avoidance of future improper payments and recovery of improper payments and debts; ensure the DIB reviews cost-benefit analyses to make certain cost savings information for the computer matching program is included before approving CMAs; and ensure the DIB performs annual reviews and submits annual reports on agency computer matching activities, as required by the act.

We recommend that the Secretary of Labor develop and implement policies and procedures for cost-benefit analyses related to computer matching agreements to include key elements such as personnel and computer costs, as well as avoidance of future improper payments and recovery of improper payments and debts; ensure the DIB reviews cost-benefit analyses to make certain cost savings information for the computer matching program is included before approving CMAs; and ensure the DIB performs annual reviews and submits annual reports on agency computer matching activities, as required by the act.

We recommend that the Secretary of Veterans Affairs develop and implement policies and procedures for cost-benefit analyses related to computer matching agreements to include key elements such as personnel and computer costs, as well as avoidance of future improper payments and recovery of improper payments and debts; and ensure the DIB reviews cost-benefit analyses to make certain cost savings information for the computer matching program is included before approving CMAs.

We recommend that the Administrator of Social Security develop and implement policies and procedures for cost-benefit analyses related to computer matching agreements to include key elements such as personnel and computer costs, as well as avoidance of future improper payments and recovery of improper payments and debts; ensure the DIB reviews cost-benefit analyses to make certain cost savings information for the computer matching program is included before approving CMAs; and ensure the DIB performs annual reviews and submits annual reports on agency computer matching activities, as required by the act.

Agency Comments and Our Evaluation

We sent draft copies of this report to the seven agencies covered by our review as well as to the Department of the Treasury and OMB. We received written responses from USDA, ED, DHS, Labor, VA, and SSA. These comments are reprinted in appendices II through VII. All of the agencies to which we made recommendations and received comments concurred with our recommendations, with the exception of ED, which concurred with one of our three recommendations. The agencies also provided technical comments, which we have incorporated as appropriate into the final report. The HHS GAO Intake Coordinator indicated via e- mail that HHS agreed with our recommendations and offered no further comments. The Executive Director of the Bureau of Fiscal Services at Treasury provided technical comments via e-mail, which we have addressed as appropriate. OMB staff provided technical comments via e- mail which we have considered and included as appropriate. The OMB staff did not state whether the agency agreed or disagreed with our recommendations.

USDA concurred with all our recommendations and stated that it plans to move forward with implementing them. USDA noted the need for consistent, clear instructions and assistance from OMB on implementing the computer matching programs.

ED concurred with one of our recommendations, to ensure the DIB performs annual reviews and submits annual reports on agency computer matching activities, as required by the Computer Matching Act. However, ED did not concur with the other two recommendations. Regarding our recommendation to develop and implement policies and procedures for cost-benefit analyses that include all key elements, ED stated that it agreed that the elements of our recommendation are important but stated that its analyses included appropriate key elements. Specifically, the department argued that not all key elements apply to every computer matching program. For example, ED did not think it appropriate to address the recovery of improper payments and debts for matching programs to establish eligibility. However, we believe all key elements should be addressed in cost benefit analyses, even if only to note that certain types of benefits have been considered and determined not to be applicable in the specific circumstances of a given computer matching program. Without a thorough assessment, the DIB may not have sufficient information to determine whether a thorough cost analysis has been conducted. Regarding our recommendation to ensure that the DIB reviews cost-benefit analyses to make certain cost savings information for CMAs are included before approval, ED did not concur and stated that the DIB has consistently reviewed cost-benefit analyses before approving CMAs and that no change in agency practices was needed. However, our review of ED’s eight cost-benefit analyses showed that two did not address avoidance of future improper payments and five did not address recovery of improper payments and debts. Given that ED’s cost-benefit analyses did not mention these costs, which are key elements of cost savings information, the DIB would not have been able to make a full review of costs and benefits to ensure that cost savings information was included in CMAs before approving them. We continue to believe it is important that agency DIBs perform comprehensive reviews of cost- benefit analyses to ensure that benefits outweigh costs.

DHS stated that it will work to update its guidance concerning CMAs and the DIB and that it plans to update instructions on implementing policies and procedures for cost-benefit analyses to include the key elements we identified. In addition, the DHS Privacy Office plans to update its CMA process to clarify the DIB’s responsibilities in assessing cost-benefit analyses and ensure the DIB reviews and reports annually on its computer matching program. In addition to DHS’s written comments, a DHS privacy official provided technical comments in an e-mail, which we have incorporated as appropriate.

Labor concurred with our recommendations and provided technical comments. We have taken Labor’s comments into consideration and updated the report as appropriate. Labor also stated that it agreed that the computer matching process is both lengthy and resource-intensive, and we have noted this in the report.

VA stated that it would revise its current policy to include the key elements of cost-benefit analyses within the next 12 months. Furthermore, VA also plans to ensure that the DIB reviews cost-benefit analyses to make certain that cost savings information is included in CMAs before approval.

SSA stated that it is currently working on an initiative to improve its cost- benefit analysis process and will ensure that all CMAs comply with the act’s requirements and OMB’s guidance. In addition, SSA said it will ensure that the DIB receives cost-benefit analyses for proposed computer matching programs that include cost savings information prior to approval. Lastly, SSA stated that it agrees that its DIB should conduct an annual review but would defer to OMB with regard to complying with the requirement that the DIB report annually.

As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to interested congressional committees, the Director of OMB, the Secretary of Treasury and the heads of the seven agencies in our review. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (202) 512-6244 or wilshuseng@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix VIII.

Appendix I: Objectives, Scope, and Methodology

The objectives of our review were to (1) determine agencies’ responsibilities under the Computer Matching Act, (2) determine how selected agencies are implementing that act with regard to federal benefits programs, and (3) describe the views of officials at selected agencies on the process of developing and implementing computer matching agreements (CMA).

To describe agencies’ responsibilities under the Computer Matching Act, we reviewed the law, as well as other relevant laws, policies, and guidance that address computer matching for program integrity purposes. We also interviewed agency officials and examined agency documents on computer matching programs and processes. We focused on federal agencies with the highest expenditures in benefits and assistance programs, specifically the Departments of Agriculture (USDA), Education (ED), Health and Human Services (HHS), Homeland Security (DHS), and Veterans Affairs (VA), and the Social Security Administration (SSA). We added the Department of Labor (Labor) because it oversees significant employment benefit programs and there were some indications that the Labor Office of Inspector General (OIG) had faced challenges in using CMAs. Labor is also one of the 10 federal agencies with the highest expenditures in benefits and assistance programs. We also reviewed guidance developed by the Office of Management and Budget (OMB) on computer matching. In addition, we obtained information from the Department of the Treasury on the Do Not Pay Working System and the Do Not Pay Initiative, and their relationship to the computer matching provisions of the Privacy Act. We analyzed the requirements of the act and OMB guidance and confirmed with agency officials the typical process for conducting computer matching programs. In addition, while the provisions of the act established procedural safeguards for benefit programs and federal personnel management, we mainly focused on requirements for agencies to establish or verify eligibility for federal benefits.

To determine selected agencies’ implementation of the act with regard to federal benefits programs, we compared the requirements of the act with agencies’ computer matching agreements, including accompanying cost- benefits analyses and documentation of agency processes for reviewing the draft agreements. Specifically, we examined computer matching agreements to determine if the agreements contained information required by the act. In addition, we reviewed the accompanying cost- benefit analyses to determine if they contained relevant information to conclude that the matching program was beneficial to the agency. Specifically we reviewed the 1986 GAO report for criteria on cost-benefit analyses since OMB guidance refers agencies to it and because agencies we reviewed used it. We selected four key elements of costs and benefits (cost: personnel and computer costs; benefits: avoidance of future improper payment and recovery of improper payments and debts) and determined whether the agencies’ cost-benefit analyses included these key elements. We also reviewed the activities and documentation of the Data Integrity Boards (DIB) to determine if they followed the requirements of the law. Specifically, we examined the structure of the DIBs and determined whether they disapproved CMAs that included cost- benefit analyses that lacked key elements. Also, we reviewed the reporting requirements of the DIBs to determine if they issued computer matching reports as required. We also reviewed OMB’s guidance and queried agency officials to determine whether they interpreted the guidance consistently.

To describe the views of officials at selected agencies on the process of developing and implementing CMAs, we interviewed agency officials and inspectors general to determine how they implemented the act’s computer matching provisions. Furthermore, we solicited these officials’ views on the requirements of the act and whether they thought improvements could be made.

We conducted this performance audit from January 2013 to January 2014 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Comments from the Department of Agriculture

Appendix III: Comments from the Department of Education

Appendix IV: Comments from the Department of Homeland Security

Appendix V: Comments from the Department of Labor

Appendix VI: Comments from the Department of Veterans Affairs

Appendix VII: Comments from the Social Security Administration

Appendix VIII: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the individuals named above, key contributions to this report were made by John de Ferrari (Assistant Director), Wilfred B. Holloway, Tammi N. Kalugdan, Lee A. McCracken, Mimi Nguyen, David F. Plocher, and Tina M. Torabi.