Administrative Conference of the United States
in partnership with the
National Academy of Public Administration

SOCIAL SECURITY ADMINISTRATION’S
REPRESENTATIVE PAYEE PROGRAM:
INFORMATION SHARING WITH STATES

June 29, 2020

This report was prepared by the Office of the Chairman of the Administrative Conference of the United States. The views
expressed in this document do not necessarily reflect those of the Administrative Conference’s Council, its members, or its
committees.

CONTRIBUTORS

ADMINISTRATIVE CONFERENCE OF THE UNITED STATES
REEVE T. BULL
RESEARCH DIRECTOR

MARK THOMSON
DEPUTY RESEARCH DIRECTOR

BOBBY OCHOA
ATTORNEY ADVISOR

TODD PHILLIPS
COUNSEL FOR INTERGOVERNMENTAL AFFAIRS

NATIONAL ACADEMY OF PUBLIC ADMINISTRATION
BRENNA ISMAN
DIRECTOR OF ACADEMY STUDIES

JENNIFER HUGHES
PROJECT DIRECTOR

MARK THORUM
SENIOR ADVISOR

KATE CONNOR
RESEARCH ANALYST

1

Table of Contents
Executive Summary ...................................................................................................................... 6
I. Introduction ............................................................................................................................... 8
II. Potential Benefits of Information Sharing........................................................................... 11
III. Study Design ......................................................................................................................... 13
A. Data Collection ................................................................................................................... 14
B. Data Elements ..................................................................................................................... 16
C. Assumptions and Premises ................................................................................................ 17
PART 1: ADMINISTRATIVE AND OPERATIONAL BARRIERS TO INFORMATION
SHARING .................................................................................................................................... 18
I. Current Administrative Process ......................................................................................... 19
II. Current State of Data Exchanges Between SSA and State Courts ................................ 20
III. Administrative Barriers to Information Sharing .......................................................... 20
A. Challenge: Technology Barriers .................................................................................... 20
B. Challenge: Budgetary Constraints ................................................................................ 26
C. Challenge: Mandatory Data Exchange Administrative Process ................................ 28
D. Challenge: Communication Barriers Between SSA and State Court Representatives
............................................................................................................................................... 29
PART 2: LEGAL BARRIERS TO INFORMATION SHARING ......................................... 32
I. Legal Barriers to Information Sharing by SSA ................................................................ 33
A. The Privacy Act of 1974 ................................................................................................. 34
1. The Routine Use Exception ..................................................................................... 37
2. Disclosure of Representative Payee and Incapable Beneficiary Information May
Be Permissible Under the Routine Use Exception .................................................... 45
3. Additional Options for Information Sharing SSA Might Consider In Lieu of
Invoking the Routine Use Exception .......................................................................... 50
4. Consider Sharing Organizational Representative Payee Information ............... 52
B. Authorization to Share Information and Section 1106 of the Social Security Act ... 54
C. The CMPPA and Other Federal Laws ......................................................................... 55
D. Other Information Sharing Regimes ............................................................................ 56
II. Legal Barriers to Information Sharing for State Courts ............................................... 57

2

Appendix A: Key Provisions of Public Law 115-165 ............................................................... 61
Appendix B: Interview List ........................................................................................................ 63
Appendix C: Summary of Prior Reports and Documents ...................................................... 65
Appendix D: Biographical Information on EAG Members .................................................... 69
Appendix E: Web-based, Public Sector Data Exchanges........................................................ 70
Appendix F: Overview of SSA’s DEP ....................................................................................... 72
Appendix G: State Legal Barriers Chart.................................................................................. 75

3

Acronyms and Abbreviations
Acronym and
Abbreviation
Academy
ACF
ACUS
CMPPA
COSCA
DEP
DOJ
EAG
EIEN
FISMA
GAO
GLOBAL
HHS
HTTP
IT
LIHEAP
NAS
NCSC
NCSSMA
NCSSSA
NIEM
NRC
OASDI
ODEPPIN
ODXIA
OIG
OIRA
OLC
OMB
PII
PRA
PTSD
SNAP
SOLQ
SORN
SPSSBA
SSA
SSAB

Definition
National Academy of Public Administration
Administration for Children and Families
Administrative Conference of the United States
Computer Matching and Privacy Protection Act of 1988
Conference of State Court Administrators
Data Exchange Product
Department of Justice
Expert Advisory Group
Environmental Information Exchange Network
Federal Information Security Modernization Act of 2014
Government Accountability Office
Global Justice Information Sharing Initiative
Department of Health and Human Services
Hyper Text Transfer Protocol
Information Technology
Low Income Home Energy Assistance Program
National Academy of Sciences
National Center for State Courts
National Council of Social Security Management Associations
National Conference of State Social Security Administrators
National Information Exchange Model
National Research Council
Old-Age, Survivors, and Disability Insurance
Office of Data Exchange, Policy Publications, and International Negotiations
Office of Data Exchange and International Agreements
Office of the Inspector General
Office of Information and Regulatory Affairs
Office of Legal Counsel
Office of Management and Budget
Personally Identifiable Information
Paperwork Reduction Act
Post-traumatic Stress Disorder
Supplemental Nutrition Assistance Program
State On-line Query
System of Records Notice
Public Law 115-165, Strengthening Protections for Social Security
Beneficiaries Act of 2018
Social Security Administration
Social Security Advisory Board
4

SSI
SSN
SVES
TANF
VA
WINGS

Supplemental Security Income
Social Security Number
State Verification and Exchange System
Temporary Assistance for Needy Families
Department of Veterans Affairs
Working Interdisciplinary Network of Guardianship Stakeholders

5

Executive Summary
The Social Security Administration (SSA) provides benefits to vulnerable members of
society, including children, the elderly, and people with disabilities. In performing its mission,
SSA is authorized to make benefit payments to a representative payee, who is a designated
individual or organization who manages benefits on behalf of a beneficiary, if the beneficiary is
found to be incapable of managing or directing the management of his or her own benefits. In
April 2018, the President signed into law the Strengthening Protections for Social Security
Beneficiaries Act of 2018 (SPSSBA), to improve efforts to protect Social Security beneficiaries
who rely on representative payees. The SPSSBA calls for a study by the Administrative
Conference of the United States (ACUS) of the opportunities and barriers to improved
information sharing between SSA’s Representative Payee Program and state entities that
administer guardianship/conservatorship programs. ACUS partnered with the National Academy
of Public Administration (the Academy) in conducting the study. The Academy conducted the
portion of the study relating to administrative and operational opportunities and barriers, and
ACUS completed the portion relating to legal barriers.
The study generated the following key findings that are explained in the report that
follows:
Information Sharing Opportunities:
•

Potential synergies exist between SSA’s Representative Payee Program and the legal
guardianship activities of the state courts, as they tend to rely on the same data to execute
at least three common functions: capability determinations, selection of a representative
payee or guardian/conservator, and oversight of representative payees and
guardians/conservators.

•

The creation of information sharing mechanisms between SSA and state courts could
improve outcomes for incapable individuals, while also providing greater integrity to
SSA’s Representative Payee Program and state courts’ guardianship/conservator
programs.

Administrative and Operational Barriers to Information Sharing:
•

Technological barriers to information sharing exist for both SSA and state courts. These
barriers, at least in part, may be overcome by developing a web-based technology, such
as proposed within the Data Exchange Product (DEP), for this purpose.1

•

Given the technology used by SSA in their current data exchanges, the budget or resource
allocation constraints of SSA and state courts present a significant barrier to information
sharing, particularly in the initial development phase. However, once established, a webbased exchange could offer cost savings, thus freeing resources to be reallocated.

•

The complex administrative process for implementing data exchanges between SSA and

1

The Data Exchange Product, discussed more fully in Appendix F, is an information technology infrastructure
concept for data exchange modernization to provide users the ability to request, send, receive, and administer
incoming and outgoing exchange of information.

6

state entities presents an administrative barrier to information sharing and could be
addressed through streamlined and standardized processes that can be adopted by SSA
and the states.
•

Communication barriers that exist between SSA and state courts pose an obstacle to
information sharing. SSA should consider developing an institutionalized, two-way
mechanism for it and state court representatives to better work together.

Legal Barriers to Information Sharing:

2

•

The principal legal barrier to SSA sharing information with state courts is the Privacy Act
of 1974. Though SSA may be able to disclose limited types of representative payee and
incapable beneficiary information under the Privacy Act’s “routine use” exception, the
study team2 recommends that SSA seek a legal opinion from the Office of Legal Counsel
(OLC) in the Department of Justice (DOJ) before invoking this exception. If SSA does
not wish to invoke the routine use exception, it may consider seeking consent from
representative payees and beneficiaries allowing SSA to share certain limited types of
information with state courts or seeking a targeted Privacy Act exception from Congress
allowing the sharing of this information. Because the Privacy Act does not apply to
organizations as a general matter, SSA is likely permitted to disclose information to state
courts about organizational representative payees.3

•

Information sharing must be in accordance with appropriations law and Section 1106 of
the Social Security Act. If SSA decides that the information it obtains from state courts in
return for its own information sufficiently advances its statutorily authorized functions,
SSA could use appropriated funds to establish and operate the contemplated informationsharing regime. Otherwise, SSA could invoke Section 1106(b) to establish the
information-sharing regime with state courts and may charge them for the information. In
either case, SSA would need to have regulations authorizing such disclosures to state
courts.

•

State courts generally face three main types of legal barriers to sharing information with
SSA: (1) statewide privacy statutes that resemble the federal Privacy Act of 1974 and
generally govern the disclosure of personal information by state entities; (2) statewide
statutes that specifically limit disclosure of social security numbers (SSNs); and (3) state
court judicial rules that govern the collection and disclosure of personal information in
case records and related documents. In most states, however, the only potentially
significant barrier arises due to judicial rules that govern collection or disclosure of
relevant guardian/conservator information.

Throughout the report, the “study team” refers collectively to ACUS and the Academy.

3

As explained further in the legal analysis below, SSA has not previously conducted significant analysis of which
categories of information it would find beneficial if it were to be obtained from state courts. As such, the study team
premised its Privacy Act analysis on a hypothetical scenario in which limited pieces of information (the names,
dates of birth, and SSNs of incapable beneficiaries, representative payees, and state guardians/conservators, and
whether such payees or guardians/conservators had previously been removed or disqualified) are shared. See p. 17,
infra.

7

I. Introduction
SSA provides Old-Age, Survivors, and Disability Insurance (OASDI) and Supplemental
Security Income (SSI) benefits to vulnerable members of society, including children, the elderly,
and people with disabilities, as well as auxiliary beneficiaries.4 In performing its mission, if SSA
finds a beneficiary incapable of managing or directing the management of his or her own
benefits, the agency is permitted to appoint a suitable representative payee to manage the
payments on the beneficiary’s behalf.5 SSA appoints representative payees only to manage
Social Security or SSI payments, and the appointment does not confer legal authority over other
matters, such as non-Social Security income or medical matters.6
A representative payee can be a suitable individual (such as a relative, guardian, friend,
or any other interested person who is in a position to care for the beneficiary) or a suitable
organization (such as a social service agency, an institution, a state or local government agency,
or a financial institution).7 After selection, a representative payee receives benefit payments from
SSA on behalf of the beneficiary, uses the money to meet the beneficiary’s current needs and pay
for other permitted expenses,8 maintains accurate records, communicates with SSA, and files
periodic reports with SSA.9
Congress first authorized the Representative Payee Program in 1939. Since then, SSA has
implemented new operational practices and reforms in response to legislation passed in 199010
4

SSA also provides benefits to auxiliaries who may or may not fall into these other categories of vulnerable
populations. Typically, auxiliary beneficiaries include dependent spouses and children of individuals receiving
social security.
5

42 U.S.C. §§ 405(j), 1383(a)(2); 20 C.F.R. §§ 404.2001 et seq., 416.601 et seq. See also Representative Payee,
SOC. SEC. ADMIN., https://www.ssa.gov/payee/index.htm (last visited June 1, 2020).
6

SOC. SEC. ADMIN., A GUIDE FOR REPRESENTATIVE PAYEES, https://www.ssa.gov/pubs/EN-05-10076.pdf (last
visited June 1, 2020); SOC. SEC. ADMIN., GUIDE FOR ORGANIZATIONAL REPRESENTATIVE PAYEES 22,
https://www.ssa.gov/payee/NewGuide/toc.htm (last visited June 1, 2020) (“Limits to What a Payee May Do”).
7

42 U.S.C. §§ 405(j)(1)(A), 1383(a)(2)(A)(i); 20 C.F.R. §§§ 404.2020, 416.620.

To meet the beneficiary’s needs, representative payees typically use the money to pay for the beneficiary’s food,
clothing, housing, medical care, personal items, and other immediate and reasonably foreseeable needs. 20 C.F.R.
§§ 404.2040, 416.640.
8

9

SOC. SEC. ADMIN., A GUIDE FOR REPRESENTATIVE PAYEES, supra note 6, at 1–13; SOC. SEC. ADMIN., GUIDE FOR
ORGANIZATIONAL REPRESENTATIVE PAYEES, supra note 6, at 16–17 (“Duties of a Representative Payee”).
10

The Omnibus Budget Reconciliation Act of 1990, Pub. L. No. 101-508, § 5105, 104 Stat. 1388, 1388-254,
required SSA to verify the identification of representative payee applicants and determine if the applicant had been
convicted of social security fraud; prohibited the appointment of representative payees who had been convicted of
social security fraud; prohibited certification of a representative payee without adequate evidence that the
certification is in the interest of the beneficiary; required SSA to establish and maintain a centralized, current file,
accessible to SSA’s local offices, identifying persons who have previously misused OASDI or SSI benefits;
generally prohibited a beneficiary’s creditor from serving as his or her representative payee; directed SSA to provide
beneficiaries with notice of a determination that they need a representative payee, including an explanation of their
right to appeal such determination; directed SSA to terminate payment of benefits to a representative payee who
misuses such benefits and to certify payments to an alternative representative payee or to the individual; allowed for
compensation to certain social service agencies that serve as representative payees and limited the amount of fees

8

and 2004.11 Despite those improvements, many organizations and key stakeholders, including the
Social Security Advisory Board (SSAB), the Government Accountability Office (GAO), the
National Academy of Sciences (NAS), the National Research Council (NRC), the SSA Office of
the Inspector General (OIG), and the Conference of State Court Administrators (COSCA), later
conducted studies and issued reports calling for more reforms involving, among other things, the
selection and oversight of representative payees.12
These studies also identified the need for enhanced collaboration and information sharing
between SSA’s Representative Payee Program and state court guardianship/conservatorship
programs. Although state guardianship/conservatorship practices vary from state to state, in
general, state courts appoint an individual or organization to make important decisions regarding
a beneficiary’s life or property upon a determination that the adult lacks the capacity to do so
him or herself.13
For example, in 2004, GAO observed that state courts and federal agencies “collaborate
little in the protection of incapacitated elderly people and the protection of federal benefit
payments from misuse” and recommended increased coordination between federal agencies and
state courts that appoint guardians.14 Two years later, GAO concluded that little had changed.15
In a subsequent 2011 report, GAO concluded that information sharing among federal fiduciary
programs and state courts could improve protection of incapacitated adults, and it recommended
“the Commissioner of SSA take whatever measures necessary to allow it to disclose certain

such agencies may collect; required SSA to maintain a centralized, current file, accessible to local SSA offices,
identifying all representative payees and the beneficiaries using their services; and required SSA offices to maintain
a current list of the public agencies and community-based nonprofit social service agencies qualified to serve as
representative payees and which are located in the area served by such an office.
11

The Social Security Protection Act of 2004, Pub. L. No. 108-203, 118 Stat. 493, principally required that SSA
perform periodic onsite reviews for all nonprofit fee-for-service payees, organizational payees (both governmental
and nongovernmental) serving 50 or more beneficiaries, and individual payees serving 15 or more beneficiaries;
required SSA to ensure all fee-for-service organizational representative payees are licensed and bonded; disqualified
an individual from serving as a representative payee if he or she was convicted of an offense resulting in more than
one year of imprisonment; and gave SSA the authority to impose a civil monetary penalty for offenses involving
misuse of OASDI or SSI payments received by a representative payee on behalf of another individual.
See, e.g., U.S. GOV’T ACCOUNTABILITY OFFICE, GAO-13-473, ADDRESSING LONG-TERM CHALLENGES REQUIRES
A MORE STRATEGIC APPROACH 16 (2013).
12

See, e.g., SOC. SEC. ADVISORY BOARD, IMPROVING SOCIAL SECURITY’S REPRESENTATIVE PAYEE PROGRAM
(2018), https://www.ssab.gov/research/improving-social-securitys-representative-payee-program/ (last visited June
1, 2020); GOV’T ACCOUNTABILITY OFFICE, GAO-13-473, ADDRESSING LONG-TERM CHALLENGES, supra note 12, at
16; U.S. GOV’T ACCOUNTABILITY OFFICE, GAO-11-678, INCAPACITATED ADULTS: OVERSIGHT OF FEDERAL
FIDUCIARIES AND COURT-APPOINTED GUARDIANS NEEDS IMPROVEMENT 17 (2011); U.S. GOV’T ACCOUNTABILITY
OFFICE, GAO-06-1086T, GUARDIANSHIPS: LITTLE PROGRESS IN ENSURING PROTECTION FOR INCAPACITATED
ELDERLY PEOPLE 5 (2006); U.S. GOV’T ACCOUNTABILITY OFFICE, GAO-04-655, GUARDIANSHIPS: COLLABORATION
NEEDED TO PROTECT INCAPACITATED ELDERLY PEOPLE 32–33 (2004).
13

U.S. GOV’T ACCOUNTABILITY OFFICE, GAO 04-655, GUARDIANSHIPS: COLLABORATION NEEDED TO PROTECT
INCAPACITATED ELDERLY PEOPLE (2004).
14

15

U.S. GOV’T ACCOUNTABILITY OFFICE, GAO 06-1086T, supra note 13.

9

information about SSA beneficiaries and fiduciaries to state courts.”16
For example, SSA maintains information about the individual or organization who is
serving as an incapable beneficiary’s representative payee. This information could be useful to a
state court when selecting an appropriate guardian/conservator under state law; if SSA has
determined that a particular individual is qualified to serve as an incapable person’s
representative payee, a state court may consider that same individual to serve as a guardian or
conservator over the same beneficiary’s other assets. Likewise, both SSA’s representative payee
and state courts’ guardian/conservator programs require aspects of oversight and monitoring. If
SSA removes a representative payee for misconduct, that would be important information for
state courts to consider when determining whether to appoint that individual as a
guardian/conservator. Conversely, it would be relevant for SSA to know if a
guardian/conservator has been removed for misconduct.17 Despite these overlapping functions
and populations served, SSA and state courts currently engage in very limited information
sharing or formal collaboration. Thus, these previous studies posit that information sharing
would, at a minimum, better inform both SSA and state court decisions about whether to appoint
a representative payee or guardian/conservator, to determine the suitability of a potential
representative payee or guardian/conservator, and to improve the oversight of existing
representative payees and guardians/conservators.
State courts have undertaken several initiatives to encourage such enhanced collaboration
and information sharing. First, COSCA has issued two resolutions calling for key reforms to
improve the communication and exchange of information between state courts with jurisdiction
over guardianships/conservatorships and SSA staff administering the Representative Payee
Program.18 Second, COSCA launched a nationwide effort to standardize data definitions between
state courts to address the need for consistent data collection. Third, in collaboration with the
National Center for State Courts (NCSC), COSCA launched the National Open Court Data
Standards to develop business and technical court data standards to support the creation, sharing,
and integration of court data in a user-friendly format.19 Together, these initiatives help address
the need for standardized definitions and data elements, potentially allowing for state courts to
16

U.S. GOV’T ACCOUNTABILITY OFFICE, GAO 11-678, INCAPACITATED ADULTS, supra note 13, at 17.

17

Interviews with SSA field office staff confirmed that in the selection of a representative payee, data about
guardians removed for malfeasance, misuse, or poor performance could be useful in making a suitability
determination. Similarly, if the guardian is also serving as a representative payee, it would be useful to receive
notification when a change in guardian/conservator occurs; notification of removal for cause raises a red flag that
would suggest the need for a higher level of scrutiny on the part of SSA.
18

See Conf. of State Court Administrators, Resolution 4: Encouraging Collaboration Between State Courts and
Federal and State Representative Payee Programs (2014),
https://cosca.ncsc.org/~/media/Microsites/Files/CCJ/Resolutions/01292014-Encouraging-Collaboration-StateCourts-Federal-State-Representative-Payee-Programs.ashx; Conf. of State Court Administrators, Resolution 1:
Urging the Social Security Administration to Amend its Regulations and Congress to Add an Exception to the
Privacy Act of 1974 for the Purpose of Protecting Assets of Social Security Recipients (2017),
https://ccj.ncsc.org/~/media/Microsites/Files/CCJ/Resolutions/08092017-1-SSA-Amending-Regulations-PrivacyAct-1974.ashx.
NAT’L CTR. FOR STATE CTS., NAT’L OPEN CT. DATA STANDARDS, https://www.ncsc.org/nods (last visited June 1,
2020).
19

10

have an improved ability to match and exchange data with SSA.
In 2017, the House Ways and Means Subcommittee on Social Security held several
hearings on the SSA Representative Payee Program. These hearings included testimony from
SSA officials, including representatives from SSA’s OIG, and key stakeholders. During the
hearings, there was considerable discussion of the apparent need for improved information
sharing between state courts determining guardianship/conservatorship and SSA staff
determining representative payees, given the significant overlap between those who are both
guardians/conservators and representative payees.20 Shortly after these hearings, the SPSSBA
was passed.
In the SPSSBA, Congress included a provision requiring a study by ACUS to evaluate
the potential opportunities and barriers to information sharing between SSA and state entities
regarding representative payees and guardians/conservators.21 Specifically, Congress directed
that the study provide:
“(A) an overview of potential opportunities for information sharing between
[SSA] and State courts and relevant State agencies;
“(B) a detailed analysis of the barriers to such information sharing, including any
Federal or State statutory barriers;
“(C) a description of how such information sharing would be implemented,
including any additional infrastructure needed; and
“(D) a description of any risks or other factors that [SSA] and the Congress
should consider before implementing such information sharing.”22
II. Potential Benefits of Information Sharing
The study team concludes that the creation of information sharing mechanisms between
SSA and state courts could improve outcomes for incapable individuals while also providing
greater integrity to SSA’s Representative Payee Program and state court
guardianship/conservatorship programs. As noted above, SSA field office staff and state courts
currently engage in very limited information sharing, even though they often serve similar
populations of elderly and non-elderly incapable individuals. Based on the study team’s
interviews with SSA field office and state court officials, as well as findings set forth in SSAB

See, e.g., Joint Hearing on Social Security’s Representative Payee Program: Hearing Before the Subcomm. on
Oversight and the Subcomm. on Social Security of the H. Comm. on Ways & Means, 115th Cong. (2017),
https://docs.house.gov/meetings/WM/WM06/20170322/105750/HHRG-115-WM06-20170322-SD001.pdf.
20

21

Appendix A summarizes the key provisions of the SPSSBA.

22

Strengthening Protections for Social Security Beneficiaries Act of 2018, Pub. L. No. 115-165, § 103(c)(1), 132
Stat. 1257, 1263.

11

and GAO reports,23 this premise appears particularly true for three common functions that both
SSA and state courts perform: capability determinations, representative payee or
guardian/conservator selection, and representative payee and guardian/conservator oversight.24
First, SSA is authorized to determine whether beneficiaries are capable of managing or
directing the management of their own cash benefits and, if they are deemed incapable, to
appoint a responsible third party to serve as their representative payee, who serves as the
beneficiary’s fiduciary solely for SSA benefits.25 The procedure carried out by SSA staff is
known as a capability determination and requires field office employees to consider factors such
as the physical and mental health of the beneficiary, the beneficiary’s living situation, how the
beneficiary’s money is being handled currently, and how the beneficiary’s needs are being met.26
Similarly, state courts may conduct a capability determination and conclude that an adult is not
capable of managing his or her own personal affairs or property and designate a responsible third
party to serve as his or her guardian/conservator. Both SSA field office staff and state court
officials27 stated during interviews that it would be particularly helpful when making their
respective capability determinations to know whether the individual had already been assigned a
representative payee or guardian/conservator. This is particularly true with respect to SSA’s
determination because, if an individual has been deemed legally incompetent by a court, SSA
will likely determine that he or she would require a representative payee.
Second, both SSA field office staff and state court officials also explained that when an
incapable individual has both a representative payee and a guardian/conservator, it is typically
beneficial for the same individual to serve in both capacities.28 This position is also supported in
See, e.g., SOC. SEC. ADVISORY BOARD, IMPROVING SOCIAL SECURITY’S REPRESENTATIVE PAYEE PROGRAM
(2018), https://ssab.gov/Portals/0/OUR_WORK/REPORTS/ImprovingRepPayee2018.pdf (recommending that
OMB consider “creat[ing] a shared database for federal benefit-paying agencies and state and local courts that make
guardianship decisions”); GOV’T ACCOUNTABILITY OFFICE, GAO-11-678, INCAPACITATED ADULTS, supra note 13,
at 17.
23

The study team notes that SSA’s criteria, process, and purpose for making a capability determination are different
than the criteria, process, and purpose of a state court’s incompetence determination.
24

25

The SPSSBA required SSA to create policies for SSA beneficiaries to designate a representative payee in advance
of SSA’s determination that the beneficiary needs a representative payee. Strengthening Protections for Social
Security Beneficiaries Act of 2018, supra note 22, § 201. SSA finalized these regulations in February 2020. Soc.
Sec. Admin., Advance Designation of Representative Payees for Social Security Beneficiaries, 85 Fed. Reg. 7661
(Feb. 11, 2020).
SOC. SEC. ADMIN., PROGRAM OPERATIONS MANUAL GN 00502.060, “MAKING A CAPABILITY DETERMINATION,”
https://secure.ssa.gov/poms.nsf/lnx/0200502060 (last visited June 1, 2020).
26

Throughout this report, references to comments made by SSA “field office” and “headquarters” staff or officials,
as well as “state court” officials and other categories of interviewees, do not necessarily represent the views of all
interviewees from such group, but rather only that some interviewees expressed the articulated opinion.
27

28

However, according to SSA policies, SSA does not necessarily prioritize guardians above family in payee
selection. See SOC. SEC. ADMIN., PROGRAM OPERATIONS MANUAL GN 00502.105B, “PREFERRED REPRESENTATIVE
PAYEE ORDER OF SELECTION CHARTS,” https://secure.ssa.gov/apps10/poms.nsf/lnx/0200502105 (noting a legal
guardian with custody of the beneficiary or who demonstrates strong concern for the beneficiary’s well-being is of
equal preference to a spouse or other relative who similarly has custody of the beneficiary or demonstrates strong
concern for the beneficiary's well-being).

12

prior studies, including in a 2007 NRC report on SSA fiduciary programs. The report
recommended that SSA give preference to existing legal guardians when designating a fiduciary,
citing potential “conflicts among federal law, SSA policies, and state practices” that could arise
when an incapacitated adult’s SSA-designated fiduciary and his or her court-appointed guardian
are not the same person.29 Thus, information regarding the individual serving in either role would
benefit both SSA and state courts when they select or are required to reassign a third party to
serve in either role.
Third, both SSA field office staff and state court officials stated that they believed
information sharing would also provide meaningful improvements to their respective oversight
of representative payees and guardians/conservators. Indeed, state court officials expressed
concern that there had been several cases where an individual was removed from serving as a
guardian/conservator for misconduct but nonetheless continued to serve as that incapable
individual’s SSA representative payee. They also expressed concern that, due to the lack of
information sharing with SSA, there may be cases where the reverse was true. SSA field office
staff expressed similar concerns.30 Thus, both SSA field office staff and state court officials posit
that sharing information regarding changes to the individual serving as representative payee or
guardian/conservator would improve their oversight and monitoring of representative payees and
guardians/conservators and thereby better protect incapable individuals from harm.
In addition to these benefits, some SSA field office staff stated they believe information
sharing might also produce other ancillary benefits, such as improved customer service, faster
turnaround for routine office tasks, and more efficient use of front office resources. Currently,
certified paper documentation is required for proof of guardianship and other statuses. This
requirement causes delays in processing, extra effort on the part of SSA field staff and
beneficiaries, and unnecessary errors due to the lack of real-time information.
III. Study Design
The study team designed this study to investigate the operational and legal opportunities
and barriers to information sharing between SSA and state courts. In conducting preliminary
research, the study team has learned that state courts are the principal repository of
guardianship/conservatorship information in all states. Because courts are the entities that would
exclusively or nearly exclusively exchange guardianship/conservatorship information with SSA,
the study team has determined that the prudent use of resources would be to focus on information
exchanges between those entities and SSA.31

29

NATIONAL RESEARCH COUNCIL, IMPROVING THE SOCIAL SECURITY REPRESENTATIVE PAYEE PROGRAM: SERVING
BENEFICIARIES AND MINIMIZING MISUSE (Nat’l Academies Press, 2007).
30

In one SSA field office, staff explained to the study team that the courts in their area had a practice of sending a
letter notifying them of changes regarding an incapacitated person’s guardian/conservator, but that because those
letters did not contain the incapacitated person’s SSN, they had no way of identifying the incapacitated person or
determining whether a new representative payee should also be assigned.
31

Incidentally, the legal barriers for information sharing are likely lower for state courts than for state agencies as
courts are often exempted from state privacy laws that might otherwise pose a barrier to information sharing.

13

The study team has divided the study and this report into two main parts. The first part
addresses the opportunities and barriers for information sharing between SSA and state courts
from an administrative and operational standpoint. It was completed by the Academy. The
Academy is a congressionally chartered, non-partisan, non-profit academy that principally
functions as an expert advisor to government agencies on matters of public administration.32
Since its inception in 1967, the Academy has successfully conducted hundreds of studies related
to improving the effectiveness and efficiency of federal agency programs. To benefit from the
Academy’s deep expertise in these areas, ACUS partnered with the Academy to complete the
administrative and operational aspects of the study. The second part of the report addresses the
legal barriers for information sharing. It was completed by ACUS’s Office of the Chairman.
Following these two parts is a series of Appendices containing more information relevant to the
study.
A. Data Collection
The study was conducted from April through December 2019 and employed qualitative
research methods.
Law and Literature Review
To identify the opportunities and potential barriers to information sharing, the study team
reviewed federal statutory requirements; guidance on information sharing practices and
information security requirements as promulgated by the Office of Management and Budget
(OMB) and SSA; literature and official documentation related to SSA’s Representative Payee
Program, including related congressional hearings and reports conducted by GAO, SSAB,
ACUS, and the SSA OIG; federal court decisions and DOJ OLC opinions regarding the scope
and import of potential barriers to information sharing; and state statutory requirements
regarding information sharing. The law and literature review provided a baseline for the report’s
findings.33
Interviews
Along with this review of the legal requirements and relevant literature, the study team
conducted semi-structured interviews34 with a range of stakeholders, including experts,
advocates, and federal and state representatives involved with state guardianship/conservatorship
programs or SSA’s Representative Payee Program. Interviews were conducted in person or by
phone with SSA headquarters staff from the Office of Retirement and Disability Policy; Office
of Data Exchange, Policy Publications, and International Negotiations (ODEPPIN); Office of
Operations; Office of Systems; Office of the General Counsel; and Office of Legislation and
32

See NAT’L ACAD. OF PUBLIC ADMIN., https://www.napawash.org/about-us/who-we-are/ (last visited June 1, 2020).

33

Appendix C summarizes prior reports and other documents.

34

The interviews with each category of stakeholders (e.g., SSA officials, state court officials, and so forth) were
conducted using a standardized set of questions related to information sharing. These questions mainly asked
interviewees what types of data they would like to receive from SSA or state courts. Interviewees also were
generally asked what they perceived to be the principal barriers to information sharing. Along with these two
principal types of questions, interviewees were also encouraged to share any additional information they believed
may be useful to the study.

14

Congressional Affairs (collectively, headquarters staff).35 The study team submitted several
follow-up questions to clarify interview details, which were answered by SSA headquarters staff.
To better understand the needs of the various SSA field and regional offices, the study team
interviewed field office staff from nine locations with diverse demographic characteristics. Those
included: Austin and San Marcos, Texas; Minneapolis, St. Paul, and St. Cloud, Minnesota;
Denver, Colorado; Chicago, Illinois; Rockville, Maryland; and Philadelphia, Pennsylvania.
Recognizing the large number and diversity of the state courts, the study team
interviewed a non-generalizable sample of state court administrators from eight states: Texas,
Minnesota, Maryland, New York, Utah, Florida, Wyoming, and Ohio. Selection criteria included
diversity of geographical location, whether the state had implemented a unified case
management system,36 and the level of technological infrastructure in place. As the sample size
was limited and state court administrators were not randomly selected, the results of these
meetings are not necessarily generalizable to all state courts.37
To garner the viewpoints of subject-matter experts, the study team interviewed the
following sample of expert and advocacy groups involved with guardianship/conservatorship
issues:
• COSCA leadership
• Representatives of several regional offices of The Working Interdisciplinary Network
of Guardianship Stakeholders (WINGS)
• Officials of the National Council of Social Security Management Associations
(NCSSMA)
• Leadership at the American Bar Association’s Commission on Law and Aging
The study team also interviewed congressional staff from the House Ways and Means
Committee and the Senate Finance Committee to better understand the congressional intent of
the language mandating this study.

35

See Appendix B for the list of interviews conducted by the study team.

36

A unified case management system refers generally to a statewide software system that virtually all courts in the
state use to manage and track case information.
37

The study relied on a non-generalizable sample of state court administrators to obtain a variety of perspectives
from a limited sample. A statistically relevant and generalizable sample would involve the random selection of a
much larger sample of state court administrators. The study team determined that conducting a nationally
representative sample would have been prohibitively expensive and resource inefficient. GAO guidance explains
that using a non-generalizable sample is appropriate to “describe aspects of an issue, understand the context of a
problem, or provide anecdotes to illustrate a finding.” U.S. GOV’T ACCOUNTABILITY OFFICE, SELECTING A SAMPLE
OF NONGENERALIZABLE CASES FOR REVIEW IN GAO ENGAGEMENTS (2017). The study team supplemented the
information received from the sampled administrators with information from national organizations representing all
state court administrators. The information provided by the national organizations was consistent with the team’s
findings from the individual state court representatives.

15

Expert Advisory Group
Finally, the study team was advised by an Expert Advisory Group (EAG) consisting of
four Academy Fellows with expertise and leadership experience in Social Security programs,
information technology (IT), privacy matters, intergovernmental programs, and financial
oversight. The Fellows met with the study team several times and provided ongoing guidance to
the study team throughout the project, including providing input on the findings from the
fieldwork, analysis, draft report, and recommendations. The biographical information of the
Academy Fellows who served on the EAG is provided in Appendix D.
B. Data Elements
Both state court and SSA field office personnel indicated that their respective programs
would better serve incapable individuals if they could access even basic information from each
other. Although they each had several unique data elements, the study team has found a common
core of data elements that each would like to request from the other.38 Those staff directly
making either guardianship/conservatorship or representative payee determinations suggested
they would find the information listed below to be most useful. The study team concludes that
narrowing the focus of information sharing to three types of data could minimize the legal and
administrative barriers and would provide an important first step to improving outcomes for
incapable beneficiaries:
•

Name, SSN, date of birth, and contact information of incapable individuals or
beneficiaries with representative payees or guardians/conservators;

•

Name, SSN, date of birth, and contact information of representative payees or
guardians/conservators; and

•

Information regarding representative payees or guardians/conservators who have been
removed or disqualified.39

In the two parts that follow, the study team’s analysis of the opportunities and barriers to
information sharing assume such sharing would, at least initially, be limited to these data
elements.

38

In reviewing feedback from state court administrators obtained in the 2014 ACUS study, the study team observed
that many respondents in that report cited the same core data elements that SSA field office staff identified as
valuable in connection with this study.
39

The underlying data exchange agreement would specify that the data exchange would be limited to specific
subpopulations of interest to each party. Additionally, state court and SSA field office officials indicated they would
find it useful to be notified when a change in representative payee or guardian/conservator occurs. However, this
would likely be a function of the technology developed to facilitate data exchange.

16

C. Assumptions and Premises
The study team notes several important caveats, particularly with respect to the legal
discussion. First, the discussions about data elements and the Privacy Act analysis included in
the sections below are premised on a hypothetical scenario. SSA has not previously conducted
significant analysis of which categories of information it would find beneficial if they were to be
obtained by state courts, or what information it might share with state courts. As such, the study
team has limited its legal analyses to the categories of information SSA field office and state
court staff identified as being useful (enumerated above) and explored the potential practical and
legal barriers under these assumptions.
Additionally, the study team notes that the information-sharing scheme described and
referenced throughout the report in most instances would not provide SSA with information
sufficiently comprehensive to be acted upon without further investigation. In most cases, SSA
headquarters staff reported that the information described—names, SSNs, and dates of birth—
would flag information for follow-up investigation, rather than provide immediately actionable
information upon which SSA could solely rely in its decision-making process. For example, if a
state court notified SSA that a specific individual or organization had been removed as guardian
or conservator for relevant misconduct, SSA headquarters staff reported that determining
whether that individual or organization is currently serving as a representative payee, whether the
misconduct is a relevant factor in SSA’s decision-making process, and whether that misconduct
is supported by relevant evidence upon which SSA could rely would likely require additional
investigation.
Finally, as SSA headquarters staff reported in interviews, there is a negative correlation
between the scope of the information exchanged and the strength of potential legal arguments
under the Privacy Act. This correlation will be analyzed more fully below.
These premises notwithstanding, the study team acknowledges SSA’s ultimate authority
to assess and weigh the value of such data exchanges in light of their respective burdens and
costs to the agency. The study did not examine such resource allocation issues, which are policy
decisions more appropriately to be made by SSA and are beyond the scope of this report’s
charge.

17

National Academy of Public Administration

PART 1: ADMINISTRATIVE AND
OPERATIONAL BARRIERS TO
INFORMATION SHARING

18

I. Current Administrative Process
For purposes of this report, data exchange means the one- or two-way sharing of
personally identifiable information (PII) with a government or private entity. The sharing of data
is typically governed by legal agreements that document the exchange and the data requestor’s
acceptance of any restrictions on the data, including confidentiality requirements.
SSA participates in hundreds of different data exchanges with federal and state agencies
ranging from SSN verifications to computer matching of databases to verify eligibility for
federal programs.40 SSA’s Office of Data Exchange and International Agreements (ODXIA) is
housed within ODEPPIN.41 ODXIA is the centralized office governing data exchange. 42 It
coordinates the data exchange agreements process, provides oversight, and formulates policy
and procedures. 43
All information sharing must be in accordance with the Privacy Act, 5 U.S.C. § 552a;
appropriations law and Section 1106 of the Social Security Act; SSA’s privacy regulations, 20
C.F.R. Part 401; and other applicable law.44 Additional SSA criteria for data exchange include
the following three factors:
•

Data System Security: The Federal Information Security Modernization Act of 2014
(FISMA) requires external entities with access to federal data to comply with
FISMA’s data security requirements.45

•

Systems Feasibility: SSA considers the systems options available to make an
exchange and whether systems development is needed.46

•

Costs of Data Exchange: SSA typically requires reimbursement of additional costs
related to the data exchange.47

Notwithstanding the above requirements, a robust information sharing practice already
exists between SSA and those state entities that administer federal benefit programs, including
the Supplemental Nutrition Assistance Program (SNAP), Temporary Assistance for Needy
Families (TANF), Low Income Home Energy Assistance Program (LIHEAP), and Foster Care
and Adoption Assistance. In administering these programs, state entities are required to use
SSA’s Income and Eligibility Verification system to verify the SSN and eligibility of all
recipients of federally funded aid in those programs. In addition, state entities are required to
follow mandatory guidelines and procedures that are outlined in information sharing agreements.

40

See, e.g., SOC. SEC. ADMIN., DATA EXCHANGE, https://www.ssa.gov/dataexchange/ (last visited June 1, 2020).

41

SOC. SEC. ADMIN., ORGANIZATIONAL CHART, https://www.ssa.gov/org/ssachart.pdf (last visited June 1, 2020).

42

SOC. SEC. ADMIN., DATA EXCHANGE, supra note 40.

43

Id.

44

A discussion of the legal barriers to information sharing is contained in Part 2 below.

45

SOC. SEC. ADMIN., DATA EXCHANGE, supra note 40.

46

Id.

47

Id.

19

SSA currently uses several different platforms for its information-sharing activities.
SSA’s State Verification and Exchange System (SVES) provides participating state entities with
a standardized method to confirm an applicant’s SSN, earnings information, and other data
required to determine eligibility. SVES was developed to provide an electronic, computer-tocomputer method by which a state can submit multiple data requests daily. The requests are then
batched together and SSA returns the data overnight. More recently, SSA developed the State
On-line Query (SOLQ)—a real-time online application of the verification and exchange system.
Using SOLQ, data requests from a state entity are processed and answered immediately.48
II. Current State of Data Exchanges Between SSA and State Courts
In contrast to the robust information-sharing practice that exists between SSA and state
entities administering federal benefit programs, information sharing among state courts and SSA
is virtually non-existent and is severely limited by the Privacy Act.49 SSA field office staff
indicated, that due to the lack of real-time information, they may be making determinations or
providing oversight of representative payees with incomplete or erroneous information.
Similarly, state court officials may be recommending and making decisions that are contrary to
the interests of those with guardians or conservators. Very often, these decisions impact the most
vulnerable beneficiaries—individuals with limited capacity to manage their own finances and
other matters.
III. Administrative Barriers to Information Sharing
While data sharing among federal and state agencies may provide numerous benefits, it
also presents potential challenges at each phase of the process comprising data collection, data
transmission, and data analysis. This section examines the administrative barriers from the
perspective of SSA and state courts, including technology barriers, budget constraints,
cumbersome data exchange processes, and communication barriers between SSA and state court
representatives. It recognizes that although certain barriers are unique to either, many are
common to both state and federal entities.
A. Challenge: Technology Barriers
As explained above, SSA has developed various data exchange platforms to
accommodate the transfer of data between SSA and entities with different IT systems and levels
of technology. However, much of the data SSA provides are gathered through older legacy
systems that rely on outdated applications and technologies. Legacy systems require constant
monitoring for data integrity and compatibility and are expensive to maintain. In general, data
from one legacy system source is formatted to be compatible with the legacy system receiving
the data, followed by a series of uploads and downloads of the data. Those systems are resourceintensive from both a human capital and a technology perspective, requiring significant

48

Id.

49

A full discussion of the Privacy Act’s implications on information sharing is included in Part 2.

20

programming resources and server capacity.50
Therefore, the technology generally used by SSA in their data exchanges (uploading and
downloading data from SSA’s legacy system to the other entity’s system) is costly and complex.
Creating a data exchange with each of the thousands of court systems presents significant
limitations from both SSA and the state courts’ perspective. However, the ability to implement
data exchanges using web-based technology and the development of cloud computing are rapidly
evolving and offer more cost-efficient solutions.
Web-based technology allows users to access a program via a network connection using
Hyper Text Transfer Protocol (HTTP).51 Users typically interact with a remote server through a
web browser interface and run the program inside a web browser, rather than utilizing a device’s
stored memory. Provided there is internet access, a user can access a web-based application from
any location at any time. Cloud computing, or the use of cloud-based applications, represents a
more advanced form of web-based applications.52 Cloud computing provides on-demand access
to a broad range of shared computing resources, including networks, servers, storage,
applications, and services. The cloud environment may be on-site or external.53
As part of a broader effort to transform IT within the federal government, OMB in 2010
mandated that federal agencies begin to shift their IT services to a cloud environment when
feasible.54 Consistent with the OMB directive, SSA is migrating internal IT systems to a cloud
environment. As of September 2019, SSA deployed its on-site-private cloud environment and 30
systems in external cloud environments. Of the 30, 17 collect, process, maintain, transfer, or
store sensitive information, such as program data and PII.55
In its 2019 report on cloud computing, GAO highlighted several key benefits of using
web and/or cloud-based applications, including cost savings, improved communication,
efficiency, and employee productivity as well as enhanced data security.56
SOC. SEC. ADMIN., OFFICE OF THE INSPECTOR GENERAL, FISCAL YEAR 2018 INSPECTOR GENERAL’S STATEMENT
ON THE SOCIAL SECURITY ADMINISTRATION’S MAJOR MANAGEMENT AND PERFORMANCE CHALLENGES (2018),
50

https://oig.ssa.gov/sites/default/files/audit/full/pdf/A-02-18-50307.pdf (last visited June 1, 2020).
51

HTTP is the protocol and foundation to transfer data over the World Wide Web.

52

The principal difference is that cloud applications utilize multiple data centers while web-based utilize a single
location.
53

See FINANCES ONLINE, CLOUD-BASED VS WEB-BASED APPLICATIONS: A COMPARISON OF FEATURES KEY
ASPECTS, https://financesonline.com/cloud-based-web-based-applications-a-comparison-of-features-keyaspects/#whatarecloud (last visited June 1, 2020).
OFFICE OF MGMT. & BUDGET, EXEC. OFFICE OF THE PRESIDENT, 25 POINT IMPLEMENTATION PLAN TO REFORM
FEDERAL INFORMATION TECHNOLOGY MANAGEMENT (2010),
https://www.dhs.gov/sites/default/files/publications/digital-strategy/25-point-implementation-plan-to-reformfederal-it.pdf (last visited June 1, 2020).
54

See SOC. SEC. ADMIN., OFFICE OF THE INSPECTOR GENERAL, STATEMENT ON SSA’S MAJOR MANAGEMENT AND
PERFORMANCE CHALLENGES (2019), https://oig.ssa.gov/sites/default/files/audit/full/pdf/A-02-18-50705.pdf (last
visited June 1, 2020).
55

See U.S. GOV’T ACCOUNTABILITY OFFICE, GAO-19-58, CLOUD COMPUTING: AGENCIES HAVE INCREASED USAGE
AND REALIZED BENEFITS, BUT COST AND SAVINGS DATA NEED TO BE BETTER TRACKED (2019).
56

21

•

Cost savings: Unlike traditional desktop applications, which require the purchase and
download of software, web and/or cloud-based applications allow users to avoid the
costs of all the required computing services. The cost is incurred as the service is
used, preserving funds for more critical needs such as IT modernization. Further
savings arise from the fact that developers are not required to write multiple versions
of the same application for different operating systems, and also because maintenance
costs are borne by the provider.

•

Greater flexibility and mobility: The use of a web- or cloud-based application
provides users greater flexibility and mobility. Web-based applications are device
agnostic—they do not require the use of a particular device or operating system. Any
device that can access a browser, including laptops, tablets, and cell phones can
access the application. This provides users the opportunity to work in any location at
any time. Finally, as the application is run on the web it does not require hard drive
storage capacity.

•

Greater efficiency: The use of a web- or cloud-based application allows agencies to
introduce new versions of a software application and modifications to an existing
work product immediately and make them available for all users, improving
efficiency and mitigating version control issues. Web- or cloud-based applications are
also more efficient. They are more intuitive, more user friendly, and require fewer
training resources.

•

Data security: The use of a web- or cloud-based application can also improve data
security as confidential data is stored on a secure server whose security is constantly
monitored by sophisticated protective mechanisms and protocols.

Cybersecurity may also present a significant challenge to data exchange. Issues can occur
at several levels, including the sharing of raw data and of statistical analysis that identifies
individuals and organizations. SSA and state courts are responsible for the safekeeping of
sensitive and important personal information of individuals and are constantly working to ensure
personal data is secure and available only to authorized entities. Recent data breaches of SSNs
and other PII illustrate how difficult this task is in the current cyber environment. FISMA
requires SSA to enforce security requirements when exchanging data. SSA meets those
requirements by ensuring that data exchange partners comply with its Information System
Security Guidelines. Those guidelines provide a detailed description of the management,
operational, and technical controls SSA requires of electronic data exchange partners to
safeguard its information. 57 Further, prior to sharing data, SSA must certify that new data
exchange partners are in full compliance with its safeguard requirements. Finally, SSA conducts
triennial security reviews of all electronic data exchange partners to ensure their ongoing
compliance with those requirements.

57

SOC. SEC. ADMIN., DATA EXCHANGE SECURITY INFORMATION, https://www.ssa.gov/dataexchange/security.html
(last visited June 1, 2020); see also Federal Information Security Management Act, 44 U.S.C. § 3541, Privacy Act
of 1974, 5 U.S.C. § 552a.

22

There are a number of success stories related to the use of web-based technology, both
within the federal government and throughout the public sector. Appendix E provides several
recent examples of data exchanges using web-based technology. Similarly, SSA had been
developing an IT infrastructure concept to modernize data exchanges, known as the Enterprise
Data Exchange Network, that demonstrated functionality that would allow sharing of real time
data using a single data-exchange platform. Interviews with SSA headquarters staff conducted in
June 2019 discussed imminent deployment progress and field visits in July 2019 garnered
indications of initial deployment as well. Subsequently, the study team was informed that this
program was renamed to the Data Exchange Project (DEP) concept and funding was no longer
provided.58
In interviews with SSA representatives from ODEPPIN, staff explained that DEP would
include a web-based functionality that would allow sharing of real-time data using a single data
exchange platform. Additionally, SSA staff explained that DEP would create a menu of standard
data elements to which SSA could grant entities access to the particular data elements that have
been agreed to through data exchange agreements. Any particular entity would only be able to
access those data elements authorized by a data exchange agreement. SSA staff indicated that the
intention was to reach “full functionality” of the DEP concept by 2021, though they expected to
continue to build on DEP after that date. However, in subsequent interviews with SSA
headquarter staff, the Academy team was informed that no funding for this type of data exchange
modernization was available at this time.
As described in the overview of the DEP in Appendix F, this effort could provide
numerous advantages, including a single point of entry for internal and external users and the
ability for customers to create user accounts and to authorize and manage those accounts, to
submit online requests, to initiate and monitor a workflow process, and to create real time
management information reports. Finally, the DEP could integrate SSA’s existing Identity and
Access Management system and comply with applicable federal and commercial security
standards, including FISMA. When fully developed, this product may reduce the need for
computer systems (SSA’s and/or the other entity’s) to be reprogrammed or reformatted in order
to exchange data and may reduce costs and time in development, implementation, and training.
Additional State Court Technological Barriers
State courts and related agencies face additional technological barriers. The difficulty
arises in part from the fact that, in the United States, each state independently defines the
structure and administrative rules for its court system.59 Consequently, data management
systems, data governance policies, definitions of data points (or “data definitions”), and the
complexity and sophistication of data collection can vary significantly from state to state.

58

The study team requested additional information about the apparent change in direction and did not receive any
clarifying information.
See CONF. OF STATE COURT ADMINISTRATORS, https://cosca.ncsc.org/ (last visited June 1, 2020); see also NAT’L
CTR. FOR STATE CTS., NATIONAL PROBATE COURT STANDARDS (2013),
https://ncsc.contentdm.oclc.org/digital/collection/spcts/id/240 (last visited June 1, 2020).
59

23

The challenge is even more complex in that not all states have court systems that are
governed by rules and procedures determined by a state court administrator. Some do not have a
common case management database. There are a number of large states where each county may
determine its own procedures, its own data collection methodologies, its own definitions, and its
own data governance policies. As a result, the timeliness of data submission, the level of
granularity/detail of data, and the level of data error can vary greatly.
There is also great variation among the courts both across and within states as to the
sophistication of their data management systems. For example, the Minnesota courts have made
significant progress in unifying and upgrading their data management systems to the point that
all county courts use the same data management system, including a probate information system
that is partially accessible to the public via the web. Maryland’s State Court Administrator
indicated that Maryland courts are also upgrading and requiring a consistent approach to data
collection across all counties.
In contrast, other state court administrators believed that their internal data collection
capabilities were not sufficiently developed to allow them to share data with other state and
federal entities. For example, several administrators commented that many court files are not
accessible online, particularly with respect to ongoing guardianship/conservatorship cases that
the records for which are stored only as paper files. Others stated that some guardian reports are
not centrally filed and may not be included in the aggregate database due to a lack of resources.
Although they acknowledged the benefits of having access to SSA data on representative payees,
they felt that the costs to develop a state-wide unified database on guardianship/conservatorship
activities might exceed those benefits. (However, with the development of the DEP, such a
unified database, while ideal, would not be necessary for accessing data from SSA. It could be
accessed by single users through the approved web portal). Finally, certain state court
representatives expressed concern about sharing PII data with federal entities and losing
oversight of the data.
Variations in data definitions and data quality among state court entities also present a
challenge. Those issues exist throughout the state court systems, which may not have
terminology consistent with SSA (e.g., legal guardian, conservator, guardian of the estate).
Further, existing state and federal data systems have been designed to collect and analyze data
sets for specific purposes.60 Aggregating data from different data management systems may
create possible data integrity issues resulting in greater data collection error rates.

COMM’N ON EVID.-BASED POL’Y MAKING, THE PROMISE OF EVIDENCE-BASED POLICYMAKING: REPORT OF THE
COMMISSION ON EVIDENCE-BASED POLICYMAKING (2017), https://www.cep.gov/report/cep-final-report.pdf (last
visited June 1, 2020).
60

24

Potential Solutions:
•

Prioritization and continued development of web-based data exchanges: A webbased, bi-directional data exchange provides data sharing participants the flexibility
to enter or upload real-time data directly to the web-based data management system
without first modifying/revising their own data management systems.61 This
facilitates the exchange of data among entities with different IT systems and levels of
technical sophistication. As noted in the above-referenced GAO report,62 such a
system would also enhance cybersecurity as data exchange partners are only provided
access to specific data sets and the confidential data is stored on a secure server with
sophisticated protective mechanisms. Web-based technology is rapidly evolving, and
a growing number of state and federal entities are partnering to develop these
exchanges. Examples include the CDX exchange used by the Environmental
Protection Agency, the SSA exchange with state departments of motor vehicles, and
the Department of Health and Human Services (HHS) data exchange with state
agencies that monitor the well-being of foster children. See Appendix E for a review
of current federal and state government data exchanges.

•

Standardized data definitions and data integration standards: There is a national effort
by COSCA to standardize data definitions throughout the court system. COSCA and
NCSC have launched a joint initiative, the National Open Court Data Standards, to
develop business and technical court data standards to support the creation, sharing,
and integration of court data in a user-friendly format.63 Both of these efforts would
address the issue of standardized definitions and data elements, allowing for
improved ability to match and exchange SSA data with the state courts.

•

Pilot with state courts with robust data collection and IT capabilities: In order to
assess the benefits and barriers to data sharing among SSA and the state courts more
accurately, a trial launch could be implemented among SSA and those states with
more robust data reporting and IT capabilities.64 As one state court administrator
commented, “the best states for sharing data are the ones that adjudicate
guardianship/conservatorship cases statewide, and not in local courts. It is more
difficult to locate information from individual counties than a single statewide
source.” Based on the information received by the study team regarding their existing
data systems, Minnesota and Maryland appear to be two states well positioned to be
pilots for this effort. Each of those states would offer a useful test for a data exchange
with SSA and would offer important insights into the costs and benefits of improved

61

The term bi-directional data exchange refers to an exchange where participants are both providing and drawing
data from the exchange.
62

GOV’T ACCOUNTABILITY OFFICE, GAO-19-58, CLOUD COMPUTING, supra note 56.

NAT’L CTR. FOR STATE CTS., NATIONAL OPEN COURT DATA STANDARDS, https://www.ncsc.org/nods (last visited
June 1, 2020).
63

64

The study team acknowledges that a pilot data exchange would be conditional on the legal authority to disclose
and consideration of other limitations discussed herein, and on there being sufficient state courts that collect the
necessary data in a technologically-sufficient manner to participate in such a pilot.

25

information sharing. If SSA and state courts determine that the trial effort is
successful, other court systems could also accrue these benefits through web-based
direct data exchanges.
B. Challenge: Budgetary Constraints
Budget or resource allocation constraints both within SSA and among the states may
present a significant barrier to implementing additional data sharing arrangements. As noted
above, if data exchanges continue through the use of expensive and cumbersome legacy systembased data exchanges, the cost of developing compatible databases with the thousands of
different court systems throughout the U.S. would be both technologically infeasible and cost
prohibitive. Further, as the SSA OIG recently observed, SSA’s use of outdated IT systems is not
sustainable as the agency is forced to use much of its IT budget to operate and maintain these
systems.65 Accordingly, SSA is actively working to migrate away from the use of legacy
systems, consistent with the OMB directive to move to cloud computing for applications
whenever feasible.
The study team queried SSA regarding the costs of developing a web-based platform for
data exchanges, understanding that the initial development of a web-based data exchange system
is often where the largest investment is required, and that the addition of other databases and
users is less resource intensive. The team also requested information on what the costs of adding
each incremental data exchange would be once the basic framework for such exchanges was
established. SSA officials explained it was very difficult to provide these figures and stated they
were unable to provide the study team with the cost information requested.
In a June 2019 interview, staff from ODEPPIN explained that their ultimate goal was to
migrate all data exchanges to the DEP concept. There would be a standard set of data variables
that would be accessed as needed by each entity engaged in a data exchange with SSA. Once this
initial data set is structured, there would likely be some changes as different entities request
different data elements that may not be part of the initial standard data set. However, SSA
ODEPPIN staff indicated that the basic information articulated by both state court staff and SSA
field office staff as their priority would be part of the initial standard data set provided through
the DEP concept. Once the DEP concept is fully developed, the cost to SSA of beginning a new
exchange with states may be minimal.
SSA ODEPPIN staff indicated they anticipate significant resource savings on their part
by migrating data exchanges to the DEP concept. Staff also stated that SSA currently must
manually process any new data exchanges and has 23 different administrative applications to
manage their thousands of data exchanges. The resource requirements to develop and maintain
web-based data exchanges would be significantly less.
Additionally, the DEP would eliminate the need for each exchange partner to build its
own data management system to communicate with SSA. This means that the burden on states
would be dramatically reduced. As noted by SSA headquarters staff, one of the goals of the DEP
See SOC. SEC. ADMIN., OFFICE OF THE INSPECTOR GENERAL, STATEMENT ON SSA’S MAJOR MANAGEMENT AND
PERFORMANCE CHALLENGES (2018), https://oig.ssa.gov/sites/default/files/audit/full/pdf/A-02-18-50307.pdf (last
visited June 1, 2020).
65

26

is to ensure that resource constraints are not a barrier to information sharing.
As stated above, SSA headquarters officials stated that there is no funding for the DEP at
this time. Nonetheless, the DEP concept appears promising if is fully developed by SSA in the
future.
Additional State Court Budgetary Constraints
Although funding for data-sharing activities may be included as part of a federal
program, it typically does not cover the costs associated with building the state court information
systems side of the exchange. A case in point is the data sharing activities among child welfare
agencies and state courts. The HHS Administration for Children and Families (ACF) and NCSC
partnered to improve the timely sharing of data between child welfare agencies and state courts.
HHS oversees the data exchange and participants include federal, state, local and tribal entities.
Although ACF provides technical guidance to courts and state welfare agencies to create the bidirectional data exchange and funds a portion of the costs, federal funding does not cover the
building or enhancing of data management systems at the tribal, state, or local level.66 Absent
sufficient additional funding, state courts would need to divert funds earmarked for other IT
related services and may not be able to participate in a timely manner. For example, the absence
of funding is one factor for the slow pace at which states have begun sharing data with SSA
regarding minor beneficiaries who enter or exit foster care, as required by Section 103 of the
SPSSBA.
Constrained state budgets and the complexity of sharing data through the
uploading/downloading methodology have slowed implementation. Interviews with SSA
officials and state court associations confirmed that to date only a few states have actually
complied with SPSSBA’s mandate, and ten others were in the queue to do so. At the time of this
report, it is not clear how or when the rest of the states will comply.
A web-based platform for this data exchange would likely allow more states to comply
with the congressional mandate for foster care data exchanges. However, SSA is currently
relying on its existing legacy-based systems for the data exchange.
The resources afforded state court systems vary widely from state to state, and their
priorities for their funding may also differ significantly. Without the use of web-based data
exchanges, it is likely that very few states or courts would have the resources necessary to
engage in a data exchange with SSA centered on representative payees or guardians. Use of the
web-based technology would largely address the budgetary issue, since states would no longer
have to invest in the expensive construction and maintenance of legacy databases. Even smaller
court systems, in states with non-unified databases, would be able to access and input data via
the web-based exchange.

See DEP’T OF HEALTH & HUMAN SERV., DATA SHARING: COURTS AND CHILD WELFARE,
https://www.acf.hhs.gov/sites/default/files/cb/data_sharing_toolkit.pdf (last visited June 1, 2020); see also NAT’L
INFO. EXCH. MODEL, HELPING CHILDREN AT RISK,
https://www.niem.gov/sites/default/files/NIEM_helping_children.pdf (last visited June 1, 2020).
66

27

Potential Solutions:
The solutions identified below assume the use of a robust, web-based data exchange
platform that is developed by SSA with access to agreed-upon data elements provided to state
courts. However, as explained above, the study team was unable to ascertain a projected budget
for the development of such a platform by SSA and was informed there is no funding for the
DEP at this time.
•

Continue development of the DEP concept and migrate SSA data exchanges to the
DEP concept. As noted by SSA staff in interviews, once the DEP concept is built, the
costs to either SSA, or partner entities, of providing access to the minimum data
requested by state court representatives may be minimal.
At the time of the study team’s June 2019 interview, SSA staff noted that moving
away from legacy-based data exchanges would free up significant staff and operating
resources, while providing greater accuracy and timeliness in data exchanges. SSA
staff also indicated that the intention was to reach “full functionality” of the DEP
concept by 2021, though they expected to continue to build on DAP after that date.
While not fully developed, the DEP concept could lessen costs for both SSA and a
state court entity with which it is exchanging information as they would not have to
construct new data platforms for loading and downloading data. Training and
transition costs would also be lower for both parties as the technology is simpler and
more intuitive. For example, SSA field office staff reported there had been no
significant training for other web-based exchanges such as the financial information
data exchange, but they still found it easy to operate and useful.

•

Given the possible funding constraints for both SSA and state courts, Congress
should consider appropriating funds for the completion and implementation of SSA’s
DEP concept. At the same time, a grant program to assist states in developing the
ability to access and utilize the web-based data exchange would help to address
budgetary barriers for state court systems.

•

To better focus the data exchange efforts, and reduce the costs and risks, those data
elements identified by both SSA and state court interviewees should be exchanged
during the initial phases of implementation. As noted above, the following data
elements were identified as the most relevant to the work of both SSA field offices
and state courts: beneficiary/ward personal information such as SSN and date of birth;
SSN, date of birth, and contact information for representative payee; and notification
regarding an individual’s termination as a representative payee or
guardian/conservator.

C. Challenge: Mandatory Data Exchange Administrative Process
The current process for SSA approval of a data exchange requires that each state or court
system enter into a data exchange agreement with SSA. This is necessary in order to ensure that
those entities with which SSA shares data will protect the security and privacy of that data, and
conversely that SSA protects the security and privacy of the data it receives. Individual states
may have disparate privacy and data sharing guidelines, including different definitions of
28

confidentiality, statutory protections, and levels of authorization to access databases.
Additionally, as described above, each state court or entity may have different terminology for
data points used by SSA. Interviews with SSA staff confirmed that the approval process can take
12-18 months, and state court entities would have to have sophisticated and well-defined IT
functions.
Potential Solutions:
•

Pilot with state courts that possess a unified court data system and are best able to
navigate the SSA process for data exchanges. Although a separate data exchange
agreement may be necessary for each system, the process and complexity of the
process could be streamlined with standardized data exchange agreements. In
interviews with SSA staff, they indicated that templates for the data exchange
agreements are available and that one could be developed for the use of data
exchanges with state courts.

•

Follow up with OMB to pursue the improvements recommended by the Data
Exchange Community of Practice, a multi-agency data exchange group. These
recommended improvements were referenced in an interview with SSA staff.

D. Challenge: Communication Barriers Between SSA and State Court
Representatives
In addition to the more specific data challenges above, the study team notes a critical
challenge related to communication practices between SSA and state court representatives.
Despite the potential synergy in data sharing, interviewees confirmed there is no institutionalized
form of communication between SSA offices and the state courts. To the extent there is any
communication between those entities, it is episodic, based on personal contacts, and severely
constrained by SSA’s interpretation of the Privacy Act’s applicability to such data sharing. The
lack of institutionalized communication for policy development between the two levels of
government at the regional level means that policies and practices that are intended to serve
similar vulnerable populations—those in need of guardians/conservators and/or payees—may be
disjointed and even contradictory.
For example, when SSA changed its priority order for assigning payees, the change was
not generally communicated to state courts that may be assigning that same person a conservator
and/or guardian. And as many state courts move to a “supported decision-making” model67 for
those with disabilities, rather than simply assigning them a guardian/conservator, it would be
beneficial if such a policy were coordinated with SSA as it determines a payee. While the
individual may still be assigned a guardian/conservator, the role of that guardian may be
diminished as the independence of the beneficiary improves.

67

A supported decision-making model works to create greater independence for those who may have been
determined to be unable to manage their own financial or other affairs. It provides the individual with support in
learning the life skills necessary to function more independently, make decisions, and reduce his or her dependence
on his or her guardian/conservator.

29

SSA lacks an institutionalized form of communication between its regional offices and the
state courts
In some locations, field office staff developed contacts with individuals within the state
courts and developed approaches to supplement the evidence already received through verbal
verification. However, the majority of information sharing between SSA and the courts remains
heavily dependent on documentation provided by the representative payee/guardian/conservator.
The use of some paper documentation, such as guardianship/conservatorship certifications,
marriage certificates, and travel documentation, can be difficult and costly for beneficiaries or
their guardian to access. Further, as SSA field office staff stated, relationships based on
individual contacts are difficult to maintain due to changes in personnel in either SSA offices or
the state courts.
There is no formal mechanism for regular two-way communication between state courts
and SSA regarding policy or other issues—at both the field office and regional office levels.
Although there are some states that have an active WINGS chapter, whose mission it is to
enhance communication for the benefit of those with Social Security representative payees or
guardians, participation by SSA is episodic and limited. Furthermore, since the participation in
WINGS is an added responsibility for often over-burdened staff in both SSA and the state courts,
offices may simply not have the resources to activate and maintain a WINGS chapter.
State courts face organizational communication barriers
Other factors that contribute to the lack of communication include state officials who
may not see the benefit to, or may be unable to commit the resources to, ensure institutionalized
communication with SSA. There are also states with particularly fragmented court systems that
may be less able to ensure standardization within their states.
Despite these challenges, a recommendation from state court judges and staff from a
2014 NCSC survey “suggested that SSA local or regional offices designate staff to act as a
liaison to state courts,”68 indicating the interest of state courts to share data with SSA. It was also
noted that WINGS has helped improve collaboration between state courts and SSA. WINGS
chapters exist in 17 states, and SSA participates through a regional SSA WINGS representative
for each of the participating states.
During the March 22, 2017, congressional hearing related to the SSA representative
payee program, there was considerable discussion regarding the anticipated increase in the senior
citizen demographic and the marked projected increase in the number of SSA beneficiaries who
will require representative payees. Members of Congress probed SSA administrators regarding
the resources needed to more appropriately monitor and provide oversight to payees. SSA made
clear they do not have the resources to keep up with the increasing number of representative

Joint Hearing on Social Security’s Representative Payee Program: Hearing Before the Subcomm. on Oversight
and the Subcomm. on Social Security of the H. Comm. on Ways & Means, 115th Cong. 42 (2017) (statement of
Brenda K. Uekert, Principal Court Research Consultant, NCSC).
68

30

payees.69
Potential Solutions:
•

Develop an institutionalized, two-way mechanism for SSA and representatives of
state courts to work together. The most meaningful collaboration would likely be
between SSA regional offices and state court administrators. Although WINGS
chapters provide a communication vehicle, not all areas have active WINGS chapters
and SSA participation is not institutionalized where WINGS chapters do exist.
Participation from SSA appears to be dependent on the interest and available time of
the staff. Similarly, state court representatives should be incentivized to develop
relationships with SSA staff and enhance communication.

•

Reinstitute regular meetings between SSA policy staff and state court officials with
sufficient federal and state resources to ensure meaningful communication and
collaboration. In interviews with SSA staff, the study team learned that SSA
previously convened a regular, institutionalized meeting between SSA policy staff
and state court officials. However, that practice was discontinued by SSA in 2017.
SSA staff indicated they were in internal discussions as to whether to resurrect this
group.

69

Id. at 12–17 (statement of Marianna LaCanfora, Acting Deputy Commissioner for Retirement and Disability
Policy, SSA).

31

Administrative Conference of the United States

PART 2: LEGAL BARRIERS TO INFORMATION
SHARING

32

The legal barriers to information sharing for SSA and state courts are distinct from each
other. As a result, this part of the report is divided into two main sections. The first section
addresses those barriers faced by SSA in sharing information with state courts. The second
section addresses those barriers faced by state courts in sharing information with SSA. Included
within each of these sections is a comprehensive analysis of the existing legal barriers, as well as
steps SSA and state courts may consider taking to mitigate them.
I. Legal Barriers to Information Sharing by SSA
To identify the legal barriers facing SSA, the study team (1) requested and received a list
of federal laws from SSA that it believed may pose a barrier to information sharing, (2) surveyed
the applicability of other privacy-related federal statutes and regulations, and (3) compared
SSA’s existing information sharing regimes with those of other federal agencies. From that
process, the study team has concluded that information sharing must be in accordance with the
Privacy Act of 1974, as amended by the Computer Matching and Privacy Protection Act of 1988
(CMPPA),70 and appropriations law and Section 1106 of the Social Security Act.71 Although
each of those laws potentially makes it harder for SSA to share representative payee and
beneficiary information with state courts, the study team does not believe any of them
necessarily poses an insuperable obstacle to SSA’s doing so.
The Privacy Act substantially restricts the collection, maintenance, use, and
dissemination of personal information by executive branch agencies. Notwithstanding the Act’s
restrictions, its “routine use exception” may permit SSA to disclose certain types of
representative payee and incapable beneficiary information to state courts for limited purposes.
Though the precise contours of the exception are murky, such that disclosing information could
create a litigation risk, the study team concludes that case law, relevant guidance, and DOJ OLC
opinions show there is at least a reasonable argument that the exception covers information
sharing by SSA, at least under carefully tailored circumstances. The study team recommends
that, before engaging in any information sharing with state courts, SSA solicit an opinion from
DOJ’s OLC to confirm the study team’s reading of the routine use exception.
Even if SSA ultimately determines that it cannot or simply does not want to rely on the
routine use exception as authority for sharing representative payee and beneficiary information
with state courts, other options are available to it if SSA believes such data sharing would be
beneficial to the agency. For instance, SSA could share the information by establishing
procedures to obtain advance written consent from beneficiaries and representative payees. Or
SSA could ask Congress to amend the Social Security Act to expressly authorize SSA to share
information with state courts without the consent of SSA beneficiaries and representative payees.
Moreover, the study team concludes that SSA is likely already permitted to share information
about organizational representative payees with state courts under certain circumstances because
the Privacy Act only protects individuals.
Assuming SSA could share information with state courts without violating the Privacy
Act, the study team also concludes that Section 1106 of the Social Security Act, which limits the
70

5 U.S.C. § 552a.

71

42 U.S.C. § 1306.

33

circumstances under which SSA may disclose information in its possession, does not foreclose
information sharing with state courts. If SSA decides that the information it obtains from state
courts in return for its own information sufficiently advances its statutorily authorized functions,
SSA could use appropriated funds to establish and operate the contemplated information-sharing
regime. Otherwise, SSA could invoke Section 1106(b) to establish the information-sharing
regime with state courts and may charge them for the information. Either way, so long as SSA
has regulations authorizing the disclosure, Section 1106 should not stand as a barrier to
information sharing.
Finally, whether disclosing representative payee and beneficiary information implicates
the CMPPA is largely a function of how any information exchange is structured. As with the
Privacy Act and Section 1106 of the Social Security Act, SSA and state courts can work together
to carefully tailor any information exchange so that it complies with the law’s requirements—
which, in the case of the CMPPA, are largely administrative.
A survey of other information sharing regimes suggests that it is at least feasible for SSA
to share information with state courts. The remainder of this section explains why federal law
does not conclusively forbid such an arrangement.
A. The Privacy Act of 1974
SSA has indicated that it views the Privacy Act as the principal legal barrier to
information sharing with state courts.72 The Privacy Act is an “omnibus ‘code of fair information
practices’” that “regulate[s] the collection, maintenance, use, and dissemination of personal
information by federal executive branch agencies.”73 The Privacy Act generally prohibits nonconsensual disclosures74 by federal executive branch agencies75 of PII unless, as explained
below, one of the Privacy Act’s specific exceptions applies.76 Agencies that disclose information
in violation of the Privacy Act are subject to civil damages (as well as attorney’s fees) in private
rights of action brought in federal district court, and their officials may be subject to criminal
penalties.77 In a private civil suit, the plaintiff is entitled to compensation for actual damages
suffered (or at least $1,000) and attorney’s fees upon proving that the agency disclosed the
information “intentional[ly] or willful[ly]”78—terms of art requiring a plaintiff to prove the

72

GOV’T ACCOUNTABILITY OFFICE, GAO-11-678, INCAPACITATED ADULTS, supra note 13, at 25.

73

U.S. DEP’T OF JUSTICE, OVERVIEW OF THE PRIVACY ACT OF 1974 1 (2015 ed.).

5 U.S.C. § 552a(b) (“No agency shall disclose any record which is contained in a system of records by any means
of communication to any person, or to another agency, except pursuant to a written request by, or with prior written
consent of, the individual to whom the record pertains ….”). “‘[S]ystem of records’ means any group of records
under the control of any agency from which information is retrieved by the name of the individual or by some
identifying number, symbol, or other identifying particular assigned to that individual.” Id. § 552a(a)(5).
74

75

5 U.S.C. § 552a(a)(1) (defining “agency” as only executive branch agencies).

76

Id. § 552a(a)(5).

77

See id. § 552a(g).

78

Id. § 552a(g)(4).

34

agency acted “reckless[ly]”79 or “without grounds for believing [its actions are] lawful.”80 For
criminal liability, the agency official making the disclosure must have known the disclosure
violated the Privacy Act.81
The study team agrees with SSA that the Privacy Act prohibits SSA from disclosing
representative payee and incapable beneficiary information unless such disclosures fall within
one of the 12 statutory exceptions that each authorize the release of certain records.82 Based on
the study team’s review of these exceptions, only one—the “routine use” exception—might
apply in the context of information sharing with state courts.83
In response to previous calls for it to begin sharing information with state courts,84 SSA
has stated that the Privacy Act prohibits it from disclosing representative payee or incapable
beneficiary information and that it does not believe the routine use exception applies.85 For
example, in a July 2011 report, GAO called on SSA to “determine how, under applicable laws
and consistent with SSA’s existing legal authority, the agency might be permitted to disclose
information about incapable beneficiaries and their fiduciaries to state courts.” In response, SSA
explained that the Privacy Act barred it from doing so:
We previously evaluated applicable laws to determine if we may disclose this
information to States. We assert, as we did in response to your 2004 report,
“Guardianships—Collaborations Needed to Protect Incapacitated Elderly

79

Andrews v. Veterans Admin. of United States, 838 F.2d 418, 425 (10th Cir. 1988).

80

Laningham v. United States Navy, 813 F.2d 1236, 1242 (D.C. Cir. 1987). See also Covert v. Harrington, 876 F.2d
751, 757 (9th Cir. 1989) (holding that an “agency acts in violation of the [Privacy] Act in a willful or intentional
manner, either by committing the act without grounds for believing it to be lawful, or flagrantly disregarding others’
rights under the [Privacy] Act”); Moskiewicz v. United States Dep’t of Agric., 791 F.2d 561, 564 (7th Cir. 1986)
(holding that “intentional or willful” requires “evidence of conduct which would meet a greater than gross
negligence standard, focusing on evidence of reckless behavior and/or knowing violations of the [Privacy] Act on
the part of the accused”);Chapman v. NASA, 736 F.2d 238, 243 (5th Cir. 1984) (requiring a showing of “unlawful
intent or ulterior motive” to establish an intentional or willful violation); Wisdom v. Dept. of Hous. & Urban Dev.,
713 F.2d 422, 425 (8th Cir. 1983) (interpreting “willful” to mean “so patently egregious and unlawful that anyone”
should have known that he or she was violating the Privacy Act).
81

5 U.S.C. § 552a(i)(1).

The twelve exceptions are: (1) the intragency “need to know” exception, 5 U.S.C. § 552a(b)(1); (2) required FOIA
disclosures, 5 U.S.C § 552a(b)(2); (3) the routine use exception, id. § 552a(b)(3); (4) Bureau of Census disclosures,
id. § 552a(b)(4); (5) the statistical research exception, id. § 552(b)(5); (6) the National Archives exception, id.
§ 552a(b)(6); (7) law enforcement request disclosures, id. § 552a(b)(7); (8) disclosures for the health or safety of an
individual, id. § 552a(b)(8); (9) disclosures to the U.S. Congress, id. § 552a(b)(9); (10) disclosures to the
Comptroller General of the U.S. GAO, id. § 552a(b)(10); (11) court ordered disclosures, id. § 552a(b)(11); (12) Debt
Collection Act disclosures, id. § 552a(b)(12).
82

83

Id. § 552a(b)(3).

GOV’T ACCOUNTABILITY OFFICE, GAO-13-473, ADDRESSING LONG-TERM CHALLENGES, supra note 12, at 16;
GOV’T ACCOUNTABILITY OFFICE, GAO-11-678, INCAPACITATED ADULTS, supra note 13, at 17; GOV’T
ACCOUNTABILITY OFFICE, GAO-06-1086T, GUARDIANSHIPS, supra note 13, at 5; GOV’T ACCOUNTABILITY OFFICE,
GAO-04-655, GUARDIANSHIPS, supra note 13, at 32–33.
84

85

GOV’T ACCOUNTABILITY OFFICE, GAO-11-678, INCAPACITATED ADULTS, supra note 13, at 17.

35

People” (GAO-04-655), that privacy implications prevent us from doing so.
We may only disclose information to State courts or other Federal agencies in
accordance with the Privacy Act, section 1106 of the Social Security Act, and
regulations at 20 C.F.R. Part 401. The Privacy Act governs how Federal
agencies collect, use, maintain, and disclose personal information, and it forbids
disclosure of personal information about a living person without the written
consent of the individual or someone who can consent on the individual’s
behalf. Without consent, the only relevant Privacy Act exception is the routine
use exception 5 U.S.C. § 552a(b)(3).
To create a routine use, we must determine if the requested disclosure is
compatible with the purpose for which we collect the information. In this case,
it does not appear the proposed disclosure is compatible. We collect information
about representative payees solely to evaluate whether they are fit to manage
Social Security benefits. State-appointed legal guardians, on the other hand,
may have broader legal authority to care for personal property and other
interests. There is no clear indication of how any SSA disclosure of beneficiary
information or representative payee information to a State court is compatible
with SSA’s collection of the information to assist beneficiaries in managing
their benefits or payments.86
SSA has reiterated its position recently, consistently maintaining that it may not disclose
personal identifying information to state courts without violating the Privacy Act. For example,
at a March 2017 hearing before the House Ways and Means Committee’s Subcommittees on
Social Security and Oversight, SSA officials reaffirmed the agency’s position and again
explained they believe SSA is prohibited by the Privacy Act from sharing any representative
payee or incapable beneficiary information with state entities.87 In November 2019, SSA
headquarters officials confirmed with the study team that the agency’s position regarding the
Privacy Act and its routine use exception had not changed. SSA headquarters staff explained that
the agency does not believe disclosure of its records to state courts for the purposes of better
administering the Representative Payee Program and facilitating States’ guardian-conservator
programs meets the compatibility requirements in the Privacy Act.

86

GOV’T ACCOUNTABILITY OFFICE, GAO-11-678, INCAPACITATED ADULTS, supra note 13, at 17.

87

Hearing on Social Security Representative Payee Program Before the Subcomms. on Social Security and
Oversight of the H. Comm. on Ways and Means, 115th Cong. 108 (Mar. 22, 2017) (testimony of Marianna
LaCanfora, Acting Deputy Comm’r, Office of Ret. and Disability Policy, Soc. Sec. Admin.).

36

1. The Routine Use Exception
The routine use exception permits an agency to disclose a record “for a routine use.” The
Privacy Act defines a “routine use” as “the use of [a] record for a purpose which is compatible
with the purpose for which it was collected.”88 In addition to compatibility of the underlying
purposes, the Privacy Act requires that, before disclosure, agencies first publish a notice in the
Federal Register identifying “each routine use of the records contained in the [corresponding]
system, including the categories of users and the purpose of such use.”89 In sum, “[t]o fit within
the confines of the routine use exception to the Privacy Act, an agency’s disclosure of a record
must be both (i) ‘for a purpose which is compatible with the purpose for which it was collected’
and (ii) within the scope of a routine use notice published by the agency.”90
There does not appear to be a barrier to SSA’s satisfying the routine use exception’s
notice requirement. SSA has previously issued Systems of Records Notices (SORNs) detailing
when it will release certain information under the Privacy Act,91 including many routine uses for
disclosure of representative payee information.92 It may modify its SORNs or provide for
additional SORNs in the Federal Register at any time.
The main question, therefore, is whether SSA’s disclosure of representative payee and
incapable beneficiary information to state courts would be “for a purpose which is compatible
with the purpose for which it was collected.”93 To answer that question, the study team first
consulted the Privacy Act’s text and legislative history. But the Privacy Act does not define
“compatible” or provide examples of disclosures that might qualify as “compatible.” The
legislative history likewise sheds little light on the issue.94
Because the text and history of the Privacy Act are of scant help in determining the
meaning of “compatible,” the study team focused on three other sources: court decisions, OMB

88

5 U.S.C. § 552a(b)(3).

89

Id. § 552a(e)(4).

Ames v. United States Dep’t of Homeland Sec., 861 F.3d 238, 240 (D.C. Cir. 2017); see also 5 U.S.C.
§ 552a(a)(7) (defining “routine use as “the use of [a] record for a purpose which is compatible with the purpose for
which it was collected.”).
90

A system of records is a “group of any records under the control of any agency from which information is
retrieved by name of the individual or by some identifying number, symbol, or other identifier assigned to the
individual, such as a finger or voice print or a photograph.” 5 U.S.C. § 552a(a)(5). The Privacy Act requires each
agency to publish notice for each of its systems of records in the Federal Register. Id. § 552a(e)(4). These notices
are called “System of Records Notices” or “SORNs.” Included in these SORNs are the routine use notices required
by the Privacy Act before an agency’s disclosure of information under the routine use exception. See id.
§ 552a(e)(4)(D).
91

92

See, e.g., 83 Fed. Reg. 31,250, 31,251 (July 3, 2018); 83 Fed. Reg. 55,228 (Nov. 2, 2018).

93

5 U.S.C. § 552a(a)(7).

See Disclosure of Parolees’ Names to Local Police, 6 Op. O.L.C. 227, 229 (1982) (“The legislative history of the
Privacy Act ... do[es] not provide much guidance as to the outer limits of the ‘routine use’ exception.”).
94

37

guidance, and opinions issued by DOJ’s OLC.95 The three are not of equal significance. Court
decisions set out binding legal standards to which SSA’s actions are subject.96 Decisions by
federal courts of appeals constitute the law in the circuits in which they are issued and are often
treated as highly persuasive authority in other circuits throughout the country. OMB guidance
and OLC opinions, by contrast, are only persuasive authority.97 They do not constitute the law,
and a court would not be required to abide by them. At the same time, they may help flesh out
the meaning of the Privacy Act in ways courts will ultimately find persuasive.
Although court decisions, OMB guidance, and DOJ OLC opinions concerning the
Privacy Act are all due different weight, they all tend to show more or less the same things: that
“compatible” does not mean “identical”; that compatibility is often, though not always, framed at
a comparatively high level of generality; and that compatibility requires not just that information
sharing be helpful, but that there be some level of congruence between the purpose for which the
95

SSA has issued a regulation implementing the routine use exception. See 20 C.F.R. § 401.150. It expressly
contemplates that SSA “may disclose information for the administration of other governmental programs.” Id.
§ 401.150(c)(2). Such disclosures, the regulation continues, generally meet three conditions: (1) “The program is
clearly identifiable as a Federal, State, or local government program”; (2) “The information requested concerns
eligibility, benefit amounts, or other matters of benefit status in a Social Security program and is relevant to
determining the same matters in the other program”; and (3) “The information will be used for appropriate
epidemiological or similar research purposes.” Id. The regulation itself identifies a broad range of permissible
disclosures, including “to the Railroad Retirement Board for pension and unemployment compensation programs, to
the Department of Veterans Affairs for its benefit programs, to worker’s compensation programs, to State general
assistance programs and to other income maintenance programs at all levels of government.” Id. § 401.150(c)(2)(ii).
That SSA has, in its own regulations, interpreted the routine use exception to permit such an array of disclosures
might be taken to show that the exception has a broad scope. And sharing representative payee and incapable
beneficiary information with state courts would seem to fit within the regulation’s plain language, both because the
information would be shared with a “State … government program,” and because the information being shared
concerns “other matters of benefit status in a Social Security program and is relevant to determining the same
matters in the [state] program.” Id. § 401.150(c)(1)–(2). Ultimately, however, the principal authority for determining
whether SSA can disclose information under the Privacy Act is the act itself, not an SSA regulation. Indeed, because
Congress has not vested SSA with authority to issue binding rules interpreting the Privacy Act, it is unlikely courts
would defer to SSA’s regulation. Presumably for those reasons, SSA has repeatedly asserted that it is the Privacy
Act, not SSA’s regulations, that bars disclosure of information to state courts. Furthermore, to the extent SSA’s
regulations are understood as a barrier to disclosing information to state courts, SSA can solve the problem by
amending its regulations.
96

The extent to which a court decision is binding depends on the court that decided it. Congress has divided the
United States into 94 federal judicial districts. Each district is home to a federal district court. Federal district courts
are responsible for resolving disputes, determining the facts, and applying legal principles to decide which party to a
legal action should prevail. Congress has placed each of the 94 districts in one of 12 regional circuits. Each circuit is
home to a court of appeals. The courts of appeals, also known as circuit courts, are tasked with reviewing contested
district court decisions to determine whether the law was correctly applied. The rules and decisions announced by a
court of appeals are binding on all federal judges and litigants within that court’s circuit, whereas district court
decisions bind only the parties to the case being decided.
See Casa de Md. v. U.S. Dep’t of Homeland Sec., 924 F.3d 684, 692 n.1 (4th Cir. 2019) (“Although not binding
on courts, OLC opinions reflect the legal position of the executive branch and are generally viewed as providing
binding interpretive guidance for executive agencies.”) (internal quotation marks and brackets omitted); Office of
Mgmt. & Budget, Exec. Office of the President, Final Bulletin for Agency Good Guidance Practices, 72 Fed. Reg.
3432, 3434 (Jan. 25, 2007) (clarifying that guidance may set forth an agency’s “policy on … or interpretation of a
statutory or regulatory issue,” but may not “impose a legally binding requirement”).
97

38

information was collected and the purpose for which it is shared.
a. Court Decisions
Litigants routinely ask federal courts to decide whether certain uses of information are
“compatible with the purpose for which [the information] was collected.” Although the Supreme
Court of the United States has never decided such a case or otherwise weighed in on the meaning
of “compatible” in the Privacy Act, scores of federal appellate and district courts have. Their
decisions establish that applying the routine use exception requires comparing the use for which
the information was originally collected and the use for which the information is to be shared.
Their decisions also establish that, though uses need not be identical to be “compatible,” there
must be some concrete relationship between them. Apart from those vague and amorphous
standards, however, the case law offers almost no general rules for applying the routine use
exception and its compatibility requirement.98 Instead, to the extent courts have fleshed out the
routine use exception’s contours, they have done so through narrow, fact-specific opinions
deciding whether the exception applies in particular cases.
The most frequently cited court decision concerning the meaning of “compatibility’” is
Britt v. Naval Investigative Service.99 There, the United States Court of Appeals for the Third
Circuit held that the Naval Investigative Service’s collecting information for purposes of a
criminal investigation into a Marine Corps reservist was not compatible with the Services’
disclosing that information to the reservist’s civilian employer for use in evaluating the
reservist’s integrity.100 In so holding, the Third Circuit emphasized that nothing in the record
suggested “that the [civilian employer] was conducting its own criminal investigation of the
same activity or any other activity” by the reservist.101 Instead, the Service had argued that its
reason for compiling the records was “compatible” with the civilian employer’s use of them
because the civilian employer “might find it relevant to have information suggesting” the
reservist lacked integrity.102 But “relevance,” the Third Circuit explained, “is not the standard
Congress placed in” the routine use exception.103 Rather, there must be “a concrete relationship
or similarity, some meaningful degree of convergence, between the disclosing agency’s purpose
in gathering the information and in its disclosure.”104 Deciding whether such a relationship
exists, according to the Britt court, “requires … a dual inquiry into the purpose for the collection

See, e.g., Chichakli v. Tillerson, 882 F.3d 229 (D.C. Cir. 2018); Ames, 861 F.3d at 238; U.S. Postal Serv. v. Nat’l
Ass’n of Letter Carriers, 9 F.3d 138 (D.C. Cir. 1993); Britt v. Naval Investigative Serv., 886 F.2d 544 (3d Cir.
1989).
98

99

Britt, 886 F.2d at 544; see, e.g., Ames, 861 F.3d at 240 (citing Britt); U.S. Postal Serv., 9 F.3d at 145 (same);
Swenson v. U.S. Postal Serv., 890 F.2d 1075, 1078 (9th Cir. 1989) (same); Fattahi v. Bur. of Alcohol, Tobacco &
Firearms, 186 F. Supp. 2d 656, 660 (E.D. Va. 2002) (same).
100

Id. at 549–50.

101

Id. at 549.

102

Id.

103

Id. at 549.

104

Id.

39

of the record in the specific case and the purpose of the disclosure.”105
Britt is not the only case in which a federal court held that two uses were too dissimilar to
each other to be “compatible.” In Swenson v. U.S. Postal Service, a mail carrier sent a letter to
members of Congress regarding the Postal Service’s alleged undercounting of rural route
mailboxes.106 The members requested information regarding the mail carrier’s allegations, to
which the Postal Service responded by disclosing “private facts about [the mail carrier’s]
employment status,” including that she “filed charges of sex discrimination with the Equal
Employment Opportunity Commission.”107 The Ninth Circuit Court of Appeals agreed with the
mail carrier that the Postal Service had violated the Privacy Act when it shared the records,
originally collected “to perform routine personnel functions,” with members of Congress to
“addres[s] the congressmen’s concerns with the alleged undercounting of rural mail routes.”108
As in Britt, then, the court’s decision hinged on what it viewed as the fundamentally different
purposes of the two uses at issue.
A number of other circuit and district court cases have applied the framework articulated
in the Britt decision but have concluded that a challenged use was “compatible” within the
meaning of the routine use exception.109 For instance, in Ames v. United States Department of
Homeland Security, the United States Court of Appeals for the D.C. Circuit applied the approach
from Britt but held that the routine use exception permitted a federal agency to share information
about a former employee’s misconduct with the federal agency that had subsequently hired the
former employee.110 In reaching this result, the court analyzed the “compatibility” of purposes
and found that the information collected by the federal agency was collected to determine the
individual’s “suitability” for federal employment and that the purpose of the disclosure was so
that it could be used for the same “suitability” purpose at the individual’s new agency.111 The
panel acknowledged that the D.C. Circuit had “not definitively determined the precise meaning”
of “compatibility” and again declined to make such a determination, finding that, under any
“reasonable formulation of the compatibility test,” including the test put forth by the Third
Circuit in Britt, the purposes were compatible.112
Other decisions confirm that the approach from Britt does not foreclose sharing
information for seemingly divergent uses. In Melvin v. SSA, for example, the plaintiff alleged
that SSA violated the Privacy Act when it provided a written doctor’s evaluation to the
Department of Veterans Affairs (VA).113 SSA had obtained the evaluation to assess plaintiff’s
105

Id. at 548–49.

106

See 890 F.2d at 1076.

107

Id.

108

Id. at 1078.

See, e.g., Melvin v. Soc. Sec. Admin., 126 F. Supp. 3d 584, 605–06 (E.D.N.C. 2015); Radack v. U.S. Dep’t of
Justice, 402 F. Supp. 2d 99, 106 (D.D.C. 2005); Fattahi, 186 F. Supp. 2d at 660.
109

110

Ames, 861 F.3d at 241.

111

Id. at 240.

112

Id. at 240 n.1.

113

126 F. Supp. 3d 584 (E.D.N.C. 2015), aff’d, 686 Fed. Appx. 230 (4th Cir. 2017).

40

claim for disability benefits, and VA used the record to assess plaintiff’s claim for serviceconnected Post-traumatic Stress Disorder (PTSD). In analyzing the compatibility of the two
agencies’ uses of the record, the court wrote:
it cannot be seriously disputed that there is compatibility between the SSA’s
procurement of a consultative examination to assess Plaintiff’s claim for
disability benefits on the basis of, inter alia, ‘service-connected [PTSD],’ and
its disclosure to the VA for the purposes of determining Plaintiff's entitlement
to a service-connected claim for PTSD.114
The district court in Doe v. United States DOJ employed a similarly flexible approach in
construing “compatible,” albeit without directly citing Britt.115 In Doe, the plaintiff alleged that
his employer, DOJ, “violated the Privacy Act by improperly disclosing plaintiff’s private
medical information [demonstrating his disability] to various persons inside and outside of the
agency,” including his state’s unemployment commission when his employment was
terminated.116 The court identified that the purpose for DOJ’s collection of the record was to
allow DOJ to determine how to provide disability accommodations (i.e., to “‘clearly explain the
nature of the disability or the need for the reasonable accommodation’”).117 It identified a distinct
purpose for disclosing the record, which was to show that the plaintiff “had been fired for ‘just
cause.’”118 Notwithstanding the differing purposes, the court held that the two uses were
compatible under the Privacy Act because the “plaintiff’s records were both collected and
disclosed in order to determine the rights and benefits to which he was entitled under ‘pertinent’
laws.”119
Cases like Britt, Swenson, Ames, Melvin, and Doe reveal that no general definition or test
exists to determine whether two uses are “compatible” under the routine use exception.120 About
the most that can be said is that two uses can be compatible even if they are not identical, so long
as there is some concrete relationship between them, and that, the more conceptually similar the
uses, the more likely courts are to deem them compatible.121 Thus, for example, the court in Britt
found no compatibility because the two uses at issue there—one for law enforcement, the other
for employment—were conceptually very different, whereas the court in Ames found
compatibility where the two uses at issue both pertained to employment.

114

Id. at 605–06.

115

Doe v. United States DOJ, 660 F. Supp. 2d 31 (D.D.C. 2009).

116

Id. at 45.

117

Id. at 48.

118

Id.

119

Id.

U. S. DEP’T OF JUSTICE, OVERVIEW OF THE PRIVACY ACT OF 1974, supra note 73, at 87 (explaining that the
“precise meaning of the term ‘compatible’” remains “quite uncertain and must be assessed on a case-by-case basis”).
120

Cf. Disclosure of Parolees’ Names to Local Police, 6 Op. O.L.C. 227, 229 (1982) (denying that “compatible” is
synonymous with “identical”).
121

41

Unfortunately, those vague and general standards are of limited predictive value. Neither
provides a clear rule for ascertaining whether the nexus between two uses is close enough for the
uses to be compatible. And neither provides guidance about the level of generality at which a
given “use” should be defined for purposes of the routine use exception. Because of the
uncertainty inherent in the courts’ seemingly ad hoc and fact-intensive approaches to cases
concerning the routine use exception, there is almost inevitably some litigation risk when
agencies share information under the routine use exception.
b. OMB Guidance
Guidance issued by OMB is another source of information about the routine use
exception’s contours. The Privacy Act tasks OMB with developing “guidelines and regulations
for the use of agencies in implementing the [Privacy Act’s] provisions.”122 OMB complied with
that mandate in 1975 when it issued its Privacy Act Guidelines and Circular A-108.123 In the
course of clarifying agencies’ obligations under the Privacy Act, the Guidelines and Circular A108 further illuminate the meaning of “compatibility” and the proper application of the routine
use exception.
The Guidelines state that “the term ‘routine use’ was introduced to recognize the practical
limitations of restricting use of information to explicit and expressed purposes for which it was
collected” and to acknowledge “that there are corollary purposes ‘compatible with the purpose
for which the information was collected’ that are appropriate and necessary for the efficient
conduct of government and in the best interest of both the individual and the public.”124 Circular
A-108 makes a similar point, explaining that a “routine use [disclosure] may be appropriate
when the use of the record is necessary for the efficient conduct of government, and when the
use is both related to and compatible with the original purpose for which the information was
collected.”125 Circular A-108 further explains that “[c]ompatibility comprises both functionally
equivalent uses of the information as well as other uses of the information that are necessary and
proper.”126 It also instructs agencies to “narrowly tailor” routine uses to address a “specific and
appropriate use of the records.”127

122

5 U.S.C. § 552a(v).

123

Privacy Act Implementation: Guidelines and Responsibilities, 40 Fed. Reg. 28,953 (July 9, 1975), revised by 40
Fed. Reg. 56,741 (Nov. 21, 1975). OMB rescinded Circular A-108 in 1985, incorporating its substance into an
appendix in the newly issued Circular A-130. See OFFICE OF MGMT. & BUDGET, EXEC. OFFICE OF THE PRESIDENT,
CIRCULAR A-130, MANAGEMENT OF FEDERAL INFORMATION RESOURCES (1985). Then, in 2016, after public notice
and comment, OMB reissued Circular A-108 to provide further guidance on agencies’ responsibilities under the
Privacy Act. See OFFICE OF MGMT. & BUDGET, EXEC. OFFICE OF THE PRESIDENT, CIRCULAR A-108, FEDERAL
AGENCY RESPONSIBILITIES FOR REVIEW, REPORTING, AND PUBLICATION UNDER THE PRIVACY ACT 11–12 (2016).
124

40 Fed. Reg. 28,953 (July 9, 1975).

OFFICE OF MGMT. & BUDGET, EXEC. OFFICE OF THE PRESIDENT, CIRCULAR A-108, FEDERAL AGENCY
RESPONSIBILITIES FOR REVIEW, REPORTING, AND PUBLICATION UNDER THE PRIVACY ACT 11–12 (2016) (emphasis in
original).
125

126

Id.

127

Id.

42

Echoing the relevant court decisions, Circular A-108 confirms that whether information
may be disclosed under the routine use exception is a fact-intensive inquiry. Agencies must
consider whether the purposes for collection and disclosure of the information are “functionally
equivalent” or have a “concrete relationship or similarity.”128 If so, the agency can disclose the
information so long as the routine use is narrowly tailored and sufficient prior notice has been
published in the Federal Register.129
OMB’s pronouncements on these points are due special weight because Congress
expressly delegated to OMB authority to establish rules and guidelines for implementing and
administering the Privacy Act.130 Because OMB promulgated the Guidelines under that
authority, courts have consistently applied Chevron deference to the interpretations the
Guidelines set out. 131 And because OMB also promulgated Circular A-108 under its authority to
establish rules and guidelines for implementing and administering the Privacy Act, it is likely
courts would similarly give Chevron deference to the interpretations in Circular A-108,132
although it appears no court has directly addressed that question.
Notwithstanding that courts would likely defer to the interpretations announced in
OMB’s Guidelines and Circular A-108, there are a few reasons those sources are of limited
utility in precisely defining “compatibility” and the boundaries of the routine use exception.
First, the standards they set out—typified by phrases like “appropriate and necessary,”133 “related
to and compatible with,”134 and “necessary and proper”135—are too abstract to yield a
particularized meaning. Second, and relatedly, because the Guidelines and Circular A-108 are
framed at such a high level of abstraction and do not flesh how the routine use exception would
apply to specific types of information sharing, whatever deference courts afford the Guidelines
and Circular A-108 would be limited to the overarching tests they establish and would not apply
to specific applications of those tests. Third, because OMB’s test mirrors the one predominantly
Britt, 886 F.2d at 550; OFFICE OF MGMT. & BUDGET, EXEC. OFFICE OF THE PRESIDENT, CIRCULAR A-108,
FEDERAL AGENCY RESPONSIBILITIES FOR REVIEW, REPORTING, AND PUBLICATION UNDER THE PRIVACY ACT 11–12
(2016).
128

OFFICE OF MGMT. & BUDGET, EXEC. OFFICE OF THE PRESIDENT, CIRCULAR A-108, FEDERAL AGENCY
RESPONSIBILITIES FOR REVIEW, REPORTING, AND PUBLICATION UNDER THE PRIVACY ACT 11–12 (2016).
129

130

5 U.S.C. § 552a(v).

See, e.g., Sussman v. U.S. Marshals Serv., 494 F.3d 1106, 1120 (D.C. Cir. 2007) (stating that OMB’s Privacy Act
Guidelines “are owed the deference usually accorded interpretation of a statute by the agency charged with its
administration”); Whitaker v. CIA, 31 F. Supp. 3d 23, 47 (D.D.C. 2014) (“[T]he Court notes that the D.C. Circuit
has previously accorded Chevron deference to the OMB Guidelines interpreting the Privacy Act.”).
131

132

See United States v. Mead Corp., 533 U.S. 218, 226–27 (2001) (holding that an agency may claim Chevron
deference “when it appears [1] that Congress delegated authority to the agency generally to make rules carrying the
force of law, and [2] that the agency interpretation claiming deference was promulgated in the exercise of that
authority”).
133

See 40 Fed. Reg. 28,953 (July 9, 1975).

OFFICE OF MGMT. & BUDGET, EXEC. OFFICE OF THE PRESIDENT, CIRCULAR A-108, FEDERAL AGENCY
RESPONSIBILITIES FOR REVIEW, REPORTING, AND PUBLICATION UNDER THE PRIVACY ACT 11–12 (2016) (emphasis
omitted).
134

135

Id.

43

applied by the courts, it is unlikely much would change based on whether courts applied the test
announced by OMB or their own test.
c. OLC Opinions
OLC opinions interpreting and applying the routine use exception are another significant
source of guidance about the exception’s contours and the meaning of “compatibility.”136
Although the opinions are not legally binding or dispositive of the questions they address,137 they
merit serious consideration because OLC is the arm of the executive branch responsible for
providing legal advice to the President and all executive branch agencies.138
OLC’s opinions regarding the routine use exception suggest that, although Congress
“apparently did want ‘to prohibit gratuitous, ad hoc, disseminations for private or otherwise
irregular purposes,’”139 it left agencies with “broad discretion” and “considerable latitude” in
classifying routine uses.140 Consistent with that view, OLC has stated that uses of information

The study team identified 15 opinions issued by DOJ’s OLC since 1977 referencing the Privacy Act’s routine use
exception: Whether the United States Department of Labor Has the Authority to Control the Disclosure of Federal
Employee Compensation Act Records Held by the United States Postal Service, __ Op. O.L.C. __, 2012 OLC
LEXIS 8 (2012); Application of Record Destruction Requirements to Information Received From the National
Instant Criminal Background Check System, __ Op. O.L.C. __, 2005 OLC LEXIS 7 (2005); Checking Names of
Prohibited Persons Against Records in the NICS Audit Log Concerning Allowed Transfers, 25 Op. O.L.C. 215
(2001); Access to Criminal History Records by Non-Governmental Entities Performing Authorized Criminal Justice
Functions, 22 Op. O.L.C. 119 (1998); Contractor Access to Information from Interstate Identification Index, 20 Op.
O.L.C. 299 (1996); Brady Act Implementation Issues, 20 Op. O.L.C. 57 (1996); Immigration and Naturalization
Service Participation in Computer Matching Program with Department of Education, 16 Op. O.L.C. 159 (1992);
Procedures for Investigating Allegations Concerning Senior Administration Officials, 6 Op. O.L.C. 626 (1982);
United States Secret Service Use of the National Crime Information Center, 6 Op. O.L.C. 313 (1982); Disclosure of
Parolees’ Names to Local Police, 6 Op. O.L.C. 227 (1982); United States Participation in Interpol Computerized
Search File Project, 5 Op. O.L.C. 373 (1981); Disclosure of Information Collected Under the Export Administration
Act, 5 Op. O.L.C. 255 (1981); Questions Concerning the Right to Financial Privacy Act, 3 Op. O.L.C. 217 (1979);
FBI Disclosure to Local or State Law Enforcement Agency of Personal Information Obtained From Another Law
Enforcement Agency, 3 Op. O.L.C. 12 (1979); Legality of Proposed Executive Order Requiring Public Disclosure
of Employee Financial Statements, 2 Op. O.L.C. 329 (1977).
136

Because OLC’s opinions are relatively old and span several decades, it is possible that the prevailing legal
standard may have changed since many of them were written. For example, the sometimes-cursory application of
Chevron deference and the heavy reliance on legislative history in some of OLC’s older opinions would presumably
look different today. Yet the opinions have been relatively consistent in their approach over time, suggesting that the
standard they articulate has achieved widespread acceptance.
137

138

U.S. DEP’T OF JUSTICE, OFFICE OF LEGAL COUNSEL, https://www.justice.gov/olc (last visited June 1, 2020).

Disclosure of Parolees’ Names to Local Police, 6 Op. O.L.C. 227, 229 (1982) (quoting 120 Cong. Rec. 36,967
(1974) (remarks of Cong. Moorehead)); see also Presidential Authority — Legality of Proposed Executive Order
Requiring Public Disclosure of Employee Financial Statements, 2 Op. O.L.C. 329, 339 (1977) (characterizing the
routine use exception as having a “rather limited scope,” and explaining that the exception “was never intended by
Congress to be an independent vehicle for disclosing information to the public at large”).
139

140

6 Op. O.L.C. at 227; see also United States Participation in Interpol Computerized Search File Project, 5 Op.
O.L.C. 373, 383 (1981) (routine use exception’s legislative history “does not provide much guidance as to the outer
limits of the ‘routine use’ exception”).

44

need not be identical to be “compatible”141 and that “the purpose for which [information] was
collected” can be defined in relatively broad terms.142
Although the OLC opinions concern factual contexts different from the one that is the
subject of this report, they still help explain the degree of relatedness that is required for two uses
to be “compatible.” For example, OLC has advised that data collected by the Attorney General
for conducting background checks on prospective firearms purchasers may be shared with law
enforcement agencies to advance their ongoing criminal investigations—even if those
investigations do not relate to the sale of firearms—because both uses advance a general “law
enforcement purpose.”143 Likewise, OLC has advised that transmission of information from the
United States Secret Service to the National Crime Information Center, and from there to state
and local law enforcement agencies, may qualify as a routine use because the information is
being shared “for the same purpose for which it was originally collected—protection of
protectees,” even though the nature of the protection and identity of the protectees differs.144
Opinions like these suggest that, at least as interpreted by OLC, “compatibility” should be
assessed at a relatively high level of abstraction.145
2. Disclosure of Representative Payee and Incapable Beneficiary Information May
Be Permissible Under the Routine Use Exception
SSA has taken the position that the Privacy Act generally prohibits SSA from disclosing
representative payee or incapable beneficiary information to state courts. The study team finds
this to be a reasonable interpretation of the Privacy Act, particularly given that the Privacy Act,
its legislative history, the case law interpreting it, the applicable OMB guidance, and the
potentially pertinent OLC opinions do not squarely address such an information exchange.
SSA’s position is not, however, the only reasonable one possible. Indeed, there are
reasonable arguments—drawing on case law, OMB guidance, and OLC opinions—that the
routine use exception authorizes disclosure of representative payee and incapable beneficiary
See 5 Op. O.L.C. at 383 (agencies may share information about people’s criminal histories “for a wide variety of
law enforcement and humanitarian purposes”); see also United States Secret Service Use of National Crime
Information Center, 6 Op. O.L.C. 313, 323 (1982) (“It is clear, for example, that the exemption may cover the
dissemination of information even though it is used for a purpose different from the one for which it was
collected.”).
141

142

See Brady Act Implementation Issues, 20 Op. O.L.C. 57, 60 (1996); 6 Op. O.L.C. at 324.

143

See 20 Op. O.L.C. at 60.

144

See 6 Op. O.L.C. at 324. Although these OLC opinions at first appear to be distinct or cabined to the specific
law-enforcement context, they do not apply the Privacy Act’s specific exception for law enforcement under 5 U.S.C.
§ 552a(b)(7). As a result, these OLC opinions addressing issues in the law-enforcement context are not as easily
dismissed as distinct on that ground alone.
145

Although an exhaustive review of each opinion is beyond the scope of this report, the following list of the
purposes discussed or noted in these opinions helps to illustrate the level of generality at which OLC characterizes
the relevant purpose under the routine use exception: law enforcement, law enforcement audits, background
investigations, criminal justice, auditing systems, verifying eligibility for benefits, employment purposes, licensing
purposes, and discovering and avoiding conflicts of interest. These categorizations suggest that, even though the
inquiry depends heavily on the specific facts and uses at issue, OLC and agencies have defined such purposes in
broad terms.

45

information, at least in some circumstances. At bottom, whether the routine use exception
permits SSA to disclose representative payee or incapable beneficiary information with state
courts depends on the details of that information-sharing arrangement. As noted above, SSA has
not extensively studied what the details of such an arrangement might look like.146 For purposes
of analyzing the issue, therefore, the study team has responded to a hypothetical scenario
involving the sharing of only a limited set of facts—specifically representative payees’,
guardians’/conservators’, and beneficiaries’ names, SSNs or EINs, dates of birth, and contact
information; as well as information about representative payees and guardians who have been
removed or disqualified.
Within that hypothetical scenario, the study team sees a reasonable argument for
invoking the routine use exception to permit information sharing with state courts. But acting on
that argument would expose SSA to litigation risk, particularly given that the case law prescribes
a case- and fact-intensive inquiry and that no court has ever addressed the information-sharing
arrangement contemplated here. That litigation risk is amplified by the fact that SSA could face
litigation anywhere in the country, including in federal courts in circuits that have little or no
case law regarding the routine use exception. And it is amplified still further by the fact that the
Privacy Act establishes four separate civil causes of action, including two for money damages.147
Thus, even if SSA were to conclude that the best reading of the routine use exception permits it
to share certain information about representative payees with state courts, SSA might
nevertheless justifiably decline to engage in such an exchange.
Under the circumstances, the study team recommends that SSA seek an OLC opinion
before deciding whether to engage in information sharing. By delegation from the Attorney
General, OLC provides “legal advice to the President and all executive branch agencies.”148 That
includes providing written opinions to agencies for “concrete” legal problems when there is a
“practical need” for the advice.149 Over the last several decades, OLC has issued over a dozen
opinions referencing the Privacy Act’s routine use exception in some way, several of which
included a compatibility analysis similar to what the study team recommends that SSA obtain.150
Given how useful it could be for SSA and state courts to share information regarding
representative payees, guardians, and conservators, as well as the indefiniteness of the
underlying law, SSA could make a strong case to OLC of a “practical need” for advice.
Of course, even a favorable OLC opinion would not eliminate SSA’s litigation risk when
it comes to sharing information about representative payees. Agencies do not become immune to
In particular, and as noted in the Study Design’s “Assumptions and Premises” § II(C), SSA headquarters staff has
not extensively studied (i) specific categories of information that would be helpful to receive from state courts to
administer its programs, or (ii) specific categories of information SSA would be willing to share with state courts
assuming the Privacy Act is not a barrier.
146

147

See 5 U.S.C. § 552a(g)(1).

148

U.S. DEP’T OF JUSTICE, OFFICE OF LEGAL COUNSEL, https://www.justice.gov/olc (last visited June 1, 2020).

U.S. DEP’T OF JUSTICE, OFFICE OF LEGAL COUNSEL, MEMORANDUM FOR ATTORNEYS OF THE OFFICE,
https://www.justice.gov/sites/default/files/olc/legacy/2010/08/26/olc-legal-advice-opinions.pdf (last visited June 1,
2020).
149

150

See supra note 136 (listing the 15 opinions issued since 1977).

46

lawsuits by virtue of acting in accord with OLC opinions.151 Still, obtaining an OLC opinion
would be a prudent next step. OLC has significant experience evaluating questions regarding the
Privacy Act, in general, and the routine use exception, in particular.152 SSA could benefit from
availing itself of that expertise. Moreover, although courts are not bound to defer to OLC’s
interpretations of the Privacy Act, a court might look more favorably on SSA’s position if it
knew that SSA had come to that position only after consulting with OLC.
Although OLC has primary responsibility for providing legal advice to executive branch
agencies, and also has considerable Privacy Act expertise, the Administrative Conference has
ultimately been tasked by statute with analyzing the legal viability of an information-sharing
arrangement between SSA and state courts. In carrying out that task, the study team has focused
on three specific and limited data points that SSA and state courts might exchange:153
•

Representative Payee and Guardian/Conservator Information: Name, SSN (or
employer identification number for organizations), Date of Birth, Contact
Information;

•

Incapable Beneficiary Information: Name, SSN, Date of Birth, Contact Information;
and

•

Information about representative payees or guardians/conservators who had been
removed or disqualified.

If information sharing is limited to these three types of information, the study team
concludes that SSA could make a reasonable argument that the routine use exception applies.
SSA collects information about current and prospective representative payees to determine
whether the subjects are fit to manage Social Security benefits—in other words, fit to serve as
fiduciaries for incapable people with respect to some part of those people’s finances.154 Under an
information-sharing agreement, state courts would use the same information from SSA to
determine whether the same individuals are fit to serve as guardians or conservators, which
would require them to manage or serve as fiduciaries regarding other aspects of the incapable
persons’ finances. Because SSA and state courts would use the same information for the same
Although courts might treat OLC’s interpretation of the Privacy Act as persuasive authority, they are not bound
to defer to it. See Crandon v. United States, 494 U.S. 152, 177 (1990) (explaining that an “advisory opinion ... of the
... OLC ... is not an administrative interpretation that is entitled to deference under Chevron”); Cherichel v. Holder,
591 F.2d 1002, 1016 (8th Cir. 2010) (“We note ... that while OLC opinions are generally binding on the Executive
branch, the courts are not bound by them.” (internal citation omitted)). Because an individual alleging that his or her
information has been disclosed in violation of the Privacy Act has a private right of action, as explained above, it
ultimately falls to the courts to determine whether any invocation of the routine use exception is permissible. In this
light, even were it equipped with an OLC opinion blessing disclosure of certain representative payee and beneficiary
information to state courts, SSA would still run a litigation risk.
151

152

See ns. 136–145 and accompanying text.

As noted earlier, the Privacy Act protects “any records under the control of any agency from which information is
retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular
assigned to that individual.” 5 U.S.C § 552a(a)(5). Because SSA would be retrieving all of the identified data points
by SSN or name, the Privacy Act applies to all of this information.
153

154

GOV’T ACCOUNTABILITY OFFICE, GAO-11-678, INCAPACITATED ADULTS, supra note 13, at 25.

47

general purpose—establishing certain people’s fitness to oversee finances for vulnerable
people—the two uses of the designated information may fairly be characterized as “functionally
equivalent,” and thus “compatible” under the routine use exception.155
The same logic applies with respect to the sharing of information about incapable
beneficiaries. SSA’s stated purpose for collecting information about an incapable person is to
determine whether that individual needs a representative payee and, if so, to properly administer
and oversee payments of his or her benefits to the representative payee. Based on the study
team’s interviews with state court officials, state courts would use the disclosed information for a
similar purpose: evaluating whether an incapable person needs a guardian or conservator and, if
so, what qualifications the guardian or conservator should possess to properly oversee the
management of the incapable individual’s assets and income.156 The substantial overlap between
those two purposes means SSA could make a reasonable argument that its purposes in compiling
designated information about incapable beneficiaries is “compatible” with state courts’ purposes
in using that information.
Whether federal courts will ultimately hold that SSA’s purposes in collecting the
designated information about representative payees and incapable beneficiaries are “compatible”
with state courts’ uses of that information depends, in the first place, on the level of generality
with which federal courts define the relevant purposes. As explained above,157 court decisions in
cases like Ames158 and Doe,159 along with several of OLC’s opinions,160 support defining the
relevant purposes at a high level of abstraction. Thus, it is at least plausible that federal courts
will define both relevant purposes as being to determine whether a person is suitable to manage
an incapable person’s government-allocated finances. Defined that way, the study team

See Britt, 886 F.2d at 550; OFFICE OF MGMT. & BUDGET, EXEC. OFFICE OF THE PRESIDENT, CIRCULAR A-108,
FEDERAL AGENCY RESPONSIBILITIES FOR REVIEW, REPORTING, AND PUBLICATION UNDER THE PRIVACY ACT 11–12
(2016).
155

As noted above in the Study Design’s “Assumptions and Premises” § II(C), this information would flag
information for follow-up investigation, rather than provide immediately actionable information upon which SSA
could solely rely in its decision-making process. A narrower information exchange along these lines would be less
likely to disclose irrelevant information and thus would be more likely to satisfy the Privacy Act’s compatibility
analysis and reduce SSA’s litigation risk.
156

157

See supra pp. 40–41 and nn. 110–119.

158

Ames, 861 F.3d at 241.

159

Doe, 660 F. Supp. 2d at 31.

160

See, e.g., 20 Op. O.L.C. at 60 (advising that the routine use exception permits the Attorney General to take data
collected to conduct background checks on prospective firearms purchasers and share it with law enforcement
agencies for use in their ongoing criminal investigations because both uses of the data advance a general “law
enforcement purpose”).

48

concludes that there is a sufficiently “concrete relationship”161 between SSA’s use of the relevant
information and the state courts’ uses of it that the uses are “compatible” for purposes of the
routine use exception.
The strength of any argument about compatibility also depends on the expansiveness of
the disclosure at issue. It matters, for instance, how much information SSA discloses to state
courts. The more information SSA shares, the more likely it is that state courts’ uses of that
information will not be compatible with the purposes for which SSA collected it. Likewise,
information sharing is more likely to comply with the routine use exception if state courts agree
to narrow and carefully tailored limitations on how they will use the information SSA shares
with them. The more constrained state courts are in their use of representative payee information,
the less likely they are to use it for purposes that are incompatible with SSA’s reasons for
collecting it. Consistent with those two considerations, SSA’s argument for compatibility will be
strongest if it limits disclosure of information about beneficiaries and their representative payees
to those instances in which state courts are assessing whether or not the same pairings of
beneficiaries and representative payees are appropriate for guardian-conservator pairings. The
obvious congruity of uses in such cases would increase the likelihood that they would fit within
the routine use exception. By contrast, were SSA to simply share with state courts the names,
SSNs, and dates of birth of every single representative payee and beneficiary, the case for
compatibility would be considerably weaker, because the data set would include a significant
amount of information of no use to state courts.
In the past, SSA has stated that it does not appear that its purpose for collecting
representative payee information is compatible with the purpose for disclosure because, unlike
representative payees, “[s]tate-appointed legal guardians … may have broader legal authority to
care for personal property and other interests.”162 This is a valid concern, as the additional uses to
which the state courts put the information could detract from the argument that it is being used
for the same “purpose.” But SSA can address the concern in a way that still allows it to share
representative payee information with state courts. Specifically, SSA can refuse to share
representative payee information unless the state courts that receive it agree to use it only to
ascertain whether a person would be a suitable fit for a particular guardianship or
conservatorship relationship. By limiting the use of representative payee information in that way,
the study team concludes that SSA can ensure that state courts use the information only for

As discussed earlier, Britt is the “leading” case on compatibility. U.S. DEP’T OF JUSTICE, OVERVIEW OF THE
PRIVACY ACT OF 1974, supra note 73, at 88. For that reason, the study team used its framework in analyzing
compatibility in this section. The study team acknowledges that the D.C. Circuit may potentially take a less stringent
approach to determining compatibility, see, e.g., Ames, 861 F.3d at 240 n.1 (explaining that the D.C. Circuit has not
yet determined the precise meaning of compatibility); U.S. Postal Serv., 9 F.3d at 144, but did not consider
application of a less stringent approach given that SSA’s Representative Payee Program is national in scope and
therefore the agency is likely bound, as a practical matter, to the more stringent interpretation set out by the Third
Circuit in Britt.
161

162

GOV’T ACCOUNTABILITY OFFICE, GAO-11-678, INCAPACITATED ADULTS, supra note 13, at 17.

49

purposes that are “compatible” with SSA’s purposes in obtaining it.163
In sum, the study team has concluded that SSA could make a reasonable argument in
favor of invoking the routine use exception to disclose these limited types of information to state
courts for the limited purposes discussed above.164 Still, given the considerable uncertainty
concerning the outer bounds of the routine use exception, the study team recommends that SSA
seek an opinion from OLC before invoking the exception. And even if SSA obtained such an
opinion, it would still run a risk of litigation from a representative payee or beneficiary alleging
that his or her information was improperly shared in violation of the Privacy Act.165 In this light,
the study team has identified two other options SSA may consider taking rather than invoke the
routine use exception if it wishes to pursue information sharing with state courts.
3. Additional Options for Information Sharing SSA Might Consider In Lieu of
Invoking the Routine Use Exception
Set forth below are two other options that SSA may consider taking if it wishes to pursue
information sharing with state courts but does not wish to invoke the routine use exception under
the Privacy Act.
(1) Written Consent
The Privacy Act only applies to disclosures made without prior written consent.166 Thus,
if SSA wishes to pursue information sharing with state courts, it should consider whether there
are mechanisms it can implement to prospectively obtain written consent from representative
payees and incapable beneficiaries to share their information with state courts. For example, SSA
could request that representative payees voluntarily consent to their information being shared
when they apply to serve as a payee or, for existing payees, when they are assigned to serve an
additional or new beneficiary. Similarly, under Section 201 of the SPSSBA, SSA beneficiaries
can designate in advance individuals to serve as their representative payees.167 SSA should
163

A similar principle disposes of certain concerns that might arise were SSA to receive information from state
courts as part of a reciprocal information-sharing arrangement. In phone calls with the study team, SSA’s
headquarters staff raised the possibility of state courts providing SSA with information about people who are not
being assessed for representative payee status. In that case, headquarters staff hypothesized, SSA might find itself in
violation of the Privacy Act’s requirement that an agency “maintain in its records only such information about an
individual as is relevant and necessary to accomplish a purpose of the agency required to be accomplished” by law.
5 U.S.C. § 552a(e)(1). Here again, the underlying concern is valid but within SSA’s power to address. SSA might,
for instance, condition any information-sharing arrangement on state courts’ agreeing not to provide SSA with
information unless the information pertains to someone being assessed for representative payee status. SSA thus has
it within its power to structure information-sharing arrangements in ways that minimize Privacy Act concerns.
As noted earlier, SSA has promulgated a regulation implementing the Privacy Act’s compatibility standard. See
20 C.F.R. § 401.150. Accordingly, SSA must also ensure that any information it shares under the routine use
exception conforms to the terms of this standard.
164

As noted above in the Study Design’s “Assumptions and Premises” § II(C), the study team acknowledges and
accepts SSA’s ultimate authority to assess and weigh the value of such data exchanges in light of their respective
burdens and costs to the agency. Further, resource-allocation and other policy decisions are beyond the scope of this
report.
165

166

5 U.S.C. § 552a(b).

167

Strengthening Protections for Social Security Beneficiaries Act of 2018, supra note 22, § 201.

50

consider whether beneficiaries could at the same time also consent in advance to have their
information shared if they are assigned a representative payee.168 Both mechanisms could
provide a meaningful way for SSA to prospectively share information with state courts without
resorting to the routine use exception.
At the same time, obtaining consent from representative payees and incapable
beneficiaries may pose other additional legal or administrative hurdles. For example, SSA
headquarters staff identified the Paperwork Reduction Act (PRA)169 as a major legal obstacle
that SSA would be required to overcome when establishing a consent-based approach to
information sharing. The PRA is “the basic statute controlling paperwork requirements imposed
on the public by the federal government” and sets out a process with which federal agencies must
comply to gain approval (known as “clearance”) from OMB’s Office of Information and
Regulatory Affairs (OIRA) for an information collection.170 This clearance process would apply
to a hypothetical form SSA would presumably use to collect information and obtain written
consent from representative payees and incapable beneficiaries. Nothing in the PRA appears to
prohibit such a hypothetical consent form outright, and SSA has not identified any such
provision. Notably, SSA has created consent forms in other contexts in the past and complied
with the PRA in so doing, including obtaining clearance from OIRA.171 Although the clearance
process may be burdensome, such concerns are more appropriately considered administrative
hurdles consistent with other similar concerns identified by SSA headquarters staff.
With respect to administrative hurdles, SSA headquarters staff pointed to various
legitimate challenges to overcome, such as tracking the status of written consent and any
attendant time limitations, implementing an opt-out process, avoiding imposing unnecessary
burdens on vulnerable populations, and the apparent absence of incentives for individuals to
provide consent. Notably, SSA has created consent forms in other contexts in the past.172 Even
so, whether to implement such a consent-based approach is ultimately a policy decision for SSA
in assessing whether the value derived justifies the costs given the unique and specific
considerations at issue in this information-sharing regime.

SSA’s Program Manual lays out the agency’s internal requirements and procedures for obtaining consent. SOC.
SEC. ADMIN., PROGRAM OPERATIONS MANUAL GN 00305, “DISCLOSURE WITH CONSENT,”
https://secure.ssa.gov/apps10/poms.nsf/subchapterlist!openview&restricttocategory=02033 (last visited June 1,
2020).
168

169

44 U.S.C. §§ 3501 et seq.

170

See Paperwork Reduction Act, FEDERAL ADMINISTRATIVE PROCEDURE SOURCEBOOK (June 1, 2020),
https://sourcebook.acus.gov/wiki/Paperwork_Reduction_Act/view (describing the details of the PRA’s clearance
process).
171

See, e.g., Form SSA-3288, Consent for Release of Information, https://www.ssa.gov/forms/ssa-3288.pdf
(including a PRA Statement noting compliance with the PRA’s clearance provisions).
172

See, e.g., id. (including a PRA Statement noting compliance with the PRA’s clearance provisions).

51

(2) Request that Congress Amend the Social Security Act
Finally, if SSA wishes to pursue information sharing with state courts, it should also
consider requesting that Congress amend the Social Security Act to provide explicit
authorization for it to disclose representative payee and incapable beneficiary information to
state courts. As an initial matter, SSA would need to clear such a legislative request with
OMB.173 To craft the appropriate legislative language, SSA would need to work closely with
Congress to identify the specific types of information that should be disclosed and the purpose
for the disclosure.
Congress has previously provided express authorization for an agency to disclose
information in collaboration with state entities in other contexts, such as tax administration and
law enforcement, and Congress might consider doing so here as well. For example, Congress has
explicitly provided the IRS with statutory authority to share certain tax information with states
for the purpose of state tax administration.174 In providing this authorization, Congress restricted
the sharing to specific types of taxes and imposed additional administrative obligations for states
seeking the information. Similarly, Congress has also expressly authorized information sharing
with states in the law enforcement context. In the Homeland Security Act of 2002, Congress
chartered a “Directorate for Information Analysis and Infrastructure Protection” within the
Department of Homeland Security.175 This directorate was given explicit authorization to
exchange, among other things, information with states related to threats of terrorism. Given the
existing precedent for Congressional action regarding information sharing, it seems possible
Congress might be willing to authorize SSA to begin sharing information with state courts
regarding representative payees and incapable beneficiaries.
Thus, if SSA wishes to pursue information sharing with state courts, it could also
consider asking Congress to pass legislation expressly permitting it to do so (after clearing such a
request with OMB). Whether OMB or Congress would or should approve such a request is
beyond the scope of this report.
4. Consider Sharing Organizational Representative Payee Information
SSA should also consider whether the Privacy Act applies to its approximately 32,000
organizational representative payees. An organizational representative payee “is a business,
company or the like . . . that manages benefits on behalf of an incapable beneficiary” or, more
often, on behalf of multiple beneficiaries.176 Because the Privacy Act’s protections extend only
to “individual[s],” which the Privacy Act defines as either a “citizen of the United States” or an
See OFFICE OF MGMT. & BUDGET, EXEC. OFFICE OF THE PRESIDENT, CIRCULAR A-19, LEGISLATIVE
COORDINATION AND CLEARANCE (rev. Sept. 20, 1979) (setting forth requirements in sections 7 and 8 for the
submission of agency proposed legislation and the clearance of agency proposed legislation).
173

174

26 U.S.C. § 6103(d)(1).

175

6 U.S.C. § 121.

176

SOC. SEC. ADMIN., TRAINING ORGANIZATIONAL REPRESENTATIVE PAYEES,
https://www.ssa.gov/payee/LessonPlan-2005-2.htm (last visited June 1, 2020). See also SOC. SEC. ADMIN., OFFICE
OF THE INSPECTOR GENERAL, EXAMINING SSA’S REPRESENTATIVE PAYEE PROGRAM: WHO PROVIDES HELP,
https://oig.ssa.gov/newsroom/congressional-testimony/march22-representative-payee (last visited June 1, 2020).

52

“alien lawfully admitted for permanent residence,” it appears the Privacy Act does not protect
the information of organizational representative payees, and SSA is therefore permitted to share
that information.177
Sharing organizational representative payee information would be a significant step
forward. Although the 32,538 organizational representative payees made up less than 1% of all
payees in fiscal year 2019, they collectively served as payees for 918,000 of the 8 million
beneficiaries who had been assigned one in 2019.178 Moreover, these 918,000 beneficiaries are
among the most vulnerable of all beneficiaries “because, in addition to being deemed incapable
of managing [or directing the management of] their own benefits, they [may] lack family or
another responsible party to assume this responsibility.”179
SSA headquarters staff noted specific concerns about disclosing information about
organizational representative payees180 that could result in improperly disclosing information
about specific incapable beneficiaries, which would likely trigger the Privacy Act. Notably, SSA
already discloses certain information annually about organizational representative payees,
including details about certain allegations and findings of misuse, without disclosing information
about specific beneficiaries.181 These summaries identify the name and location of the
organizational representative payees and briefly describe select details about the allegations,
investigation, or findings.182 Therefore, SSA could realize many benefits associated with
information sharing by exchanging information about organizational representative payees
without disclosing information about specific beneficiaries.183

5 U.S.C. § 552a(a)(2). See also U.S. DEP’T OF JUSTICE, OVERVIEW OF THE PRIVACY ACT OF 1974, supra note 73,
at 16 (explaining that “[c]orporations and organizations also do not have any Privacy Act rights.”); 20 C.F.R.
§ 401.25 (defining “individual” as a “living natural person” that does “not include corporations partnerships, and
unincorporated business or professional groups of two or more persons”).
177

178

SOC. SEC. ADMIN., ANNUAL REPORT ON THE RESULTS OF PERIODIC REPRESENTATIVE PAYEE SITE REVIEWS AND
OTHER REVIEWS 2 (2019).
U.S. GOV’T ACCOUNTABILITY OFFICE, GAO-19-688, SOCIAL SECURITY BENEFITS: SSA NEEDS TO IMPROVE
OVERSIGHT OF ORGANIZATIONS THAT MANAGE MONEY FOR VULNERABLE BENEFICIARIES 1 (2011).
179

180

Other concerns involved the accuracy and detail of information identifying the organizational representative
payees because the organization may use multiple names and multiple employer identification numbers.
181

See, e.g., SOC. SEC. ADMIN., ANNUAL REPORT ON THE RESULTS OF PERIODIC REPRESENTATIVE PAYEE SITE
REVIEWS AND OTHER REVIEWS (2018), https://www.ssa.gov/legislation/2018RepPayeeReport.pdf (disclosing
information about organizational representative payees).
182

Id. at 13–35.

As noted previously, the study team acknowledges SSA’s ultimate authority to assess and weigh the value of
such hypothetical data exchanges in light of their respective burdens and costs to the agency, and this report does not
examine resource allocation issues.
183

53

B. Authorization to Share Information and Section 1106 of the Social Security Act
Even assuming SSA could share information with state courts without violating the
Privacy Act, SSA has taken the position that it is not authorized to disclose information with
state courts and that it would therefore have to charge state courts for any information it
provides.184 As an initial matter, SSA cannot use appropriated funds in a manner that is not
authorized by Congress.185 To determine whether SSA could use appropriated funds to create the
contemplated information-sharing regime with states, SSA would be required to decide whether
any information it obtains from state courts in return for its own information sufficiently
advances its statutorily authorized functions. The study team takes no position on that question.
If SSA determines that a reciprocal information-sharing regime insufficiently advances
its statutorily authorized functions, the study team agrees with SSA’s conclusion that it is
permitted to charge the states for any information it provides. Section 1106 of the Social Security
Act186 governs that analysis. Section 1106(a) generally prohibits the unauthorized disclosure of
information in SSA’s possession and would likely apply to its disclosures in an informationsharing exchange with state courts.187 Section 1106(a) applies broadly, and SSA may not
disclose information in its possession unless SSA regulations authorize the disclosure.188
Subsection (b) provides SSA the authority to disclose information for non-program purposes,
subject to regulations prescribed “to avoid undue interference with [SSA’s] functions” so long as
“the agency, person, or organization making the request agrees to pay for the information …
requested in such amount, if any (not exceeding the cost of furnishing the information or
services)[.]”189 In other words, subsection (b) permits SSA to charge recipients for any
information SSA discloses pursuant to its regulations.190
Read together, these statutory provisions provide that SSA may charge state courts for
establishing and operating the information-sharing regime as long as SSA regulations authorize
such disclosure. SSA would need have regulations to facilitate the program because its current
information-disclosure regulations do not authorize or contemplate such a disclosure regime with
state courts.191

See, e.g., GOV’T ACCOUNTABILITY OFFICE, GAO-11-678, INCAPACITATED ADULTS, supra note 13, at 25
(responding to GAO’s report proposing that SSA disclose certain information about incapacitated beneficiaries and
their fiduciaries to state courts by stating that information sharing is not viable because if it were to disclose
information to state courts it “would have to charge [states] for [its] services.”). During the study team’s interview
process, SSA headquarters staff reiterated this assessment.
184

185

31 U.S.C. § 1301.

186

42 U.S.C. § 1306.

187

Id. § 1306(a)(1). Subsection (a)(1) also sets out penalties for unauthorized disclosures, including felony
conviction, a fine up to $10,000 per occurrence, and up to 5 years in prison.
188

Id.

189

Id. § 1306(b).

190

Id.

191

See 20 C.F.R. pts. 401–402.

54

C. The CMPPA and Other Federal Laws
The final potential barrier to information sharing is the CMPPA, which sets out
requirements for federal agencies to follow when engaging in computer-matching activities.192
The hypothetical data exchanges discussed in this report may implicate the CMPPA’s
requirements, depending on their design, the type of exchange, the purpose of the exchange, and
the data to be disclosed.
The CMPPA amended the Privacy Act to add special requirements and privacy
protections when agencies engage in computer-matching programs with other federal or state
agencies.193 A computer-matching program is any computerized comparison of two or more
automated systems of records controlled by federal agencies, or a computerized comparison of a
federal agency’s system of records with other non-federal records, to establish or verify
eligibility or compliance under federal benefit programs.194 The CMPPA requires that federal
agencies who match information with other entities provide prior public notice about the
establishment or revision of such programs, as well as enter into written matching agreements
that specify, among other things, the scope, purpose, and legal authority of the program.195
Similarly, the CMPPA also lays out guidelines for computer matching that ensure federal
agencies conduct computer matches uniformly and provide the protections required by the
Privacy Act.196
These burdens are largely administrative and dependent on the design of the hypothetical
data exchanges. SSA headquarters staff acknowledged that the CMPPA may not be a significant
legal barrier. This accords with current agency practices, given that SSA has routinely complied
with the CMPPA’s requirements in the context of other matching programs. For example, SSA
has matching programs with state agencies that administer and determine eligibility for certain
entitlement programs, such as SNAP197 and the Special Supplemental Nutrition Program for
Women, Infants, and Children.198
Even so, SSA headquarters staff explained that the CMPPA could pose a significant
administrative barrier given the time, effort, and volume of data at issue, which SSA would need
to weigh with countervailing concerns, including agency interest. Notably, SSA headquarters
officials emphasized during the study team’s interviews that it is common for it to take 12 to 16
months to create a new matching agreement and that it can be difficult to get every state to agree
192

Computer Matching and Privacy Protection Act of 1988, Pub. L. No. 100-503, 102 Stat. 2507 (amending various
provisions of the Privacy Act at 5 U.S.C. § 552a). SSA has not pointed publicly to the requirements of the CMPPA
as posing a barrier to information sharing in the context of this study.
193

Id.

194

5 U.S.C. § 552a(a)(8).

195

Id. § 552a(o). See also SOC. SEC. ADMIN., MODEL COMPUTER MATCHING AND PRIVACY PROTECTION ACT
AGREEMENT, https://www.ssa.gov/dataexchange/documents/CMPPA%20State%20Agency%20Model.pdf (last
visited June 1, 2020).
196

5 U.S.C. § 552a(o).

197

See generally 7 U.S.C. §§ 2011 et seq.

198

See generally 42 U.S.C. §§ 1771 et seq.

55

to the same set of terms set forth in the agreements. As previously explained, SSA would need to
assess and weigh the value of these matching programs in light of their respective burdens and
costs to the agency.199
Beyond the Privacy Act, Social Security Act, and CMPPA, the study team has conducted
a general survey of other federal laws to determine whether there may be other significant
federal legal barriers to information sharing. The study team has not identified any such laws.
Likewise, SSA did not identify any other federal laws that it believed may pose a significant
legal barrier to information sharing in response to an ACUS inquiry.
D. Other Information Sharing Regimes
The final aspect of the study team’s analysis of the legal barriers consisted of reviewing
other information sharing practices within SSA and at other federal agencies to identify any
useful similarities or differences that might provide context to the legal barriers that exist for
information sharing here. This review led to two key findings.
First, as noted in Part 1 above, a robust information sharing regime already exists
between SSA and those state agencies that administer federal benefit programs, including SNAP,
TANF, LIHEAP, and Foster Care and Adoption Assistance. In addition, information-sharing
regimes appear to be commonplace across the federal government, with many large agencies
engaging in information sharing with state entities. For example, the Federal Emergency
Management Agency shares PII of individual disaster-assistance applicants under the routine use
exception with a range of government and private entities, including state courts, in carrying out
its disaster-assistance programs.200 Similarly, the HHS shares PII under the routine use exception
with a wide variety of state entities.201 Although these existing information sharing regimes do
not change the fact that SSA must carefully consider whether it may, consistent with its legal
obligations, share representative payee or incapable beneficiary information with state courts, it
does show that the legal barriers associated with disclosing information to state courts under the
routine use exception are not necessarily insurmountable.
Second, aside from the pervasiveness of these existing information sharing regimes, it
appears SSA has also already published in its SORNs many routine uses for disclosure of
representative payee information. For example, SSA has published 24 routine uses in the SORN
for its “Master Representative Payee File.”202

As noted above in the Study Design’s “Assumptions and Premises,” § II(C), the study team acknowledges and
accepts SSA’s ultimate authority to assess and weigh the value of such data exchanges in light of their respective
burdens and costs to the agency. Further, resource-allocation and other policy decisions are beyond the scope of this
report.
199

Dep’t of Homeland Security, Privacy Act of 1974; Department of Homeland Security Federal Emergency
Management Agency-008 Disaster Recovery Assistance Files System of Records, 78 Fed. Reg. 25,282 (Apr. 30,
2013).
200

See, e.g., U.S. DEP’T OF HEALTH & HUMAN SERV., CENTERS FOR MEDICARE & MEDICAID SERVICES, SORNS,
https://www.hhs.gov/foia/privacy/sorns/cms-sorns.html (last visited June 1, 2020).
201

202

Soc. Sec. Admin., Privacy Act of 1974; System of Records, 83 Fed. Reg. 55,230–31 (Nov. 2, 2018).

56

II. Legal Barriers to Information Sharing for State Courts
To identify the most common and significant types of legal barriers for state courts, the
study team surveyed the statutory codes and judicial rules of all 50 states.203 From this survey,
the study team has identified three main categories of potential legal barriers: (1) statewide
privacy statutes that resemble the federal Privacy Act of 1974 and generally govern the
disclosure of personal information by state entities; (2) statewide statutes that specifically limit
disclosure of SSNs; and (3) state court judicial rules that govern the collection and disclosure of
personal information in case records and related documents.
The application and complexity of the laws and rules within each of these categories
varied, often significantly, from state to state. Moreover, the laws or rules governing disclosure
within any given state often interacted or overlapped with one another. For example, some
statewide privacy statutes incorporate by reference the prohibitions against disclosure potentially
contained in other state or federal statutes or judicial rules (e.g., the statewide privacy statute in
California provides that “[n]othing in this [statute] should be construed to authorize the
disclosure of any record containing personal information, other than to the subject of such
records, in violation of any other law.”).204 Thus, even if disclosure were permitted under the
statewide privacy statute, it may still be barred by some other state statute, such as a statute
specifically governing disclosure of SSNs.
Another layer of complexity is that in many states some of the laws governing the
disclosure of personal information exempt the state judiciary, whereas other state privacy-related
statutes in that same state may not. For example, it is possible that the statewide privacy statute
does not apply to the judiciary, but the statewide law governing disclosure of SSNs does. Given
this complexity, the analysis below of state court legal barriers is necessarily limited to a
discussion of each type of barrier generally, along with citations to examples of the laws or rules
from various states that may pose a barrier to information sharing.
A. General Statewide Privacy Laws
The study team has found that all 50 states have adopted laws that generally govern the
disclosure of personal information by state entities. A survey of these laws revealed that they fall
into two main categories. First, in 11 states, the general state privacy laws resemble the federal
Privacy Act in that they are standalone statutes that apply generally to disclosing personal
information by all state governmental entities except the courts.205 Thus, in these 11 states, the
statewide privacy laws do not pose a barrier to information sharing.
In the remaining 39 states, the general privacy laws are not standalone or independent in
operation. Rather, they are embedded as exceptions to disclosure within each state’s public
203

As noted above, the study team limited its study of the barriers to information sharing to specific data points.
Because state courts are the main repositories of this information in all states, the study team limited its study of the
opportunities and barriers to information sharing to state courts.
204

See Cal. Civ. Code § 1798.3 (provision of statewide privacy statute explicitly excluding the state courts from
coverage); id. § 1798.85 (statute governing disclosure of SSNs and appears to apply to state courts).
205

The study team identified Alaska, Arkansas, California, Connecticut, Illinois, Massachusetts, Minnesota, New
York, North Carolina, Ohio, and Virginia as falling within this category.

57

records law. However, similar to standalone privacy statutes, in some states these public records
laws explicitly exempt the judiciary,206 whereas in others they do not.207 In addition, within those
states where the public records law applies to the judiciary, the disclosure exceptions differ in
operation. In some states, the exceptions are mandatory (i.e., affirmatively prohibit disclosure of
personal information),208 whereas in other states they are merely discretionary (i.e., leave
disclosure to the discretion of the state entity responding to the records request).209 And, in at
least one state, the privacy exceptions can be discretionary or mandatory depending on the
personal information at issue.210
Finally, along with the operational differences, the types of personal information covered
by the exceptions vary widely. In some states, the privacy exceptions are very broad and bar
disclosure of SSNs and contact information both of incapable beneficiaries and guardians.211 In
other states, the statutes define protected personal information narrowly and permit disclosure of
incapable beneficiary and guardians or conservator information.212
Given the disparities in the operation and breadth of these exceptions, it is difficult to
estimate the significance of these laws on information sharing. Even so, based on the study
team’s survey, the barrier posed by these laws does not appear to be significant. Only 12 of the
39 states without standalone or independent general privacy laws have a public records law that
both applies to the judiciary and contains mandatory exceptions that would affirmatively prohibit
state courts from disclosing personal information. Thus, in 38 of the 50 states, statewide privacy
statutes would not serve as a barrier to information sharing. A chart displaying the study team’s
findings about statewide privacy laws is in Appendix G.
B. State Statutes Limiting Disclosure of SSNs
The second category of potential barriers involves state statutory provisions governing or
prohibiting the disclosure of SSNs by state entities. These provisions are of particular importance
because SSNs may serve as the unique identifier that enables information sharing with SSA
under certain circumstances in the hypothetical regime set out in this report. The study team has
identified 37 of 50 states as having some statutory provision specifically governing the
disclosure of SSNs. Like general statewide privacy laws, these statutory provisions vary widely
Based on the study team’s survey, 6 of the 33 states with public records’ laws explicitly exempt state courts. See,
e.g., Haw. Rev. Stat. Ann § 92F-3 (stating that Hawaii’s public records law “does not include the non-administrative
functions of the courts”).
206

See, e.g., Idaho Code § 74-101 (defining state agency for purpose of the public records law as “including . . .
[the] judicial branch”).
207

See, e.g., Miss. Code Ann. § 25-62-3(2) (stating that “[personal information shall be exempt from disclosure
under the Mississippi Public Records Act”).
208

See, e.g., Okla. Stat. tit. 51, § 24A.5(2) (stating that “[a]ll [SSNs] included in a record may be confidential . . .
and may be redacted or deleted prior to release of the record by the public body”).
209

210

See, e.g., Maryland GP §§ 4-301, 4-343.

211

See, e.g., Pennsylvania Right-to-Know Law, 65 P.S. § 67.708; Neb. Rev. Stat. § 84-712.05(19).

212

See, e.g., Miss. Code Ann. § 25-62-1 (defining personal information narrowly to only include names/information
of people who have donated to nonprofits).

58

in application and operation, and in some states are embedded within the state public records law
as mandatory exceptions.
Collectively, these provisions likely would not pose a significant barrier to information
sharing in the majority of states. In the 37 states that the study team has identified as having such
a provision, 20 have SSN provisions that are not applicable to state courts.213 In the other 17
states, the relevant statutory language was ambiguous regarding whether or not the relevant
provision applied to state courts. Thus, collectively these provisions do not pose a barrier to
information sharing in at least 33 of the 50 states. A chart displaying the study team’s findings
about these provisions is in Appendix G.
C. State Court Judicial Rules
The final potential category of legal barriers to information sharing for state courts is
court-created judicial rules. Like both types of state statutes discussed above, state court rules
governing the disclosure of records also vary widely in operation and breadth. Generally, court
records in all states are presumed to be open to the public. That said, some state courts have
adopted disclosure rules that protect certain types of personal information in court records. The
study team’s survey of state court rules identified 39 states as having adopted a statewide judicial
rule or rules governing information disclosure. A chart displaying the study team’s findings
about judicial rules is in Appendix G.
The study team has reviewed these disclosure rules, as well as state judicial rules more
broadly, and identified three common types of rules that may pose a barrier to information
sharing:
•

Rules governing when judges may seal case records. Judges in all states may seal
case records under certain circumstances. In specifying whether it is appropriate to
seal a record, most state rules instruct the judge to balance the public’s interest in
disclosure or accessibility against the individual privacy interests at stake.214 During
the study team’s interviews with state court officials, some indicated that judges
sometimes seal records in guardianship/conservatorship cases.

•

Rules governing the disclosure of SSNs. Most states with a judicial rule specifically
governing SSNs prohibit the disclosure of SSNs or, in some cases, all but the last four
digits of an SSN.215 Some courts have also implemented filing rules that discourage
or prohibit including SSNs in court filings, which poses a similar legal obstacle. As
discussed above, disclosure of SSNs may be necessary to facilitate more effective
information sharing with SSA.

See, e.g., Alaska Stat. § 45.48.090(3) (defining “governmental agency” as “a state or local governmental agency,
except for an agency of the judicial branch”).
213

214

See, e.g., Alaska Rules of Administration 37.5; California Trial Court Rules, Article 4, 2.550.

215

See, e.g., Arizona Rules of the Supreme Court 123(c); 123(g)(1)(A); Colorado Directive Concerning Access to
Court Records, § 4.60(e).

59

•

Rules governing the disclosure of information in court records to other
governmental entities. In some states, the disclosure rules provide special
procedures or exceptions when disclosure of court records is to another governmental
entity.216 These rules generally enhance the ability of state courts to share information
with SSA. Even so, in some cases these rules also place additional administrative or
procedural requirements on state courts making such disclosures.

In sum, although many state courts have implemented rules that may serve as a barrier to
information sharing, none of these rules makes information sharing a legal impossibility. This is
largely because state courts can amend their rules as necessary to facilitate information
sharing.217 The process and complexity for amending judicial rules also varies between states,
but most states have standing rules committees or working groups specifically assigned to
recommend amendments to existing rules to improve the fairness, effectiveness, or efficiency of
court proceedings and programs. For example, California’s standing Rules Committee meets
almost monthly to discuss needed changes or amendments to state judicial rules.218
Finally, during the study team’s interviews with state court officials, they consistently
expressed their view that the principal barrier to information sharing from their perspective was
technological, not legal. None of the state court officials interviewed expressed strong concerns
about the legal barriers to sharing information with SSA. As a result, the study team concludes
that the principal legal barriers to information sharing relate to SSA’s ability to share
information, not state courts’ ability.

216

See, e.g., California Trial Court Rules, Article 4, 2.540.

217

Whether a specific state court would change their rules to accommodate a hypothetical information-sharing
regime is beyond the scope of this report.
218

California Rule of Court 10.13 (establishing and defining the California court system’s Rules Committee).

60

Appendix A: Key Provisions of Public Law 115-165
On February 5, 2018, the Committee on Ways and Means Chairman Kevin Brady (R-TX8) and
Ranking Member Richard E. Neal (D-MA1) submitted a Legislative History and Technical
Explanation of H.R. 4547 (became Public Law 115-165), the SPSSBA, to then Acting
Commissioner of SSA Nancy Berryhill. Outlining the need for the legislation, the document
provided seven key provisions:
• SECTION 101: STRONGER MONITORING OF REPRESENTATIVE PAYEES
Representative payees will be subject to increased on-site reviews to be carried out by
each state’s Protection and Advocacy (P&A) system. SSA will provide annual grants to
state P&A systems to accommodate the increased reviews.
• SECTION 102: REDUCING THE BURDEN ON FAMILIES
While still requiring benefits to be used on behalf of the beneficiary, SSA will no longer
require annual filings of accounting forms for “representative payees who are a parent or
legal guardian living with the child receiving Social Security or SSI benefits, a parent
living with an adult who is receiving benefits, and spouses.”
• SECTION 103: PROTECTING BENEFICIARIES THROUGH INFORMATION SHARING
SSA is required to complete data exchanges with state foster care agencies on a monthly
basis to monitor children receiving Social Security benefits to determine if they have
been moved in or out of the foster care system and if SSA needs to determine a new
representative payee.
• SECTION 201: ADVANCE DESIGNATION OF PAYEE
SSA will allow beneficiaries to designate in advance a potential representative payee
prior to the necessitation of representative payee services. Organizational representative
payees will not be eligible for advanced designation.
• SECTION 202: PROHIBITION ON INDIVIDUALS CONVICTED OF CERTAIN CRIMES
SERVING AS REPRESENTATIVE PAYEES
Individuals convicted of at least one of the twelve felonies listed in this section are not
eligible to serve as representative payees. Individuals currently acting as representative
payees who have previously been convicted of at least one of the twelve felonies will be
removed as representative payee within five years.
• SECTION 203: PROHIBITION ON INDIVIDUALS WITH REPRESENTATIVE PAYEES
SERVING AS REPRESENTATIVE PAYEES
Individuals with representative payees may not serve as representative payees for other
beneficiaries.

61

• SECTION 204: REASSESMENT OF PAYEE SELECTION AND REPLACEMENT
POLICIES
SSA must review, and make available for public comment, a reassessment of the order by
which it designates representative payees.

62

Appendix B: Interview List
The study team interviewed a range of stakeholders, including experts, advocates, and federal
and state representatives involved with state guardianship/conservatorship programs and SSA’s
Representative Payee Program. Notably, the study team interviewed a number of officials in
SSA field offices, but the specific names of those interviewees are not provided in this report.
This section lists the non-SSA interviewees alphabetically.
COSCA
•
•

Pam Harris, Maryland State Court Administrator
Robin Sweet, Nevada State Court Administrator

General Services Administration
•

Bill Zielinski, Assistant Commissioner, Office of IT Category

House Ways and Means Committee
•
•

Amy Shuart, Staff Director, Social Security Subcommittee
TJ Sutcliffe, Professional Staff Member, Social Security Subcommittee

National Association of State Chief Information Officers
•

Eric Sweden, Program Director, Enterprise Architecture & Governance

NCSC
•
•

Paul Embley, Chief Information Officer
Kathryn Holt, Senior Court Research Analyst

National Conference of State Social Security Administrators (NCSSSA)
•
•
•
•
•

Kathleen Baxter, NCSSSA Vice President & State Comptroller (Alabama)
Daniel Huffine, NCSSSA Vice President & Compliance Officer (Iowa)
Maryann Motza, NCSSSA Legislative Committee Chair
Thomas J. Rearden, NCSSSA President & State Social Security Administrator, MD
Veronica Silva-Gil, State Social Security Administrator, CA

NCSSMA
•
•
•
•

Joe Deaton, NCSSMA Executive Officer & District Manager, Hot Springs, AR
Rachel Emmons, NCSSMA Washington Representative
David Lescarini, NCSSMA Vice President & SSA District Manager, TN
Peggy Murphy, President of NCSSMA & SSA District Manager, Great Falls, MT

New York State Courts
•
•
•

Michelle Gartner, Special Counsel, Fiduciary Appointments
Lawrence Marks, Chief Administrative Court Judge
Paul McDonald, Deputy Counsel for Criminal Justice Matters
63

Ohio State Courts
•
•

David Edelblute, Manager, Children and Families Section at The Supreme Court of Ohio
Dixie Park, Judge, Stark County Court of Common Pleas, Probate Division

Senate Finance Committee
•
•

David Timmons, Policy Advisor
Jeff Wrase, Deputy Staff Director and Chief Economics

SSAB
•
•
•
•

Diane Brandt, Research Director
Claire Green, Staff Director
Kim Hildred, Board Chair
Conway Reinders, Lead Policy Analyst

Virginia Tech/SSAB Project
•

Pam Teaster, Director of the Center for Gerontology and SSAB Project Lead

WINGS
•
•
•
•

Jamie Majerus, Minnesota WINGS Co-Chair
Anita Raymond, Minnesota WINGS Co-Chair
David Slayton, Texas WINGS Chapter
Erica Wood, Assistant Director at the American Bar Association and WINGS
Representative

64

Appendix C: Summary of Prior Reports and Documents
The following is a brief summary of prior literature on the SSA Representative Payee
Program from GAO, SSAB, NAS, the SSA OIG, COSCA, ACUS, and WINGS.
GAO
Over the past two decades, GAO has conducted several studies highlighting the need to
enhance data exchange between SSA and the state courts. In 2004, GAO observed that state
courts and federal agencies “collaborate little in the protection of incapacitated elderly people
and the protection of federal benefit payments from misuse” and recommended increased
coordination among federal agencies, and between federal agencies and state courts that appoint
guardians.219 In its follow up review two years later, GAO concluded that little had changed.220
Several subsequent GAO reports reiterated the need for information sharing among
federal fiduciary programs and state courts, suggesting that better information sharing could
improve the protection of older adults with guardians. For example, in 2011, a GAO report
revealed how gaps in information sharing adversely affected incapacitated adults who are
vulnerable to financial exploitation by fiduciaries and guardians.221 More recently, in its 2013
report, GAO concluded that SSA needed to improve oversight of the representative payees.222
SSAB
The SSAB serves as an independent federal government agency that advises on the
administration of SSA’s OASDI and SSI programs. Over the years, SSAB has issued many
reports and recommendations related to SSA’s Representative Payee Program. In its 2016 report,
Representative Payees: A Call to Action, SSAB calls on SSA, Congress, and stakeholders to
reexamine SSA’s procedures for appointing, selecting, training, and monitoring payees. The
report describes key “issues facing the representative payee program” and warranting “more
interagency research and collaboration to generate media interest, congressional commitment,
and public awareness.”223
Upon holding a public forum in 2017, SSAB released a comprehensive review in January
2018, recommending that SSA “research and evaluate the order of preference for payee
selection.” Shortly after, Congress enacted the SPSSBA. Section 204 of the SPSSBA requires the
Commissioner to review how representative payees are selected and replaced.

219

GOV’T ACCOUNTABILITY OFFICE, GAO-04-655, GUARDIANSHIPS, supra note 13, at 30.

220

GOV’T ACCOUNTABILITY OFFICE, GAO-06-1086T, GUARDIANSHIPS, supra note 13.

221

GOV’T ACCOUNTABILITY OFFICE, GAO-11-678, INCAPACITATED ADULTS, supra note 13.

222

GOV’T ACCOUNTABILITY OFFICE, GAO-13-473, ADDRESSING LONG-TERM CHALLENGES, supra note 12.

223

SOC. SEC. ADVISORY BOARD, REPRESENTATIVE PAYEES: A CALL TO ACTION 1 (2016),
https://www.ssab.gov/announcements/representative-payees-a-call-to-action/ (last visited June 1, 2020).

65

In June 2019, SSAB released its latest brief, Recent Developments in the Social Security
Administration’s Representative Payee Program. The brief discusses salient issues addressed at
SSAB’s September 2018 policy forum, the use of evidence-based policymaking, and the
implementation of the new payee monitoring process.224 More recently, SSAB appointed an
independent, expert panel to review SSA’s progress in implementing key initiatives of its IT
Modernization Plan, including how systems processes are developed, modified, and used by the
agency.225
NAS
Following a congressional request, SSA engaged NAS to review the SSA payee program
in 2007. Specifically, NAS was asked to examine the extent to which representative payees were
not performing their responsibilities in accordance with SSA standards, to determine whether the
representative payment program policies were practical and appropriate, to identify the types of
payees that exhibit the highest risk of misuse, and to identify ways to mitigate the risk of misuse.
Among the major recommendations listed in its report was that SSA “redesign the annual
accounting form to obtain meaningful accounting data and payee characteristics that would
facilitate evaluation of risk factors and payee performance.” Second, NAS recommended that
SSA standardize the process for selecting representative payees, which at the time of the study
varied across field offices.226
NAS also suggested that SSA shift from auditing a random sample of representative
payees to more targeted audits of those most likely to misuse funds. To that end, NAS identified
key risk factors that would suggest the need for enhanced monitoring of a representative payee,
including whether the payee’s zip code differs from the beneficiary’s; the payee also receives
government benefits; the payee has had multiple address changes during the past two years; an
individual payee was serving 15 or more beneficiaries; an organizational payee was serving 50 or
more beneficiaries, and if the payee was a fee-for-service payee.
As for sharing data with state entities, NAS observed that state court
guardianship/conservatorship programs operated independently from the SSA payee program
even though SSA required any beneficiary with a guardian/conservator to also have a payee
selected by SSA. NAS also observed that certain beneficiaries had SSA-appointed representative
payees who were different from the people who served as their guardian/conservator. This in
turn caused “potential conflicts, violations of [SSA] rules, inefficiencies and inaccuracy in
reporting, delays in payee selection, and duplication of effort.”227
SOC. SEC. ADVISORY BOARD, RECENT DEVELOPMENTS IN THE SOCIAL SECURITY ADMINISTRATION’S
REPRESENTATIVE PAYEE PROGRAM, https://www.ssab.gov/research/recent-developments-in-the-social-securityadministrations-representative-payee-program/ (last visited June 1, 2020).
224

225

SOC. SEC. ADVISORY BOARD, https://www.ssab.gov/announcements/expert-panel-to-review-informationtechnology-modernization-efforts/ (last visited June 1, 2020).
NAT’L RESEARCH COUNCIL, DIVISION OF BEHAVIORAL AND SOCIAL SCIENCES AND EDUCATION; COMMITTEE ON
SOCIAL SECURITY REPRESENTATIVE PAYEES, IMPROVING THE SOCIAL SECURITY REPRESENTATIVE PAYEE PROGRAM:
SERVING BENEFICIARIES AND MINIMIZING MISUSE, https://doi.org/10.17226/11992 (last visited June 1, 2020).
226

227

Id.

66

SSA OIG
The SSA OIG has conducted several audits and reviews of SSA’s operations. In its 2018
statement on SSA’s Major Management and Performance Challenges,228 the OIG cited these
seven management and performance goals:
•
•
•
•
•
•
•

Improve Administration of the Disability Programs
Reduce Improper Payments and Increase Overpayment Recoveries
Improve Customer Service
Modernize IT Infrastructure
Secure Information Systems and Protect Sensitive Data
Strengthen the Integrity and Protection of the SSNs
Strengthen Planning, Transparency, and Accountability

In its 2017 testimony, the OIG expressed concerns with several aspects of the
Representative Payee Program, including whether SSA is adequately screening representative
payees and providing sufficient payee oversight. The OIG also found that SSA did not properly
document capability determinations for almost half of their beneficiaries, and that further
statistical analysis identified a population of disabled beneficiaries with mental impartments who
did not have payees. As for the latter, the OIG suggested that SSA could identify beneficiaries
potentially in need of payees by further analyzing agency data and trends.229
ACUS
SSA tasked ACUS with researching and cataloguing the guardianship laws and practices
of the 50 states; gathering information on state guardianship processes; and conducting
interviews with guardianship and foster care agencies to evaluate their practices. ACUS
conducted this research to help enhance information-sharing and coordination on overlapping
guardianship/conservatorship-representative payee matters between SSA and state courts.
Completed in 2014, the ACUS report confirmed the difficulties guardians face in
obtaining information from local SSA field offices and the barriers to information sharing among
various stakeholders because of the decentralized recordkeeping practices of courts and state
agencies.230 Reflecting those difficulties, approximately 82 percent of the state courts surveyed
stated that they had infrequent or no interaction with SSA related to data exchange or to consult
on overlapping guardianship-representative payee matters.231 Finally, the report emphasized the
SOC. SEC. ADMIN., OFFICE OF THE INSPECTOR GENERAL, FISCAL YEAR 2018 INSPECTOR GENERAL’S STATEMENT
ON THE SOCIAL SECURITY ADMINISTRATION’S MAJOR MANAGEMENT AND PERFORMANCE CHALLENGES (2018),
228

https://oig.ssa.gov/sites/default/files/audit/full/pdf/A-02-18-50307.pdf (last visited June 1, 2020).
SOC. SEC. ADMIN., OFFICE OF THE INSPECTOR GENERAL, EXAMINING THE SOCIAL SECURITY ADMINISTRATION’S
REPRESENTATIVE PAYEE PROGRAM (testimony of Gale Stallworth Stone),
https://oig.ssa.gov/newsroom/congressional-testimony/march22-representative-payee (last visited June 1, 2020).
229

230

Admin. Conf. of the U.S., Office of the Chairman, SSA Representative Payee: Survey of State Guardianship
Laws and Court Practices (Dec. 24, 2014),
https://www.acus.gov/sites/default/files/documents/SSA%2520Rep%2520Payee_State%2520Laws%2520and%252
0Court%2520Practices_FINAL.pdf.
231

Id. at 40–41.

67

need for information sharing between SSA and the state courts in order to perform their
respective functions more efficiently as well as the need for congressional action.232
COSCA
Established in 1955, COSCA serves as a national forum for the state court administrators
across the United States. COSCA is a leading advocate for adult guardianship/conservatorship
issues. In 2017 and 2014, COSCA issued Resolutions 1 and 4 respectively to promote several
key reforms: (i) to improve communication and exchange of information between state courts
with jurisdiction over guardianships/conservatorships and SSA staff administering the
Representative Payee Program; (ii) to allow SSA to recognize state court orders related to the
appointment, resignation, and removal of court-appointed guardians/conservators; and (iii) to
encourage SSA participation in stakeholder collaboration groups such as WINGS.233
In its 2010 publication, The Demographic Imperative: Guardianships and
Conservatorships, COSCA calls for a coordinated federal and state partnership to foster a
“national guardianship court improvement program” to focus resources on the needs of
individuals with intellectual or cognitive impairments and to compile accurate data on adult
guardianships. COSCA posits that accurate and timely data is necessary to “(1) shape
guardianship policy, practice, training and education—and obtain the resources for system
improvements; (2) determine effective case processing and monitoring of guardians by the
courts; (3) gauge the extent of abuse by guardians and the extent to which guardians protect
individuals from abuse; and (4) determine current and future resource needs.”234

232

Id. at 6, 65-66.

233

CONF. OF STATE COURT ADMINISTRATORS, Resolution 1,
https://cosca.ncsc.org/~/media/Microsites/Files/CCJ/Resolutions/08092017-1-SSA-Amending-Regulations-PrivacyAct-1974.ashx (last visited June 1, 2020); CONFERENCE OF STATE COURT ADMINISTRATORS, Resolution 4,
https://cosca.ncsc.org/~/media/Microsites/Files/CCJ/Resolutions/01292014-Encouraging-Collaboration-StateCourts-Federal-State-Representative-Payee-Programs.ashx (last visited June 1, 2020).
234

CONF. OF STATE COURT ADMINISTRATORS, THE DEMOGRAPHIC IMPERATIVE: GUARDIANSHIPS AND
CONSERVATORSHIPS, https://ncsc.contentdm.oclc.org/digital/collection/famct/id/308/ (last visited June 1, 2020).

68

Appendix D: Biographical Information on EAG Members
The following individuals, all of whom are Academy Fellows, made up the EAG:
Gary Glickman, Former Managing Director, Health & Public Service Innovation,
Accenture. Senior Policy Advisor, U.S. Department of the Treasury; Coordinator,
Partnership Fund for Program Integrity Innovation, OMB, Executive Office of the
President; President and CEO, Imogen LLC; President and CEO, Giesecke and Devrient
Cardtech; President and Chief Marketing Officer, Maximus; President, Phoenix Planning
& Evaluation, Ltd.; Principal/National Director, Federal Consulting, Laventhol &
Horwath; Practice leader, Financial Institutions Division, Orkand Corporation; Senior
Consultant, Deloitte Consulting, LLP.; Team Member, Office of the Secretary, U.S.
Department of the Treasury; Chief, Financial Management Division, Office of the
Comptroller of the City of New York.
Franklin Reeder, Former Director, Office of Administration, the White House. Former
chair, Federal Information Security and Privacy Advisory Board. Former positions with
OMB: Deputy Associate Director for Veterans Affairs and Personnel; Assistant Director
for General Management and Deputy Assistant Director; Chief, Deputy Chief,
Information Policy Branch; Policy Analyst; Chief, Systems Development Branch. Former
Deputy Director, House Information Systems, Committee Staff, Committee on House
Administration, U.S. House of Representatives. Former positions with U.S. Department
of the Treasury and U.S. Department of Defense focusing on IT and systems.
Kurt Schmoke, President, the University of Baltimore. Former positions with Howard
University: Dean, School of Law; Senior Vice President of Academic Matters. Positions
with City of Baltimore: Mayor; State Attorney. Former Assistant Director, White House
Domestic Policy Staff; Assistant U.S. Attorney.
Barry Van Lare, Independent Consultant, Management and Public Policy; Former
Director, Office of Management Consulting and Training, National Governors
Association; Senior Vice President for Strategic Marketing, MAXIMUS Inc.; Executive
Director, The Finance Project; Senior Manager, Deloitte Consulting; Deputy Executive
Director, Director of State Services, Director of Human Resources, National Governors
Association; Special Administrator for Gasoline Rationing, U.S. Department of Energy;
Deputy Assistant Secretary for Welfare Legislation, HHS; Associate Commissioner for
Family Services, SSA; Commissioner, Erie County Department of Social Services;
Director, Division of Community Services, Washington State Department of Social and
Health Services. Earlier positions with State of New York: Executive Secretary, Health
Planning Commission; Director, State Senate Task Force on Critical Problems; Executive
Deputy and Acting Commissioner, Department of Social Services; Assistant Secretary to
the Governor for Human Resources, Deputy Commissioner, Division of Human Rights.

69

Appendix E: Web-based, Public Sector Data Exchanges
These are examples of information sharing platforms that occur across state, federal, and tribal
entities within the United States.
HHS and State Courts
HHS’s ACF and NCSC partnered to improve the timely sharing of data between child welfare
agencies and state courts. HHS oversees the data exchange. The domain uses the National
Information Exchange Model (NIEM) that provides participating state entities a template that
can be easily tailored to its individual needs. Participants in the data exchange include federal,
state, local, and tribal entities. More information about the data exchange is provided at
https://www.niem.gov/sites/default/files/NIEM_helping_children.pdf.
U.S. Environmental Protection Agency
The Environmental Information Exchange Network (EIEN) is a web-based system used by state,
tribal, and territorial partners to share environmental and health information with one another and
the EPA securely. EIEN uses a standards-based approach that allows partners to exchange data
regardless of the specific IT used and eliminates the need to share data on paper, discs, or by
other media (including email). According to the EPA, EIEN provides information-sharing
partners the ability to improve operational efficiency while reducing costs by:
•

Improving the timeliness and accuracy of environmental data,

•

Reducing the burden and costs associated with reporting data,

•

Using robust security measures to control data access,

•

Enhancing data access for environmental professionals, and

•

Supporting better decisions on environmental and health issues.

More information about the benefits of EIEN can be found at
https://www.epa.gov/exchangenetwork/learn-about-environmental-information-exchangenetwork.
Global Justice Information Sharing Initiative (GLOBAL)
Under the auspices of DOJ, GLOBAL is a web-based information-sharing platform among more
than thirty independent entities to enhance information sharing between law enforcement, courts,
and correctional facilities. More information about the benefits of GLOBAL can be found at
https://it.ojp.gov/global.

70

Pennsylvania Department of Human Services Enterprise Web Services Security and
Governance framework
In recent years, Pennsylvania’s Department of Human Services took several initiatives to
enhance both operational and cybersecurity aspects of data exchange. As for the latter, it created
a centralized gateway to secure the exchange of sensitive PII data exchanged with federal, state,
and county agencies. The framework improved operational efficiency, leading to significant cost
savings to the agency. Separately, the agency automated many of its data exchange processes to
optimize the exchange of data between the department and over 100 entities within the state and
federal government. For more information, see
https://d117h1jjiq768j.cloudfront.net/docs/default-source/default-document-library/pa-casestudy-redesign_final05970506bd9442d49ab7d7f1bf49981a.pdf?sfvrsn=ec882838_0.

71

Appendix F: Overview of SSA’s DEP
As described in Appendix E, federal and state entities are increasingly partnering to
develop bi-directional, web-based data exchanges to share data and to improve the outcome of
their respective programs. The development of web-based data exchanges allows for a nimbler
and more cost-effective way to access large and complex databases. In addition, the exchange
may provide data-sharing participants several additional benefits:
•

Facilitate the exchange of data among entities with different IT systems and levels of
technical sophistication as participants can upload real time data directly to the webbased system without first modifying their own data collection systems;

•

Enhance cybersecurity as data exchange partners are only provided access to
predetermined data sets; and

•

Potentially eliminate the need for computer systems (SSA’s and/or the other entity’s) to
be reprogrammed or reformatted in order to exchange data, significantly reducing costs
and time in both development, implementation, and training.

In conducting interviews with SSA head-office staff in March 2019, the study team has
learned that SSA has been developing an IT infrastructure concept for data exchange
modernization—the DEP. The DEP concept would allow sharing of real time data “through a
single data exchange gateway” with web-based technology. The DEP concept provides, “a
centralized, interactive, and dynamic user-friendly experience for requesting, sending, receiving,
and administering incoming and/or outgoing data exchanges.” An overview of the DEP concept
provided by SSA appears below.
More recently, SSA informed the study team that they had put development of the DEP
concept on hold and that the project did not receive funding for FY 2020. At the time of this
report, it is unclear when and if SSA will resume the DEP.
SSA provided the following description of the DEP to the study team:
Product Vision
The [DEP] will reduce and centralize the many different systems and
applications that process and manage the agency’s data exchanges. [The DEP]
will be the foundation for data exchange that will support future customer
requests, commissioner priorities, and legislative mandates[.]
The [DEP] will provide data exchange customers, both internal and
external to SSA, with a centralized, interactive, and dynamic user-friendly
experience for requesting, sending, receiving, and administering incoming and/or
outgoing data exchanges. The [DEP] investment addresses the problems that both
internal and external data exchange customers experience with the existing data
exchange processes, applications, and workload. [The DEP] will provide a
holistic solution that will generate greater value for our customers and maximize
the Return on Investment for the agency.
72

Data exchange processes and customer communication will be
transparent, cost-effective, and streamlined. Data will be offered from a menu of
data exchange services utilizing an authoritative source of data and shared
through a single data exchange gateway. SSA will use historical and management
information about our customers to drive resource decisions, identify possible
fraud indications, evaluate the effectiveness of exchanges, and anticipate future
needs.
We believe [the DEP] may help other organizations receive data more
quickly, and help to reduce improper payments, SSA field office traffic, and
administrative expenses.
Future To-Be Steps
Below is a technical diagram of [the DEP]. This is a high-level depiction
of the communication between the customer, the applications, and the processing.
The [DEP] will include three pieces of functionality for streamlining the
complete end to end data exchange process:
1.
2.
3.

Customer Connection
Workflow Processor
Data Exchange Gateway

Customer Connection
The Customer Connection is a foundational piece of [the DEP] that will be
provided to data exchange customers. This includes internal SSA employees, as
well as external customers from various Federal, state, private, and foreign
entities. Customer connection will be a role-based communication tool for the
individuals interested in data exchange. Customer Connection will provide
functionality to:
•
•
•
•
•
•

Obtain general information about the data exchange process
Obtain data-exchange specific information
Submit an online, automated, and complete data exchange request
Create and manage account information
Obtain historical and management information
Submit and receive data exchange-specific communication

Workflow Processor -- Creating Agreements, Generating Bills, and
Receiving Payments
The Workflow Processor will be a tool used to establish the work flows
required for establishing and maintaining a data exchange. There will be direct
communication between the customer connection and the workflow processor to
ensure timely establishment of the exchange. The Workflow Processor will
provide functionality for:
•

Account feasibility analysis
73

•
•
•
•
•

Agreement creation
Reimbursable billings
Account payments and fund allocations
Document repository
Collection of management information

Data Exchange Gateway -- Implementing the Request and Sending the Data
The Data Exchange Gateway will provide a centralized location for
entities to send and receive data. The Data Exchange Gateway will communicate
with the data stored from the customer connection and workflow processor to
ensure that data is exchanged in compliance with the corresponding legal
agreement. The gateway will allow for entities to transfer data using online
applications, web services, and batch files. The Data Exchange Gateway will
provide functionality for SSA to:
•
•
•
•
•
•
•
•

Have a single access point for data exchange transactions
Accurately track data sent and/or received from customers
Ensure data is in compliance with the various agreements
Have sufficient information in application logs to identify and debug issues
Capture meta-data for every exchange transaction
Fan out data requests to various services
Use Application Program Interfaces to process data through selectable and
reusable business process logic
Process data through flexible and standardized business rules stored in a
central location

Note: This is not a final list of functionality; planning and analysis and/or Agile
methodology will identify and develop additional functionality
Data Exchange Product

74

Appendix G: State Legal Barriers Chart
The table below reflects the study team’s findings about the three main types of statutes
or judicial rules that potentially serve as legal barriers in each state. As discussed in the report,
some of these statutes explicitly exempt state courts (or are otherwise not applicable). As a
result, the fact that a state has been identified as having one of these statutes does not necessarily
mean the law poses a barrier. For that reason, those state laws the study team has identified as
not applying to state courts have been marked with an asterisk. For example, because Alabama
has a statewide statute governing the disclosure of SSNs, but it does not apply to state courts, the
entry is followed by an asterisk.
To gather this information, the study team has generally reviewed the statutory code in
each state; searched for key words within each state’s code, including the words “privacy,”
“open records,” and “social security number;”235 and reviewed the judicial rules on state court or
government websites.

State

Alabama
Alaska
Arizona
Arkansas
California
Colorado
Connecticut
Delaware
Florida
Georgia
Hawaii
Idaho
Illinois
Indiana

Statewide Privacy
Law?

Statewide Statute
Specifically
Governing the
Disclosure of SSNs?

Statewide
Judicial Rules
Governing
Disclosure of Case
Records by Courts?

YES*
YES*
YES*
YES*
YES*
YES*
YES*
YES*
YES
YES*
YES*
YES
YES*
YES*

YES*
YES*
YES
YES
YES
YES*
NO
NO
YES
YES*
YES
YES
YES*
YES*

YES
YES
YES
YES
YES
YES
YES
YES
YES
NO
NO
YES
YES
YES

235

Because of the wide diversity and complex nature of state statutory codes, the study team acknowledges the small
possibility that some state laws falling within one of these three categories may not have been identified using these
search terms. Even so, because the purpose of the survey was to gain a general understanding of the significance and
operation of state laws that may serve as a barrier to information sharing, not to determine or analyze the precise
legal barriers present in each state, the study team is confident its survey, as a whole, accurately reflects the general
significance of each type of state law identified in the study.

75

Iowa
Kansas
Kentucky
Louisiana
Maine
Maryland
Massachusetts
Michigan
Minnesota
Mississippi
Missouri
Montana
Nebraska
Nevada
New Hampshire
New Jersey
New Mexico
New York
North Carolina
North Dakota
Ohio
Oklahoma
Oregon
Pennsylvania
Rhode Island
South Carolina
South Dakota
Tennessee
Texas
Utah
Vermont
Virginia
Washington
West Virginia
Wisconsin
Wyoming

YES*
YES*
YES
YES
YES
YES*
YES*
YES*
YES*
YES
YES*
YES
YES
YES*
YES*
YES*
YES*
YES*
YES*
YES*
YES*
YES*
YES*
YES
YES*
YES*
YES*
YES*
YES*
YES
YES*
YES*
YES*
YES
YES
YES*

YES*
YES*
NO
NO
NO
YES*
NO
YES
YES*
YES
YES*
NO
NO
YES
NO
YES*
YES*
YES*
YES
YES
YES
YES
YES*
YES*
YES*
YES
YES
YES
YES*
YES
YES*
YES*
NO
NO
NO
NO

76

YES
YES
NO
NO
YES
YES
YES
YES
YES
YES
YES
NO
YES
YES
YES
YES
YES
NO
NO
YES
YES
YES
NO
YES
YES
YES
YES
NO
YES
YES
YES
NO
YES
NO
YES
YES