Comprehensive Integrity Review Process

 

·         Name of project.

Comprehensive Integrity Review Process

·         Unique project identifier.

016-00-SSA/FAM-G-009

·         Privacy Impact Assessment Contact.

      Director
      Office of System Security Operations Management
      Office of Financial Policy and Operations
      Social Security Administration
      6401 Security Boulevard
      Baltimore, MD 21235

·         Describe the information to be collected, why the information is being collected, the intended use of the information and with whom the information will be shared.

The Comprehensive Integrity Review Process (CIRP) is a Social Security Administration (SSA) certified and accredited General Support System that collects and evaluates electronic transactions entered into our programmatic systems (e.g., Title II and Title XVI Claims Processing Systems).  CIRP identifies those transactions that may indicate abuse or fraudulent activity involving SSA employees or the public.  Data in the CIRP system derives from existing systems that contain the basic information we collect to determine individuals’ entitlement to benefits under Title II (Retirement, Survivors, Disability Insurance) and Title XVI (Supplemental Security Income) programs.  Included in these existing systems are  personal identification data such as names, Social Security numbers (SSN), dates of birth, and Title II and/or Title XVI benefit or income data.  CIRP provides electronic screens that allow authorized employees to access items selected for review and the case details associated with the transaction(s).  For example, when an employee takes an action on a beneficiary record, we would collect the employee’s Personal Identification Number (PIN), the date and time of the action, and the SSN of the beneficiary and the specific action taken about that individual.  CIRP also provides the capability for authorized employees to review those actions to record and to report the results of their review. 

CIRP is a valuable tool to identify programmatic transactions that may indicate fraudulent activity involving our employees.   Our employees have access to extremely valuable and sensitive data for processing claims and resolving post-entitlement or pre-entitlement issues.  There is a possibility of Privacy Act violations and unauthorized disclosure, and electronic systems misuse ranging from possible sanctionable actions to potential fraudulent/criminal activities.  CIRP helps detect and deter fraud and abuse by targeting activities that are prone to such occurrences.  Also, CIRP provides one source for authorized employees to obtain integrity review cases, review results and obtain management information on pending and cleared cases.  When CIRP reviews uncover potential employee or claimant fraud and abuse, the cases are referred for further investigation and potential prosecution. 

We disclose the information maintained in this system only as necessary to ensure the proper payments to individuals, to support investigations/prosecution of employee or claimant fraud and abuse, for the defense of an employee or our Agency, or as authorized by Federal law.  CIRP is not accessible to members of the public.  

·         Describe the administrative and technological controls that are in place or that are planned to secure the information being collected.

CIRP has undergone authentication and security risk analyses.  The latter includes an evaluation of security and audit controls proven to be effective in protecting the information collected, stored, processed, and transmitted by our information systems.  These include technical, management, and operational controls that permit access to those users who have an official “need to know.”  CIRP uses “TOP SECRET” to restrict access to the data in this system.

We protect the information in CIRP by requiring employees who are authorized to access the information system to use a unique PIN.  In addition, we store the computerized records in secure areas that are accessible to those employees who require the information to perform their official duties.  Furthermore, all of our employees who have access to our information systems that maintain personal information must sign a sanction document annually that acknowledges penalties for unauthorized access to, or disclosure of, such information.

·         Describe the impact on individuals’ privacy rights.

Are individuals afforded an opportunity to decline to provide information? 

We collect information only where we have specific legal authority to do so in order to administer our responsibilities under the Social Security Act.  When we collect personal information from individuals, we advise them of our legal authority for requesting the information, the purposes for which we will use and disclose the information, and the consequences of their not providing any or all of the requested information.  The individuals can then make informed decisions as to whether or not they should provide the information.

Are individuals afforded an opportunity to consent to only particular uses of the information?

When we collect information from individuals, we advise them of the purposes for which we will use the information.  We further advise them that we will disclose this information without their prior written consent only when we have specific legal authority to do so

(e.g., the Privacy Act).  

·         Does the collection of this information require a new system of records under the Privacy Act (5 U.S.C. § 552a) or an alteration to an existing system of records?

The CIRP does not require a new Privacy Act system of records or an alteration to an existing system of records.  CIRP uses information that is collected and maintained for purposes related to other business processes for which there are currently Privacy Act systems of records in existence.  For example, claimant data in CIRP is covered by systems of records, such as the Master Beneficiary Record (60-0090) and/or Supplemental Security Income Record and Special Veterans Benefits (60-0103).  The employees’ PIN collected by CIRP is covered by system of records, Personal Identification Number File (60-0214).

 

PIA CONDUCTED BY PRIVACY OFFICER, SSA:

______________________________                     September 25, 2007

SIGNATURE                                                         DATE

PIA REVIEWED BY SENIOR AGENCY PRIVACY OFFICIAL, SSA:

   /S/    Thomas W. Crawley________                       September 27, 2007

SIGNATURE                                                             DATE