OMB and Agencies Have a Variety of Responsibilities under the Computer Matching Act

OMB is responsible for developing guidelines and providing continuing  assistance to agencies on the implementation of the Computer Matching  Act, while agencies have a variety of implementation responsibilities. Agency responsibilities can be grouped into three major areas: (1)  developing computer matching agreements containing specific elements  for each proposed matching program and notifying Congress, OMB, and  the public of computer matching activities; (2) conducting cost-benefit  analyses for proposed computer matching programs; and (3) establishing  DIBs to oversee computer matching programs, including reviewing and  approving computer matching agreements. OMB has periodically published guidance for  implementing the act, including documents issued in 1989, 1991,  2000, and 2013. If a proposed match is covered by the Computer Matching Act,  a CMA must be developed and approved by all participating agencies.Among other things, the act requires that CMAs include  the purpose and legal authority for conducting the program;  the justification for the program and the anticipated results, including a  specific estimate of any savings; a description of the records that will be matched, including each data  element that will be used, the approximate number of records that will  be matched, and the projected starting and completion dates of the  matching program; procedures for providing individual notice at the time of application,  and notice periodically thereafter as directed by the DIB (subject to  OMB guidance), to applicants or recipients of federal benefits; procedures for verifying information produced in the matching  program as required to ensure that no benefits action is taken before  the information acquired through computer matching is verified and  potentially affected individuals are notified and have an opportunity to  contest findings; procedures for the retention and timely destruction of identifiable  records created by a recipient agency or nonfederal agency in the  matching program; procedures for ensuring the administrative, technical, and physical  security of the records matched and the results of the matching  programs; and  information on assessments that have been made on the accuracy of  the records that will be used in the program. OMB recommended, but did not require, that the Privacy Act  officer serve as the board secretary. However, implementation among these seven  agencies was inconsistent in several ways:
Agencies differed in their understanding of what circumstances and  types of data-sharing the act applied to, such as whether CMAs were  required for “front-end” data queries. While these agencies generally developed cost-benefit analyses for  their computer matching agreements, they did not consistently  address key costs and benefits needed to assess the value of their  computer matching programs. Further, OMB has provided little assistance to agencies in implementing  the act, which may contribute to inconsistent implementation. Labor’s DIB did not submit biennial reports in 2008 or 2012. However, agency officials stated  that they have not received consistent assistance from OMB. Several Factors May Discourage Implementation of CMAs at Selected Agencies

Agency officials at six of the seven agencies we reviewed told us that the  act’s rigorous requirements and the CMA review processes within and  among agencies were lengthy and resource-intensive and that statutory  time frames for conducting matching activities were too short,  discouraging implementation of CMAs. Similarly, OIG officials at four  agencies stated that, given the short duration of CMAs, the typical length  of the CMA approval process discouraged them from computer matching,  as did the requirement that their proposed agreements be approved by  agency DIBs. We recommend that the Secretary of Health and Human Services develop and implement policies and procedures for cost-benefit  analyses related to computer matching agreements to include key  elements such as personnel and computer costs, as well as  avoidance of future improper payments and recovery of improper  payments and debts; ensure the DIB reviews cost-benefit analyses to make certain cost  savings information for the computer matching program is included  before approving CMAs; and ensure the DIB performs annual reviews and submits annual reports  on agency computer matching activities, as required by the act. The OMB  staff did not state whether the agency agreed or disagreed with our  recommendations. SSA stated that it is currently working on an initiative to improve its cost- benefit analysis process and will ensure that all CMAs comply with the  act’s requirements and OMB’s guidance. Appendix I: Objectives, Scope, and Methodology

The objectives of our review were to (1) determine agencies’  responsibilities under the Computer Matching Act, (2) determine how  selected agencies are implementing that act with regard to federal  benefits programs, and (3) describe the views of officials at selected  agencies on the process of developing and implementing computer  matching agreements (CMA). We focused on federal  agencies with the highest expenditures in benefits and assistance  programs, specifically the Departments of Agriculture (USDA), Education  (ED), Health and Human Services (HHS), Homeland Security (DHS), and  Veterans Affairs (VA), and the Social Security Administration (SSA). We also reviewed  guidance developed by the Office of Management and Budget (OMB) on  computer matching.
Why GAO Did This Study

Computerized matching of data from two or more information systems is one method of data analysis that can assist in detecting and preventing fraud, waste, and abuse in government programs, and it is commonly used to help identify improper payments in federal benefit programs and activities. However, computer matching may also pose privacy risks to individuals. To ensure that federal agency computer matching programs protect individuals' privacy rights, from 1988 through 1990 Congress enacted amendments to the Privacy Act of 1974 (collectively referred to in this report as the Computer Matching Act).
GAO was asked to review issues relating to computer matching. This report examines (1) agencies' responsibilities under the Computer Matching Act, (2) how selected agencies are implementing the act with regard to federal benefits programs, and (3) the views of officials at selected agencies on the process of developing and implementing computer matching agreements. GAO reviewed the act's provisions and OMB guidance. It also interviewed officials and examined documents at seven agencies with high expenditures in benefits and assistance programs.

What GAO Found

The Office of Management and Budget (OMB) is responsible for developing guidelines and providing assistance to agencies on implementing the Computer Matching Act, while agencies have a variety of implementation responsibilities. Agency responsibilities include (1) developing computer matching agreements (CMA) containing specific elements for each proposed matching program and notifying Congress, OMB, and the public of such activities; (2) conducting cost-benefit analyses for proposed matching programs; and (3) establishing data integrity boards to oversee matching programs.
The seven agencies GAO reviewed (the Departments of Agriculture, Education, Health and Human Services, Homeland Security, Labor, Veterans Affairs, and the Social Security Administration) have taken a number of steps to implement the act's requirements. They have all established processes for creating CMAs, and the agreements generally included the elements required by the act. However, implementation among these agencies was inconsistent in several ways. First, the selected agencies differed in their understanding of whether CMAs were required for data queries. OMB's guidance is not clear on whether such queries are covered by the act. Second, while the selected agencies generally developed cost-benefit analyses for their CMAs, they did not consistently address key elements needed to assess the value of computer matching programs. OMB stated in 1989 that it would issue specific guidance for cost-benefit analyses of computer matching programs, but it has not done so. Finally, agency data integrity boards have not consistently reported to OMB on agencies' computer matching activities as required by the act. OMB guidance requires biennial reporting, which varies from the act's requirement for annual reports. The lack of clear guidance from OMB has contributed to the inconsistent implementation of the act at the agencies GAO reviewed.
Several agency and office of inspector general officials stated that the act's rigorous requirements and short time frames discouraged them from pursuing CMAs. Officials at six agencies stated that CMA review processes were lengthy and resource-intensive and that statutory durations for conducting matching activities were too short. Similarly, officials from offices of the inspector general at four agencies stated that the length of the approval process and the requirement that proposed agreements be approved by data integrity boards discouraged them from computer matching.

What GAO Recommends

GAO is recommending that OMB revise its guidance and that selected agencies develop and implement policies and procedures for cost-benefit analyses and ensure annual reviews and reporting. In their comments, agencies concurred with GAO's recommendations, with the exception of Education. OMB did not state whether the agency agreed or disagreed. GAO continues to believe that the recommendations are valid, as discussed in the report.