Box Storage Solution

BSS doesn't directly collect an individual's Personal Identifiable Information (PII). Employee and contractor credentials to include user first and last name, email address, phone numbers and CMS user IDs are sourced from the Enterprise User Administration (EUA) which has its own PIA. 

BSS does store files and documents containing various PII information types that employees, contractors and third parties have uploaded into the system. The function of the system makes it impractical to know all information types that users of the system will store. CMS has the requirement that data stored will follow the HHS rules of behavior and be limited to that which is necessary for the business purpose. BSS will retain data indefinitely if the CMS maintains an active contract with the BSS.

• Name
• E-Mail Address
• Phone Numbers
• Other - CMS User IDs, this system may contain sensitive information, including unsolicited PII and Protected health information (PHI) based on need, such as social security numbers.

• Employees
• Public Citizens
• Business Partners/Contacts (Federal, state, local agencies)
• Vendors/Suppliers/Contractors

BSS system uses the PII for account creation and logon.

The primary purpose of Users entering data into BSS is general business need and analysis.  

• Online

• Within the OPDIV
• Other HHS OPDIV
• State/Local/Tribal

• Private Sector

The PII for login purposes is collected is from a separate application, EUA, therefore there is no ability to opt-out.

All other PII collected is voluntary and as such, is at the discretion of the user to opt-in by uploading information.

The PII login data is obtained from EUA, therefore, there is no process in place by BSS to address an individuals' concerns.

Standard CMS Incident handling Procedures will be used if PII/PHI has been inappropriately uploaded or disclosed.

Due to the nature of the BSS and the anticipated broad use of these services across CMS, it is the responsibility of the parties providing the data to ensure the completeness, accuracy, and currency of data at the time it is submitted.

Continuous log analysis and review by administrators is standard practice as well as integration with CMS cyber security asset teams for auto log ingestion and review. 

Cloud Lock implementation monitors files and folders for PII information through CMS created policies. Cloud lock sends an alert to administrators and deletes PII information when a policy is violated.

• Users: Users will have access to any files or folders with PII that they create or that they have been granted shared access to.
• Administrators: BOX administrators will have access for reasons of account management.

Box will retain customer data indefinitely if the customer maintains an active contract with Box. Box securely disposes of PII on its servers by deleting the files and database records so that they are unrecoverable.

CMS will ensure that the following processes and guidelines are adhered to in the retention destruction of PII data: National Archives Records Administration (NARA) Record Control Schedules N1-GRS-87-005, N1-GRS-92-002, N1-GRS-95-002, General Record Schedule (GRS) 3.1, item 020, DAA-GRS-2013-0006. CMS retains records facilitate the review of PII disclosures/access for five (5) years. CMS ensures that audit information is archived six (6) years to enable the re-creation of computer related accesses to both the operation system and the application wherever PII is stored. CMS retains PII inspection reports, including a record corrective actions, for a minimum three (3) years from date the inspection was completed. CMS retains electronic records for 1 year to provide support for after-the-fact investigations of security incidents and to meet regulatory and CMS information retention requirements. CMS record retention requirements are updated to meet the requirements of the National Archives and Records Administration (NARA) General Records Schedules. 

When PII is destroyed, CMS follows the guidance of the National Institute of Standards and Technology (NIST) Special Publication 800-88 Rev. 1. CMS will disintegrate, pulverize, melt, incinerate, and/or shred PII data once it is no longer necessary to retain. Certificates of destruction are completed and retained whenever PII data is destroyed.

Any PII is safeguarded physically via Box.com for Government, a secure cloud storage solution that is compliant to standards like Box FedRAMP, ITAR, EAR, DoD SRG L4, ISO 27018, HIPAA, and IRS-1075 with a 3-year retention policy as per General Records Schedule (GRS) 3.1, item 020.

Administrative controls used in this system include, but are not limited to, requiring users to acknowledge the usage conditions and take explicit actions to log on to or further access the information system.

A technical control used in this system include, but are not limited to, requiring users to have a username and password or Smart (PIV) card to access their user account.

Physical controls include, but are not limited to, the use of locked cabinets to store server hardware, which are housed in an access-controlled secure data center.

All controls are documented fully in the Security Assessment Report (SAR).