Cloud Content Management
Privacy Impact Assessment (PIA) published by CMS as an Operating Division of the U.S. Department of Health and Human Services
Date signed: 8/28/2024
OPDIV: | CMS |
|---|---|
PIA Unique Identifier: | P-2263675-209329 |
Name: | Cloud Content Management |
The subject of this PIA is which of the following? | Major Application |
Identify the Enterprise Performance Lifecycle Phase of the system. | Operate |
Is this a FISMA-Reportable system? | Yes |
Does the system include a Website or online application available to and for the use of the general public? | No |
Identify the operator: | Agency |
Is this a new or existing system? | Existing |
Does the system have Security Authorization (SA)? | Yes |
Date of Security Authorization | 3/22/2024 |
Indicate the following reason(s) for updating this PIA. Choose from the following options. | PIA Validation (PIA Refresh/Annual Review) |
Describe in further detail any changes to the system that have occurred since the last PIA. | Updated: PIA-025 was updated to reflect the expiration date with 08/31/2025 and PIA-032 with additional job code for the Collaborative Application Lifecycle Tool (CALT) users: Enterprise Content Management (ECM) ECM_CALT_USER - User has access to all Collaborative Application Lifecycle Tool project-related data and documents stored in the Cloud Content Management platform. Please note that all systems named here are covered under its own Authority to Operate (ATO) and Privacy Impact Assessment (PIA). |
Describe the purpose of the system | The Cloud Content Management platform is a proposed Centers for Medicare & Medicaid Services (CMS) wide Content Management System built in combination of centralized content management services that exploits the advantages of the cloud computing delivery model. The Cloud Content Management Platform offers advanced security and governance designed for the storage and retrieval of documents, metadata, and facilitate content moderation/workflow for various business processes at the Centers for Medicare & Medicaid Services. Please note that all systems named here are covered under its own Authority to Operate and Privacy Impact Assessment. |
Describe the type of information the system will collect, maintain (store), or share. (Subsequent questions will identify if this information is PII and ask about the specific data elements) | The Cloud Content Management system currently does not collect or share but stores Personally Identifiable Information (PII)/Protected Health Information (PHI). The specific information that the Cloud Content Management system maintains in its database is based on the integrating application’s business need. The Enterprise User Administration (EUA) and Identity Management (IDM) Okta is a system of Record for User credentials and following information’s (Username, User Role, Plan Contract Number, Email Address and Name) are collected and stored in the Cloud Content Management system during the authentication and authorization. Following are the information currently stored in the Cloud Content Management system:
|
Provide an overview of the system and describe the information it will collect, maintain (store), or share, either permanently or temporarily. | The Cloud Content Management platform is a proposed Centers for Medicare & Medicaid Services wide Content Management System built in combination of centralized, content management services that exploits the advantages of the cloud computing delivery model. The Cloud Content Management platform offers advanced security and governance designed for the storage and retrieval of documents, metadata, and facilitate content moderation/workflow for various business processes at the Centers for Medicare & Medicaid Services. The Cloud Content Management system currently does not collect or share but stores Personally Identifiable Information/Protected Health Information. The specific information that the Cloud Content Management system maintains in its database is based on the integrating application’s business need. The Enterprise User Administration and Identity Management Okta is a system of Record for User credentials and following information’s (Username, User Role, Plan Contract Number, Email Address and Name) are collected and stored in the Cloud Content Management system during the authentication and authorization. Please note that all systems named here are covered under its own Authority to Operate and Privacy Impact Assessment. |
Does the system collect, maintain, use or share PII? | Yes |
Indicate the type of PII that the system will collect or maintain. |
|
Indicate the categories of individuals about whom PII is collected, maintained or shared. |
|
How many individuals' PII in the system? | 500-4,999 |
For what primary purpose is the PII used? | The Personal Identifiable Information collected is strictly the Centers for Medicare & Medicaid Services User Identifications, Work Email addresses, User Role, Plan Contract Number and Name. The Enterprise User Administration and Identity Management Okta is a system of Record for User credentials and following information: Username, User Role, Plan Contract Number, Email Address and Name is collected and stored in the Cloud Content Management system during the authentication and authorization. The collection of this information is used for user authentication and authorization in the Cloud Content Management platform. This authentication and authorization data is maintained by Enterprise User Administration and Lightweight Data Access Protocol. The Cloud Content Management platform integrates with the Enterprise User Administration for authentication and authorization to support the business needs of the integrating application. Please note that all systems named here are covered under its own Authority to Operate and Privacy Impact Assessment. |
Describe the secondary uses for which the PII will be used (e.g. testing, training or research) | There is no secondary use for which Personal Identifiable Information/Protected Health Information is used. |
Describe the function of the SSN. | Not applicable. |
Cite the legal authority to use the SSN. | Not applicable. |
Identify legal authorities governing information use and disclosure specific to the system and program. | The Cloud Content Management application data is covered under the System of Record Notice of individual integrating business applications. Center for Program Integrity System of Record Notice National Claims History-09-70-0558 applies to the Cloud Content Management system. This system contains Protected Health Information as defined by the Department of Health and Human Services regulation "Standards for Privacy of Individually Identifiable Health Information" (45 Code of Federal Regulations parts 160 and 164, subparts A and E) 65 Federal Regulations 82462 (12-28-00). Disclosures of such Protected Health Information that are otherwise authorized by these routine uses may only be made if, and as, permitted or required by the "Standards for Privacy of Individually Identifiable Health Information." (See 45 Code of Federal Regulations 164-512(a)(1)). |
Are records on the system retrieved by one or more PII data elements? | No |
Identify the sources of PII in the system: Directly from an individual about whom the information pertains | Online |
Identify the sources of PII in the system: Government Sources | Within the OPDIV |
Identify the sources of PII in the system: Non-Government Sources | Private Sector |
Identify the OMB information collection approval number and expiration date | N/A |
Is the PII shared with other organizations? | No |
Describe the process in place to notify individuals that their personal information will be collected. If no prior notice is given, explain the reason. | Before users are allowed to logon to the Cloud Content Management Platform, they are required to select "Agree to our Terms & Conditions".
|
Is the submission of the PII by individuals voluntary or mandatory? | Voluntary |
Describe the method for individuals to opt-out of the collection or use of their PII. If there is no option to object to the information collection, provide a reason. | Individuals do not have the choice to opt-out of the use or collection of their Personal Identifiable Information/Protected Health Information. There is no method for users to opt-out in the Cloud Content Management system. Users are not allowed to log on and gain access to the system if they do not select the "I agree" button (to agree to terms) when signing on. The data in this system is based on the integrating application’s business need for storing them in the Cloud Content Management system and is covered by the application’s System of Record Notice. |
Describe the process to notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changes since the notice at the time of original collection). Alternatively, describe why they cannot be notified or have their consent obtained. | If there were any major changes, the Cloud Content Management Platform Application Development Organization will notify users using their work emails addresses via a disclosure after getting approval from the Cloud Content Management Business Owner. |
Describe the process in place to resolve an individual's concerns when they believe their PII has been inappropriately obtained, used, or disclosed, or that the PII is inaccurate. If no process exists, explain why not. | The Application Development Organization (ADO) team will work with the Cloud Content Management Chief Information Security Office immediately if a user's Personal Identifiable Information/Protected Health Information is obtained, used, or disclosed inappropriately. If a user's Personal Identifiable Information/Protected Health Information has been obtained, used, or disclosed inappropriately, the Cloud Content Management team will notify the Security Officer or Director of Operations to report the incident to the Centers for Medicare & Medicaid Services within 1 hour. A notification will go out to the Centers for Medicare & Medicaid Services Contracting Officer and the Centers for Medicare & Medicaid Services IT Service Desk at 410-786-2580, 800-562-1963 or CMS_IT_Service-Desk@cms.hhs.gov. If the Internet is not accessible, and you have questions about this topic, the Centers for Medicare & Medicaid Services can be reached by phone at 1-800-MEDICARE (1-800-633-4227). When calling, ask to speak to a customer support rep about Medicare’s Privacy Notice. Teletypewriter users may call 1-800-486-2048. Individuals who wish to file a complaint directly without access to the Internet may directly call the Office of Civil Rights at 1-800-368-1019. Teletypewriter users may call 1-800-537-7697 to file their complaints. |
Describe the process in place for periodic reviews of PII contained in the system to ensure the data's integrity, availability, accuracy and relevancy. If no processes are in place, explain why not. | The Cloud Content Management platform is hosted on the Centers for Medicare & Medicaid Services Cloud in the Amazon Web Service. The Cloud Content Management platform integrates with the Enterprise User Administration Enterprise User Administrative System to offer role-based access to Cloud Content Management system once user authenticated and authorized via the Enterprise User Administration job codes setup. The Cloud Content Management Platform System Architecture maintains the data integrity and availability by employing security procedures including virtual firewalls and encryption layers. User's Personal Identifiable Information/Protected Health Information is non-editable since the Enterprise User Administration Lightweight Directory Access Protocol integration is read-only and hence changes to the Personal Identifiable Information/Protected Health Information need to occur on the Enterprise User Administration and are later synced with the Cloud Content Management platform the next time the user logon happens. Please note that all systems named here are covered under its own Authority to Operate and Privacy Impact Assessment. |
Identify who will have access to the PII in the system and the reason why they require access. |
|
Describe the procedures in place to determine which system users (administrators, developers, contractors, etc.) may access PII. | The Cloud Content Management platform implements a Role-Based Access Control. The roles are defined by the Cloud Content Management Platform System Administrator and Business Owners. There are job codes that define a user's access. These job codes are authenticated/provisioned through Centers for Medicare & Medicaid Services' Enterprise User Administrative System. Business Owner: ECM_CALT_USER - User has access to all Collaborative Application Lifecycle Tool project-related data and documents stored in the Cloud Content Management platform. Please note that all systems named here are covered under its own Authority to Operate and Privacy Impact Assessment. |
Describe the methods in place to allow those with access to PII to only access the minimum amount of information necessary to perform their job. | The Cloud Content Management platform utilizes roles and permissions matrix of the underlying Drupal Content Management System to enforce those with access to Personal Identifiable Information/Protected Health Information to only access the minimum information necessary to perform their job functions. Please note that all systems named here are covered under its own Authority to Operate and Privacy Impact Assessment. |
Identifying training and awareness provided to personnel (system owners, managers, operators, contractors and/or program managers) using the system to make them aware of their responsibilities for protecting the information being collected and maintained. | All Users (Business Owners, Managers, Contractors and/or Program Managers) must complete the Centers for Medicare & Medicaid Services Annual Security Awareness Computer Based Training. In addition, the Information System Security Officer and Contractors attended and received the Centers for Medicare & Medicaid Services Information System Security Officer certification. The Information System Security Officer certification consists of a two-day (16 hours) training course and written exam. This certification is maintained in the Training Matrix of the Application Developer Owner Admins. |
Describe training system users receive (above and beyond general security and privacy awareness training) | The Application Developer Owner Admins are also required to take the following mandatory trainings annually: 1. Role-Based Access Training |
Do contracts include Federal Acquisition Regulation and other appropriate clauses ensuring adherence to privacy provisions and practices? | Yes |
Describe the process and guidelines in place with regard to the retention and destruction of PII. Cite specific records retention schedules. | The Centers for Medicare & Medicaid Services has employed a records retention schedule referred to as a "Bucket Approach", or otherwise known as flexible scheduling. More about this approach, what it means, and how it is applied at Federal Agencies can be found on the National Archive's website at: https://www.archives.gov/records-mgmt/faqs/flexible-scheduling.html. The Cloud Content Management platform contains archived information of the Change Management within the Medicare Enrollment and Payment Systems, the Personally Identifiable Information such as (Centers for Medicare & Medicaid Services User Identification, Full Name, and Work Email Address) are only retained for the purposes of authentication and/or Cloud Content Management platform audit logs. For the purposes of records retention, these are considered part of Bucket 9: Compliance and Integrity records schedule for the Centers for Medicare & Medicaid Services (DAA-0440-2015-0012). All files within this grouping are considered Temporary; they do not have to be transferred for Permanent storage at the National Archives once the amount of time they must be retained is complete. All files within this category must be destroyed after seven (7) years old or when no longer needed for agency business, whichever is later. Additionally, the Part D Event Records and Supporting Documentation in the Medicare Part C and Part D audit packages stored within the Cloud Content Management database are used for reviewing the compliance and ensuring the integrity of Medicare programs and are considered part of Bucket 3: Financial Records within the records schedule for Centers for Medicare & Medicaid Services (DAA-0440-2015-0004). All files within this grouping are considered Temporary; they do not have to be transferred for Permanent storage at the National Archives once the amount of time they must be retained is complete. All files within this category must be destroyed after seven (7) years old or when no longer needed for agency business, whichever is later. Please note that all systems named here are covered under its own Authority to Operate and Privacy Impact Assessment. |
Describe, briefly but with specificity, how the PII will be secured in the system using administrative, technical, and physical controls. | The Personal Identifiable Information (Centers for Medicare & Medicaid Services User Identification, Full Name, and Work Email Address) are stored in the encrypted MySQL Relational Database Service database in the Centers for Medicare & Medicaid Services Cloud. All policies relating to information security are addressed in the Centers for Medicare & Medicaid Services organizational security and privacy policy and procedures, including the Centers for Medicare & Medicaid Services policy for Information Security Program and the Centers for Medicare & Medicaid Services Acceptable Risk Safeguards. Technical controls include access controls which are established to limit operations and maintenance user access to the data based on role-based design and assigned on a need-to-know basis. Physical controls include access controls which are established to limit data center access to the Cloud Service Provider team and are granted based on the principle of least privilege, where requests must specify to which layer of the data center the individual needs access and are time-bound. Requests are reviewed and approved by authorized personnel, and access is revoked after the requested time expires. Once granted admittance, individuals are restricted to areas specified in their permissions. The Cloud Content Management Team has no physical access to any of the datacenters or facilities. The application is regularly assessed using the Centers for Medicare & Medicaid Services security policies and controls that include administrative, technical, and physical controls. All controls are tested using an Adaptive Capabilities Testing methodology within a 3-year period as part of annual Federal Information Security Management Act evaluations. Please note that all systems named here are covered under its own Authority to Operate and Privacy Impact Assessment. |