CMS Acquia Cloud

• PIA Validation (PIA Refresh/Annual Review)
• Other - Addition of two new applications to Acquia Cloud and transition to Acquia Cloud Next

Acquia Cloud is a Drupal-tuned application lifecycle management suite with a complete infrastructure to support Drupal deployment workflow processes from development and staging through to production. It has a strong focus on security and compliance, a robust API, and automated deployment from a version-controlled code repository. It runs on proven open-source technologies that Acquia has selected, tested, and optimized for Drupal

The Acquia web content management platform includes several subsystems. The following sites are currently in scope for Acquia:

CMS Homepage

CMS Innovation Center

CMS Marketplace

OpenPayments Data HomePage

Medicare Homepage

Marketplace HealthCare Data

Medicaid & CHIP Open Data HomePage

Performance Indicator Reporting System Login

File an EMTALA complaint (EMTALA)

Aloha-UF Infraops Backends (ALOHA)

Aloha Infraops Backends (ALOHA)

The ALOHA URLs are internal. They provide logging and monitoring between the frontend and backend of Acquia.

Of the above listed sites, sdis.medicaid.gov and the EMTALA complaint form are the only sites that collect Personally Identifiable Information (PII) or Protected Health Information (PHI). For the State Data Information System (SDIS), the PII is collected in support of account creation. For EMTALA, the PII/PHI data is only collected, encrypted, and sent to CMSNet via QualityNet.

EMTALA is a project that the CMS Office of Administration is spearheading for the White House. The goal is to support a consumer page to gather their information, encrypt the data, and send the encrypted data to QualityNet via CMSNet.  PHI and PII will be transmitted to and collect from the consumer page using Transport Layer Security (TLS Version 1.2) encryption based on a patient's visit to a medical provider.

The data fields appearing on the EMTALA Complaint form on CMS Homepage and being collected from public users are as follows

Last Name
First Name
Phone 
Email
Relationship to patient (I am the patient, I'm filing a complaint for someone else, I work at this hospital, I prefer not to say)
U.S. State or Territory
Hospital Name
When did the problem happen?
Describe the situation in detail. Be sure to include
 The people who were involved (Examples witnesses, hospital staff)
What actions you took
If the hospital tried to address the situation
 Any concerns about sharing your information with the state
 Have you reported this problem before? If so, what office did you report this problem to?
NOTE  The system of records notice (SORN) applicable to this information collect is the ASPEN Complaints/Incident Tracking System (ACTS) 09-70-0565, published at 
Privacy Act of 1974; Report of a Modified or Altered System of Records)

As required by the state, State Data Information System (SDIS) Performance Indicator Reporting System, the following fields are collected and maintained to create establish a user account

Password

Email

Username (pre-defined by Drupal)

Role (State Editor)

State affiliation

Time zone

The Acquia Cloud System is a Federal Risk and Authorization Management Program (FedRAMP) authorized Cloud Service Provider system. Its platform is built on Amazon web Services (AWS) and inherits infrastructure layer controls from Amazon. Amazon AWS has received a FedRAMP authorization for the infrastructure layer. Acquia Cloud utilizes Drupal website content management tool to provide support for the public with healthcare consumer information. This system supports the CMS e-Government presence and the official public Agency websites for the Centers for Medicare & Medicaid Services. As of January 2022, authentication for all sites will be established via Single Sign on methodology.

Physical Security System personnel who access or use the system do not use any personal identifiers to retrieve records held in the system.

In this system, the SDIS site collects or stores the Password, Email, Username, Role, State affiliations and Time zone to establish a User ID/account with the appropriate state. All other sites areall authenticated via EUA ID and password. For Enterprise User Administration (EUA) details, please see PIA for EUA.

• Name
• E-Mail Address
• Phone Numbers
• Other - This is specifically for the SDIS application under Open Data only. There are two pieces of identifiable information of corporate PII that are captured in SDIS from users. These are names, email, and location. However, first name and last name are not required, but they are optional to add. Many state user emails are in the form of firstname.lastname@state.gov. Other user types are all authenticated via Enterprise User Administration (EUA) ID and password. EUA has an approved PIA. Additional data for EMTALA complaint form is being collected from public users, including Relationship to patient, US State/Territory, Hospital Name, Names of people involved (witnesses, hospital staff).

• Employees
• Public Citizens
• Other - Employees: State Government employees for SDIS; Public citizens filing a complaint, names of witnesses, including hospital staff.

ASPEN Complaints/Incidents Tracking System (ACTS) 09-70-0565, 83 FR 6591 (2/14/2018)

1-800 Medicare Helpline (HELPLINE), System No. 09-70-0535, 83 FR 659 (2/14/2018)

“Health Insurance Exchanges (HIX) Program” (No. 09-70-0560), 83 FR 659 (2/14/2018)

• In-person
• Online

• Within the OPDIV
• State/Local/Tribal

• CMS Identifier: CMS-10892
• Title: Emergency Medical Treatment and Labor Act (EMTALA) Complaint Form
• OMB Control Number: 0938-1185(*)
• Expiration Date: 03/31/2026

First Name, Last Name are required for the submission of the EMTALA complaint form. 
Name and email address are required for the creation of a user account. The account creation is voluntary and PII is required to create an account.

State users are not collected and added to the system without their prior knowledge. Also, system admins do not automatically add a state user in the DKAN tool. They have to come to us to request addition as a state user. First, the potential state user requests that CMS add them to the DKAN tool as a potential state data entry user. Second, CMS asks for their names and state/work-related email to create their profile. Once a profile is created, the state user now has access. The only personal information that is collected from the state users are their first and last names, and state/work email (with prior notice). No other information is collected from state user.

CMS user credentials are not initially provided by Acquia It is acquired by the CMS source system- EUA is covered by a separate PIA. 

A Privacy Act Statement is made available to individuals during the account creation process and within the Privacy Policy of the website. 

State users are not collected and added to the system without their prior knowledge. Also, system admins do not automatically add a state user in the DKAN tool. They have to come to us to request addition as a state user. First, the potential state user requests that CMS add them to the DKAN tool as a potential state data entry user. Second, CMS asks for their names and state/work-related email to create their profile. Once a profile is created, the state user now has access. The only personal information that is collected from the state users are their first and last names, and state/work email (with prior notice). No other information is collected from state users.

The EMTALA form only requires first and last names, which are voluntarily supplied by the consumer.

CMS user credentials are not initially provided by Acquia. They are acquired by the CMS source system - EUA (FISMA name) - which is covered by a separate PIA. 

No process exists for the EMTALA and State Medicaid websites. For the state Medicaid websites, aggregate data is collected at the state level. The only information needed from a state username and email address for registration. Users can request to change their email addresses. No privacy-related data is stored within the Acquia Cloud system.

For the EMTALA complaint form, only first name and last name are required fields. All other fields are optional. There is a privacy notice on the website to notify the consumer (patient) of their rights.

CMS user credentials are not initially provided by Acquia. They are acquired by the CMS source system- EUA is covered by a separate PIA.  

State users are not collected and added to the system without their prior knowledge. Also, system admins do not automatically add a state user in the DKAN tool. They have to come to us to request addition as a state user. First, the potential state user requests that CMS add them to the DKAN tool as a potential state data entry user. Second, CMS asks for their names and state/work-related email to create their profile. Once a profile is created, the state user now has access. The only personal information that is collected from the state users are their first and last names, and state/work email (with prior notice). No other information is collected from state users.

The system receives PII from another system, therefore, it is covered under EUA’s PIA. 

If a state user is no longer affiliated with the state or the project, the user account is deactivated. Hence, that user has no access to the portal. State user PII is provided by the user, and the user ensures the data's accuracy. 

• Administrators: CMS Admin users have access to state user data. CMS Admin access to state user data allows these users the ability to assist state users with any issues they have entering in their data. CMS Admin users also export the data to use on other platforms.
• Contractors: Some Administrators are also contractors. These contractors are direct contractors who provide support for the SDIS system.

Acquia will follow the CMS Records Schedule, which is aligned with the National Archives Records Administration (NARA) Records Control Schedule.

DM-0440-2015-0006-0001, Enrollment Records, Request for Records Disposition Authority ODF

System access records. Systems not requiring special accountability for access. These records are created as part of the user. These are user identification records generated identification and authorization process to gain according to preset requirements, typically system access to systems. Records are used to monitor inappropriate systems access by users. Includes records such as

user profiles

log-in files

password files

audit trail files and extracts

system usage files

cost-back files used to assess charges for system use

Records are cut off at end of calendar year. Destroy no sooner than 7-years after cut off but longer retention is authorized.

Administrative – Acquia will follow the least privilege principle, meaning that only those that require access to the data to perform their duties are actually granted that access. In addition, all CMS employees and contractors are required to take privacy and security awareness training that explains the requirements for handling sensitive data. All security controls are reviewed both internally and by an auditor from a third-party accredited organization (3PAO) during Security Control Assessments (SCA) to ensure compliance with CMS security standards.

Technical - The Acquia system is built using industry best practices and independently reviewed against Federal Information Security Management Act (FISMA) and NIST Security and Privacy controls to ensure technical, operational, and management controls are properly applied. This includes the necessary Federal Information Processing Standard (FIPS) 140-2 encryption standards to protect the PII both in transit and at rest. In addition, IServ uses the following security principles: define-in-depth, continuous monitoring, and role-based access control.

Physical - This system is located in a world-class cloud-based data center which provides premier physical control protections. The services used within the data center undergo their own Security Control Assessment (SCA) from a Third-Party Assessment Organization (3PAO) to ensure compliance with all physical security controls. In addition, the cloud-based environment is FedRAMP certified, including all physical security controls  

CMS Homepage

CMS Innovation Center

CMS Marketplace

Open Payments Data

Medicare Homepage

Marketplace Datasets

Medicaid & CHIP Open Data

Performance Indicator Reporting System Login

EMTALA Complaint Form(EMTALA)
Aloha-UF Infraops Backends (ALOHA)
Aloha Infraops Backends (ALOHA)

These sites are all hosted on Acquia Cloud.