Eligibility Support Desktop Change Utility Tool

The major changes to the Eligibility Support Desktop Change Utility Tool (ESDCU) since the last PIA are:

Eligibility and subsidy changes related to the American Rescue Plan and Inflation Reduction Act.

Changes related to decoupling ESDCU from Federally Facilitated Marketplace (FFM).

Neither of these changes pose a privacy risk or add PII to ESDCU.

The Eligibility Support Desktop Change Utility Tool (ESDCU) is an application that provides access to search and display consumer, insurance application and enrollment data, makes limited eligibility redeterminations, and allows users to open special enrollment periods (SEPs).

The core capability is search and display of data housed in Federally Facilitated Exchange (FFE) through Application Programming Interfaces (APIs). 

The ESDCU collects audit records that show user activity within the system, and information related to users’ editing sessions. Audit records are not purged and are persisted indefinitely. User session info is retained until the end of the user’s editing session, to a maximum of 24 hours. User session information includes Social Security Number, Driver's License Number, Email address, Date of Birth (DOB), mailing address, Name, Mother's Name, Phone number, Legal documents, Tax information, immigration documents, wage data.

No information from insurance applications, policies, or plans is persisted in ESDCU. No Personal Identifiable Information (PII) is persisted in ESDCU. User IDs are persisted as part of audit records to identify the user who made changes to an insurance application, but no other information about the user is retained. 

The ESDCU is a CMS internal tool for making updates to the Federally Facilitated Marketplace (FFM) eligibility and enrollment records in support of case work relating to eligibility appeals, support, and information corrections. The ESDCU was developed to allow for off-line capturing/editing of information and submission back into the Federally Facilitated Exchange (FFE) for effectuation. The information transmitted to ESDCU is about consumers enrolled in or attempting to enroll in the FFE. The ESDCU regularly uses PII to validate a consumer’s eligibility to apply for and receive healthcare via the FFE and includes the consumer’s name, address, phone number and other information. Audit information is collected because it is a business requirement. User session information is collected to keep track of each user’s changes made during the session, and to enable the changes to be saved back to the FFM.  

The ESDCU uses the Marketplace Consumer Record (MCR) person search Application Program Interface (API) to search insurance applications using marketplace consumer PII. Data elements used for person search are first name, last name, city, state, zip, social security number. Date of birth, and phone number. The search criteria are not persisted.  

ESDCU users are CMS employees and direct contractors. ESDCU is accessed in two ways. 1. The ESDCU appeals workers use the CMS Enterprise Portal and select the ESDCU application within that environment; they do not enter user credentials into ESDCU. Login credentials are entered into the CMS Portal and are managed by Enterprise Identity Management (EIDM). The EIDM has its own PIA about the information contained within it. 2. System Administrators access the ESDCU through the CMS Virtual Private Network (VPN); they log in using their CMS Enterprise User Administration (EUA) ID which has its own PIA for the information that it handles. 

• Social Security Number
• Name
• Driver's License Number
• Mother's Maiden Name
• E-Mail Address
• Phone Numbers
• Military Status
• Taxpayer ID
• Date of Birth
• Mailing Address
• Legal Documents
• Employment Status
• Other - Wage data; Immigration Documents;

• Public Citizens
• Other - ESDCU maintains a list of known portal user IDs for use in the monthly user reconciliation process. Information about whether the IDs have been recently used is shared with the POC of each user group as part of the process.

42 U.S.C. Section 18081

Affordable Care Act, Section 1411;

There is no method for individuals to opt-out of the collection or use of their PII because the ESDCU does not directly collect PII, it is transferred from the FFE system. FFE will outline any processes for notification. Also, system users' access ESDCU through other CMS systems, EIDM and CyberArk/XOC. For information obtained from EIDM, it is the responsibility of this system to provide individuals the option to opt-out. 

There is no process in place to resolve an individual's concerns about their PII, because the ESDCU does not directly collect PII, it is transferred from the FFE system. However, an individual can contact the FFE Health Insurance Marketplace call center at 1-800-318-2596, with concerns that their PII may have been inappropriately obtained, used, disclosed or is inaccurate.

The PII within this system is not collected by ESDCU. The PII is collected from the individual by another CMS system, which is FFE, and that PIA should reflect how this process is addressed.

Centers for Medicare and Medicaid Services (CMS) has a continuous monitoring program based on the National Institutes of Science and Technology (NIST) recommendations to ensure system integrity, availability. The individual enrollment application is designed with logic checks to ensure data accuracy and integrity. Centers for Medicare and Medicaid Services (CMS)/Center for Consumer Information and Insurance Oversight (CCIIO) has established an Enrollment Resolution and Reconciliation program to provide services necessary to resolve errors and reconcile discrepancies in enrollment data between the Health Insurance Exchange, State Based Marketplaces, issuer community, and CMS. Yearly, CCIIO is required to review and update the enrollment process to ensure data collected is relevant to the health insurance enrollment process.

• Users: Users have access to PII to perform the function of ESDCU: update consumers' information in connection with eligibility and enrollment in the FFE.
• Administrators: Administrators have access to PII to review user accounts, provide support to the application process and investigate problems that may contain PII.
• Contractors: CMS direct contractors, as users or administrators would have access to PII in conjunction to those roles and job functions.

Individuals requesting access must sign an Account request form prior to account creation, it indicates the level of access required. This form is reviewed and approved by the Information System Security Officer (ISSO) prior to account creation. ESDCU uses the principle of least privilege as well as a role-based access control to ensure system administrators and users are granted access on a "need-to-know" and "need-to-access" basis. 

System administrators review user accounts at least semi-annually. Any anomalies are addressed and resolved by contacting the user, and modifying their user data, or by removing their access if no longer required. Activities of all users including system administrators are logged and reviewed by ESDCU ISSO to identify any unusual activity. 

ESDCU uses the principle of least privilege as well as a role-based access control to ensure system administrators, and users are granted access on a "need-to-know" and "need-to-access" commensurate with their assigned duties. 

An audit log is maintained to record and review all the activities of users, including system administrators, and is reviewed by ESDCU ISSO to identify any abnormal activities.

The ESDCU system follows the National Archives and Records Administration (NARA), Disposition Authority Number DAA-GRS2022-00090002, which states that records will be destroyed when no longer needed for business use, or according to an agency predetermined time or business rule. The DAA record schedule for HIX was approved by Office of the Archivist in June 2023. 

ESDCU complies with GRS 5.1 and 5.2. 

ESDCU is hosted at Amazon, AWS operates the data centers in alignment with Tier III+ guidelines which provides the physical control protections. The physical controls are security guard presence, identification checks, and video monitoring on the interior and exterior of the building.  

The technical controls in place are intrusion detection/prevention systems, encryption of data, firewalls, and application vulnerability scans. Additionally, administrative access is ESDCU uses the principle of least privilege as well as a role-based access control to ensure system administrators, and users are granted access on a "need-to-know" and "need-to-access" commensurate with their assigned duties.

The administrative controls in place to secure the PII include access control - request and authentication through the CMS EIDM system, periodic review of users and deletion of non-active accounts. Access to ESDCU is based on the principle of least privilege to ensure system administrators and users are granted access on a "need-to-know" and "need-to-access" basis.