Hotjar

• SORN Number: Not Applicable
• If not published: Not applicable

• OMB Approval Number: 938-1397
• Expiration Date: 07/31/2024

The purpose for this tool is to:

1) visually represent where users click, hover, and scroll on our site (Heatmaps)
2) create and use targeted surveys to get a better understanding of our users (Surveys)

Heatmap: Utilizing Hotjar’s Heatmap functionality will allow the Quality Payment Program’s (QPP) Human-Centered Design team to visualize user behavior by viewing “hot spots” on screenshots of our site content. In summary, configuration and implementation of Hotjar’s Heatmap functionality on QPP will provide the following benefits:

a) Discover what attracts attention - See the elements of a page that capture attention so we can deliver the right information to our users at the right time.
b) See where user attention drops - Remove the guesswork and learn where users drop off our page. Discover practical ways design and copy can keep users’ attention.
c) Compare engagement on different devices - Spot problems on mobile, like unclickable elements or broken forms, by switching between desktop, tablet, and mobile views.

Surveys: Utilizing Hotjar’s Survey functionality will allow QPP’s Human-Centered Design team to bring the voice of the customer to our decision making via an onsite survey. In summary, configuration and implementation of Hotjar’s Survey functionality on QPP directly supports the overarching CCSQ Customer Satisfaction (CSAT) initiative being led by the HCD Centers of Excellence. Specifically, the HCD Team has developed a customer satisfaction survey that will prompt users of the unauthenticated Frontend to answer a few questions about their experience, once per quarter.

The survey has been submitted for PRA approval.

A TPWA is being completed to ensure that the configuration, implementation and usage of Hotjar protects the privacy of our end users.

Through the use of Privacy Manager the public will have the option to block Hotjar, thus preventing the government from having the ability to collect the corresponding information, while still allowing the QPP site to function as originally intended.

As referenced below in Response #13, Hotjar is embedded into the QPP Website and is imperceptible by end users.

CMS will use Hotjar in a manner that protects the privacy of consumers who visit qpp.cms.gov and respects the intent of qpp.cms.gov users. CMS will conduct periodic reviews of Hotjar's privacy practices to ensure its policies continue to align with agency objectives and privacy policies and do not present unreasonable or unmitigated risks to consumer privacy.

Hotjar is employed solely for the purposes of improving CMS services and on-line activities related to operating qpp.cms.gov.

Risk #1:
Persistent cookies are used by Hotjar on qpp.cms.gov and can be stored on a user’s local browser. For heatmapping and session recording, the main cookie stores the universally unique identifier (UUID) for 365 days. All other cookies expire after 30 minutes or the end of the session and are mostly used to monitor that a user is still active. A full list of cookies is provided here: https://help.hotjar.com/hc/en-us/articles/115011789248-Hotjar-Cookie-Information

Mitigation:
Hotjar's privacy policies, notices from qpp.cms.gov, information published by Hotjar about its privacy policies, and the ability for consumers to opt-out of having their information collected by Hotjar maximizes consumers’ ability to protect their information and mitigate risks to their privacy.

Additionally, the Hotjar surveys on qpp.cms.gov are voluntary and consumers can choose not to participate in surveys. CMS has configured its use of Hotjar to mask IP addresses before being stored to ensure that this data cannot be connected with other data in order to identify a consumer who completes a survey. In some cases, consumers may volunteer PII information in the free text field of surveys. If CMS staff see this occur, they will delete this information from the system.

Finally, consumers can also use the Tealium iQ Privacy Manager on qpp.cms.gov privacy page and "opt out" of having data collected about them by Hotjar.