Mixpanel

• SORN Number: Not Applicable
• If not published: Not applicable

• OMB Approval Number: Not applicable
• Expiration Date: Not applicable
• Explanation: Not applicable

The Centers for Medicare & Medicaid Services (CMS) uses MixPanel to collect, report, and analyze visitor interactions through event tracking on CMS’ websites, including CMS.gov, Medicare.gov, MyMedicare.gov, HealthCare.gov, CuidadoDeSalud.gov, Medicaid.gov, InsureKidsNow.gov, and various subdomains of the above top-level domains (TLDs). These TLDs are hereafter referred to as “CMS’ websites.”   

CMS uses this information to measure the number of visitors to our websites and various sections, analyze visitor interactions and to help make our site more useful to visitors. The analyses that MixPanel performs allows for a different kind of granularity and flexibility compared to other analytics tools CMS uses. 

The CMS staff analyze the reports generated by Mixpanel using the data collected from consumer activity on CMS’ websites. The reports are available only to CMS managers, teams who implement Federally Facilitated Marketplaces programs represented on HealthCare.gov, members of the CMS communications and web teams, and other designated federal staff and contractors who need this information to perform their duties.

If consumers do not want MixPanel to collect information related to their visits to CMS’ websites, consumers can use other means of interaction, including but not limited to paper applications, call centers, or in-person assisters. 

In addition to these options, a consumer can use the Tealium iQ Privacy Manager on each CMS website’s privacy page and opt out of having data collected about their visit to Healthcare.gov by MixPanel. 

Alternatively, a consumer can disable their cookies if they do not want their information to be collected. 

https://www.cms.gov/privacy-policy/

https://www.medicare.gov/privacy-policy/

https://www.healthcare.gov/privacy/  

Additional privacy policies for subdomains of the above websites    

CMS will use of MixPanel in a manner that protects the privacy of consumers who visit CMS’ websites and respects the intent of those visitors. CMS will conduct periodic reviews of MixPanel's privacy practices to ensure its policies continue to align with agency objectives and privacy policies and do not present unreasonable or unmitigated risks to consumer privacy. 

MixPanel is employed solely for the purposes of improving CMS' services and activities online related to operating CMS’ websites. Information collected by MixPanel is created and maintained by MixPanel.  

Potential Risk: Persistent cookies are used by MixPanel’s with third-party tools on CMS’ websites and can be stored on a user’s local browser. MixPanel cookies are stored for one year. 

Mitigation: MixPanel's privacy policies, notices from CMS’ websites, information published by MixPanel about its privacy policies, and the ability for consumers to opt-out of providing their information to MixPanel maximizes consumers’ ability to protect their information and mitigate risks to their privacy. A consumer can also use the Tealium IQ Privacy Manager on each CMS website’s privacy page and opt out of having data collected about their visit by MixPanel.  

CMS will not deploy the Mixpanel tool if the website is not using Tealium iQ.    

Potential Risk: MixPanel collects many data elements which include: the user’s IP address, device, device type, screen resolutions, flash version, browser, browser version, OS and OS version. Read a full list of the standards data elements that MixPanel collects.  

Mitigation: MixPanel collects users’ IP addresses to determine city, state and region, but then deletes them after storing location information which adds additional safeguards to ensure that this data cannot be connected with other data to identify individual consumers. In addition to the standard data elements collected, custom data is collected via ‘events’ and ‘custom properties'.  For example, tracking how many people download a PDF file by clicking a link.  

Potential Risk: CMS also recognizes that if MixPanel is not implemented correctly in relation to CMS’ websites, personal information could be collected about site visitors.  

Mitigation: Therefore, to mitigate this risk, CMS only allows a limited number of trained and credentialed staff or contractors to implement MixPanel.