Opportunity to Network and Engage

zONE stores the following information passed by CMS' Identity Management (IDM) system after a user registers in that system and is authenticated/provided permission to access zONE: IDM ID and password, IDM user name (user's first and last name), and on-file email address. zONE may also store optional user-provided profile photos and organization names. The IDM system is covered under its own PIA.  

zONE collects and shares content such as documents, events, and Wikis (explained below) which are community related content. 

In addition, zONE may store information pertaining to the internal operations of a network or computer system, including: network and device addresses; system and protocol addressing schemes implemented at an agency; network management information protocols, community strings, or network information packets; or zONE may store security management information for SBM exchanges or the Federal-facilitated Marketplaces (FFM), including security information on protection during operations.

zONE is a social platform for organizations and individuals partnering and working with the Centers for Medicare & Medicaid Services (CMS). It is a secure, collaborative venue for States, Issuers, business and technology teams to connect, communicate, and share information such as reuse documents, resources and best practices.

After a user registers in the IDM system and is authenticated/authorized to access zONE, zONE will access the IDM user name, IDM ID and password and email address. Other information a user may upload, as an option, are a profile photo and organization information. User information is retained/accessed by zONE for as long as the user requires or wants access or subject to employment.

As part of the content creation and sharing, users may: (1) upload standard files such as .doc, .xls, and .pdfs; (2) create text for title and description, and (3) enter Uniform Resource Locators (URL). Wikis are more complex documentation/ content that can be edited by multiple authorized members and revisions can be tracked.

All content within zONE is stored until a decision is made by the Business Owners to delete or remove. Any content that is posted in zONE is subject to removal if it does not abide by the HHS Rules of Behavior as explained in House Rules within zONE.

• Name
• E-Mail Address
• Photographic Identifiers
• Other - Organization Name, User Credentials: user ID and password, network and device addresses

• Employees
• Business Partners/Contacts (Federal, state, local agencies)
• Vendors/Suppliers/Contractors

PII is used to:

Create/Register a user's zONE account.

Users are identified by their first name and last name to Create and maintain content within the zONE communities.

Communicate with one another within the collaborative application via user profiles.

• Online

• Within the OPDIV
• State/Local/Tribal
• Other Federal Entities
• Other - Contractors

• Private Sector

As a part of the community-based collaboration environment, users will only have access to PII provided in the user profiles. If a user believes this information has been accessed or used in an inappropriate manner, they have the ability to contact site administrators using the “Contact Us” form and reach out to the Federal Exchange Program System (FEPS) helpdesk: CMS FEPS Email, or 1-855-CMS-1515. The FEPS helpdesk will review the situation and create a ticket in Service Now system to track and resolve the individual's concerns. 

The FEPS helpdesk will work with IDM support team responsibility if user data has been compromised at the account level. 

The FEPS helpdesk will also work with the zONE system administrators and ensure that the user’s complaint is addressed accordingly.

• Users: Users have access to search and view other zONE user profile information, which includes name and organization and/or profile picture if provided, to communicate and share content.
• Administrators: Users with administrator role may have access to the name, profile picture and email addresses of zONE users to support role-based authorization which is internal to the zONE.
• Developers: Users with developer role may need access to troubleshoot user support tickets
• Contractors: Users may be direct contractors that support the system by managing the software, hardware and other backend systems that support zONE.
• Others: zONE access request approvers. 

The system restricts access to PII depending on the role granted to the user. Users without the appropriate role cannot see the PII. Depending on the justification provided by the requestor, the Business Owner can grant the roles of Administrator or User from a drop-down menu.

The Administrator and User roles are created in zONE with a specific set of pre-approved permissions for each role. These approved permissions determine if the user can see first name, last name, and/or email address (PII). 

If the requestor is denied the requested Administrator role, then the requestor will have user level permissions selected from the drop-down menu and the system will restrict the user from viewing email addresses. System administrators have the ability to provide additional access within the zONE application if requested and authorized by the CMS zONE Business Owners.

Once a user has access to zONE, they will be able to view the CMS zONE 101 training materials, "House Rules" documents and user manuals which provide Rules of Behavior and other guidelines for using CMS zONE.

All community managers have to sign the attestation form that defines zONE’s policy on PHI/PII. Per the attestation form, the community managers take responsibility for the content that is hosted within their communities, which includes training community members.

The administrative controls in place to secure the PII include access control - request and authentication through the CMS IDM system, periodic review of users and deletion of non-active accounts, role-based access for developers and administrators. For example, if a user is granted the role of zONE user, then the controls embedded in the system allow him to see only information that is allowed for “User role”. If the user is approved to have “Administrator role”, then the user will be able to see the name and the email ID as intended by the system design.

The technical controls in place are firewalls that prevent unauthorized access, encrypted access when users obtain the IDM authentication (approval) to log into the application and a tiered system architecture which means users can only log into the application but not into any test environment and the testing and active applications are not joined together.

The physical controls in place are addressed by AWS (Amazon Web Services Inc.). The zONE system is hosted in the AWS, US-East Region. The data center is located in a special facility in Ashburn, VA. 

The zONE maintenance team accesses the zONE system by CMS authentication and access controls by using security tokens and user credentials.