Qualtrics

• SORN Number: Not Applicable
• If not published: Not applicable

• OMB Approval Number: Not applicable
• Expiration Date: Not applicable
• Explanation: Not applicable

The Centers for Medicare & Medicaid Services (CMS) uses Qualtrics to gather feedback from visitors to CMS’ websites, including CMS.gov, Medicare.gov, MyMedicare.gov, HealthCare.gov, CuidadoDeSalud.gov, Medicaid.gov, InsureKidsNow.gov, and various subdomains of the above top-level domains (TLDs), to gauge overall satisfaction with the website and to find out how we can improve the consumer experience. These TLDs are hereafter referred to as “CMS’ websites.” 

Feedback collected is general consumer feedback information via multiple-choice questions such as, "What is your feedback about?" "How can we improve this page?" and "Did you find the information helpful?" Consumers provide feedback through online surveys facilitated by the Qualtrics tool. These surveys are anonymous and not associated with a Consumers account or application. Persistent cookies can be stored on a user’s local browser and are used to ensure a consumer cannot fill out a feedback survey multiple times. Qualtrics cookies are stored for one year.

Qualtrics' privacy policies, notices from CMS’ websites, information published by Qualtrics about its privacy policies, and the ability for consumers to opt-out of providing their information to Qualtrics maximizes consumers’ ability to protect their information and mitigate risks to their privacy.  The CMS staff analyze and report using the collected data from Qualtrics. The reports are available only to CMS managers, teams who implement CMS programs represented on CMS’ websites, members of the CMS communications and web teams, and other designated federal staff and contractors who need this information to perform their duties. 

If consumers do not want Qualtrics to collect information about their device, consumers can choose not to take a CMS website survey or they can use the CMS website privacy manager to opt-out website analytics tools.  

Survey questions are used to improve the online application process and are not applicable to alternative application channels. 

https://www.cms.gov/privacy-policy/ https://www.medicare.gov/privacy-policy/ https://www.healthcare.gov/privacy/

Additional privacy policies for subdomains of the above websites can be found at https://www.cms.gov/privacy-policy/   

CMS will use Qualtrics in a manner that protects the privacy of consumers who visit CMS’ websites and respects the intent of visitors. CMS will conduct periodic reviews of Qualtrics’ privacy practices to ensure its policies continue to align with agency objectives and privacy policies and do not present unreasonable or unmitigated risks to consumer privacy. 

Qualtrics is employed solely for the purposes of improving CMS' services and activities online related to operating HealthCare.gov. Information collected by Qualtrics is created and maintained by Qualtrics.  

Potential Risk: Persistent cookies are used with third-party tools on CMS’ websites and can be stored on a user’s local browser. Qualtrics cookies are stored for one year.  

Mitigation: Qualtrics' privacy policies, notices from CMS’ websites, information published by Qualtrics about its privacy policies, and the ability for consumers to opt-out of providing their information to Qualtrics maximizes consumers’ ability to protect their information and mitigate risks to their privacy.  

Additionally, Qualtrics' surveys are voluntary and consumers can choose not to participate in surveys. CMS has configured its use of Qualtrics to mask IP addresses before being stored to add additional safeguards to ensure that this data cannot be connected with other data in order to identify a consumer who completes a survey supported by Qualtrics. In some cases, consumers may volunteer PII information in the free text field of surveys. If CMS staff see this occur, they will delete this information from the Qualtrics system.  

CMS will not deploy the Qualtrics tool if the website is not using Tealium iQ.    

Potential Risk: CMS also recognizes that if Qualtrics is not implemented correctly in relation to CMS’ websites, personal information could be collected about CMS website visitors.  

Mitigation: Therefore, to mitigate this risk, CMS only allows a limited number of trained and credentialed staff or contractors to implement Qualtrics.