Skip to main content

Relationships, Events, Contacts, and Outreach Network

Privacy Impact Assessment (PIA) published by CMS as an Operating Division of the U.S. Department of Health and Human Services

Date signed: 7/7/2023

View all CMS PIAs
PIA Information for Relationships, Events, Contacts, and Outreach Network
PIA QuestionsPIA Answers
OPDIV:CMS
PIA Unique Identifier:P-8861203-134893
Name:Relationships, Events, Contacts, and Outreach Network
The subject of this PIA is which of the following?Major Application
Identify the Enterprise Performance Lifecycle Phase of the system.Operate
Is this a FISMA-Reportable system?Yes
Does the system include a Website or online application available to and for the use of the general public?No
Identify the operator:Contractor
Is this a new or existing system?Existing
Does the system have Security Authorization (SA)?Yes
Date of Security Authorization10/4/2024
Indicate the following reason(s) for updating this PIA. Choose from the following options.PIA Validation (PIA Refresh/Annual Review)
Describe in further detail any changes to the system that have occurred since the last PIA.We've made minor changes to the interface to improve usability, reduce confusion and aid data integrity and accuracy. The SORN number was also updated.
Describe the purpose of the systemThe Relationships, Events, Contacts, and Outreach Network (RECON) system is a customer relationship management (CRM) system the Centers for Medicare and Medicaid Services uses to help manage relations with partner organizations on outreach and education to consumers and beneficiaries. It is used to determine effectiveness of messages delivered to beneficiaries; identify communications gaps for initiatives; and link data with local partner information.  It has contact management capability. RECON is an app which is developed in Salesforce based on the business requirements for Office of Communications (OC). External users can complete any of the forms for speaking requests at upcoming events or for any queries. All communication from CMS, for both approvals and denials, will be directed to the point of contact listed in the form providing a historical record and context for partner relations. 
Describe the type of information the system will collect, maintain (store), or share. (Subsequent questions will identify if this information is PII and ask about the specific data elements)The information collected by the Relationship, Events, Contacts and Outreach Network system will be contact information for both the organization and the individual:  name, address, phone number, email, and website address. Also, the system captures location information for outreach activities regarding CMS initiatives.
Provide an overview of the system and describe the information it will collect, maintain (store), or share, either permanently or temporarily.

The Relationship, Events, Contacts, and Outreach Network (RECON) system collects and stores information about partner organizations. Partner organizations represent the following sectors and communications channels: Health Insurance Issuers, Health Care Providers, Hospitals, Minority and Underserved, Youth, Consumer Groups, Foundations, Chronic Illness and Disease, Disabled, Educational Institutions, Community Organizations and Institutions, Pharmacies and Pharmacists, Communities of Faith, Caregivers, and Aging Issues. The information collected from partner organizations are the following: name, address, phone number, email, and websites. Records in RECON are retrieved by contact name, agency/company name or Partner category.  Users are assigned a license for them to access RECON.

 
CMS created the CMS Speaking Engagement Request Form and the Administrator Speaking Engagement Request Form to give the public a more efficient way to request a CMS representative to speak at an upcoming event. As part of the request process, the requestor is required to submit their name, email address, phone number, and an address for the event, information which is considered PII. This information is necessary to ensure CMS can stay in contact with the requestor for event planning purposes.

CMS created the CMS Speaking Engagement Request Form and the Administrator Speaking Engagement Request Form to give the public a more efficient way to request a CMS representative to speak at an upcoming event. As part of the request process, the requestor is required to submit their name, email address, phone number, and an address for the event, information which is considered PII. This information is necessary to ensure CMS can stay in contact with the requestor for event planning purposes.

 

Does the system collect, maintain, use or share PII?Yes
Indicate the type of PII that the system will collect or maintain.
  • Name
  • E-Mail Address
  • Phone Numbers
  • Mailing Address
  • Other - Organization and website address.
Indicate the categories of individuals about whom PII is collected, maintained or shared.
  • Employees
  • Business Partners/Contacts (Federal, state, local agencies)
  • Vendors/Suppliers/Contractors
How many individuals' PII in the system?500-4,999
For what primary purpose is the PII used?Personally Identifiable Information (PII) is used by Partner Leads (Relationships, Events, Contacts, and Outreach Network licensed users) to develop and maintain relationships with partners.  PII is also used to create user accounts.  Access to the RECON system is granted to the System Administrator and direct CMS contractor.
Describe the secondary uses for which the PII will be used (e.g. testing, training or research)N/A
Describe the function of the SSN.N/A
Cite the legal authority to use the SSN.N/A
Identify legal authorities​ governing information use and disclosure specific to the system and program. 42 CFR 401.101–401.148 and sec 1106(a) of the Social Security Act, 42 U.S.C. 1306(a).
Are records on the system retrieved by one or more PII data elements?Yes
Identify the number and title of the Privacy Act System of Records (SORN) that is being used to cover the system or identify if a SORN is being developed.

09-90-1901, HHS Correspondence, Customer Service, and Contact List Records 

 

Identify the sources of PII in the system: Directly from an individual about whom the information pertains
  • In-Person
  • Email
  • Other - Phone CMS created the CMS Speaking Engagement Request Form and the Administrator Speaking Engagement Request Form to give the public a more efficient way to request a CMS representative to speak at an upcoming event. As part of the request process, the requestor is required to submit their name, email address, phone number, and an address for the event, information which is considered PII. This information is necessary to ensure CMS can stay in contact with the requestor for event planning purposes.
Identify the sources of PII in the system: Government Sources
  • Within the OPDIV
  • Other HHS OPDIV
  • State/Local/Tribal
  • Other Federal Entities
Identify the sources of PII in the system: Non-Government Sources
  • Private Sector
  • Public Media/Internet
Identify the OMB information collection approval number and expiration dateN/A
Is the PII shared with other organizations?No
Describe the process in place to notify individuals that their personal information will be collected. If no prior notice is given, explain the reason.Notices, that personal information will be collected, to the Partner community is provided by the Partner Leads (User) when they are in communication (phone or email) with their respective Partner Group.   After permission is granted; Partner Leads input contact information into the Relationship, Events, Contacts and Outreach Network (RECON) application. 
Is the submission of the PII by individuals voluntary or mandatory?Voluntary
Describe the method for individuals to opt-out of the collection or use of their PII. If there is no option to object to the information collection, provide a reason.Partner Leads (RECON Users) inform their partner contacts on a quarterly basis (using the mass email functionality within RECON) to inquiry if the partner contacts want to opt-out of the collection or use of their PII.
Describe the process to notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changes since the notice at the time of original collection). Alternatively, describe why they cannot be notified or have their consent obtained.When there is a major change to the Relationships, Events, Contacts, and Outreach Network (RECON) application that affects the PII information in the system; Partners are told of the changes via email from their respective Partner Lead (User).
Describe the process in place to resolve an individual's concerns when they believe their PII has been inappropriately obtained, used, or disclosed, or that the PII is inaccurate. If no process exists, explain why not.If a Partner has any concern about their PII being inappropriately obtained, used, or disclosed; they can contact their Partner Lead and discuss the situation.  At any time, Partners can request that their PII not be used.
Describe the process in place for periodic reviews of PII contained in the system to ensure the data's integrity, availability, accuracy and relevancy. If no processes are in place, explain why not.The Relationships, Events, Contacts and Outreach Network (RECON) information is backed up daily to ensure that data is available in a timely fashion.  Users receive on a quarterly basis, email asking the Partners if their PII has changed or if they want to opt-out of the collection of their PII.  Partner leads (RECON Users) are responsible for reviewing and changing the Partner's information accordingly.  Data integrity is maintained through user system access.
Identify who will have access to the PII in the system and the reason why they require access.
  • Users: To maintain and update information
  • Administrators: The System Administrator has access to all the data in the system by necessity of her role as the system maintainer.
  • Developers: Developers may access to system data when they are making needed code changes.
  • Contractors: CMS direct contractors, in their role as an administrator, would have access to PII as required to maintain and manage user accounts.
Describe the procedures in place to determine which system users (administrators, developers, contractors, etc.) may access PII.

The Relationships, Events, Contacts and Outreach Network system require licenses to authorize the system.  Licenses are role based.  All authorized users (licenses) may access PII, but the ability to make changes to PII has varying restrictions for some users.  The administrator of the system grants permission (through license type/role) after review of request.

Users - are approved by the business owner before access is granted

Administrator - is approved by business owner

Contractor - is approved by the administrator and business owner

Describe the methods in place to allow those with access to PII to only access the minimum amount of information necessary to perform their job.The Relationships, Events, Contacts and Outreach Network (RECON) system has three different levels of licenses and within each license type there are different profile types.  Functionality is restricted based on both licenses and profile types.  RECON also employs the Automated Audit Actions which allows the administrator to monitor account creation and modification.
Identifying training and awareness provided to personnel (system owners, managers, operators, contractors and/or program managers) using the system to make them aware of their responsibilities for protecting the information being collected and maintained.All RECON Users are required to take the annual CMS Security Awareness Training.
Describe training system users receive (above and beyond general security and privacy awareness training)N/A
Do contracts include Federal Acquisition Regulation and other appropriate clauses ensuring adherence to privacy provisions and practices?Yes
Describe the process and guidelines in place with regard to the retention and destruction of PII. Cite specific records retention schedules.

The records are maintained on-line in the system for 2 years. After a 2-year period, records are transferred to an archive file and destroyed three years later.

NARA DAA-GRS-2013-0001-0005.

Describe, briefly but with specificity, how the PII will be secured in the system using administrative, technical, and physical controls.
  • Administrative: Role base Access Control - only individuals with appropriate clearance and need to know have access to PII. Additionally, every CMS employee signs a "Rules of Behavior" form reminding to safeguard resources and attend annual security training.
  • Technical: Single Sign On (SSO) stipulates session and user authentication permits a user to use one set of login credentials so only approved users can access PII.
  • Physical: Federal buildings are monitored with security guards 24/7. Employees are required to always show badge.