Skip to main content

Tealium

Date signed: 9/27/2019

TPWA PIA info for Tealium
TPWA PIA QuestionsTPWA PIA Answers
OPDIV:CMS
TPWA Unique Identifier (UID):T-5983159-234204
Is this a new TPWA?Yes
Please provide the reason for revisionThe Tealium TPWA PIA is being revised to reflect changes in CMS’ use of Tealium.
Will the use of a third-party Website or application create a new or modify an existing HHS/OPDIV System of Records Notice (SORN) under the Privacy Act?No
Indicate the SORN number (or identify plans to put one in place.)
  • SORN Number: Not applicable
  • If not published: Not applicable
Will the use of a third-party Website or application create an information collection subject to OMB clearance under the Paperwork Reduction Act (PRA)?No
Indicate the OMB approval number and approval number expiration date (or describe the plans to obtain OMB clearance.)
  • OMB Approval Number: Not applicable
  • Expiration Date: Not applicable
  • Explanation: Not applicable
Does the third-party Website or application contain Federal Records?No
Describe the specific purpose for the OPDIV use of the third-party Website or application:

Many of the third-party tools used in connection with the Centers for Medicare & Medicaid Services’ (CMS’) websites, including CMS.gov, Medicare.gov, MyMedicare.gov, HealthCare.gov, CuidadoDeSalud.gov, Medicaid.gov, InsureKidsNow.gov, and various subdomains of the above top- level domains (TLDs), rely on cookies or web beacons to perform their functions.

These TLDs are hereafter referred to as “CMS’ websites.” CMS uses Tealium includes Tealium as a solution for CMS staff to manage these cookies and web beacons from a single interface. Specifically, Tealium allows CMS to control, which cookies or web beacons are enabled/disabled, and thus which third-party tools are enabled/disabled. Tealium adds, removes and modifies code across CMS’ websites. Many of the tools CMS uses to gather data on visitors’ onsite behavior and interactions  and monitor the health of HealthCare.gov CMS Websites are deployed using Tealium. Tealium gives CMS and its staff and contractors an easy way to manage all of these tools.

Tealium also includes the iQ Privacy Manager which offers opt-in or opt-out choices to site visitors and gives site visitors control over which tags or cookies you want to accept while you visit the site. The Tealium Universal Data Hub also allows CMS to define custom attributes and audiences for the purpose of audience discovery, and to syndicate enriched data or trigger action directives via 3rd party applications.

Have the third-party privacy policies been reviewed to evaluate any risks and to determine whether the Website or application is appropriate for OPDIV use?Yes
Describe alternative means by which the public can obtain comparable information or services if they choose not to use the third-party Website or application:If consumers do not want to use CMS’ websites due to the site's use of Tealium iQ, consumers can use other means of interaction, including but not limited to paper applications, call centers, or in- person assisters. In addition to these options, a consumer can disable their cookies if they do not want their device information to be collected.
Does the third-party Website or application have appropriate branding to distinguish the OPDIV activities from those of nongovernmental actors?No
How does the public navigate to the third party Website or application from the OPIDIV?Not applicable.
Please describe how the public navigate to the third-party website or application:Not Applicable. The public cannot navigate directly to Tealium since the application works in the background.
If the public navigate to the third-party website or application via an external hyperlink, is there an alert to notify the public that they are being directed to a nongovernmental Website?No
Has the OPDIV Privacy Policy been updated to describe the use of a third-party Website or application?No
Provide a hyperlink to the OPDIV Privacy Policy:https://www.cms.gov/privacy-policy/ 
https://www.medicare.gov/privacy-policy/ 
https://www.healthcare.gov/privacy/
Additional privacy policies for subdomains of the above websites can be found at 
https://www.cms.gov/privacy-policy/
Is an OPDIV Privacy Notice posted on the third-party Website or application?No
Is PII collected by the OPDIV from the third-party Website or application? No
Will the third-party Website or application make PII available to the OPDIV?No
Describe the PII that will be collected by the OPDIV from the third-party Website or application and/or the PII which the public could make available to the OPDIV through the use of the third-party Website or application and the intended or expected use of the PII:CMS does not collect any PII through the use of Tealium.
Describe the type of PII from the third-party Website or application that will be shared, with whom the PII will be shared, and the purpose of the information sharing:CMS does not collect any PII through the use of Tealium.
If PII is shared, how are the risks of sharing PII mitigated?CMS does not collect any PII through the use of Tealium.
Will the PII from the third-party Website or application be maintained by the OPDIV?No
Describe how PII that is used or maintained will be secured:Not applicable
What other privacy risks exist and how will they be mitigated?

CMS will use Tealium in a manner that protects the privacy of consumers who visit
CMS’ websites and respects the intent of visitors. CMS will conduct periodic reviews of Tealium’s privacy practices to ensure its policies continue to align with agency objectives and privacy policies and do not present unreasonable or unmitigated risks to consumer privacy. Tealium is employed solely for the purposes of improving CMS' services and activities online related to operating CMS’ websites. Information collected by Tealium is created and maintained by Tealium.

Potential Risk: 
Persistent cookies are used by third party Tealium’s tools on CMS’ websites to collect user’s information such as IP address, host name, operating system, browser, screen resolution, timestamp, etc. These cookies are stored on a user’s local browser. Persistent cookies remain in your browser after you close your browser or turn off your computer. With the exception of the Tealium "Privacy Manager" cookie discussed below, Tealium cookies remain on users’ browsers for one year.

The Tealium "Privacy Manager" feature creates a cookie that and has a lifespan of 3 years. This cookie only stores information about consumer's privacy settings to ensure their preferences are saved. Because the Privacy Manager works using a cookie that is installed on a site visitor's browser, the opt-in and opt-out choices made through the Privacy Manager will only be effective on the device through which a user makes opt-in or opt-out choices using the Privacy Manager, and a user's choices will expire after 3 years when the Privacy Manager cookie expires. Thereafter, users must revisit the Privacy Manager to renew their opt-in and opt-out choices.

Mitigation: 
Tealium’s privacy policies, notices from CMS’ websites, information published by Tealium about its privacy policies, and the ability for consumers to disable cookies and opt out of providing their information to Tealium maximizes consumers ability to protect their information and mitigates risks to their privacy.

Potential Risk: 
CMS also recognizes that if Tealium is not implemented correctly in relation to CMS’ websites, personal information could be collected about visitors.

Mitigation: 
Therefore, to mitigate this risk, CMS only allows a limited number of trained and credentialed staff or contractors to implement Tealium.

Third-Party Web and Application (TPWA) Privacy Impact Assessment (PIA) published by CMS as an Operating Division of the U.S. Department of Health and Human Services

View all CMS PIAs