Skip to main content

TWITTER

Date signed: 9/7/2018

TPWA PIA info for TWITTER
TPWA PIA QuestionsTPWA PIA Answers
OPDIV:CMS
TPWA Unique Identifier (UID):T-2963383-037191
Is this a new TPWA?Yes
Please provide the reason for revision.This TPWA is revised to identify all of the added CMS websites that occasionally deliver digital advertising on third-party websites in order to reach new users and that provide information to previous visitors. The CMS websites are; www.CMS.gov, www.Medicare.gov, www.MyMedicare.gov, www.Medicaid.gov, www.InsureKidsNow.gov, HealthCare.gov, and CuidadoDeSalud.gov.
Will the use of a third-party Website or application create a new or modify an existing HHS/OPDIV System of Records Notice (SORN) under the Privacy Act?No
Indicate the SORN number (or identify plans to put one in place.)
  • SORN Number: Not Applicable
  • If not published: Not applicable
Will the use of a third-party Website or application create an information collection subject to OMB clearance under the Paperwork Reduction Act (PRA)?No
Indicate the OMB approval number and approval number expiration date (or describe the plans to obtain OMB clearance.)
  • OMB Approval Number: Not applicable
  • Expiration Date: Not applicable
  • Explanation: Not applicable
Does the third-party Website or application contain Federal Records?No
Describe the specific purpose for the OPDIV use of the third-party Website or application:

CMS maintains an educational presence on Twitter in the form of a CMS website branded page. This page allows for a direct connection with end users to provide broad educational opportunities and limited opportunities to address consumer questions and concerns. 

Twitter is a popular platform where users can consume and interact (Favorite, ReTweet, Reply) with content related to their friends, and personal interests. CMS has created a branded page on Twitter for specific CMS websites to provide educational content in a space where many potential end users of products made available on CMS websites are already spending their time online. 

The primary purpose of having a branded page on Twitter is to promote information related to a CMS website  and to provide resources to consumers who may not be regular visitors to a CMS website; occasionally we will leverage the innate social sharing capacity of this platform by asking fans of our branded page to Retweet our content with their friends and followers on the platform for the purpose of disseminating a particular message as it relates to an initiative or information related to a CMS website.

Have the third-party privacy policies been reviewed to evaluate any risks and to determine whether the Website or application is appropriate for OPDIV use?Yes
Describe alternative means by which the public can obtain comparable information or services if they choose not to use the third-party Website or application:Consumers are also educated through traditional advertising through TV, radio, CMS websites and local partners/counseling entities and events. Additionally information is available through other 3rd party digital properties such as YouTube, Facebook, and Google+.
Does the third-party Website or application have appropriate branding to distinguish the OPDIV activities from those of nongovernmental actors?Yes
How does the public navigate to the third party Website or application from the OPIDIV?An external hyperlink from an HHS Website or Website operated on behalf of HHS.
Please describe how the public navigate to the third-party website or application:Directly through Twitter.com, via a connect icon on the CMS website site, using a web search or via a web-based URL to content hosted on Twitter.com.
If the public navigate to the third-party website or application via an external hyperlink, is there an alert to notify the public that they are being directed to a nongovernmental Website?Yes
Has the OPDIV Privacy Policy been updated to describe the use of a third-party Website or application?Yes
Provide a hyperlink to the OPDIV Privacy Policy:

https://www.cms.gov/privacy/ is the privacy policy for all CMS websites unless a separate one is noted below.  

https://www.healthcare.gov/privacy/ https://www.medicare.gov/privacy-policy/index.html  

Is an OPDIV Privacy Notice posted on the third-party Website or application?No
Is PII collected by the OPDIV from the third-party Website or application? No
Will the third-party Website or application make PII available to the OPDIV?Yes
Describe the PII that will be collected by the OPDIV from the third-party Website or application and/or the PII which the public could make available to the OPDIV through the use of the third-party Website or application and the intended or expected use of the PII:

CMS does not collect any PII through its use of Twitter. Individual users who register with Twitter are required to provide a first name, valid email address, password, and handle to create a personal Twitter profile. 

Once registered, users have the option to provide a wealth of additional information about themselves such as telephone number, interests, etc. which may be accessible on the individual user’s personal Twitter profile page based on who they follow or otherwise maintained or used by Twitter (review Twitter's data policy and how they may use the provided information).  

This information may be available to CMS page administrators in whole or part, based on a user’s privacy settings. CMS does not solicit, collect, or maintain any personally identifiable information from individuals who visit, favorite, retweet, reply, or otherwise engage with the CMS website Twitter page or tweets. The CMS website Twitter page administrator may however, read, review, or rely upon information that individuals make available on Twitter in the form of replies, use of hashtags, or "@ mentions" for the purposes of responding to a user's question. 

Even though this information may be accessible to the CMS website’s Twitter page administrators, CMS does not collect, disseminate, or maintain any of the information provided on a CMS website’s Twitter page. 

Describe the type of PII from the third-party Website or application that will be shared, with whom the PII will be shared, and the purpose of the information sharing:This information is not shared beyond a CMS website Twitter Administrator. PII is not collected outside of Twitter or used for other CMS purposes.
If PII is shared, how are the risks of sharing PII mitigated?This data is kept within the Twitter platform.  It is not downloaded into other tools and or repositories.
Will the PII from the third-party Website or application be maintained by the OPDIV?No
Describe how PII that is used or maintained will be secured: 

CMS does not keep separate records or accounting of Twitter users or their interaction with a CMS website’s Twitter page. CMS does not store or share this information. User information is retained by Twitter as long as a user maintains a Twitter account. 

See Twitter's privacy policy to see how long user information is retained after an account has been deleted. Twitter users can learn more about how their information is used and maintained by Twitter by visiting Twitter's data policy.  

What other privacy risks exist and how will they be mitigated?

Due to limitations on Twitter, the CMS website Privacy Notice is not posted on the CMS website Twitter page. However, a URL to CMS Website’s privacy policy is referenced in the bio section of the page, the only space available to include any privacy related information. 

Links to bio sections for CMS websites: 

In addition to the link on Twitter consumers are provided notice on the CMS website. A link to our Linking Policy is in the footer of the CMS website. Our Linking Policy includes a privacy notice for social media sites and provides links to a CMS website’s presence on Third Party sites as well as the privacy policies of those social media sites. 

Additionally, when a consumer places their mouse cursor over a link to a social media site, hover text informs them that they will be "Leaving the CMS website" if they click. Twitter is a third-party service that uses persistent tracking technologies. In an effort to help consumers understand how their information is used by Twitter, the CMS website’s Twitter page includes a link to a privacy notice for the CMS website which addresses this topic.

https://www.cms.gov/privacy/ is the privacy policy for all CMS websites unless a separate one is noted below. https://www.healthcare.gov/privacy/ 

https://www.medicare.gov/privacy-policy/index.html  

As mentioned above, due to limitations on Twitter, the CMS website’s Privacy Notice is not posted on the CMS website’s Twitter page due to length limitations. However, a URL to the privacy notice for the CMS website is prominently displayed.  

The CMS website’s Privacy Notice Statement for the CMS website directs Twitter users to review Twitter's terms of service and privacy policies to understand how Twitter may collect information about users, including what pages the user may visit, and how Twitter may use or share such information for third-party advertising or other purposes.  

Twitter is created and maintained by Twitter. CMS has reviewed Twitter's privacy practices and has concluded that risks to consumer privacy are sufficiently mitigated through application of Twitter's privacy policies, notices from the CMS website and Twitter informing consumers of these policies, and the ability of consumers to opt-out of providing their information to the CMS website and Twitter. 

CMS will conduct a periodic review of Twitter's privacy practices to ensure Twitter's policies continue to align with agency objectives and privacy policies and do not present unreasonable or unknown risks to consumer privacy. 

Third-Party Web and Application (TPWA) Privacy Impact Assessment (PIA) published by CMS as an Operating Division of the U.S. Department of Health and Human Services