State access to SSA incarceration data for unemployment claims

CLASSIFICATION
   EMPLOYMENT AND TRAINING ADMINISTRATION                Unemployment Insurance
                  ADVISORY SYSTEM                        CORRESPONDENCE SYMBOL
             U.S. DEPARTMENT OF LABOR                    OUI/DPM
                Washington, D.C. 20210                   DATE
                                                         October 29, 2021


ADVISORY:       UNEMPLOYMENT INSURANCE PROGRAM LETTER NO. 1-22

TO:             STATE WORKFORCE AGENCIES

FROM:           ANGELA HANKS
                Acting Assistant Secretary

SUBJECT:        Announcing the Availability of an Incarceration Data Exchange and Instructions
                to Access the Data Exchange between the Unemployment Insurance (UI)
                Interstate Connection Network (ICON) and the Social Security Administration
                (SSA) Prisoner Update Processing System (PUPS)

1. Purpose. To announce the availability of an incarceration data exchange with SSA’s PUPS
   systems through the ICON network and to provide instructions to states on the steps required
   to access the data exchange. The incarceration data exchange will provide State Workforce
   Agencies (SWAs) with the ability to cross-match UI claims information with SSA’s prisoner
   data to aid states in determining if an individual meets UI eligibility requirements.

2. Action Requested. The U.S. Department of Labor’s (Department) Employment and
   Training Administration (ETA) requests that SWA Administrators review the information
   provided in this Unemployment Insurance Program Letter (UIPL), and, if appropriate,
   promptly prepare and submit the necessary information to SSA.

3. Summary and Background.

   a. Summary – ETA actively worked with SSA and the National Association of State
      Workforce Agencies (NASWA) to establish a secure data exchange between ICON and
      SSA’s PUPS systems to provide all SWAs with the ability to cross-match UI claims data
      with prisoner records for use in determining UI eligibility. This UIPL provides SWAs
      detailed information on the steps that must be completed in order to access the
      incarceration data exchange available through ICON, including detailed instructions on
      completing the Form SSA-157 Data Exchange Request Form (DXRF) (see Attachment
      I).

   b. Background – To be eligible for unemployment benefits an individual must be able,
      available, and actively seeking work. Incarcerated individuals do not typically meet the
      eligibility requirements to receive UI benefit payments as they would not be able or
      available for work while incarcerated. The Department’s Office of Inspector General

   RESCISSIONS                                            EXPIRATION DATE
   None                                                   Continuing

        (DOL-OIG) issued an alert memorandum1 on February 22, 2021, identifying that the
        social security numbers of 13,446 potentially ineligible federal prisoners were used in
        attempts to file UI claims equaling more than $98 million in UI benefits. While some
        SWAs have access to various local, state, and/or federal incarceration cross-matches, it is
        critical that all SWAs regularly cross-match UI claims against prisoner records to ensure
        unemployment benefits are only paid to eligible individuals.

        To provide this important cross-matching functionality, the Department and SSA worked
        together to enter into the required legal agreements and engaged the National Association
        of State Workforce Agencies (NASWA) to develop and test an incarceration data
        exchange between the ICON and PUPS systems. ICON is a secure, national system
        operated by NASWA and funded by the Department through a cooperative agreement to
        support the exchange of data among SWAs and has been in use since the early 1980s.
        The ICON network consists of various applications that allow SWAs to share UI data
        seamlessly and securely through agreements with each other. SSA’s PUPS system
        contains records on individuals reported to SSA as being confined to certain institutions,
        including but not limited to jails, prisons, and other correctional facilities.

4. Accessing the Incarceration Data Exchange. Beginning October 1, 2021, SSA’s prisoner
   data from the PUPS system of records is available for cross-matching through the ICON.
   States must complete specific actions to obtain access to the SSA incarceration cross-match
   which will assist with eligibility determinations for applicants or recipients of unemployment
   benefits.

    The SSA’s Regional Data Exchange Coordinators (DECs) assist states by streamlining data
    exchange activities, which include receiving and processing the state’s DXRF, entering into
    and/or updating an Information Exchange Agreement (IEA), and coordinating data exchange
    security assessments with the state. The required steps each state must take to access the
    incarceration data exchange to receive cross-match results through ICON are outlined below.

        1. Complete the SSA-157 DXRF following the instructions in Attachment I of this
           UIPL. The completed DXRF must be e-mailed to the appropriate SSA Regional
           DECs for processing. The state-specific contact information for the SSA’s Regional
           DECs can be found at https://www.ssa.gov/dataexchange/stateagreements.html.

            States must include the following statement in the e-mail transmitting the DXRF to
            the SSA’s Regional DEC:

                “Attached please find the completed DXRF from [state agency][state]. The
                completed DXRF represents our request for use of prisoner data maintained by
                SSA for the sole and exclusive purpose of supporting eligibility and entitlement
                determinations for unemployment benefit programs. If our request is approved,
                we acknowledge that the prisoner data disclosed by SSA may only be used in the

1
 DOL-OIG Report number: 19-21-002-03-315 at https://www.oig.dol.gov/public/reports/oa/2021/19-21-002-03-
315.pdf

               manner described in the DXRF. Additionally, we understand that if we would
               like to re-disclose SSA data or use SSA data for a purpose not identified in the
               attached DXRF, that we must submit a new request for consideration and
               approval.”

           If the above statement is not included in the e-mail containing the state’s completed
           DXRF, the DXRF will not be approved.

       2. Upon approval of the state’s DXRF, the SSA’s Regional DECs will work with the
          state to either modify the existing IEA between the state and the SSA to include the
          PUPS data exchange, or, if the state does not currently have an IEA with SSA, the
          regional DECs will work with the state to develop an IEA.

       3. After the IEA that includes the PUPS data exchange is completed, the SSA’s
          Regional DECs will work with SSA’s Office of Data Exchange, Policy, Publications,
          and International Negotiations (ODEPPIN) to coordinate the security assessment and
          data exchange. The extent of the security assessment may differ by state based on the
          timing of the state’s most recently completed SSA security assessment.

           The SSA’s Office of Information Security (OIS) conducts SSA’s security assessments
           to ensure that external systems receiving information from SSA are secure and
           operate in a manner consistent with SSA’s Information Technology (IT) security
           policies and in compliance with the terms of electronic data exchange agreements
           executed by SSA with external partners. Within the context of SSA’s security
           policies and the terms of the electronic data exchange agreements with SWAs, SSA
           exclusively conducts and completes these security assessments. This includes (but is
           not limited to) administering security assessments for any SWA that processes,
           maintains, transmits, stores, or destroys SSA data in accordance with pertinent
           Federal requirements.

       4. PUPS data will be made accessible to the states through ICON UImail. To set up
          UImail access to PUPS data, the SWA will designate the staff member(s) who will
          serve as PUPS point(s) of contact, i.e., receive the state’s incarceration cross-match
          results through ICON UImail. The SWA will work with the NASWA ICON Team to
          (1) request UImail access for the designated PUPS point(s) of contact and provide all
          necessary contact information, and (2) arrange UImail training for the point(s) of
          contact, as appropriate. Contact the NASWA ICON Team at [email protected] to
          initiate the process.


5. Ongoing Independent Verification Requirement.
   Prisoner data sets may not be updated in real time and therefore may lag in the reported
   incarceration entrance and/or release dates. ETA reminds states to factor in potential lag
   times when reviewing any incarceration data cross-match results to consider individuals who
   may have recently been released and could be potentially eligible for unemployment benefits.
   Information from PUPS provides an indication or tip that there is a possible eligibility issue.

   After receiving incarceration cross-match information states must conduct appropriate
   investigations to determine eligibility.

   For certain overpayments detected from matching with a Federal database, such as the PUPS
   system, the Computer Matching and Privacy Protection Act (CMPPA) also applies. This law
   provides in part, in 5 U.S.C. 552a(p), that an agency participating in a matching program,
   including a non-Federal agency such as a state or local government agency, may not
   “suspend, terminate, reduce, or make a final denial of any financial assistance or payment
   under a Federal benefit program” unless three conditions are met. First, the agency must
   have “independently verified the information” obtained from the computer match. Second,
   the agency must notify the individual of the issue and provide them with an opportunity to
   contest the findings. Third, the individual must be provided either 30 days or, if a different
   period of time is provided by statute or regulation, such other period of time, to respond to
   the notice of findings. See UIPL No. 01-16.

6. Inquiries. Please direct inquiries to [email protected] and copy the appropriate ETA
   Regional Office.

7. References.
       Section 303 of the Social Security Act (42 U.S.C. 503);
       Computer Matching and Privacy Protection Act of 1988, as amended (CMPPA), 5
         USC 552a(o)-(r);
       UIPL No. 23-20, Program Integrity for the Unemployment Insurance (UI) Program
         and the UI Programs Authorized by the Coronavirus Aid, Relief, and Economic
         Security (CARES) Act of 2020 - Federal Pandemic Unemployment Compensation
         (FPUC), Pandemic Unemployment Assistance (PUA), and Pandemic Emergency
         Unemployment Compensation (PEUC) Programs, issued May 11, 2020,
         https://wdr.doleta.gov/directives/corr_doc.cfm?DOCN=4621;
       UIPL No. 01-16, Change 1, Federal Requirements to Protect Claimant Rights in
         State Unemployment Compensation Overpayment Prevention and Recovery
         Procedures - Questions and Answers, issued January 13, 2017,
         https://wdr.doleta.gov/directives/corr_doc.cfm?DOCN=7706;
       UIPL No. 01-16, Federal Requirements to Protect Individual Rights in State
         Unemployment Compensation Overpayment Prevention and Recovery Procedures,
         issued October 1, 2015, https://wdr.doleta.gov/directives/corr_doc.cfm?DOCN=5763;
       UIPL No. 04-01, Payment of Compensation and Timeliness of Determinations during
         a Continued Claims Series, issued October 27, 2000,
         https://wdr.doleta.gov/directives/corr_doc.cfm?DOCN=1746; and
       Employment Security Manual, Section 7511, The Secretary’s Interpretation of
         Federal Law Requirements, available at 20 C.F.R. Part 614, Appendix C, Standard
         for Fraud and Overpayment Detection.

8. Attachment(s).
       Attachment I: Instructions for Completing the Social Security Administration (SSA)
         Form SSA-157 Data Exchange Request Form (DXRF)

                                                               Attachment I to UIPL No. 1-22

           Instructions for Completing the Social Security Administration (SSA)
                   Form SSA-157 Data Exchange Request Form (DXRF)

Use the current version of the DXRF form for submission. Form SSA-157, Office of
Management and Budget (OMB) Control No. 0960-0802:
https://www.ssa.gov/dataexchange/documents/ssa-157.pdf

Data Request Section

1. Name of organization requesting the data exchange. Input your State Workforce Agency
   name.

2. Indicate what type of organization you are. Check the box next to “State & Local” under
   the heading “Government.”

3. Briefly state the purpose for requesting this information and tell us how your
   organization will use the data. Input “Prisoner data will be used to determine eligibility for
   Unemployment Insurance (UI) benefits by cross-matching UI claims through the National
   Association for State Workforce Agencies’ (NASWA) Interstate Connection Network
   (ICON)” into the text box.

4. What specific information are you requesting from SSA? (Social Security number
   verification, benefit verification, disability payments, data elements, etc.). Input
   “Prisoner Update Processing System (PUPS) data” into the text box.

5. What data elements will you send to support your request (e.g., SSN, name, date of
   birth), if applicable? Input “SSN, Name, Date of Birth” into the text box.

6. Is your organization currently receiving this information by another means (e.g., paper
   reports, etc.)?
    If your state does not currently receive PUPS data, check the box for “No”.
    If your state currently receives PUPS data from SSA, but you prefer to receive it through
       ICON, check the box for “Yes” and explain in the text box below.

7. Describe the benefit to your organization of receiving this data. Input “Incarcerated
   individuals are ineligible to receive UI benefits. Having incarceration data at the time of
   application will assist [Insert Name of State] in preventing payment of benefits to ineligible
   individuals.”

8. Is there any benefit to SSA? Check the box for “No”.

9. What is the impact to your organization if it does not receive this data? Input “[Insert
   Name of State] will be unable to ensure benefits are paid only to eligible individuals resulting
   in losses to the state UI trust fund and higher UI employer payroll taxes at both the state and

   federal levels” into the text box.

10. SSA generally requires that you pay for our services. Are you willing to incur costs?
    Check the box for “No”. Input in item #36, “Response to Question #10 – N/A, costs are
    reimbursed by the United States Department of Labor for this data exchange.”

11. Provide your legal authority allowing the collection of this data from SSA. Input
    “Section 1137(a)(2) and (b)(3) of the Social Security Act (SSA) (42 USC 1320b-7) and
    Section 303(a)(1) SSA, 42 U.S.C. 503(a)(1)” into the text box.

12. List the organization and job functions/titles within the organization(s) that will have
    access to SSA-provided information. Input the name of your State Workforce Agency and
    the job functions/titles of the individual(s) that will access the PUPS data through ICON.

13. Do you plan to share the data with anyone other than those listed in question 12? Check
    the box for “No”.

14. How frequently do you want to receive the data? Check the box for “Daily”.

15. Based on the frequency selected above, provide an estimate of the number of records
    you will submit for processing. Input your state’s estimated number of initial claims per
    year.

16. How will we exchange the data? Check the boxes for “Batch” and for “Other”, and next to
    “Other” input “The PUPS data will be received through the data exchange established with
    ICON.” into the text box.

17. When do you expect this data exchange to begin? Input “As soon as possible” into the
    text box.


Security Section

18. If you are a federal agency, does your organization have documented information
    security policies and procedures to safeguard SSA-provided information from
    unauthorized access and improper disclosure? Check the box for “Not Applicable – Non-
    Federal Agency”.

19. If you are not a federal agency, does your organization have documented information
    security policies and procedures to reduce information security risks to an acceptable
    level in accordance with the Federal Information Security Management Act (FISMA):
    Ensure your state meets this requirement and, if so, check the box for “Yes”.

20. Will the information SSA provides be stored or processed in an external commercial
    cloud?
     If your state will not store or process PUPS data received through ICON in an external

       commercial cloud, check the box for “No” and skip to question #22.
      If your state will store or process PUPS data received through ICON in an external
       commercial cloud, check the box for “Yes” and answer the following:
           o What is the name of the Cloud Service Provider (CSP)? Input the name of
               your State’s CSP.
           o Is the CSP FedRAMP authorized? Check the appropriate box to identify
               whether or not the State’s CSP is FedRAMP authorized.

21. Is the cloud provider contractually required to enforce security policies and procedures
    that will safeguard the information SSA provides from unauthorized access and
    improper disclosure? Check the appropriate box (“Yes” or “No”) based on your state’s
    contract requirements with your CSP.

22. Will the information SSA provides be stored off-shore: i.e., in a foreign country? Check
    the appropriate box (“Yes” or “No”) based on your state’s storage location.

23. List any current or previous data exchanges your organization has with SSA (i.e., by
    SSA agreement number or description). List any other data exchanges between SSA and
    your state in the text box.

State Agency Section

24. If your agency already has an existing agreement with SSA to receive SSA data, are
    there any other programs or purposes for requesting SSA data that you wish to add to
    the current agreement? Check the appropriate box (“Yes” or “No”) based on your state-
    specific response.

25. Name the programs your agency administers for which you are requesting SSA data.
    Input “Unemployment Insurance” into the text box.

26. Indicate whether the programs are federally-funded (either fully or partially) or state-
    funded. Input “Both. The regular state UI program is state-funded, while other UI programs
    are federally-funded or mixed depending on the specific UI program” in the text box.

27. List the benefits or service provided under these programs. Input “Unemployment
    benefits” into the text box.

28. Does your staff take applications or determine eligibility for TANF, Medicaid, or SNAP
    for any of the programs listed in question 25.
     If no, check the box for “No”.
     If yes, check the box for “Yes”, input the name of the program in the text box, and for
        question #36 input the following in the text box: “[Insert State Workforce Agency Name]
        is responsible for administering the [Insert Program(s) Name(s)], including taking
        applications and determining eligibility. However, the staff working in these programs
        will not have access to PUPS data. Only the staff identified in question #12, which are
        UI program staff, will have access to PUPS data.”

29. How is the requested SSA data relevant to determining entitlement/eligibility to benefits
    or services under the programs your agency administers? Input the following in the text
    box: “To be determined eligible for UI benefits, an individual must be able and available for
    work under Federal and state law. Incarcerated individuals typically do not meet this
    eligibility requirement. The PUPS incarceration data will allow the state to determine the
    eligibility of applicants who are incarcerated.”

Skip Questions 30-35

36. Additional Comments: If state-specific responses require further clarification, such as the
    response to Question #28, input the additional information in this section.

Points of Contact

37. Approving authority contact information for the person signing the agreement for the
    agency requesting the data. Input the contact information (Name, Title, Address, Phone
    Number, and Email Address) for the approving state official in the text box.

38. Requester contact information for the agency. Input the contact information (Name, Title,
    Address, Phone Number, and Email Address) for the state official filling out the DXRF or
    the individual SSA should contact with any questions regarding the request for this data
    exchange in the text box.