Agency Information Collection Activities: How States Safeguard SNAP Participant Personally Identifiable Information

AGENCY:

Food and Nutrition Service (FNS), United States Department of Agriculture (USDA).

ACTION:

Notice.

SUMMARY:

In accordance with the Paperwork Reduction Act of 1995, this notice invites the general public and other public agencies to comment on this proposed information collection. This is a new information collection. The Supplemental Nutrition Assistance Program (SNAP) is the largest domestic nutrition assistance program in the United States, having served approximately 20.1 million low-income households in 2018, with $60.1 billion in benefits provided during that time. Section 11(e)(8) of the Food, Conservation, and Energy Act of 2008 requires that these millions of households must submit personally identifiable information (PII) in order to receive SNAP benefits. PII includes information that directly identifies individuals, such as individuals' names and Social Security numbers, as well as information like home addresses, which can be used to deduce the identity of an individual. While State agencies (SAs) implement policies to safeguard SNAP PII, little is systematically known about the policies and practices that SAs have in place. Accordingly, FNS wants to assess the ways that States safeguard SNAP PII and identify best practices to protect such information.

DATES:

Written comments on this notice must be received on or before May 20, 2019.

ADDRESSES:

Comments are invited on (a) whether the proposed collection of information is necessary for the proper performance of the functions of the agency, including whether the information has practical utility; (b) the accuracy of the agency's estimate of the burden of the proposed collection of information, including the validity of the methodology and assumptions that were used; (c) ways to enhance the quality, utility, and clarity of the information to be collected; and (d) ways to minimize the burden of the collection of information on those who are to respond, including the use of appropriate automated, electronic, mechanical, or other technological collection techniques or other forms of information technology.

Comments may be sent to: Jenny Laster Genser, Office of Policy Support, U.S. Department of Agriculture, Food and Nutrition Service, 3101 Park Center Drive, Room 1014, Alexandria, VA 22302. Comments may also be submitted via fax to the attention of Jenny Laster Genser at 703-305-2576 or via email to jenny.genser@fns.usda.gov. Comments will also be accepted through the Federal eRulemaking Portal. Go to http://www.regulations.gov and follow the online instructions for submitting comments electronically.

All written comments will be open for public inspection at FNS offices during regular business hours (8:30 a.m. to 5:00 p.m. Eastern Time, Monday through Friday) at 3101 Park Center Drive, Room 1014, Alexandria, VA 22302.

All responses to this notice will be summarized and included in the request for Office of Management and Budget approval. All comments will be a matter of public record.

FOR FURTHER INFORMATION CONTACT:

Requests for additional information should be directed to Jenny Laster Genser at 703-305-2559.

SUPPLEMENTARY INFORMATION:

Title: How States Safeguard SNAP Participant Personally Identifiable Information.

OMB Number: 0584-NEW.

Expiration Date of Approval: Not yet determined.

Type of Information Collection Request: New Collection.

Abstract: Supplemental Nutrition Assistance Program (SNAP) benefits are funded by the Federal Government through the U.S. Department of Agriculture (USDA) Food and Nutrition Service (FNS). FNS and State SNAP agencies (SAs) share responsibility for program administration and associated administrative expenses. As part of their administrative responsibilities, SAs are required to ensure that all personally identifiable information (PII) provided by SNAP applicants and participants is properly safeguarded and secure. SAs develop security plans as part of their Advanced Planning Document (OMB number 0584-0083, expires 7/30/2020), which is required in order for the SA to obtain federal funding for information systems updates.

No known breaches of SNAP data have occurred to date. However, the following circumstances suggest a need for more focus on data security: (1) The growing amount of data stored by SAs (and by the Federal Government as a whole); (2) the degree to which PII is shared or matched with data from multiple State and Federal agencies, with a wide variety of matches required by statute; and (3) the increasingly sophisticated methods for breaching datasets. These trends, in combination with limited resources for many SAs, may have left many States vulnerable to data security breaches. The contexts in which SAs must operate (for example, outdated computer systems) may also contribute to inadequate levels of PII security. Because little is known about the security protocols, policies, and procedures that SAs implement in protecting PII, FNS seeks to examine how States are currently protecting SNAP applicant/participant PII that is submitted in SNAP applications and maintained in SNAP caseload files.

This study has five main objectives: (1) Describe legislation, regulations, and policies that address how participants' PII must be safeguarded; (2) describe methods that can be used to safeguard PII; (3) describe how States currently safeguard participants' PII; (4) examine the consistency of safeguarding practices across States; and (5) provide recommendations to States to improve safeguarding of PII.

The study will draw on the following primary data sources:

A web-based survey of all 53 SA SNAP Directors and other relevant SA staff, which will obtain information on safeguarding methods and current processes required to address research questions under Objectives 2, 3, and 4. The survey respondents will also include up to two State information technology (IT) and/or data/program analysts in each of the 53 SAs to provide technical information that the SA Director may not know. The survey is expected to take a cumulative total of 1 hour to complete across the three respondents.

Semi-structured, 1-hour telephone interviews with five industry experts who will provide broader views of PII protection in private-sector companies and in other public agencies (business or not-for-profit), which will clarify both private-industry and public-sector benchmarks for information security, thereby informing Objectives 1, 2, and 5.

In-depth, semi-structured telephone interviews (expected to be 1 hour long) with five SA SNAP Directors in five States that have been identified as strong examples of best practices for protecting PII. The interviews will also include the same two State IT and data/program analysts who responded to the web survey, again to provide technical information that the SA SNAP Director may not know. Selection of these States will be based on the discussions with industry experts and on analysis of the web survey. These interviews will provide information relevant to Objective 5.

Secondary information sources will include laws, regulations, policies, and FNS guidance materials, which will be used to address Objective 1 research questions.

FNS will use the information collected to provide information to SAs on ways they can improve how they safeguard SNAP PII. SAs may have developed innovative and cost-effective methods that can be shared with other States. In addition, information from this study will provide insight into the various constraints SAs face in their efforts to maintain PII protection. By further understanding these constraints, future policies and regulations can support SAs in maintaining adequate protection.

Affected Public: State governments (SA SNAP Directors, SA IT staff, and SA data/program analysts) and Business or Not-for-Profit Private/Commercial Industry (industry experts).

Estimated Number of Respondents: (169 in total, with 164 respondents, and 5 nonrespondents). Estimates of respondent burden account for the fact that multiple staff may need to be consulted for SAs to address all of the topics explored in the web survey and also (for those selected) in the exemplary SA interviews. The total estimated number of respondents for the web-based survey is 53 SA SNAP Directors, 53 SA IT staff, and 53 SNAP program/data analysts, and 5 business-sector respondents for the industry expert interviews. The semi-structured interviews with five exemplary SAs are assumed to be with the same staff who completed the web survey for these States, so they are not considered additional respondents.

The estimated number of respondents for the web survey and interviews are as follows:

(1) SA Web Survey: The sample for this collection includes all 53 SA SNAP Directors (50 U.S. States, 2 U.S. Territories, and the District of Columbia); 53 SA IT staff; and 53 SA data/program analysts, all of whom are expected to respond. To make response as easy as possible, the study team will send biweekly email reminders throughout the data collection period (14 weeks) to SAs that have not yet responded. If an SA has not responded within 6 weeks, the study team will then reach out via telephone reminder calls in the weeks between emails. The initial mailing will encourage the SA Director to assign parts of the instrument that require detailed IT or security expertise to other staff members, as appropriate, simply by forwarding the original email containing the link to the survey. On the study team's behalf, the SA SNAP Director will send the survey to up to two senior IT staff or data/program analysts. The survey's estimated duration of 1 hour will be split evenly across the three respondents (20 minutes or .33 hour each). The study team will offer resources in the form of telephone and email help desks to provide quick answers to any questions (including problems with survey access), along with answers to frequently asked questions (FAQs) that will be accessible from within the survey or separately. As SA Directors submit surveys, an automated process will check the quality and completeness of each survey, allowing the study team to recontact the respondents promptly, if necessary. Total respondents = 159, assuming full cooperation by SAs.

(2) Business: Industry Expert Interviews: The sample for this collection will initially include up to 10 industry experts, selected using snowball sampling based on the experts' knowledge of IT, SNAP data collection and management, and privacy protection standards and practices. The study team will prioritize the list of experts, and study team recruiters will proceed down the list in order until five experts have agreed to participate. The study team will conduct these interviews by telephone, so follow-up calls generally will not be needed. The team expects to contact no more than 10 individuals (5 respondents and up to 5 nonrespondents).

(3) Exemplary SA Interviews: The sample for this collection includes up to seven SA SNAP Directors. When five SA SNAP Directors agree to participate, they will be supported during the interview by up to two SNAP senior IT staff or data/program analysts. These staff are assumed to be the same individuals who previously completed the web survey. The five exemplary SAs will be selected using information gathered through the web survey and industry expert interviews. The assumption is that obtaining cooperation among SAs called “exemplary” will only require contacts with seven SAs to obtain five exemplary SA interviews. The study team will conduct these interviews by telephone conference call, with all respondents from a given SA participating jointly or in another, similar format. The number of respondents will be unchanged, since all are assumed to have participated in the web survey. The number of nonrespondents is expected to be no more than two, but they also are assumed to have participated in the web survey.

Estimated Total Number of Respondents: 169 across the 3 data collection efforts. The total number of respondents contacted will be 159 for the web survey (53 SAs with up to 3 respondents each) and, at most, 5 respondents (and 5 nonrespondents) for the industry expert interviews. The number of respondents contacted for the exemplary SA interviews is 7 SA SNAP Directors (out of which 2 are nonrespondents), and 10 staff for the 5 directors who agree to the interview. For all individuals contacted, it is assumed that the respondents will be the same individuals who are responding to the web survey, so they are not included in the total.

Estimated Number of Responses per Respondent: 4.71. SA SNAP Director respondents will be asked to complete the web survey one time. Each SA SNAP Director may receive up to 8 follow-up/reminder emails and up to 6 reminder phone calls until the target of 53 respondents is reached. After completing the survey, there may be up to three brief additional contacts—two for questions and one for a thank-you email.

The five SA SNAP Directors selected to participate in the exemplary SA interviews will be interviewed one time. The five selected SA SNAP Directors may receive up to three invitation and follow-up emails and up to two reminder phone calls to confirm the time of the planned interview until the target of five respondents is reached.

The five industry experts who agree to participate in the industry expert interviews will be interviewed one time. Ten selected experts may receive up to three invitation/recruiting emails and up to two reminder phone calls to confirm the time of the planned interview, until the target of five respondents is reached. All who participate will receive thank-you emails.

For the exemplary SA interviews, there is a total of six pre- and post-interview responses in addition to the interview. (We assume that only one of the staff attending the exemplary SA interview will receive the contacts before and after the interview.)

Estimated Total Annual Responses: 796. All 53 SA SNAP Directors will complete the web survey with up to 106 others assisting them, with up to 13 reminders before the survey is completed and up to 3 contacts afterwards. Up to 7 SA SNAP Directors will be recruited to reach five SA SNAP Directors for the exemplary SA interviews, but the study team does not count these five as respondents because they are expected to have completed the web survey earlier. Additionally, 10 industry experts will be recruited for the industry expert interviews until the target of 5 respondents is reached. Both types of semi-structured interviews may involve as many as five contacts to arrange the interview and one post-interview contact (thank-you email). We also include burden on nonrespondents from receiving and reading the various recruiting contacts (emails or phone calls).

Estimated Time per Response: 0.14 hours. The estimated time per web survey response is 1 hour. The estimated time per interview is 1 hour. The estimated time will vary depending on the type of contact and will range from 2 minutes (0.03 hours) to 3 hours (when three staff participate in a 1-hour interview). The following table outlines the estimated total annual burden for each type of respondent and for nonrespondents.

Estimated Total Annual Burden on Respondents: The annual reporting burden is estimated to be 108.76 hours.