A CMA is a written agreement between a recipient agency and a source agency that is required by the CMPPA for parties engaging in computer matching to make eligibility or entitlement determinations for a federal benefit program. A CMA is also required if the purpose of the matching program is to recoup payments or delinquent debts in a federal benefit program. A CMA must include the terms and conditions governing that data exchange, which includes: the legal authority that permits that data exchange, the parties involved, and other requirements set forth in the CMPPA. CMAs are effective for 18 months, but can be renewed for an additional 12 months.

When implementing a CMA, SSA must:

• •

  Obtain comments and clearance from OGC,

• •

  Obtain comments and clearance from the Data Integrity Board (DIB),

• •

  Obtain the appropriate signatures from both agencies, including from the DIB Chair,

• •

  Report the matching program to OMB and Congress when SSA is the recipient agency, and

• •

  Publish the CMA in the Federal Register when SSA is the recipient agency.

  NOTE: A cost benefit analysis (CBA) is required for all CMAs, unless an exception applies.

An IEA is a written agreement that outlines the terms, conditions, and safeguards under which SSA exchanges information. We may cover a data exchange by an IEA if the data exchange does not meet the technical definition of a “matching program” in accordance with the CMPPA. IEAs do not require DIB clearance, OMB or Congressional notification, Federal Register publication, or a CBA. SSA uses IEAs to cover certain data exchanges with both Federal and State agencies.

When implementing an IEA, the agency must:

• •

  Obtain comments and clearance from stakeholders,

• •

  Obtain comments and clearance from OGC,

• •

  Obtain approval for the IEA from the Office of Finance OF), as applicable, and

• •

  Acquire the appropriate signatures from both agencies.

There are several types of IEAs used to document and facilitate agency data exchanges:

103A of Strengthening Protections for Social Security Beneficiaries Act of 2018 IEA

This agreement forth the terms, conditions, and safeguards under which the State’s foster care agency will disclose information regarding children in foster care to SSA. SSA will use the data to: (1) determine the appropriate representative payee (payee) for represented minor beneficiaries who have entered or exited foster care or changed foster care placement location; (2) determine whether a payee is appropriate for unrepresented minor beneficiaries who have entered foster care; and (3) identify when the State is responsible for an overpayment issued to a minor beneficiary. Each party is responsible for its own costs or expenditures incurred in performing its responsibilities under this agreement.

Achieving a Better Life Experience (ABLE) IEA

This agreement sets forth the terms, conditions, and safeguards under which the State or State Agency will disclose ABLE account statements on distributions and account balances of all ABLE accounts to SSA. SSA uses the data to verify the accuracy of information applicants and recipients furnish concerning eligibility for the Supplemental Security Income (SSI) program. Each party is responsible for its own costs or expenditures incurred in implementing this agreement.

Help America Vote Act (HAVA) IEA

Help America Vote Act (HAVA) IEA HAVA of 2002, P.L. 107-252 requires States to verify the information of newly registered voters for Federal elections. Each state must establish a computerized state-wide voter registration list and verify new voter information with the State’s Motor Vehicle Administration (MVA) or verify the last four digits of the Social Security number (SSN).

The purpose of this agreement is to establish the terms, conditions, and safeguards under which SSA provides verification of the name, date of birth, and last four digits of the submitting SSN for new voter registration applicants, who do not have a driver’s license, to State and Territory MVAs. SSA also sends an indication of whether our records show that the applicant is deceased.

Interstate Benefit Inquiry (IBIQ) IEA

This agreement establishes the terms, conditions, and safeguards under which SSA accesses, via a single electronic query, wage and unemployment information of the State agency through the Interstate Connection Network (ICON). SSA uses the information to establish and verify eligibility and payment amounts under certain benefit programs administered by SSA. There is no cost to SSA for access to this information.

IEA-F – Federally-funded programs

This is an agreement between SSA and the State or State agency that accompanies the state level or agency level CMPPA agreement, i.e., the CMPPA agreement is an attachment to the IEA-F. The IEA-F describes in additional detail the type of data SSA discloses for the program(s) specified in the agreement, as well as the authorized data exchange system(s), data delivery method, and additional security requirements. The IEA- F covers Federally-funded, State-administered programs.

IEA-S – State-funded, State-administered programs

This is a stand-alone agreement between SSA and the State or State agency that contains the same detailed information in the IEA/F, with the exception that this agreement covers State-funded, State-administered programs. SSA may not charge the State or State agency for the data SSA provides under its established IEA/S as determined by the Commissioner of SSA. Any new, approved requests for SSA data for a State or State agency’s administration of a State-funded benefit programs are provided at cost to the State agency and typically documented via the Reimbursable IEA (R-IEA).

Motor Vehicle Administration (MVA) IEA

This agreement establishes the terms, conditions, and safeguards under which SSA will provide Social Security number (SSN) verifications via an overnight batch to the MVA. The MVA uses the SSN verifications for the purposes of administering its drivers’ licenses and identification card programs.

Reimbursable Information Exchange Agreement (R-IEA)

This is an agreement between SSA and the State agency for the State agency’s administration of State-funded programs (as identified in the agreement). There is a charge to the State agency for the SSA data provided under this agreement; SSA must seek reimbursement for the costs of performing data exchanges for the State agency’s administration of State-funded programs.

SSA Access to State Records Online (SASRO) IEA

This agreement establishes the terms, conditions, and safeguards under which SSA accesses, via a single electronic query, certain information from the State Agency. SSA uses the information to update SSA files of individuals, to assign SSNs, and to establish and verify eligibility and payment amounts under certain benefit programs administered by SSA, as required under Titles II and XVI of the Act. There is no cost to SSA for access to this information.

Social Security Online Verification (SSOLV) IEA

The purpose of this agreement is to establish the terms, conditions, and safeguards under which the American Association of Motor Vehicle Administrators (AAMVA) will provide connectivity, billing services, and staff a help desk for State Motor Vehicle Administrations and other state agencies charged with administering identification card programs (collectively, MVAs) for SSA. SSA will provide SSN verifications through AAMVA’s network to assist MVAs in administering their driver’s license and identification card programs.

State Transmission or Transfer Component (STC) IEA

SSA uses STC agreements to outline the terms, conditions, and safeguards of the data exchange. The STC must define the State agency who receives SSA data through the STC. An STC serves as a conduit between SSA and the specified State agency or agencies that receive SSA data under the conditions of separate agreements with SSA.

The role of the STC under this agreement is limited to that of a conduit, responsible for transmitting or transferring only the authorized data files between SSA and the applicable State agency for the administration of their approved program(s). The STC is not responsible for the Federal agency’s use, access, or disclosure of the authorized data once the STC transmits or transfers the authorized data. An STC requires the Office of Information Security (OIS) to perform an on-site Security Compliance Review every three years.

An MOU and an MOA is a formal written administrative agreement that details the responsibilities of each party to the agreement and the terms and conditions under which each party will operate. SSA uses an MOU or an MOA for a data exchange when the direct results of the data sharing does not adversely affect an individual’s cash benefits, for research and statistical purposes, or in cases where the data we are sharing is not a result of a computerized match of two federal systems.

When implementing a data exchange agreement that is an MOU or an MOA, the agency must:

• •

  Send the data exchange agreement for review by all stakeholders of the agreement,

• •

  Send the data exchange request to OGC and OF for review and approval, and

• •

  Acquire the appropriate signatures from both agencies, if approved.

A model agreement is a standard agreement template that SSA creates to use when a data exchange will occur with several states or private entities involving the same type of data for the same purpose and use. We call them model agreements, because these agreements are not unique in nature and usually have identical agreement terms. Since the agreement terms are identical, it is more efficient for the agency to create the same agreement for these data exchange partners and distribute, as the agency deems appropriate and necessary. A model agreement for a state exchange is generally an IEA or CMA, but can be an MOU.

Once SSA Headquarters-level components approve and sign a model agreement, other AC-level components and Regions become the signing authorities for each data exchange established under the model agreements under their purview.