[Federal Register Volume 84, Number 53 (Tuesday, March 19, 2019)]
[Notices]
[Pages 10025-10030]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2019-05080]
-----------------------------------------------------------------------
DEPARTMENT OF AGRICULTURE
Food and Nutrition Service
Agency Information Collection Activities: How States Safeguard
SNAP Participant Personally Identifiable Information
AGENCY: Food and Nutrition Service (FNS), United States Department of
Agriculture (USDA).
ACTION: Notice.
-----------------------------------------------------------------------
SUMMARY: In accordance with the Paperwork Reduction Act of 1995, this
notice invites the general public and other public agencies to comment
on this proposed information collection. This is a new information
collection. The Supplemental Nutrition Assistance Program (SNAP) is the
largest domestic nutrition assistance program in the United States,
having served approximately 20.1 million low-income households in 2018,
with $60.1 billion in benefits provided during that time. Section
11(e)(8) of the Food, Conservation, and Energy Act of 2008 requires
that these millions of households must submit personally identifiable
information (PII) in order to receive SNAP benefits. PII includes
information that directly identifies individuals, such as individuals'
names and Social Security numbers, as well as information like home
addresses, which can be used to deduce the identity of an individual.
While State agencies (SAs) implement policies to safeguard SNAP PII,
little is systematically known about the policies and practices that
SAs have in place. Accordingly, FNS wants to assess the ways that
States safeguard SNAP PII and identify best practices to protect such
information.
DATES: Written comments on this notice must be received on or before
May 20, 2019.
ADDRESSES: Comments are invited on (a) whether the proposed collection
of information is necessary for the proper performance of the functions
of the agency, including whether the information has practical utility;
(b) the accuracy of the agency's estimate of the burden of the proposed
collection of information, including the validity of the methodology
and assumptions that were used; (c) ways to enhance the quality,
utility, and clarity of the information to be collected; and (d) ways
to minimize the burden of the collection of information on those who
are to respond, including the use of appropriate automated, electronic,
mechanical, or other technological collection techniques or other forms
of information technology.
Comments may be sent to: Jenny Laster Genser, Office of Policy
Support, U.S. Department of Agriculture, Food and Nutrition Service,
3101 Park Center Drive, Room 1014, Alexandria, VA 22302. Comments may
also be submitted via fax to the attention of Jenny Laster Genser at
703-305-2576 or via email to [email protected]. Comments will
also be accepted through the Federal eRulemaking Portal. Go to http://www.regulations.gov and follow the online instructions for submitting
comments electronically.
All written comments will be open for public inspection at FNS
offices during regular business hours (8:30 a.m. to 5:00 p.m. Eastern
Time, Monday through Friday) at 3101 Park Center Drive, Room 1014,
Alexandria, VA 22302.
All responses to this notice will be summarized and included in the
request for Office of Management and Budget approval. All comments will
be a matter of public record.
FOR FURTHER INFORMATION CONTACT: Requests for additional information
should be directed to Jenny Laster Genser at 703-305-2559.
SUPPLEMENTARY INFORMATION:
Title: How States Safeguard SNAP Participant Personally
Identifiable Information.
OMB Number: 0584-NEW.
Expiration Date of Approval: Not yet determined.
Type of Information Collection Request: New Collection.
Abstract: Supplemental Nutrition Assistance Program (SNAP) benefits
are funded by the Federal Government through the U.S. Department of
Agriculture (USDA) Food and Nutrition Service (FNS). FNS and State SNAP
agencies (SAs) share responsibility for program administration and
associated administrative expenses. As part of their administrative
responsibilities, SAs are required to ensure that all personally
identifiable information (PII) provided by SNAP applicants and
participants is properly safeguarded and secure. SAs develop security
plans as part of their Advanced Planning Document (OMB number 0584-
0083, expires 7/30/2020), which is required in order for the SA to
obtain federal funding for information systems updates.
No known breaches of SNAP data have occurred to date. However, the
following circumstances suggest a need for more focus on data security:
(1) The growing amount of data stored by SAs (and by the Federal
Government as a whole); (2) the degree to which PII is shared or
matched with data from multiple State and Federal agencies, with a wide
variety of matches required by statute; and (3) the increasingly
sophisticated methods for breaching datasets. These trends, in
combination with limited resources for many SAs, may have left many
States vulnerable to data security breaches. The contexts in which SAs
must operate (for example, outdated computer systems) may also
contribute to inadequate levels of PII security. Because little is
known about the security protocols, policies, and procedures that SAs
implement in protecting PII, FNS seeks to examine how States are
currently protecting SNAP applicant/participant PII that is submitted
in SNAP applications and maintained in SNAP caseload files.
This study has five main objectives: (1) Describe legislation,
regulations, and policies that address how participants' PII must be
safeguarded; (2) describe methods that can be used to safeguard
[[Page 10026]]
PII; (3) describe how States currently safeguard participants' PII; (4)
examine the consistency of safeguarding practices across States; and
(5) provide recommendations to States to improve safeguarding of PII.
The study will draw on the following primary data sources:
[ssquf] A web-based survey of all 53 SA SNAP Directors and other
relevant SA staff, which will obtain information on safeguarding
methods and current processes required to address research questions
under Objectives 2, 3, and 4. The survey respondents will also include
up to two State information technology (IT) and/or data/program
analysts in each of the 53 SAs to provide technical information that
the SA Director may not know. The survey is expected to take a
cumulative total of 1 hour to complete across the three respondents.
[ssquf] Semi-structured, 1-hour telephone interviews with five
industry experts who will provide broader views of PII protection in
private-sector companies and in other public agencies (business or not-
for-profit), which will clarify both private-industry and public-sector
benchmarks for information security, thereby informing Objectives 1, 2,
and 5.
[ssquf] In-depth, semi-structured telephone interviews (expected to
be 1 hour long) with five SA SNAP Directors in five States that have
been identified as strong examples of best practices for protecting
PII. The interviews will also include the same two State IT and data/
program analysts who responded to the web survey, again to provide
technical information that the SA SNAP Director may not know. Selection
of these States will be based on the discussions with industry experts
and on analysis of the web survey. These interviews will provide
information relevant to Objective 5.
Secondary information sources will include laws, regulations,
policies, and FNS guidance materials, which will be used to address
Objective 1 research questions.
FNS will use the information collected to provide information to
SAs on ways they can improve how they safeguard SNAP PII. SAs may have
developed innovative and cost-effective methods that can be shared with
other States. In addition, information from this study will provide
insight into the various constraints SAs face in their efforts to
maintain PII protection. By further understanding these constraints,
future policies and regulations can support SAs in maintaining adequate
protection.
Affected Public: State governments (SA SNAP Directors, SA IT staff,
and SA data/program analysts) and Business or Not-for-Profit Private/
Commercial Industry (industry experts).
Estimated Number of Respondents: (169 in total, with 164
respondents, and 5 nonrespondents). Estimates of respondent burden
account for the fact that multiple staff may need to be consulted for
SAs to address all of the topics explored in the web survey and also
(for those selected) in the exemplary SA interviews. The total
estimated number of respondents for the web-based survey is 53 SA SNAP
Directors, 53 SA IT staff, and 53 SNAP program/data analysts, and 5
business-sector respondents for the industry expert interviews. The
semi-structured interviews with five exemplary SAs are assumed to be
with the same staff who completed the web survey for these States, so
they are not considered additional respondents.
The estimated number of respondents for the web survey and
interviews are as follows:
(1) SA Web Survey: The sample for this collection includes all 53
SA SNAP Directors (50 U.S. States, 2 U.S. Territories, and the District
of Columbia); 53 SA IT staff; and 53 SA data/program analysts, all of
whom are expected to respond. To make response as easy as possible, the
study team will send biweekly email reminders throughout the data
collection period (14 weeks) to SAs that have not yet responded. If an
SA has not responded within 6 weeks, the study team will then reach out
via telephone reminder calls in the weeks between emails. The initial
mailing will encourage the SA Director to assign parts of the
instrument that require detailed IT or security expertise to other
staff members, as appropriate, simply by forwarding the original email
containing the link to the survey. On the study team's behalf, the SA
SNAP Director will send the survey to up to two senior IT staff or
data/program analysts. The survey's estimated duration of 1 hour will
be split evenly across the three respondents (20 minutes or .33 hour
each). The study team will offer resources in the form of telephone and
email help desks to provide quick answers to any questions (including
problems with survey access), along with answers to frequently asked
questions (FAQs) that will be accessible from within the survey or
separately. As SA Directors submit surveys, an automated process will
check the quality and completeness of each survey, allowing the study
team to recontact the respondents promptly, if necessary. Total
respondents = 159, assuming full cooperation by SAs.
(2) Business: Industry Expert Interviews: The sample for this
collection will initially include up to 10 industry experts, selected
using snowball sampling based on the experts' knowledge of IT, SNAP
data collection and management, and privacy protection standards and
practices. The study team will prioritize the list of experts, and
study team recruiters will proceed down the list in order until five
experts have agreed to participate. The study team will conduct these
interviews by telephone, so follow-up calls generally will not be
needed. The team expects to contact no more than 10 individuals (5
respondents and up to 5 nonrespondents).
(3) Exemplary SA Interviews: The sample for this collection
includes up to seven SA SNAP Directors. When five SA SNAP Directors
agree to participate, they will be supported during the interview by up
to two SNAP senior IT staff or data/program analysts. These staff are
assumed to be the same individuals who previously completed the web
survey. The five exemplary SAs will be selected using information
gathered through the web survey and industry expert interviews. The
assumption is that obtaining cooperation among SAs called ``exemplary''
will only require contacts with seven SAs to obtain five exemplary SA
interviews. The study team will conduct these interviews by telephone
conference call, with all respondents from a given SA participating
jointly or in another, similar format. The number of respondents will
be unchanged, since all are assumed to have participated in the web
survey. The number of nonrespondents is expected to be no more than
two, but they also are assumed to have participated in the web survey.
Estimated Total Number of Respondents: 169 across the 3 data
collection efforts. The total number of respondents contacted will be
159 for the web survey (53 SAs with up to 3 respondents each) and, at
most, 5 respondents (and 5 nonrespondents) for the industry expert
interviews. The number of respondents contacted for the exemplary SA
interviews is 7 SA SNAP Directors (out of which 2 are nonrespondents),
and 10 staff for the 5 directors who agree to the interview. For all
individuals contacted, it is assumed that the respondents will be the
same individuals who are responding to the web survey, so they are not
included in the total.
Estimated Number of Responses per Respondent: 4.71. SA SNAP
Director respondents will be asked to complete the web survey one time.
Each SA
[[Page 10027]]
SNAP Director may receive up to 8 follow-up/reminder emails and up to 6
reminder phone calls until the target of 53 respondents is reached.
After completing the survey, there may be up to three brief additional
contacts--two for questions and one for a thank-you email.
The five SA SNAP Directors selected to participate in the exemplary
SA interviews will be interviewed one time. The five selected SA SNAP
Directors may receive up to three invitation and follow-up emails and
up to two reminder phone calls to confirm the time of the planned
interview until the target of five respondents is reached.
The five industry experts who agree to participate in the industry
expert interviews will be interviewed one time. Ten selected experts
may receive up to three invitation/recruiting emails and up to two
reminder phone calls to confirm the time of the planned interview,
until the target of five respondents is reached. All who participate
will receive thank-you emails.
For the exemplary SA interviews, there is a total of six pre- and
post-interview responses in addition to the interview. (We assume that
only one of the staff attending the exemplary SA interview will receive
the contacts before and after the interview.)
Estimated Total Annual Responses: 796. All 53 SA SNAP Directors
will complete the web survey with up to 106 others assisting them, with
up to 13 reminders before the survey is completed and up to 3 contacts
afterwards. Up to 7 SA SNAP Directors will be recruited to reach five
SA SNAP Directors for the exemplary SA interviews, but the study team
does not count these five as respondents because they are expected to
have completed the web survey earlier. Additionally, 10 industry
experts will be recruited for the industry expert interviews until the
target of 5 respondents is reached. Both types of semi-structured
interviews may involve as many as five contacts to arrange the
interview and one post-interview contact (thank-you email). We also
include burden on nonrespondents from receiving and reading the various
recruiting contacts (emails or phone calls).
Estimated Time per Response: 0.14 hours. The estimated time per web
survey response is 1 hour. The estimated time per interview is 1 hour.
The estimated time will vary depending on the type of contact and will
range from 2 minutes (0.03 hours) to 3 hours (when three staff
participate in a 1-hour interview). The following table outlines the
estimated total annual burden for each type of respondent and for
nonrespondents.
Estimated Total Annual Burden on Respondents: The annual reporting
burden is estimated to be 108.76 hours.
Dated: March 7, 2019.
Brandon Lipps,
Administrator, Food and Nutrition Service.
BILLING CODE 3410-30-P
[[Page 10028]]
[GRAPHIC] [TIFF OMITTED] TN19MR19.001
[[Page 10029]]
[GRAPHIC] [TIFF OMITTED] TN19MR19.002
[[Page 10030]]
[FR Doc. 2019-05080 Filed 3-18-19; 8:45 am]
BILLING CODE 3410-30-C