oversight

Privacy Issues and Supplemental Security Income Benefits

Published by the Government Accountability Office on 1977-11-15.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                               DCCUM NT RESUMEI

0437 -     B319443 6 ] d.),                                     ,    /C     2
Privacy Issues and Supplemental Security IcomE Benefits.
HBD-77-110; B-Ir4031(4). November 15, 1977. 12 pp. + 3
appendices (4 pp.).
Report to Rep. John E. Moss; by Elmer B. Staats, Ccmptrcller
Gen iral.
issue Area: InCome Security Progr4ms: Program Eftectiveness
      (1302) Federal Records anagement 1400).
Contact: Human Resources Div.
Bud-qet Function:    Income Scurity: Public Assistance an Cther
     Income Supplements 604).
                                                               Social
Orqauization Concerned: Railroad Retirement Board;
     Security Administration; Veterans       Administration.
Congressional Relevance: Rep. John E. floss.
Authority: Privacy Act of 1974 (5 U.S.C. 552a). Social Security
     Act Amendments of 1972 (42 U.S.C. 1383). 36 U.S.C. 3301.
                                                                            that
            A November 1976 report to tbh Congress reccumended
                                                  accurate     and   complete
the Social Security Administration obtain
data on compensation ar4 pensions promptly and regularly from
                                          Railroad Betirement Eoard.
the Veterans Administration and thepayments.
These   data  are -Lsed  for computing
                                                                    these
 Findlnqs/Concluions: The use of inadequatr; data trom
agencies had resulted iu Supplemental Security           Income     recipients
 being overpaid $60 million and underpaid        $4   millioi    annually.
                                                                          the
 General Counsel at all three agencies agree with GAO that
 recommendatior.     or accurate and complete     data   are   consistent
                                                                              use
 with the Privacy Act since the disclosures are for a routine
 compatible with the purpose for which       the   reccrd   was   collected.
 Drecommendations: Tne Administrator     ot Yete-ans Alifairs shculd
                                                                          about
 revise the routine use notice so that it is Lore explicit
 the information disclosed to the Social        Security Adminitration
 from  its  syst:m  of  records entitled   "Veterans,    Dependents, and
 Benef.ciar.es Compensation and Pensicn       Reccrds"'    and the purposes
 cf such disclosures. The Secretary      of  Health,    Education,      and
 Weltare should direct the Commissionerwhat   of Social Security to
 prepare   a risk  analysis  to  determine         security measures may
 be needed to prevent unauthorizcd access tc the The       valious palment
 rapes it transmits to the TreasuL' ea:h        month.          Chairian of
                                                                 of Veterans
 tae Railroad Retirement Board and the Adnirist-atortc determine      what
  Affairs should also conduct risk analyses                                    ct
  secitrity safequards should be exercised      over   tle  transisiou
 the compensation or pension jncome information           provided     to
  Sccial Security. (SC)
                          bj,~fn m".       excott   be
                                                    aen rtheWfbPas
                                                              bea. Sf
                                                                    euloo
                                                                      somre ti,   eovra
                                                                                      a




..-t         +i    REPORT OF THE                                                          /   7
        e
        ts         COMPTROLLER GENERAL
         c~u~
       t9OF          THE UNITED STATES



                   Privacy Issues And Supplemental
                   Security Income Benefits

                   In a November 1976 report to the Congress,
                  GAO recommended that the Social Security
                  Administration get accurate and complete
                  data on compensation and pensions promptly
                  and regularly from the Veterans Administra-
                  tion and the Railroad Retirement Board. This
                  data isused for computing payments.
                  This report
                        --discusses the agencies' compliance with
                         Privacy Act requirements in carrying
                         out this recommendation and
                       --recommends that the Veterans Admin-
                         istration fully inform the public about
                         its disclosures to Social Security and
                         that agencies determine security safe-
                        guards that may be needed for data
                        being t ansrr.itted.




                  HRD-77-110                                         NOVEMBER 15, 1977
                 COMPTROLLER KNERAL Or Tt-L UNIT3   STATM
                            WAefNSTC. D.
                                      Mr.




B-164031(4)



The Honorable John E. Moss
House of Representatives

Dear Mr. Moss:

     In your January 26, 1977, letter, you noted that our
November 1976 report to the Congress stated that the Social,
Security Administration had been computing Supplemental Secu-
rity Income payments with inaccurate Veterans Administration
and Railroad Retirement Board compensation and pension income.
Cunsequently, Supplemental Security Income recipients were
being overpaid $60 million and underpaid $4 million annually.

     We recommended that Social Security obtain accurate and
complete compensation and pension income data on a timely and
continuing basis directly from the Veterans Administration
and the Railroad Retirement Board.  We also recommended that
systems be established, where appropriate, to secure similar
data from other Federal agencies.

     Following, are answers to the questions you raised.

How is the exchange of information recommended in
the report consistent with the Privacy Act?

     We believe that our recommendations are consistent with
the Privacy Act of 1974 (5 U.S.C. 552a).  FurthermoLe, Gen-
eral Counsel at the Social Security Administration, the
Veterans Administration, and the Railroad Retirement Board
are of the opinion that the act does not prohibit their agen-
cies from giving necessary information to Social Security
to administer the Supplemental Security Income program.

     While the Privacy Act generally prohibits agencies from
disclosing information from systems of records without the
written consent of the subject of the record, there are eleven
categories of permissible disclosures without such consent.
The disclosures made by the Social Security Administration,
the Veterans Administration, and the Railroad Retirement Board
fall within the third category--disclosures fo' a routine use.
B-164031(4)

     A routine use is a use compatible with the purpose for
which the record was collected. Guidelines issued by the
Office of Management and Budget state that a routine use
must not only be compatible with but related to the purpose
for which the re'cord is maintained.
     We are of the opinion that the disclosure of informa-
tion to Social Security from records maintained by the
Veterans Administration and the Railroad Retirement Board
is cc;apatible with and related to the purpose for which
those records are maintained. This opinion was reached after
reviewing the provisions of the Privacy Act and the Social
Security Act.
     As added by the Social Security Act Amendments of 1972,
42 U.S.C. 1383(f) provides:
     'The head of any Federal agency shall provide
     such information as the Secretary [of Health,
     Education, and Welfare] needs for purposes of
     determining eligibility for or amount of
     benefits, or verifying other information with
     respect thereto."
In addition, 42 U.S.C. 1383(e) requires that eligibility
for Supplemental Security Income benefits not be determined
solely on the basis of declarations by the applicant con-
cerning eligibility or other relevant facts. Relevant in-
formation must be verified from independent or collateral
sources and additional information obtained as necessary to
assure that benefits in the correct amount are provided to
eligible individuals.
     We believe that 42 U.S.C. 1383(f) amends the purpose for
which all systemi of records are maintained to include dis-
closure for Supplemental Security Income verification. Ac-
cordingly, a Federal agency can provide Social Security with
information from any system of records as long as the data
is relevant to the dtermination of eligibility or amount
of benefits for the program, and the disclosure complies with
requirements for routine use as set forth in the Privacy Act.
     The Veterans Administratio,    n cite anothe- statute
(38 U.S.C. 3301) in justificatio-     't.-disclosares to
Social Security. This statute a     In zes the disclosure
from VeterafNs Administration's re.. H. or many urposes,
including When required by any department or other agency


                              2
B-164031(4)

of the United States Government." This section may be viewed
as establishing disclosure to Social Security as a purpose
for which the Veterans Administration maintains its records.
     It is our opinion that 42 U.S.C. 1383(f) and 38 U.S.C.
3301 are not superseded by the Privacy Act. While this
matter may not be completely free from doubt because it has
not been tested in the courts, we conclude that these dis-
closures of information to Social Security are not improper
or illegal if Privacy Act procedures have been followed.
Have all agencies notified the public of the
exchange of information through Privacy Act notices?
      The act requires agencies to publish in the Federal
Register at least annually a notice of the existence and
character of systems of records. New uses of information
in a system must also be published 30 days in advance. The
Social Security Administration, the Veterans Administration,
and the Railroad Retirement Board have published in the Fed-
eral Register pertinent routine uses of records maintained,
including the categories of users and the purposes of such
uses.
     The information disclosed by the Railroad Retirement
Board to Social Security is fr)m the system of records en-
titled "Railroad Retirement, Survivor, and Pensioner Benefit
System-RRB." On March 22, 1976, the notice for this system
was amended to include the following routine use:
     'k. Beneficiary identifying information, en-
     titlement, benefit rates and months paid may be
     released to the Social Security Administration,
     Bureau of Supplemental Security Income, to fed-
     eral, state and local welfare or public aid
     agencies to assist them in processing applica-
     tions for benefits under their res.=:tive
     programs."
      The information disclosed by the Veterans Administration
is from the system of records entitled "Veterans, Dependents
and Beneficiaries Compensation and Pension Records-VA." As
of September 7, 1976, this system had twenty-defined routine
uses, and the Veterans Administration believes that disclosure
to Social Security is authorized under the following routine
uses:




                              3
B-164031(4)

     '7. A record from this system of records may be
     disclosed to a Federal agency, in response to
     its request, in connection with the hiring or
     retention of an employee, the issuance of a security
     clearance, the reporting of an investigation of
     an employee, the letting of a contract, or the
     issuance of a license, grant, or other benefit
     by the requesting agency, to the extent that
     the information i relevant and necessary to the
     requesting agency's decision on the matter.
     "8. Transfer of statistical and other data to
     Federal, State and local government agencies and
     national health organizations to assist in :he
     development of programs that will be benefic:ial
     to claimants and to protect their rights under
     law and assure that they are receiving all bene-
     fits to which they are entitled.
               *      **            *      *


     "14. The amount of pension, compensation, or
     dependency and indemnity compensation of any
     beneficiary may be released from this system
     of records to any person who applies for such
     information."
     On September 20, 1976, Social Security defined a routine
use for the Supplemental Security Income record syster that
would permit Social Security to disclose such recipients to:
      * * * the Treasury Department to prepare supple-
     mental security income benefit checks, and * * *
     the States to establish the minimum income level
     for computation of State supplement. * * *"
     The routine uses of this record system were further
expanded in November 1976 permitting Social Security to
identify recipients to other agencies to obtain information
for verification of eligibility. This notice provides:
    "* * * Minimum information necessary to identify
    SSI applicants and recipients to the following
    Federal and State agencies for their use in pre-
    paring information for verification of eligibility
    for benefits under sections 1635(e); Bureau of In-
    dian Affairs; Civil Service Commission; Department



                              4
B-164031(4)


     of Agriculture; Department of Labor; m-
     migration and Naturalization Service; In-
     ternal Revenue Service; Railroad Retirement
     Board; State Pension Funds; State Welfare
     Offices; State Workman's Compensation; De-
     partment of Defense; United States Coast
     Guard; and, Veterans Administration. * * *"

     Both the Railroad Retirement Board and the Social
Security Administration notices of routine use are specific
about the type of information disclosed, the recipient of
the information, and the purpose of the disclosure. On the
other hand, the Veterans Administration notice could be more
explicit in its disclosures to Social Security.

What agencies are exchanging or will exchange information
on Supplemental Security Income with Social Security?

     Presently, the Veterans Administration and the Railroad
Retirement Board are the only Federal agencieJ providing
benefit data to Social Security for use in the Supplemental
Security Income program.

     Social Security has begun discussions with Civil Service
to obtain similar data for inclusion in the Supplemental
Security Income benefit computations and estimates that the
necessary data may be provided in April 1978.  Social Security
is also considering obtaining data from other Federal benefit
programs, such as Veterans Administration Education Assist-
ance, Railroad Retirement Board Unemployment and Sickness
Insurance, United States military retirement, and Black Lung,
Department of Labor.  However, no action to determine the
necessity and feasibility of obtaining such data is likely
before 1978.

What type of information will flow between agencies?
Is it all useful and relevant?

     At Social Security's request,-the Veterans Administration,
in August 1976, furnished magnetic tape files of selected com-
pensation and pension data on all veterans. The tape files
consisted of information identifying the recipient (name, sex,
address, date of birth, social security number) and Veterans
Administration award data (entitlement data, award amount,
check payment and deductions, claim number and payment status).
B-164031(4)

     In September 1976 Social Security cowpared this informa-
tion with Veterans Administration benefit data provided by
recipie' .s already in the Supplemental Security Income record.
Recipients whose checks would be increased or decreased were
notified of the new amount of payment, the reason for the
change, and the effective date of the change. Recipients
were given the opportunity to have their prior payment either
continued or reinstated if they requested an appeal within
10 days after receiving their notices of change. The October
1976 Supplemental Security Income payments reflected benefit
changes resulting from this process.
     The Veterans Administration also furnished benefit data
in October 1976 and in January and April 1977 because some
veterans received benefit increases. This notification pro-
cess was repeated for those recipients whose checks would
be affected.
     The Railroad Retirement Board furnished its entire
pension record to the Social Security Administration for
processing in December 1976. Social Security extracted
selected data it considered necessary to verify the amount
of Railroad Retirement Board benefits paid to recipients.
The extracted data was similar to the type of information
received from the Veterans Admiristration. In January 1977
recipients whose checks were to be corrected wre advised
of-the proposed change and were able to appeal. The Supple-
mental Security Income payments for February 1977 reflected
benefit changes resulting from this process. In addition,
the Railroad Retirement Board has provided microfilm of its
1975 and 1976 payment files for use in verifying benefits
paid to recipients in prior periods.
     Social Security is providing Supplemental Security In-
come information to the Departments of the Treasury and
Justice. The Treasury Department is provided information such
as name, address, social security number, payment amount, and
the type of recipient-aged, blind, or disabled--for issuing
checks. Beginning with checks to be issued after October 1,
1977, a Social Security official agreed to take appropriate
action to delete information on the type of recipient from
the payment tapes it provides Treasury because such informa-
tion is not needed by Treasury. The Justice Department is
provided information necessary for identifying the recipient
and the nature of an alleged offense with related documenta-
tion and disposition for fraud cases and claims that are
appealed to the U.S. courts.
B-164031(4)


     One primary objective of the Privacy Act is to minimize
the amount of inaccurate information which is collected about
individuals. The ct requires each agency that maintains a
system of records to keep only information about an individual
that is relevant and necessary to accomplish a purpose of the
agency.

     While most of the data Social Security obtained from
the Veterans Administration and the Railroad Retirement Board
was needed to initially verify the accuracy and completeness
of compensation and pension payments received by Supplemental
Security Income recipients, it should consider developing
a mechanism for obtaining information only on recipients
who are veterans or railroad retirees. As discussed below,
Social Security is studying a system for limiting future data
that the Veterans Administration and the Railroad Retirement
Board will provide Social Security.
How will iniormation be exchanged?
Will there be   oMputer-to-computet communication?
Is there any potential for
unauthorized access to information?

      The Veterans Administration carried its magnetic tapes
to the airport where they were mailed air express to expedite
the use of the data. Upon arrival at the airport, Social
Security received the tapes which were controlled by trans-
mittal documents. The tapes were counted, and the trans-
mitta2 documents were signed and returned to the Veterans
Administration.
     The tapes were duplicated once they reached Social
Security. After approximately 2 weeks, the Veterans Admin-
istration's tapes were returned by registered mail with re-
turn receipt requested. The duplicated tape~ were placed
in Social Security's locked tape library for use in any
appeal resulting from notification of Supplemental Security
Income benefit change. After about 6 months, the tapes will
be erased by Social Security and used again.
     The Railroad Retirement Board copied its entire pen-
sion record on magnetic tapes. The tapes were mailed to
Social Security and were controlled y transmittal documents.
The taper were counted and the transmittal documents were
signed ad returned to the Railroad Retirement Board. Social
Security extracted pertinent data from the tapes and stored
the tapes in its locked tape library. After about 6 months,
the tapes will be erased so that they can be reused.


                              7
 B-164031(4)

      The Railroad Retirement Board transmitted the
 via regular mail. The only control present was      microfilm
                                                  that it
 telephoned Social Security and advised them that
 film was being mailed and the quantity involved.  the micro-
                                                    Social
 Security nventoried and accounted for all the mircrofilm
 upon receipt. when not being used, the microfilm
 in a ocked room at Social Security.                is stored

      Social ecurity makes daily, supplemental,
payments under the Supplemental Security Income and recurring
which the U.S. Treasury issues checks. Daily     program for
which include initial payments, underpayments, payment   tapes,
payments are electronically transmitted from    and  adjustment
                                              its central
office to its Great Lakes Program Service Center
                                                  where they
are then hand-carried to Treasury's Chicago Disbursing
ter. Supplemental payment tapes for recipients            Cen-
                                                 determined
eligible after the date on which recurring payment
have been sent to Treasury are transmitted in        tapes
and to the same locations as the daily payment the same manner
                                                tapes. Social
Security carries recurring payment tapes to he
where they are shipped air freight to Treasury's airport
gional disbursing centers. It telephones each     seven re-
                                                disbursing
center to advise it of the carrier, flight number,
of expected arrival. Treasury picks up the tapes and time
respective airports. No documentation is provided at the
Security showing that Treasury actually received    Social
Instead Social Security relies on Treasury to     the  tapes.
the tapes were not received.                   notify  it if

      Because of the potential for unauthorized access
puter data, the Department of Commerce's National       to com-
Standards has established guidelines for Federal   Bureau  of
                                                  agencies to
follow in performing risk analyses to determine
needed for the handling and storage of such data.the security
the Social Security Administration, the Veterans    Neither
tion, nor the Railroad Retirement Board are aware P.dministra-
                                                   of any
unauthorized access to information being transferred.
spite this, however, the agencies hatle not conducted    De-
analyses to determine how much security should        risk
                                                be maintained
over the transmission of the information discussed
report.                                             in this

     To prevent unauthorized disclosure
personal data contained in the computer or modification of
                                        tapes, the Secretary
of ealth, Education, and Welfare; the Chairman
road Retirement Board; and the Administrator of of the Rail-
                                                Veterans
AffaJrs should prepare a risk analysis to determine
                                                    what

                              8
B-164031(4)

additional measures, if any, may e warranted to secure the
transmission of these records. If the risk analyses show
that additional safeguards are needed, they should be ex-
peditiously implemented.

Are agencies which receive information from
Social Security maintaining it? Disclosing it?
     Except as noted earlier, Social Security is not presently
sending Supplemental Security Income information to other
Federal agencies. However, Social Security advised us that
they are studying a system under which the Veterans Adminis-
tration and the Railroad Retirement Board would place an indi-
cator code in their respective master records for those in-
dividuals who receive Supplemental Security Income benefits.
The indicator code in the master records would limit the
future data provided by these agencies since data would only
be provided on those individuals known to be receiving such
income. This information would not be used by
Administration and the Railroad Retirement Boardthein Veterans
                                                       the admin-
istration of their programs, but would permit them to notify
Social Security of compensation and pension income changes
for only those individuals who also receive Supplemental
Security Income payments.
Recommendations to the agencies
     We recommend that the Administrator of Veterans Affairs
revise their routine use notice so that it is more explicit
about the information disclosed to Social Security from its
system of records entitled Veterans, Dependents, and Bene-
ficiaries Compensation and Pension Records and the purposes
of such disclosures.

     We also recommend that the Secretary of Health, Educa-
tion, and Welfare direct the Commissioner of Social Security
to prepare a risk analysis to determine what security measures
may be needed to prevent unauthorized access to the various
payment tapes it transmits to the Treasury each month. We
further recommend that the Chairma.n of the Railroad Retire-
ment Board and the Administrator of aterans Affairs also
conduct risk analyses to determine what security safeguards
should be exercised over the transmission of the compensa-
tion or pension income information provided to Social Se-
curity.




                             9
 B-164031(4)

 Agency comments and our evaluation
      We have included comments from the Department of Health,
 Education, and Welfare; the Railroad Retirement Board; and
 the Veterans Administration as appendixes to this report.
 (See apps. I, II, & III.)

     The Veterans Administration does not believe its routine
use notice for disclosing veterans compensation and pension
income data to Scial Security for the Supplemental Security
Income program snould be redrafted to specifically provide
for this disclosure. The Veterans Administration said the
existing routine uses are specific and restrictive concern-
ing authorized disclosures, and that further restrictiveness
is unnecessary and could lead to inadvertently omitting to
an agency a disclosure that would be appropriate. It noted
that disclosures made by the agency are limited and that if
it furnishes the names and addresses, only essential informa-
tion required under the Supplemental Security Income program
would be disclosed.
     We disagree with the Veterans Administration concerning
the restrictiveness of its routine use notice and believe
that the Privacy Act intended that Federal agencies full-
inform the public of those specific instances where informa-
tion would be disclosed--to whom and for what purpose--with-
out their written consent. The Veterans Administration's
routine uses described on pages 3 and 4 are so broad that
veterans and the general public reading these notices may not
be aware that information maintained by the Veterans Adminis-
tration is being disclosed to the Social Security Adminis-
tration.
      To provide for subsequent reviews of an agency's com-
pliance with the Privacy Act, Federal agencies are required
to account for all disclosures from a record, including
the name and address of the agency to which the information
was provided. Under such accounting, the Veterans Adminis-
tration should know to whom it has provided information. We
believe, therefore, that in revising the notices to make
them more explicit, any inadvertent omission to an agency
of a disclosure that would be appropriate should be mini-
mized. Furthermore, it would seem that a simple amendment
to the notice could be published to correct any such omis-
sions.




                              10
B-164031(4)


     The Department of Health, Education, and Welfare con-
curred with our recommendation that the Social Security Admin-
istration prepare a risk analysis to determine what security
measures may be needed to prevent unauthorized access to
the various payment tapes it transmits to the Treasury each
month. The Department said that preparation of the analysis
would be handled on a priority basis and that, if the results
show that additional safeguards are needed, t would be
established without delay.
     The Railroad Retirement Board said that it recognizes
the security problems which may arise in transmitting records
from one location to another and has recently reviewed its
practices of transmitting records to the Social Security
Administration. Based partly on this review, the Board is
currently in the process of establishing a uniform records
transmittal procedure designed both to protect its records
being transmitted to the Social Security Administration from
unauthorized access and to serve the interests of the public
by permitting fast and efficient transmittal at low cost.
According to the Board, it hopes to establish and implement
such a uniform procedure within the next 2 months.
     The Veterans Administration agreed that additional anal-
ysis of security measures for tne transmission of data may
be beneficial in identifying specific cases where safeguards
can be improved. It pointed out that although no unauthorized
access to information has beeh noted, an indicator identify-
ing Supplemental Security Income recipients would be added
to its -automated records to ensure that disclosures are made
only ih those cases relevant to Spplemental Security Income-
determinations.


     As you know, section 236 of the Legislative Reorganiza-
tion Act of 1970 requires the head of a Federal agency to
submit a written statement on actions taken on our recom-
mendations to the House Committee on Government Operations
and the Senate Committee on Governmental Affairs not later
than 50 days after the date of the report and to the House
and Senate Committees on Appropriations with the agency's
first request for appropriations made more than 60 days
after the date of the report.




                             11
B-1640351(4)

     As arranged with your office,
announce its contents earlier, we unless you publicly
tion of this report until 30 days plan no further distribu-
At that time, we will send copies from the date of the report.
                                   to the Department of ealth,
Education, and Welfare; the Railroad
Veterans Administration; and other    Retirement Board; the
make copies available               interested parties, and
                      to others upon request.

                                Since   y yours,



                                Comptrolle- General
                                of the United States




                           12
APPENDIX I                                                           APPENDIX I



                           VETERANS ADMINISTRATION
                       OFrncs oF TmE AD MnI5TRATOR Or VmTIAN AMIrF
                             WASHINGTON. D.C.        20420

                                 SEPTEMBER 2 1977

        Mr. Gregory J. Ahart
        Director, Human Resources Division
        U.S. General Accounting Office
        441 G Street, NW.
        Washington, DC 20548

        Dear   r. Ahart:

                  The General Accounting Office (GAO) August 1, 1977, draft
        report to Congressuma John E. Moss on privacy issues related to the
        Social Security Administration (SSA) obtaining information from the
        Veterans Administration (VA) has been reviewed. Altihough the report
        indicates the VA's routine uses are adequate for disclosure of infor-
        mation for the SSA's Supplemental Security Income (SSI) prosram, it
        recommends that we reise our routine use notices to be more explicit
        about information disclosed by this agency to the SSA. The report
        also recomends that the VA prepare risk analyses to determine the
        efficiency of its security over transmission of data from automated
        records.

                    Security guidelines have'already been reviewed in relation
         to threats to ADP property and capital equipment nd the physical
         hazards to coninuing operation. We agree that additional analysis
         of security measures for the transmission of data may be beneficial
         in identifying specific areas where safeguards can be improved.

                   We disagree that the VA's routine uses should be redrafted
         to specifically provide for the SSI program disclosure. The existing
         uses are specific and restrictive concerning authorized disclosures.
         The disclosures made by this agency are limited. If SSA furnishes
         the names and addresses, we will disclose only the essential infor-
         mation required under SSI.  Further restrictiveness is unnecessary
         and could lead to an inadvertent omission of an agency to which dis-
         closure would be totally appropriate.



                                  [See GAO note]



                   The report indicated that disclosure authority, other than
         that contained in the Privacy Act, is also present in section 1383(f)
         of title 42, U.S.C. This agency has not found it necessary to render
APPENDIX I                                                           APPENDIX I



  Mr. Gregory J. Ahart
  Director, Hunan Resources Division
  U.S. Generai Accounting Office


  a formal opinion as to whether this section given agencies the authority
  to release pertinent information to SSA in addition to the provisions
                                                                        of
  the Privacy Act, inasmuch as the existing routine uses mentioned bove
  authorize this disclosure. In this connection it might also be pointed
  out that section 3005 of itle 38, U.S.C. specifically provides for
                                                                      ex-
  change of information between the VA and the SSA

            As recmoended by the CAO report, and although no unauthorized
  access to information has been noted, an indicator iJentifying SSI recip-
  ients will be added to VA automated records to ensure that disclosures
  are made oly in thoe cases relevant to S determinations.

           Thank you for the opportunity to review this draft report.


                                        Sincerely



                                        Adu;nistr&tor




  GAQ Note:

       Deleted comments relate to matters presented in
       the draft report which have been revised in the
       final report.




                                       2
APPENDIX II*                                                  APPENDIX II




               DEPARTMENT OF HEALTH. EDUCATION. AND WELFARE
                            i opr   mi   sZeenrAr




                           SEPTEMBER 2 1977




      Mr. Gregory J. Ahart
      Director, Human Resources
        Division
      UoS. General Accounting
        Office
      Washington, D.C. 20548

      Dear Mr. Ahart:
     The Secretary asked that I respond to your request for
     our comments on your Report to Congressman John E. Moss
     on Privacy Issues Related to the Social Security Admin-
     istration obtaining Information From Selected Federal
     Agencies For Computing Supplemental Security Income
     Benefit Payments." PWe believe the report provides an
     accuate account of the Social Security Administration's
     procedures relative to the information obtained from
     other Federal agencies for purposes of computing Supple-
     mental Security Income benefit payments.
     WTe concur with the report's recc=rendation that SSA prepare
     a risk analysis to determine what security measures may
     be needed to prevent unauthorized access to the various
     payment tapes it transmits to the U.S. Treasury each
     month. Preparation of the analysis will be handled on a
     priority basis and if the results show that additional
     safeguards are needed, they will be put in place without
     delay.

     We appreciate the opportunity to comment on this draft
     report before its publication.

                                     Sincerely yours,



                                     Thomas D.  orris
                                     Inspector General
APPENDIX III                                                                            APPENDIX III


                                      UNiTe   SATE Or AMIRICA
                                    RAILROAD RETIREMENT BOARD
                                            44 RusH   rrtnIT
                                       CHICAGO.  ILLINOIS      0611


JAMSS L. COlIwN                          August 12,     1977
              Cr.AlMAN

                  anatrlOliMrmber
               ootrrabGe Zlmr B. Stats
              Comptroller Gaearal of the United States
              United States General Accounting Office
              441 G Street, H.W.
              Washington, D. C. 20548


              Dear Mr. Staats:

              This has reference to the letter of August 1, 1977, from
              Mr. Gregory J. Ahu-,. Director of the uman Resources Division of
              your Office, to Mr. Jame. L. Cowen, Chairman of the Railroad Retire-
              ment Board, requesting that he Board review and subnit its comments
              on your proposed draft report to Congressman John E. Moss concerning
              the exchange of records between several agencies and the Social
              Security Admnistration for use in the administration of the Supple-
                antal Security Income program.

              Thc Board has reviewed the proposed draft report and has found that
              it accurately reflects the Board's practices with. respect to the
              transfer of records to the Social Scurity Administration for use by
              that agency in the administration of the Supplemental Security Income
              program. The Board would, however,    ike to comment with respect to
              the section of the draft report concerning the method by vhich the
              Board transmits records to the Social Security Administration.

              In recognition of the security problem which may arise in the trans-
              misron of records from one physical location to another, the Railroad
              Retirement Board has recently reviewcd its practices with respect to
              the transmittal of records to the Social Security Administration.
              Based in part on this review, the Board is currently in the process of
              establishing a uniform records transmittal procedure designed both to
              protect Board records being transmitted to the Social Security Adminss-
              tration from unauthorized access and to serve the interests of the
              public by keeping the costs of transmittal low and permitting fast and
              efficient transmittal. Hopefully, uch a uniform procedure will be
              established and implemented by the Board within the next two months.

                                                               Siof erely Yours,


                                                               FOR Tt LAUD
                                                                      F. Butler, Secretary
                                                                      P.


                         lirp Freedom in our Fubre Wth US. S              ings Bondrs


             (105019)
                                                 4