March 18, 2024

GovDelivery Message: TPA Section 8 Clarification/ Reminder

This reminder summarizes the Social Security Administration's (SSA) policy and procedures on protecting and reporting the loss, compromise, or potential compromise of Personally Identifiable Information (PII) to ensure Employment Networks (EN) follow them and share incident information appropriately.

ENs must establish and abide by their own policy and procedures to protect PII. In addition, ENs are responsible for implementing SSA’s prescribed procedures for reporting lost, compromised, or potentially compromised PII outlined in Part IV, Section 8.C.3 of the Ticket Program Agreement (TPA). ENs must educate their employees, subcontractors, and/or provider affiliates who handle PII on protecting and reporting the loss, compromise, or potential compromise of PII, as well as enforce their compliance with these policies and procedures.

The following is an outline of the Agency-prescribed procedures for reporting all suspected or confirmed incidents involving PII:

1. When an EN employee, including a subcontractor or provider affiliate employee, becomes aware or suspects that PII has been lost, compromised, or potentially compromised, the EN must notify SSA’s National Network Service Center (NNSC) by phone at 1-877-697-4889 and the primary SSA contact at ENService@ssa.gov within one hour of the incident.

2. The EN should use the Worksheet for Reporting the Loss, Compromise, or Potential Compromise of PII to quickly gather and organize information about the incident. The worksheet identifies the information to report to the primary SSA contact and the NNSC.

3. The initial report to the primary SSA contact should be by email with “PII Breach” and the EN's Provider Identification (PID) number in the subject line. It should also include the following information:

• Contact information for the reporting individual and the individual who possessed the data, or to whom the data was assigned if it is not the reporting individual.
• A description of the loss, compromise, or potential compromise (e.g., nature of loss/compromise/potential compromise, scope, number of files or records, type of equipment or media), including the approximate time and location of the loss.
• A description of safeguards used, where applicable (e.g., locked briefcase, redacted personal information, password protection, encryption, etc.).
• An identification of SSA components (organizational divisions or subdivisions) contacted or involved.
• Whether the EN or its employee has contacted or been contacted by any external organizations (e.g., other agencies, law enforcement, press, etc.).
• Whether the EN or its employee has filed any other reports (i.e., Federal Protective Service, local police, and SSA reports).
• Any other pertinent information.

4. The initial report to the NNSC should be by phone. When reporting the loss, compromise, or potential compromise of PII to the NNSC, the agent will provide the EN one or more ticket numbers and will send at least one email. The EN must retain the ticket number(s) and email(s) and provide them to SSA upon request.

5. In the event of PII loss, compromise, or potential compromise, the EN must take immediate action to address consequential security issues identified, including actions to minimize further security risks.

NOTE: ENs bear the responsibility and cost for any data breach and/or remediation actions that might arise from the security and/or PII loss incident, including notifying affected individuals of the security breach, if required by SSA. Unless authorized by SSA, ENs are prohibited from retaining the services of a data recovery, loss mitigation, or related company to attempt to recover the lost or compromised data.

6. The EN must provide the appropriate SSA contact updates on the status of the reported PII loss or compromise as they become available, including the actions the EN has taken and plans to take in dealing with the incident.

Please contact ENService@ssa.gov with any questions concerning protecting and reporting the loss, compromise, or potential compromise of PII.

March 14, 2024

The Ticket Program Manager (TPM) has developed the following resources for ENs to use when submitting Individual Work Plans (IWP) and requests for Ticket unassignment:

IWP Submission Coversheet

TPM often receives IWPs with no submission reason identified, which delays IWP review and/or Ticket assignment. To streamline the submission process and ensure that appropriate Program Integrity staff receive the IWP, TPM developed the IWP Submission Coversheet. ENs should use this coversheet to provide the necessary information and identify the reason for submitting the IWP. We ask that ENs submit IWPs with the IWP Submission Coversheet via Government-to-Government Services Online (GSO) or, if unable to submit via GSO, please fax to 1-703-893-4020.

Ticket Unassignment Request Template

In most cases, ENs can unassign Tickets via the Ticket Portal. However, there may be instances in which the EN must reach out to TPM for Ticket unassignment (for example, the EN doesn’t have access to unassign Tickets in the Ticket Portal). The EN Unassignment Request Template outlines the information TPM needs to process a Ticket unassignment request. ENs may use the EN Unassignment Request Template to unassign a Ticket, although SSA will accept other formats, assuming the necessary information is included.

ENs should submit Ticket unassignment requests via GSO or, if they are unable to submit via GSO, via fax.

For EN convenience, we have attached a copy of the IWP Submission Coversheet and EN Ticket Unassignment Request Template to this message. They are also both available on the Your Ticket to Work website under Resources and Resource Documents.

• IWP Submission Coversheet
• EN Ticket Unassignment Request Template

Please contact Program Integrity at Programintegrity@yourtickettowork.ssa.gov for questions or assistance.

WISE Webinars