OWCP — Longshore Case Management System (LCMS) — FY 2012

Overview

In accordance with Department of Labor (DOL) guidelines, the Office of Workers' Compensation Programs (OWCP)'s Division of Longshore and Harbor Workers' Compensation (DLHWC) conducted a Privacy Impact Assessment (PIA) on the Longshore Case Management System (LCMS).

The major application, LCMS is a case management system to support DLHWC core business functions in administering the Longshore and Harbor Workers' Compensation Act.

OWCP, in conjunction with the DOL Office of the Chief Information Officer (OCIO), has determined that LCMS processes privacy information. As such, this document has been prepared to describe the information collected by LCMS; what it is used for; who has access to the information; how the information can be corrected; and in general terms how the information is secured.

Characterization of the Information

The LCMS collects PII on individuals and/or their survivors who file claims seeking benefits under the LHWCA (and/or extensions) by reason of injuries sustained while in the performance of duty. The LHWCA applies to employees injured or killed while working in private industry who are covered by the provisions of the LHWCA, the Non-Appropriated Fund Instrumentalities Act, the Defense Base Act, the Outer Continental Shelf Lands Act, referred to collectively herein as the LHWCA.
In addition to these individuals, the system contains records of medical providers, insurance providers, attorneys and others representing claimants, rehabilitation counselors, nurses, and other health care professionals who provide information in support of compensation claims. Records are also kept on employers and insurance carriers who pay the benefits provided under this program.

What are the sources of the PII in the information system?

PII is provided to the agency in a variety of ways including:

Forms submitted either by the individual claimant or the employer insurance carrier, or claim administrator. A list of the forms can be found at the following link:
http://www.dol.gov/owcp/dlhwc/lsforms.htm.
Medical records and reports from health care providers including physicians, hospitals, rehabilitation centers, and nurses.
Employment data provided by employers, unions and other federal and state agencies.
Communication from workers attorneys' representing claimants and other parties of interest.
Other records of communication including notes on phone calls, letters, emails, etc
Compensation records
Formal orders for or against the payment of benefits
Records of proceedings at the Office of Admin Law Judges, the Benefits Review Board and the U.S. Courts.
Any other medical, employer, or personal information submitted or gathered in connection with the claim.
Information relating to dates of birth, marriage, divorce, and death
Information relating to other benefits (financial and otherwise) the claimant or employer may be entitled to
Information received from various investigative agencies concerning possible violations of Federal civil or criminal law.

What is the PII being collected, used, disseminated, or maintained?

First and/or last name
Date of birth
SSN
Residential address
Personal phone numbers (e.g., phone, fax, cell)
Mailing address (e.g., P.O. Box)
Medical information including physician's notes
Legal documents or notes (e.g., divorce decree, criminal records)

How is the PII collected?

The DLHWC has a number of forms that are used to collect data in support of a claim. As indicated above, the majority of those forms are available on the Internet. These forms can be filled out on line or printed and then filled in by hand and mailed or faxed to the District Office with jurisdiction over that claim. Once the electronic copies of the forms are received, they are printed and follow the same process as the other paper forms.

Upon receipt of the forms, clerks determine whether they are for an existing case or if a new case needs to be created. Once the case file number is determined, the documents are routed to the appropriate claims examiner who reviews the case and determines its status.
Medical reports and records are routinely submitted to DLHWC district offices as required by law. District office claims staff may use LCMS to annotate medical diagnosis and other PII information.

How will the information be checked for accuracy?

Paper forms are reviewed and checked for accuracy by the responsible claims examiners and staff and the pertinent information is entered into the system. System edit checks help to ensure the accuracy of the data on the forms.

What specific legal authorities, arrangements, and/or agreements defined the collection of information?

OWCP has been authorized by Congress (Public Law 103-112) to require persons who file notices of injury and/or claims for compensation under the Longshore and Harbor Workers' Compensation Act (LHWCA) and its extensions to disclose certain identifying information, including SSN. Consequently, applicable regulations, including 20 CFR 702.202 concerning the employer's report of an employee's injury or death, have been amended to expressly require the reporting of the injured worker's SSN. The amended regulations are contained in the Federal Register dated December 23, 1993 (58 FR 68031).

Privacy Impact Analysis

There are many potential risks when medical information is recorded about an individual, such as identity theft, refusal of certain types of insurance coverage, loss of employment, etc. In particular, the risk of inadvertent disclosure of PII when information is exchanged among medical offices, rehabilitation counselors, other medical staff and DLHWC is taken very seriously. DLHWC understands its obligation to safeguard this information to prevent any of the potential risks from being realized and has established policies and procedures to safeguard this information. Throughout the remainder of this document examples of those safeguards have been explained to illustrate this commitment to prevent the compromise of PII.

Uses of the PII

The following questions are intended to clearly delineate the use of information and the accuracy of the data being used.

Describe all the uses of the PII

DLHWC uses the collected PII as critical information for the purposes of managing the claimant cases under the LHWCA.

LCMS operations provide the following functions which in some part depend on PII:

Input and process claims
Conduct correspondence with claimants, attorneys, and various medical personnel to determine the eligibility of the claim
Determine whether a claim is eligible and notify the claimant
Periodically update claimant and medical information to determine continued eligibility
Calculate the amount of benefits the claimant is eligible for
In a limited number of cases, contribute information to establish payment records in LDS for transmission to the Treasury Department
Support rehabilitation training and counseling
Resolve claim disputes between employees and employers and insurance carriers
provide statistical data for program management

What types of tools are used to analyze data and what type of data may be produced?

Data mining and some pattern recognition are used for program management purposes to determine if performance goals are being met or to identify a cohort of cases by medical diagnosis.

Will the system derive new data, or create previously unavailable data, about an individual through aggregation of the collected information?

No.

If the system uses commercial or publicly available data, please explain why and how it is used.

No.

Privacy Impact Analysis

All system users are required to read and sign the Rules of Behavior before being granted access to the system. The LCMS uses least privilege principles to ensure that only those who need access to the data to fulfill the agency's mission are given access in addition to the authentication controls discussed above.

The system maintains only PII that is necessary and relevant to accomplish the purpose for which it is being collected.

Retention

The following questions are intended to outline how long information will be retained after the initial collection.

How long is information retained in the system?

Paper case records are sent to the Federal Records Center (FRC) once they are eligible (two years after the case has been put in closed status). They are destroyed 20 years after the case is closed.

Electronic records are archived in the system (put in Federal Record Center (FRC) status, cannot be edited) two years after being placed in Closed status.

Has the retention schedule been approved by the DOL agency records officer and the National Archives and Records Administration (NARA)?

Yes. The Archivist of the United States signed the "Request for Records Disposition Authority", Job Number: N1-271-02-01 on April 30, 2004.

What efforts are being made to eliminate or reduce PII that is collected, stored or maintained by the system if it is no longer required?

PII is only stored on the system for a period of up to seven years. After that, non-active records are copied to tape and the archived records are stored at a separate backup facility.

How is it determined that PII is no longer required?

The OWCP programs, under which PII records are collected and processed, are authorized by Congress to collect such information. Because these records are part of the official record that justifies the compensation decisions made by OWCP, they are required to be maintained as part of the audit record for the agency.

Privacy Impact Analysis

The LCMS is required to maintain the paper record for the interval indicated by the Archivist of the United States. The paper files are maintained in a secure location within the DLHWC offices. Once the file is eligible to be shipped to the Federal Records Center, it is sent via tracked packages which are labeled appropriately.

Internal Sharing and Disclosure

The following questions are intended to define the scope of sharing within the Department of Labor.

With which internal organization(s) is the PII shared, what information is shared, and for what purpose?

Electronic case records can be requested by the following organizations outside of the OWCP program for auditing purposes: the DOL Office of Inspector General (OIG) and the Office of the Chief Financial Officer (OCFO) for audit purposes; and the Office of the Solicitor (SOL) for litigation support.

How is the PII transmitted or disclosed?

Access to data is provided via "read only" auditor user accounts for temporary periods required by the auditors. If any PII has to be transmitted to an auditor, it is done through an encrypted E-Mail attachment, password protected E-Mail attachment, or CD.

Privacy Impact Analysis

The sharing of data with internal DOL users is limited to SOL for litigation support; and the OIG and OCFO and their designated auditors. All auditors are required to sign strict non-disclosure agreements, read and sign Rules of Behavior and complete security screening before they are authorized to access any data. The information is being shared with auditors and the SOL for civil or criminal law enforcement.

External Sharing and Disclosure

The following questions are intended to define the content, scope, and authority for information sharing external to DOL which includes federal, state and local government, and the private sector.

With which external organization(s) is the PII shared, what information is shared, and for what purpose?

Harper, Rains, Knight & Company receives LCMS data by CD. The LCMS data is used by the company to audit Longshore insurance carriers on behalf of OWCP to ensure claims are being reported timely and accurately.

Is the sharing of PII outside the Department compatible with the original collection? If so, is it covered by an appropriate routine use in a SORN? If so, please describe. If not, please describe under what legal mechanism the program or system is allowed to share the PII outside of DOL.

Yes. It is covered by System of Records Notice DOL/ESA-24. Authorization is documented within a Memorandum of Understanding (MOU) between OWCP/DLHWC and Harper, Rains, Knight & Company.

How is the information shared outside the Department and what security measures safeguard its transmission?

The information is shared via portable media (CD) and is encrypted with the DOL mandated encryption software.

Privacy Impact Analysis

The external sharing of data is required for DLHWC and Harper, Rains, Knight & Company to ensure claims are being reported timely and accurately.

An MOU between the U.S. Department of Labor and Harper, Rains, Knight & Company is also in place covering this data exchange by CD. As indicated above, the CD is encrypted before being sent to guard against unauthorized use in the event the CD is misdirected.

Notice

The following questions are directed at notice to the individual of the scope of PII collected, the right to consent to uses of said information, and the right to decline to provide information.

Was notice provided to the individual prior to collection of PII?

Privacy Act considerations are included on the back of our claimant forms. Claimants are instructed to review the entire document before submitting the form.

Do individuals have the opportunity and/or right to decline to provide information?

Yes, we have the following statement included in our claimant forms,

In accordance with the Privacy Act of 1974, as amended, 5 U.S.C. 522a), you are hereby notified that:

The Longshore and Harbor Workers' Compensation Act, as amended and extended (33 U.S.C. 901 et seq.) (LHWCA) is administered by the Office of Workers' Compensation Programs of the U.S. Department of Labor which receives and maintains personal information on claimants and their immediate families;
Information which the Office has will be used to determine eligibility for the amount of benefits under the LHWCA;
Information may be given to the employer which employed the claimant at the time of injury, or to the insurance carrier or other entity which secured the employer's compensation liability;
Information may be given to the physicians and other medical service providers for use in providing treatment or medical/vocational rehabilitation, making evaluations and for other purposes relating to the medical management of the claim;
Information may be given to the Department of Labor's Office of Administrative Law Judges (OALJ), or other person, board or organization, which is authorized or required to render decisions with respect to the claim or other matter arising in connection with the claim;
Information may be given to Federal, state and local agencies for law enforcement purposes, to obtain information relevant to a decision under the LHWCA, to determine whether benefits are being and have been paid properly, and, where appropriate, to pursue salary/administrative offset and debt collection actions required or permitted by law;
Disclosure of the claimant's SSN or tax identifying number (TIN) on this form is mandatory. The SSN and/or other information maintained by the Office may be used for identification, and other purposes authorized by law;
Failure to disclose all requested information may delay the processing of the claim, the payment of benefits, or may result in an unfavorable decision or reduced level of benefits.

Do individuals have the right to consent to particular uses of the information? If so, how does the individual exercise the right?

As indicated in the previous question, OWCP has been authorized by law to collect certain information in order to process claims. The information is used only for the purposes of managing the Longshore claim. Claimants consent to this use of their information by signing the claimant form.

Privacy Impact Analysis

Specific notice of the need to have and use privacy data to process a claim is included on the claim form itself to ensure that all claimants are aware of the data necessary to complete their claim and its uses. In addition, System of Records Notices (SORNs) which outline the users of privacy data for this system is available to the public through the DOL internet.

The SORNs that are applicable to this system are:

Published in 67 Federal Register,
April 8, 2002.

DOL/ESA-15 — LHWCA Case files
DOL/ESA-24 — LHWCA Special Fund System
DOL/ESA-26 — LHWCA Investigation Files
DOL/ESA-43 - Office of Workers' Compensation Programs, Federal Employees' Compensation Act and Longshore and Harbor Workers' Compensation Act Rehabilitation Files

Access, Redress, and Correction

The following questions are directed at an individual's ability to ensure the accuracy of the information collected about them.

What are the procedures that allow individuals to gain access to their information?

Claimants have the right to request a copy of their file at any time.

What are the procedures for correcting inaccurate or erroneous information?

Claimants can contact the closest OWCP-DLHWC office and provide amended information.

How are individuals notified of the procedures for correcting their information?

When they file the claim they are informed that they should contact the office should there be any changes in the information provided.

If no formal redress is provided, what alternatives are available to the individual?

Individuals have access, redress, and amendment rights under the Privacy Act for their records, and the procedures pertaining thereto are documented in the Privacy Act SORN.

Privacy Impact Analysis

Electronic access to the claimant's records is strictly limited to preserve the privacy of the claimant. Only the claimant and/or "party in interest" (under federal regulations (20 CFR 702.113-114), any "party in interest", including the employer, the carrier, the claimant, and any lien claimant, as well as their legal representatives, have the right to a copy of the admin claim file) can request copies of their records to avoid any potential breach of privacy.

Technical Access and Security

The following questions are intended to describe technical safeguards and security measures.

What procedures are in place to determine which users may access the system and are they documented?

DLHWC has put in place access control measures that include documented user access authorization, encryption and least privilege.

Will Department contractors have access to the system?

DLHWC contractors are required to read the Computer Security Training slides and the OWCP MA Rules of Behavior and sign a Non-Disclosure Agreement before accessing the system. Also a Personal Identity Verification is conducted on each contractor.

Describe what privacy training is provided to users, either generally or specifically relevant to the program or system?

Annual Information System Security and Privacy Awareness Training which has a privacy module or component to it. In addition, all DOL employees must complete online training on protecting PII each year.

What auditing measures and technical safeguards are in place to prevent misuse of data?

OWCP uses the concept of least privilege as described above. Access is granted only after authorization based on documented access request policies. Logs for certain system functions are also reviewed on a regular basis to check for any misuse or other issues.

All OWCP operations are required to have security audits and assessments conducted of their operations on an annual basis. All OWCP systems must have system level auditing enabled to provide for reasonable response in the event of a security situation. IT system auditing and security testing is an essential aspect of how the Agency ensures the integrity and availability of our computing systems. Auditing and assessments also provide the Agency the ability to be more effective in preventing security vulnerabilities.

Privacy Impact Analysis

There are many potential risks when medical information is recorded about an individual, such as identity theft, certain types of insurance coverage being refused if certain medical information became public, loss of employment, etc. DLHWC understands its obligation to safeguard this information to prevent any of the potential risks from being realized. Throughout this document examples of those safeguards have been explained to illustrate this commitment to preventing the compromise of PII.

There are appropriate administrative, technical and physical safeguards in place to ensure the security and confidentiality of the information.

Technology

The following questions are directed at critically analyzing the selection process for any technologies utilized by the system, including system hardware, RFID, biometrics, and other technology.

What stage of development is the system in, and what project development life cycle was used?

Operations and Maintenance.

The DOL System Development Life Cycle Management (SDLCM) Manual.

Does the project employ technology which may raise privacy concerns? If so please discuss their implementation?

No.

Determination

As a result of performing the PIA, what choices has the agency made regarding the information technology system and collection of information?

OWCP has completed the PIA for LCMS which is currently in operation. OWCP has determined that the safeguards and controls for this moderate system adequately protect the information.
OWCP has determined that it is collecting the minimum necessary information for the proper performance of a documented agency function.