Comments on the Social Security Administration's proposed rule on use of electronic payroll data

Office of Legislation and Congressional Affairs 

Regulations and Reports Clearance Staff

Social Security Administration

Mail Stop 3253 Altmeyer 

6401 Security Boulevard

Baltimore, Maryland 21235–6401

Submitted via regulations.gov

Re: Docket No. SSA-2016-0039

Comments from Legal Aid of Arkansas and Upturn

To Whom It May Concern: 

Upturn and Legal Aid of Arkansas write in response to the Notice of Proposed Rulemaking issued on February 15, 2024, addressing the use of payroll data providers in Social Security Disability Insurance (“SSDI”) and Supplemental Security Income (“SSI”) programs. 

By way of background, Upturn and Legal Aid of Arkansas are two of the three organizations who co-founded and presently run the Benefits Tech Advocacy Hub (the National Health Law Program is the third organization but is not a signatory to this letter). The Benefits Tech Advocacy Hub is a community of advocates and technologists experienced in fighting the unjust use of technology in public benefits. We convene advocates, technologists, academics, and others to co-create strategies for increased transparency and robust accountability mechanisms throughout the lifecycle of benefits tech systems. We give advocates tools to fight harmful benefits tech and force greater transparency so that harm can be identified, prevented, or reduced as early in the lifecycle as possible. We have helped advocates with numerous technology-related problems in benefits administration. We have prevented bad algorithms from going into effect, stopped their use, and gotten errors fixed faster. 

Our work also includes addressing problems stemming from data-matching systems like the one advanced in the NPRM. Overall, the proposal to automate wage reporting could significantly reduce the administrative burdens on SSDI and SSI recipients, but its ultimate value depends on careful implementation that creates safeguards against clear risks like additional paperwork burdens, inaccuracies, and vendor lock. 

I. The proposal offers real promise to simplify the administrative burden on benefits recipients. 

Regularly representing SSI and SSDI beneficiaries or otherwise studying the benefit programs, we understand the difficulties recipients face in complying with the programs’ complex income reporting rules. Legal Aid of Arkansas’s clients have faced huge overpayments—often in the range of $30,000 to $80,000—for misunderstanding wage-reporting rules, facing practical barriers to reporting (e.g., a non-functioning site or restricted field office hours), or being otherwise unable to comply. 

Of course, one solution would be to eliminate the complex rules and make the program simpler for recipients to navigate. Absent that, however, freeing recipients from having to report changes in income from employment could significantly aid in avoiding overpayments. 

SSA’s decision to allow recipients to opt into or out of the program appropriately provides recipients a choice of how they want to manage their benefits. All recipients would benefit from a standardized, plain-language explanation that identifies the benefits and risks of opting in, notifies people that they can opt out, and tells people how to opt out. This notice could be sent to all recipients and discussed during any field office visit or call. Since all recipients are considered disabled, careful thought should be given to designing the automated wage reporting program so people will have full access to it and will not be discriminated against through policy or implementation choices. Among other ideas, SSA can consider implementing a clear process that informs people that reasonable accommodations are available, recognizes requests, and acts on them quickly and appropriately. People who primarily speak a language other than English will require proper interpretation and skillfully translated documents. 

Against this potential benefit, the NPRM does not adequately detail the risks of the proposal. Such risks mean that SSA could try to solve one problem and create others. The remainder of these comments identify the risks and possible mitigation strategies. 

II. Data matching can trigger different kinds of benefit loss or paperwork burdens. 

SSA has a known history of problematic data matching on at least two fronts. First, SSA often attributes real property of a different person in a different state to a recipient with the same name, causing the recipient to lose SSI eligibility. This error has occurred even when the people involved had different Social Security Numbers and dates of birth. Second, SSA often attributes to recipients the value of bank accounts for which they are payable-on-death beneficiaries, also causing lost SSI eligibility. To our knowledge, these basic data-matching errors persist despite being documented and known to SSA for years. The persistence of such problems does not engender confidence that an automated data-matching scheme for wage reporting will work. 

Accuracy is one challenge. Wages reported to SSA by Equifax could simply be wrong, either as a result of how Equifax manages the data or how the employer reports the wages. Certain forms of employment-related income, such as paid leave, could be misclassified as wages. There could be problems attributing the wages of people outside the household to the benefit recipients. And, presumably, there are other possible inaccuracies or time lags that could cause improper benefit reductions. Meanwhile, some employers do not report wages to Equifax at all. How will recipients in such jobs be treated by SSA’s system if they have opted in to the automated wage reporting? There are also several other accuracy-related questions to consider. What accuracy standards will SSA require of Equifax? How often will SSA measure the accuracy and how will SSA make sure it takes an appropriate measure of accuracy? Does the contract require changes from Equifax to promptly improve accuracy and correct other deficiencies? Will SSA maintain a way to smoothly return–in a way that minimizes burdens on recipients–to other reporting mechanisms if Equifax does not meet sufficient accuracy standards? 

In the event of such inaccuracies, recipients face a complex burden of proving that income that SSA attributes to them is not actually theirs. In the context of real property or bank accounts noted above, Legal Aid of Arkansas’s clients have had to jump through repeated hoops—only passable with an attorney’s support—to prove that the out-of-state property or POD bank account does not actually belong to them. SSA can consider ways to reduce this burden by, for example, accepting simple attestations from recipients. If the inaccuracy comes from Equifax, the recipient should not need to also go through Equifax’s dispute process, which would double the burden. SSA can consider this sufficient and can consider reporting the inaccuracy to Equifax to be fixed within their database, so these inaccuracies do not persist within SSA’s future imports of Equifax’s data. 

Communication with recipients is another challenge. A regular stream of incoming wage data for people working in low-wage jobs with shifting schedules means that benefit levels could fluctuate monthly. That could prompt monthly notices that confuse or overwhelm recipients. Or, the timing of the wages reported via Equifax might not align with the way the recipient gets paid or understands their pay. This could require recipients to take extra steps to maintain their benefits, such as by calling or visiting field offices to reconcile what are relatively small differences. SSA can consider ways to ensure that the automated wage reporting does not simply replace monthly income reports required of recipients with monthly notices that prompt them to call.       

SSA could consider building tolerances for income fluctuations such that small resulting changes in benefit levels—say, $50 or less—do not trigger notices for a certain period of time. SSA could consider couching these as small overpayments and using existing waiver authority to waive any small resulting overpayments. Relatedly, perhaps SSA could consider averaging wage income over a set span of time (e.g., three or six months), make one determination about benefit levels for the next span, send one notice for that span, and allow for recipients to present evidence that the amount should be adjusted upwards (e.g., in the event of a lost job). This would function similar to certification periods in the Supplemental Nutrition Assistance Program or continuous eligibility for children in Medicaid.

Whatever the mechanism, recipients would benefit most from simplified benefit calculations and fewer notices.

III. Recipients, particularly those on SSI, are not sufficiently protected when their benefits are changed.

The NPRM indicates that SSDI and SSI recipients will be treated differently when the automated wage reporting system leads to reductions in benefit amounts. 

SSDI recipients will receive an advanced notice without any accompanying change in benefit amount. This notice allows recipients 35 days to respond with information showing that benefit amounts should not be changed. If the SSDI recipient does not respond, then the change will be implemented, triggering another notice that the SSDI recipient can then appeal.   

In contrast, SSI recipients will be subject to an adverse action and benefit reduction immediately without the advanced opportunity to cure. The only recourse for SSI recipients will be to appeal the decision. Meanwhile, the benefit reduction will be set to take effect before the recipient’s appeal window has closed. This leads to greater administrative complexity. And, whenever the person does appeal, on-the-ground advocates know that, in practice, benefits are not always promptly continued at pre-reduction levels even when SSA is mandated to do so. Of course, corrective action and payments are slow if they happen at all. 

SSI recipients would benefit from an advanced notice like the one SSDI recipients will receive. Indeed, SSI recipients face more danger, as they receive lower payments and often having Medicaid tied to continuing SSI eligibility. Given the complexity of the rules and equity considerations for disabled people, recipients should be given every opportunity to correct incorrect information before facing any kind of benefit reduction. 

Of course, the content of the notices is supremely important, including clear information about what is happening, what information SSA received from Equifax, and how to contest the decision at issue or accuracy of the information. 

IV. The technology infrastructure used for automated wage reporting threatens vendor lock and related problems. 

It is discouraging that Equifax offered the only bid for the SSA automated wage reporting contract. SSA will be making a fundamental change to program administration that depends entirely on Equifax, a company with a noted history of data breaches. This is a textbook example of vendor lock. 

Vendor lock will only enhance Equifax’s leverage for any future contract consideration. The dynamics subject benefits recipients and the wider public to the performance of a private entity with opportunities for predatory behavior and little chance of meaningful accountability. In the long run, SSA might consider ways to spur a more competitive environment to encourage other vendors to participate in this critical public function, particularly as some non-profit vendors like Code for America, Nava, and others have ramped up the scale of tech-focused public infrastructure projects (NOTE: we do not vouch for or endorse any particular vendors and include their names only as examples). Starting a more robust vendor engagement campaign could help in this regard. For example, SSA could start inviting all vendors operating in the space to understand SSA’s current technology, technology-staff interfaces, the specific technology SSA uses to interface with Equifax’s reporting system, and other information necessary to build potential vendors’ baseline knowledge to reduce future barriers to submitting bids.  

SSA may also consider ways to perform the same essential function in house, either by building the needed infrastructure or using existing or available data sources. For example, SSA currently has access to some wage reporting data. Is this insufficient for the task at hand? Could it be made sufficient without turning to outside data sources like Equifax’s the Work Number? SSA could also consider working with agencies like the United States Digital Service to lessen its dependence on external vendors.

V. Data privacy and security 

As mentioned, Equifax suffered a data breach that exposed the private information of over 143 million Americans. The data breach occurred after the United States’ Computer Emergency Readiness Team alerted the public of a vulnerability contained in Equifax’s systems. Equifax failed to detect the intrusion for months, only seeing it after they renewed a nine-months-expired certificate within their systems. 

Given the track record of Equifax, SSA can consider how to mitigate both the security risks of using this vendor in general, as well as the additional security risks of any technical infrastructure built to import or export data between SSA and Equifax. 

Additionally, SSA can consider ways to inform recipients of the potential privacy risks of their personal information being managed by an additional entity. Many recipients’ data may already be contained within both entities, presenting minimal additional risk. A plain-language explanation of these risks may help alleviate concern from recipients who are wary of the new approach but want to opt in.  

VI. Recipients require appropriate language access.

Field offices often fail to provide timely, accurate language services to people who primarily speak a language other than English. Recipients require full language access for all aspects of program administration. The introduction of automated wage reporting will add a new element to benefits management. As such, it is imperative that all related information–whether provided through written notices or verbal interaction–be provided in the recipient’s preferred language according to best practices for language access.  

To facilitate this, SSA can consider improving its language service capabilities, especially the availability of interpreters. SSA can also consider adopting standardized scripts for field office workers to use when explaining the automated wage reporting system so each person receives a thorough explanation. 

VII. Transparency and meaningful public reporting throughout the technology lifecycle are a critical component to risk mitigation.

Given the dynamics around the proposed automated wage reporting, SSA can consider ways to encourage more robust mechanisms for public accountability through the lifecycle of the technology. 

Of course, the public must have the maximal ability to understand prior to deployment the technology that Equifax and SSA will implement, including how it works, what potential problem points Equifax and SSA have identified, plans to work through such problem points, plans to identify and fix unanticipated and anticipated problems, and consideration for ways to revert to non-automated means in the event that the system produces widespread inaccuracies or other problems. This information can be posted publicly. SSA can consider engaging benefits recipients and their advocates in system design and provide appropriate support to benefits recipients to enable them to meaningfully participate. 

The system can be rigorously tested prior to deployment and deployed in stages to identify problems before all recipients who opt in become subject to it.    

In addition, the project can be subjected to thorough ongoing evaluation and reporting. For example, SSA can consider maintaining statistics about the number of people facing benefit reductions, the frequency of changes, the number and outcome of appeals, and related data. 

VIII. SSA’s suggestion of allowing recipients to call to request reconsideration will likely benefit recipients. 

SSA asks for “public input on expanding the methods which are available under our regulations to initiate a reconsideration.” Specifically, SSA posits the possibility that recipients be allowed to request reconsideration via a call. This option to call would likely aid benefit recipients, provided that phone lines are sufficiently staffed to field the number of calls. Presently, wait times to speak with  field office representatives can be lengthy and discourage phone-based interactions. In addition, the staff would need to be trained to ensure that conversations with recipients would easily be registered as requests for reconsideration without putting the burden on recipients to use a particular formulation to trigger the reconsideration request. 

We appreciate the opportunity to comment. If there are any questions, please contact Kevin De Liban at kdeliban@arlegalaid.org, Emily Paul at emily@upturn.org, or Emma Weil at emma@upturn.org.   

Sincerely, 

Kevin De Liban, Legal Aid of Arkansas

Emily Paul, Upturn

Emma Weil, Upturn