July 8, 2022
The CASES Act: Implementation and Issues for Congress
The CASES Act is intended to modernize and simplify
Casework in a Congressional Office: Background, Rules,
what has been an inconsistent and variable process of
Laws, and Resources.
obtaining an individual’s written consent for information
disclosure. The act would enable constituents to provide
The process of manually obtaining a signed authorization
electronic authorization to additional parties, such as
and transmitting the form to an agency has been a time-
Members of Congress and their offices, to resolve
consuming process for both constituents and caseworkers,
constituent inquiries, compared to the current range of
which sometimes delays consideration of the case by an
requirements for verbal or email authorizations, or “wet”
agency. In addition, agencies across the federal government
signatures.
have required different versions of privacy release forms
specific to their agencies. Some agencies have accepted
The Creating Advanced Streamlined Electronic Services for
electronic versions of privacy authorizations from
Constituents Act of 2019, or the CASES Act (P.L. 116-50),
congressional offices in a variety of formats, despite
is designed to improve access to, and the efficiency of,
lacking clear authorization to do so. This has raised
government services and agencies for constituents by
casework management concerns in some congressional
updating the casework process for an increasingly digital
offices.
environment. Processing casework information often
requires the disclosure of the constituent’s individually
The Privacy Act of 1974
identifiable information to a congressional office, and is
The Privacy Act governs the disclosure of government
subject to disclosure restrictions under the Privacy Act of
information collected about individuals. Generally, the
1974 (5 U.S.C. 552a). Generally, the Privacy Act prohibits
statute establishes agency processes to determine lawful
disclosure of individually identifiable information by
uses of individually identifiable information and protect
federal agencies to third parties, including congressional
against unauthorized disclosure of the information. For
offices, without written consent.
more information about the Privacy Act, see CRS Report
R47058, Access to Government Information: An Overview.
The CASES Act requires the Office Management and
The Privacy Act
Budget (OMB) to issue guidance requiring agencies to
allows citizens of the United States or aliens lawfully
accept electronic identity proofing and authentication
admitted for permanent residence to access and correct
processes;
information collected on them by federal agencies;
create a template for electronic consent and access
restricts how and when these records may be shared to
forms and require posting of the templates on agency
third parties without an individual’s written consent; and
websites; and
allows agencies to share information on individuals for
require each agency to accept electronic consent and
select purposes without requiring the written consent of
access forms.
the individual (5 U.S.C. 552a(b)).
Agencies were required by November 21, 2021, to comply
OMB has interpreted the Privacy Act’s concept of
with OMB implementation guidance, contained in
individually identifiable information as personally
Memorandum M-21-04. Most agencies are still in the
identifiable information (PII). OMB defines PII in
process of putting procedures in place, however.
Memorandum M-07-16 as “information which can be used
to distinguish or trace an individual’s identity, such as their
Congressional Casework and Privacy
name, social security number, biometric records, etc.... ”
Most Members of Congress routinely solicit and respond to
Under statute, PII may only be shared with an entity that
requests from constituents for assistance with federal
has been designated by the individual. (In some cases, it
agencies. In general, agencies cannot reply to a
may be shared without the individual’s written consent
congressional inquiry without a Privacy Act release form
under one of the Privacy Act’s 12 exceptions described in 5
signed by the constituent requesting assistance. The form
U.S.C. 552a(b).)
authorizes the Member to access a constituent’s
individually identifiable information to assist in the
Implementation and Oversight
resolution of a case, and prevents the unauthorized
Under Memorandum M-21-04, agencies are required to
disclosure of individually identifying information. For more
provide a digital service option to individuals requesting
information on casework, see CRS Report RL33209,
access to their records or consenting to their disclosure.
They were also required to accept properly identity-proofed
https://crsreports.congress.gov
The CASES Act: Implementation and Issues for Congress
and authenticated electronic access and consent forms by
Oversight of the Routine Use Exception
November 2021. In addition, agencies must develop digital
Subject to the Privacy Act’s written consent requirement,
privacy release form templates consistent with those
information on an individual may be shared with other
provided by OMB.
persons, such as congressional caseworkers or government
agencies. However, the Privacy Act also provides 12
Implementation of these requirements must conform to
exceptions to the written consent requirement from
OMB Memorandum M-19-17, Enabling Mission Delivery
individuals, raising questions about the intended use of
through Improved Identity, Credential, and Access, and
these exceptions by government agencies. One of these
National Institute of Standards and Technology (NIST)
exceptions is the “routine use” exception, which was
Special Publication 800-63, Digital Identity Guidelines.
designed to allow individually identifiable information
Under these guidelines, agencies select the appropriate level
disclosures for purposes compatible with the original
of identity authentication based on the risks to the
information collection.
individual of unauthorized disclosure of the information.
Because these levels of identity authentication require
As described by the Department of Justice in its 2020
different levels of documentation and verification, agency
Overview of the Privacy Act of 1974,
decisions under these guidelines may vary despite the
CASES Act’s intent to simplify and expedite the process
Courts have generally held that routine use
for constituents and caseworkers.
disclosures to process an individual’s application
for a benefit, program participation, or a position
Congressional Oversight
are “compatible” disclosures under the routine use
On January 12, 2022, Representatives Gerald E. Connolly
disclosure exception.
and Jody Hice, chair and ranking member of the
Subcommittee on Government Operations of the House
This interpretation could expedite decisions related to
Committee on Oversight and Reform, sent joint letters
constituent casework, depending on the judgment of the
requesting information about the implementation of the
agency. Conversely, the routine use exception has also been
CASES Act. The letters were sent to the heads of five
generally interpreted to permit disclosures to further
federal agencies that frequently interact with congressional
investigations.
offices regarding constituent service issues. These agencies
are the Department of Veterans Affairs (VA); Internal
Agency and court interpretations of the routine use
Revenue Service (IRS); United States Citizenship and
exception may both help and hinder congressional
Immigration Services (USCIS); Social Security
casework. However, the application of routine use to
Administration (SSA); and Centers for Medicare and
benefits and program administration may warrant
Medicaid Services (CMS). CRS has not identified any
congressional interest. Congress, in its oversight efforts,
response from the agencies to the letters.
may consider directing agencies to proactively review their
interpretation of compatible routine uses to make agencies
Improving Constituent Services
more responsive and to improve constituent interactions
Through passage of the CASES Act, Congress sought to
with the federal government.
improve access and efficiency of government services by
modernizing the process of accessing individually
Continuing Digital Skills, Access Gaps
identifiable information for constituents. The law might
As electronic authorizations become more routine, a
afford agencies with opportunities to use evolving
potential concern is the issue of varying access to
technologies to manage inquiries from, and correspondence
computers and the skills to operate them among some
with, congressional offices and constituents. However,
constituents who might seek assistance from their
questions remain about whether implementation of the law
Members. This could present workload management
can fully streamline the constituent’s experience with the
challenges in some Member offices if constituents seek help
federal government.
from casework staff to complete electronic authorizations.
Constituents, Member offices, Congress, and executive
Interaction with Other Privacy Policies
agencies might not be able to take advantage of the full
The CASES Act authorizes the electronic release of
potential benefits of electronic authorizations in these
information protected by the Privacy Act for some
circumstances. Individual Member offices might consider
constituent service matters. It does not appear to provide
instituting office policies related to electronic authorization
similar processes to authorize electronic release of
processes. More broadly, Congress might consider how to
protected information pursuant to other privacy provisions.
address constituent service concerns as part of broader
These include the Health Insurance Portability and
policies meant to address and reduce disparities in access to
Accountability Act (HIPAA), which provides in part for the
technology and the skills to use those resources.
protection of individuals’ healthcare information, or USCIS
and other Department of Homeland Security entities’
Meghan M. Stuessy, Analyst in Government Organization
protection of information related to immigration cases. As
and Management
the CASES Act is implemented by executive agencies,
R. Eric Petersen, Specialist in American National
Congress might consider legislative and oversight options
Government
for expanding the scope of electronic authorizations to
incorporate other privacy policies.
IF12159
https://crsreports.congress.gov
The CASES Act: Implementation and Issues for Congress
Disclaimer
This document was prepared by the Congressional Research Service (CRS). CRS serves as nonpartisan shared staff to
congressional committees and Members of Congress. It operates solely at the behest of and under the direction of Congress.
Information in a CRS Report should not be relied upon for purposes other than public understanding of information that has
been provided by CRS to Members of Congress in connection with CRS’s institutional role. CRS Reports, as a work of the
United States Government, are not subject to copyright protection in the United States. Any CRS Report may be
reproduced and distributed in its entirety without permission from CRS. However, as a CRS Report may include
copyrighted images or material from a third party, you may need to obtain the permission of the copyright holder if you
wish to copy or otherwise use copyrighted material.
https://crsreports.congress.gov | IF12159 · VERSION 1 · NEW