April 13, 2023
The CASES Act: Implementation Challenges
The Creating Advanced Streamlined Electronic Services for
accept the access and consent forms from any individual
Constituents Act of 2019, or the CASES Act (P.L. 116-50,
properly identity-proofed and authenticated through
5 U.S.C. 101 note), is designed to improve access to, and
digital channels for the purpose of individual access to
efficiency of, government services and agencies for
records or for authorizing disclosure of the individual’s
individuals by updating the process of authorizing access to
records to another person or entity, including a
certain government information in an increasingly
congressional office.
ubiquitous digital environment. As described in S.Rept.
116-50, the act is intended to modernize and simplify what
CASES Act Implementation
had become an inconsistent and variable process of
Agencies were required by November 2021 to comply with
obtaining an individual’s written consent for information
OMB implementation guidance. The extent to which
disclosure. The CASES Act aims to enable individuals to
agencies have complied with congressional and OMB
provide electronic authorization to additional parties,
requirements related to the CASES Act varies.
including Members of Congress assisting with casework
matters. It does so by amending the Privacy Act of 1974 (5
On January 12, 2022, Representatives Gerald E. Connolly
U.S.C. 552a) to amend paper-based requirements and “wet”
and Jody Hice, then chair and ranking member,
signatures on paper forms with a requirement that agencies
respectively, of the Subcommittee on Government
provide means to accept digital authorizations. For further
Operations of the House Committee on Oversight and
consideration of casework and the CASES Act, see CRS In
Reform (the committee was renamed Oversight and
Focus IF12159, The CASES Act: Implementation and Issues
Accountability at the beginning of the 118th Congress
for Congress; and CRS Report RL33209, Casework in a
[2023-2024]), sent joint letters requesting information about
Congressional Office: Background, Rules, Laws, and
the implementation of the CASES Act. The letters were
Resources.
sent to the heads of five federal agencies that frequently
interact with congressional offices regarding constituent
The CASES Act required the Office of Management and
service issues: Department of Veterans Affairs (VA);
Budget (OMB) to issue guidance requiring agencies to
Internal Revenue Service (IRS); United States Citizenship
and Immigration Services (USCIS); Social Security
accept electronic identity proofing and authentication
Administration (SSA); and Centers for Medicare and
processes for individuals to consent to gaining personal
Medicaid Services (CMS). The Congressional Research
access to, or the disclosure of, an individual’s records in
Service (CRS) has not identified any publicly available
possession of a federal agency to another party;
response from the agencies to the letters.
create templates for electronic consent and access forms
On January 17, 2023, CRS made a preliminary assessment
and require posting of the templates on agency websites;
of the websites of 85 federal entities that typically have
and
interactions with congressional offices seeking casework
assistance on behalf of constituents to examine the extent of
accept electronic consent and access forms.
compliance with congressional and OMB instructions.
Entities included all departments; selections of department
OMB issued guidance in Memorandum M-21-04,
subentities (e.g., for the Department of Defense, the
“Modernizing Access to and Consent for Disclosure of
military branches, and other DOD civilian subentities); for
Records Subject to the Privacy Act,” on November 12,
DHS, USCIS, U.S. Immigration and Customs Enforcement
2020, and required agencies to
(USICE), and U.S. Secret Service (USSS); and selections of
independent agencies (e.g., SSA and the U.S. Consumer
accept remote identity proofing and authentication to
Product Safety Commission). A list of entities assessed is
allow an individual to request access to their records or
available to congressional offices upon request.
to provide prior written consent authorizing disclosure
Of the 85 entities assessed
of their records under the Privacy Act;
17 had web addresses that OMB directed as the landing
post on the agency website’s privacy program page
page (www.[agency].gov/privacy) for access to CASES
(www.[agency].gov/privacy) the forms developed using
Act-mandated forms.
OMB-provided templates, as customized by the agency;
66 had privacy landing pages available at a wide variety
update all relevant portions of the agency website that
of web addresses. Two entities had no identifiable
pertain to obtaining access to records with forms and
privacy landing pages.
instructions on how to submit requests digitally; and
https://crsreports.congress.gov
The CASES Act: Implementation Challenges
Of the 83 entities with privacy landing pages, none
and individuals. This might be of particular concern in
appeared to provide direct access to CASES Act-mandated
agencies where privacy management activities are
forms there. Ten entities appeared to require paper-only
colocated with entities responsible for responding to
submission for Privacy Act releases at other web addresses.
Freedom of Information Act queries or other government
Six entities provide CASES Act-mandated forms or similar
information requests.
templates, but require different processes to submit
requests; two of those agencies require applicants to
Congress might consider technical and administrative
provide written signatures, while another responds to all
options to improve the efficiency and effectiveness of
requests via the United States Postal Service.
digital authorization procedures through legislative and
administrative means.
Congressional Considerations
The extent of apparent compliance with congressional
Uniform Privacy Landing Pages
requirements and OMB guidance might raise questions
Among the agencies that provide CASES Act-mandated
about the CASES Act’s capacity to streamline privacy
forms or similar templates, the web addresses for each are
authorizations in a digital environment. This might also
not consistent, or readily identifiable through search.
raise questions about the act’s capacity to make
Similarly, despite OMB guidance for access to CASES Act-
congressional casework processes more efficient. Congress
mandated forms (www.[agency].gov/privacy), agency
might consider the following matters if it were to engage in
privacy pages are not addressed or accessible in a consistent
further legislative or oversight endeavors related to the
manner. Other common iterations of addresses included
CASES Act.
www.[agency].gov/privacy-policy, among others.
Getting Authorizations to the Right Places
These challenges might dissuade users from engaging the
websites or accessing CASES Act-mandated forms or
The CASES Act is intended to streamline access
similar templates on websites where they are available. On
authorization for constituents seeking casework assistance
sites where CASES Act-mandated forms or similar
from congressional offices. In order to start a case,
templates do not appear to be available, the lack of
congressional offices interact with agencies through
consistent website addressing might raise questions about
legislative liaison offices. These agency offices take
the availability of required digital access to forms. This
complete casework files, including a statement of the
constituent’s problem and a Privacy Act
could potentially limit the CASES Act’s ability to better
waiver or other
support Congress’s constituent service activities.
releases discussed below, which are then directed to the
appropriate office elsewhere within the agency for
While OMB has already published guidance requiring
response. It is unclear how an agency privacy office or
consistent web availability of CASES Act forms in
other entity that addresses privacy concerns might be best
Memorandum M-21-04 and general website standards in
positioned to support that effort.
M-17-06, the lack of implementation consistency may
suggest a role for Congress in conducting oversight of
Under the CASES Act and related OMB guidance, the
OMB or agencies, or future avenues for legislation to
process of a citizen providing digital authorization to
statutorily require agency privacy pages and content.
release information provides no designated mechanism to
move a digital privacy release within the agency from the
Other Privacy Policies Related to Constituent
privacy management offices to legislative liaison offices. In
Service
addition to intra-agency communications concerns, there
The CASES Act authorizes the electronic release of
appears to be no designated process for the agency to
information protected by the Privacy Act for some matters,
provide evidence of a completed, identity-verified
including constituent service. It does not appear to provide
authorization to a congressional office or the constituent
similar processes to authorize electronic release of
making the request. This may raise questions about the
protected information pursuant to other privacy provisions.
ability of a congressional office to initiate a case with an
These include the Health Insurance Portability and
agency when using a digital privacy release.
Accountability Act (HIPAA), which provides in part for the
Taken together, these concerns might limit the extent to
protection of individuals’ healthcare information, or USCIS
which the CASES Act, under current implementation
and other Department of Homeland Security (DHS)
guidance, streamlines the privacy release process in
entities’ protection of information related to immigration
casework matters. These limitations could also affect the
cases, all of which may be needed for constituent service
ability of congressional offices to monitor cases in their
purposes, and could present congressional offices with
offices, or for citizens to know where their requests stand.
multiple methods to obtain privacy authorizations from
constituents. As executive agencies continue to implement
A potential solution might be to direct privacy
the CASES Act, Congress might consider legislative and
authorizations related to casework through agency
oversight options for expanding the scope of electronic
legislative liaison offices. At the same time, digital
authorizations to incorporate other privacy policies.
authorizations for individuals to see records about them
held by government entities that are not related to
R. Eric Petersen, Specialist in American National
congressional casework might not be appropriate for
Government
handling through legislative liaison offices. Separate
processes for casework and other inquiries might cause
IF12382
misunderstandings between agencies, congressional offices,
https://crsreports.congress.gov
The CASES Act: Implementation Challenges
Disclaimer
This document was prepared by the Congressional Research Service (CRS). CRS serves as nonpartisan shared staff to
congressional committees and Members of Congress. It operates solely at the behest of and under the direction of Congress.
Information in a CRS Report should not be relied upon for purposes other than public understanding of information that has
been provided by CRS to Members of Congress in connection with CRS’s institutional role. CRS Reports, as a work of the
United States Government, are not subject to copyright protection in the United States. Any CRS Report may be
reproduced and distributed in its entirety without permission from CRS. However, as a CRS Report may include
copyrighted images or material from a third party, you may need to obtain the permission of the copyright holder if you
wish to copy or otherwise use copyrighted material.
https://crsreports.congress.gov | IF12382 · VERSION 1 · NEW