The CASES Act: Ongoing Implementation Challenges
Updated April 5, 2024
The CASES Act: Ongoing Implementation Challenges
The Creating Advanced Streamlined Electronic Services for
respectively, of the Subcommittee on Government
Constituents Act of 2019, or the CASES Act (P.L. 116-50,
Operations of the House Committee on Oversight and
5 U.S.C. 101 note), is designed to improve access to, and
Reform, sent joint letters requesting information about the
efficiency of, government services and agencies for
implementation of the CASES Act. The letters were sent to
individuals by updating the process of authorizing access to
the heads of five federal agencies that frequently interact
certain government information in a nearly ubiquitous
with congressional offices regarding constituent service
digital environment. As described in S.Rept. 116-50, the act
issues: Department of Veterans Affairs (VA); Internal
is intended to modernize and simplify what had become an
Revenue Service (IRS); United States Citizenship and
inconsistent and variable process of obtaining an
Immigration Services (USCIS); Social Security
individual’s written consent for information disclosure. The
Administration (SSA); and Centers for Medicare and
CASES Act aims to enable individuals to provide electronic
Medicaid Services (CMS). The Congressional Research
authorization to additional parties, including Members of
Service (CRS) has not identified any publicly available
Congress assisting with casework matters. It does so by
response from the agencies to the letters.
amending the Privacy Act of 1974 (5 U.S.C. 552a) to
amend paper-based requirements and “wet” signatures on
On January 17, 2023, CRS made a preliminary assessment
paper forms with a requirement that agencies provide
of the websites of 85 federal entities that typically have
means to accept digital authorizations.
interactions with congressional offices seeking casework
assistance on behalf of constituents to examine the extent of
The CASES Act required the Office of Management and
compliance with congressional and OMB instructions.
Budget (OMB) to issue guidance requiring agencies to
Entities included all departments; selections of department
accept electronic identity proofing and authentication
subentities (e.g., for the Department of Defense, the
processes for individuals to consent to gaining personal
military branches and other DOD civilian subentities; for
access to, or the disclosure of, an individual’s records in
DHS, USCIS, U.S. Immigration and Customs Enforcement
possession of a federal agency to another party; create
(USICE), and U.S. Secret Service (USSS)); and selections
templates for electronic consent and access forms and
of independent agencies (e.g., SSA and the U.S. Consumer
require posting of the templates on agency websites; and
Product Safety Commission). A list of entities assessed is
accept electronic consent and access forms.
available to congressional offices upon request.
OMB issued guidance in Memorandum M-21-04,
Of the 85 entities assessed
“Modernizing Access to and Consent for Disclosure of
Records Subject to the Privacy Act,”
•
on November 12,
17 had web addresses that OMB directed as the landing
2020, and required agencies to accept remote identity
page (www.[agency].gov/privacy) for access to CASES
proofing and authentication to allow an individual to
Act-mandated forms.
request access to their records or to provide prior written
•
consent authorizing disclosure of their records under the
66 had privacy landing pages available at a wide variety
Privacy Act; post on the agency website’s privacy program
of web addresses. Two entities had no identifiable
page (www.[agency].gov/privacy) the forms developed
privacy landing pages.
using OMB-provided templates, as customized by the
agency; update all relevant portions of the agency website
Of the 83 entities with privacy landing pages, none
that pertain to obtaining access to records with forms and
appeared to provide direct access to CASES Act-mandated
instructions on how to submit requests digitally; and accept
forms there. Ten entities appeared to require paper-only
the access and consent forms from any properly identity-
submission for Privacy Act releases at other web addresses.
proofed individual for the purpose of individual access to
Six entities provide CASES Act-mandated forms or similar
records or for authorizing disclosure of the individual’s
templates, but require different processes to submit
records to another person or entity, including a
requests; two of those agencies require applicants to
congressional office.
provide written signatures, while another responds to all
requests via the U.S. Postal Service.
CASES Act Implementation
Agencies were required by November 2021 to comply with
CRS reassessed the same entities’ privacy websites on April
OMB implementation guidance. The extent to which
1, 2024, and did not identify any changes.
agencies have complied with congressional and OMB
Congressional Considerations
requirements related to the CASES Act varies.
The extent of apparent compliance with congressional
On January 12, 2022, Representatives Gerald E. Connolly
requirements and OMB guidance might raise questions
and Jody Hice, then chair and ranking member,
about the CASES Act’s capacity to streamline privacy
https://crsreports.congress.gov
The CASES Act: Ongoing Implementation Challenges
authorizations in a digital environment. This might also
Uniform Privacy Landing Pages
raise questions about the act’s capacity to make
Among the agencies that provide CASES Act-mandated
congressional casework processes more efficient. Congress
forms or similar templates, the web addresses for each are
might consider the following matters if it were to engage in
not consistent, or readily identifiable through search.
further legislative or oversight endeavors related to the
Similarly, despite OMB guidance for access to CASES Act-
CASES Act.
mandated forms at (www.[agency].gov/privacy), other
OMB guidance makes that address the destination of other
Getting Authorizations to the Right Places
privacy-related policies that do not appear to have a direct
The CASES Act is intended to streamline access
connection to digital privacy authorizations. These include
authorization for constituents seeking casework assistance
some agency policies regarding the agency website,
from congressional offices. In order to start a case,
including types of personal information collected or web
congressional offices interact with agencies through
cookie policy. Some agencies also note prohibitions of use
legislative liaison offices. These agency offices take
of their agency name, seal, or emblems. In addition, agency
complete casework files, including a statement of the
privacy pages are not addressed or accessible in a consistent
constituent’s problem and a Privacy Act waiver or other
manner.
releases discussed below, which then travel together to the
appropriate office elsewhere within the agency for
These challenges might dissuade users from identifying or
response. In its current implementation, the CASES Act
engaging the websites or accessing CASES Act-mandated
would appear to separate a constituent’s Privacy Act release
forms or similar templates on websites where they are
from a statement of the problem for which they are asking
available. On sites where CASES Act-mandated forms or
congressional assistance. It is unclear how the release and
similar templates do not appear to be available, the lack of
statement of the problem might be reunited, or how an
consistent website addressing might raise questions about
agency privacy office or other entity that addresses privacy
the availability of required digital access to forms. This
concerns might be best positioned to support that effort.
could potentially limit the CASES Act’s ability to better
support Congress’s constituent service activities.
Under the CASES Act and related OMB guidance, the
process of a citizen providing digital authorization to
While OMB has already published guidance requiring
release information provides no designated mechanism to
consistent web availability of CASES Act forms in
move a digital privacy release within the agency from the
Memorandum M-21-04 and general website standards in
privacy management offices to legislative liaison offices. In
M-17-06, “Policies for Federal Agency Public Websites and
addition to intra-agency communications concerns, there
Digital Services,” the lack of implementation consistency
appears to be no designated process for the agency to
may suggest a role for Congress in conducting oversight of
provide evidence of a completed, identity-verified
OMB or agencies, or future avenues for legislation to
authorization to a congressional office or the constituent
statutorily require agency privacy pages and content.
making the request. This may raise questions about the
ability of a congressional office to initiate a case with an
Other Privacy Policies Related to Constituent
agency when using a digital privacy release.
Service
The CASES Act authorizes the electronic release of
Taken together, these concerns might limit the extent to
information protected by the Privacy Act for some matters,
which the CASES Act, under current implementation
including constituent service. It does not appear to provide
guidance, streamlines the privacy release process in
similar processes to authorize electronic release of
casework matters. These limitations could also affect the
protected information pursuant to other privacy provisions.
ability of congressional offices to monitor cases in their
These include the Health Insurance Portability and
offices, or for citizens to know where their requests stand.
Accountability Act (HIPAA), which provides in part for the
protection of individuals’ health care information, or
A potential solution might be to direct privacy
USCIS and other Department of Homeland Security (DHS)
authorizations related to casework through agency
entities’ protection of information related to immigration
legislative liaison offices. At the same time, digital
cases, all of which may be needed for constituent service
authorizations for individuals to see records about them
purposes, and could present congressional offices with
held by government entities that are not related to
multiple methods to obtain privacy authorizations from
congressional casework might not be appropriate for
constituents. As executive agencies continue to implement
handling through legislative liaison offices. Separate
the CASES Act, Congress might consider legislative and
processes for casework and other inquiries might cause
oversight options for expanding the scope of electronic
misunderstandings between agencies, congressional offices,
authorizations to incorporate other privacy policies.
and individuals. This might be of particular concern in
agencies where privacy management activities are
For further consideration of casework and the CASES Act,
colocated with entities responsible for responding to
see CRS In Focus IF12159, The CASES Act:
Freedom of Information Act queries or other government
Implementation and Issues for Congress; and CRS Report
information requests.
RL33209, Casework in a Congressional Office.
Congress might consider technical and administrative
options to improve the efficiency and effectiveness of
R. Eric Petersen, Specialist in American National
digital authorization procedures through legislative and
Government
administrative means.
IF12382
https://crsreports.congress.gov
The CASES Act: Ongoing Implementation Challenges
Disclaimer
This document was prepared by the Congressional Research Service (CRS). CRS serves as nonpartisan shared staff to
congressional committees and Members of Congress. It operates solely at the behest of and under the direction of Congress.
Information in a CRS Report should not be relied upon for purposes other than public understanding of information that has
been provided by CRS to Members of Congress in connection with CRS’s institutional role. CRS Reports, as a work of the
United States Government, are not subject to copyright protection in the United States. Any CRS Report may be
reproduced and distributed in its entirety without permission from CRS. However, as a CRS Report may include
copyrighted images or material from a third party, you may need to obtain the permission of the copyright holder if you
wish to copy or otherwise use copyrighted material.
https://crsreports.congress.gov | IF12382 · VERSION 3 · UPDATED