Centers for Medicare and Medicaid Services (CMS) Acquisition Lifecycle (CALM) (This manages the contract acquisition process, including “writing contracts, tracking milestones, and performing contract audits.”)*
Vendor name, address, phone number, taxpayer ID number, employer ID number, etc.
Amy Gleason, Luke Farritor, Edward Coristine, Marko Elez, Aram Moghaddassi, Rachel Riley
CMS Healthcare Integrated General, Ledger Accounting System (HIGLAS) (This is one of HHS’s central accounting systems.)
SSN, Name, DOB, Financial account information, taxpayer ID, Health insurance claim, employee ID number, salary
Luke Farritor, Edward Coristine, Marko Elez, Aram Moghaddassi
CMS Integrated Data Repository Cloud (IDRC) (This is a “high-volume data warehouse integrating Medicare claims” with data from patients and healthcare providers.)
SSN, name, date of birth, email address, phone numbers, mailing address, medical records number, medical notes, health insurance claim number (HICN), unique physician, identification number (UPIN), race, sex, diagnosis, codes, procedure codes, user credentials
Luke Farritor, Edward Coristine, Marko Elez, Aram Moghaddassi, Zachary Terrell
NIH ES Electronic Research Administration (eRA) (This is the NIH’s system for processing research grant applications.)
SSN, name, date of birth, email address, mailing address, phone numbers, education, records, disability, persistent, digital identifiers, disadvantage background, user credentials, current position, affiliated organization, sex, demographic, information, professional, performance, and provincial history, service, payback obligation, financial data, employment data
Luke Farritor
NIH ES NIH Business System (NBS) (This includes “the general ledger, finance, budget, procurement, supply, travel, and property management systems.”)
SSN, name, email address, phone numbers, financial accountant, information, employment status, taxpayer ID, employee ID number
Luke Farritor, Rachel Riley
OS ASA OHR Enterprise Human Capital Management (EHCM) Investment (This is used by HHS to process its internal “personnel actions” and “administer benefits” to its employees.)
SSN, name, email address, phone numbers, certificates, education, records, military status, date of birth, photographic, identifiers, mailing address, financial account information, employment status, user credentials
ACF Expanded Federal Parent Locator Service (FPLS) FPLS comprises four systems critical to child support: 1) National Directory of New Hires, a database of employment data; 2) Federal Case Registry of Child Support Orders, a database of child, support cases and orders; 3) Debtor File which helps states collect delinquent child support; 4) Parent Child Support Portal, which provides a secure gateway for FPLS web applications (This houses information about children placed into foster care so that the relatives of these children can be notified.)
National Directory of New Hires (2025 draft): SSN, date of birth, name, mailing address, military status, employment status
Marko Elez, Aram Moghaddassi (both deactivated)
Integrated Contracts Expert system at CDC (This is HHS’s accounting system specific to the CDC.)
SSN, name, email address, employer ID number
Luke Farritor
Acquisition, Performance and Execution system at CDC (This is a platform for the CDC to procure private sector contracts and work.)
SSN, name, email address, employment, status, employer ID number
Luke Farritor
Grants.gov (This is a platform for people and organizations to apply for government grants.)
Unaccompanied Alien Children ACF Unaccompanied Children Portal (This houses the information about unaccompanied children that is collected by Customs and Border Protection after the children are apprehended.)
Manages a large amount of information, including personal information, medical notes, educational information, and sponsorship information. There are four major groups of individuals:1. UCs—information includes: name, DOB, a number, photographs, biometrics, medical notes, country of birth, education, information, progress reports.2. Sponsors—information includes: name, DOB, SSN, email address, drivers license number, passport number, phone number(s), mailing address, financial account information, employment, status, and income information, legal documents, marital status, gender, country of residency3. Sponsor’s household—information includes: names, DOBs, gender, age, and relationship to UC4. System users — name, email address, phone number, fax number, mailing address, username, password, and roll/privileges
Kyle Schutt
Component: Financial Business Intelligence Systems Name of ATO Boundary: Unified Financial Management System Portfolio (The FBIS “retrieves, combines, consolidates, and reports data from the core financial system.” The UFMS is one of the three major core accounting systems at HHS.)
Business Intelligence Information System-Cloud (This houses HHS “payroll, time and attendance, personnel, and recruiting data.”)
SSN, mother, maiden name, user credentials, email address, date of birth, mailing address, name, phone numbers, military status, employment status, financial account info
Rachel Riley
HRSA Electronic Handbooks (This platform lets officials sign documents that create binding government contracts.)
Name, email address, phone number numbers, taxpayer ID, mailing address, user credentials, others—fax no.
Zachary Terrell, Jeremy Lewin, Conor Fennessy
Unified Financial Management System (This is HHS’s “integrated department-wide financial management system.”)
