Existing law provides for various public social services programs administered by the State Department of Social Services, State Department of Health Care Services, and counties, including, among others, the California Work Opportunity and Responsibility to Kids (CalWORKs) program, under which each county provides cash assistance and other benefits to qualified low-income families and individuals, CalFresh, under which supplemental nutrition assistance benefits allocated to the state by the federal government are distributed to eligible individuals by each county, and the Medi-Cal program, under which qualified low-income individuals receive health care service. Existing law imposes various reporting and verification requirements on applicants and recipients of these public social services programs relating to identity, income, and assets, among other things.

This bill would, to the extent permitted under federal law, require state and county agencies to accept the reporting by an applicant or recipient of public social services of any lawfully required information, changes, and verification required by law that affect eligibility and benefit amounts, by any means available to the applicant or recipient, including, but not limited to, in person, by telephone, through facsimile, by email, or by any other electronic means. The bill would require the State Department of Social Services and the State Department of Health Care Services to implement this provision through all-county letters, provider bulletins or notices, policy letters, or similar instructions from the director of each department issued no later than July 1, 2024. To the extent this bill expands eligibility for county administered programs and by imposing additional duties on counties, this bill would impose a state-mandated local program.

Existing law continuously appropriates moneys from the General Fund to defray a portion of county costs under the CalWORKs program.

This bill would instead provide that the continuous appropriation would not be made for purposes of implementing the bill.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that with regard to certain mandates no reimbursement is required by this act for a specified reason.

With regard to any other mandates, this bill would provide that, if the Commission on State Mandates determines that the bill contains costs so mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above.

Date of Hearing: May 17, 2023

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Chris Holden, Chair

ABPCA Bill Id:AB 991

Author:(Alvarez) – As Introduced Ver:February 15, 2023

Urgency: No State Mandated Local Program: Yes Reimbursable: Yes

SUMMARY:

This bill requires state and county agencies to accept information from public social service applicants and recipients by any means available (in person, electronic) to the applicant or recipient.

Specifically, this bill requires state and county agencies to accept reporting by an applicant or recipient of public social services of any lawfully required information, changes, and verification required by law that affect eligibility and benefit amounts, by any means available to the applicant or recipient, including, but not limited to, in person, by telephone, through facsimile, by email, or by any other electronic means.

FISCAL EFFECT:

1. Estimated one-time General Fund (GF) automation costs in the low-tens of millions of dollars for changes to the statewide automated welfare system (CalSAWS) and ongoing costs of approximately $3 million to $4 million GF annually to handle the increased volume of emails and faxes.
2. Local costs to county social services agencies of an unknown amount, but potentially substantial, to process electronic communication and manage privacy and confidentiality issues associated with potentially exchanging confidential information via unsecured electronic means. These costs are potentially reimbursable by the state, subject to a determination by the Commission on State Mandates.
3. Estimated administrative costs to social services agencies of an unknown amount to administer increased caseloads to the extent this bill allows recipients who found it challenging to submit required information to either access or remain on aid who otherwise would have abandoned the process. Although these county costs are mandated by the state, they are not reimbursable, but instead must be paid by the state pursuant to Proposition 30 of 2012. Proposition 30 provides that legislation enacted after September 30, 2012, that has an overall effect of increasing the costs already borne by a local agency for programs or levels of service mandated by realignment (including child welfare services and foster care) applies to local agencies only to the extent the state provides annual funding for the cost increase.

COMMENTS:

1. Purpose. According to the author:

It is important that we modernize the functions of our government that are intended to serve Californians, especially those who are in need to access food to ensure their families don’t go hungry. We know that CalFresh and CalWORKs are two programs that heavily impact low-income families. This bill is necessary to prevent program participants from missing out on these benefits.

1. Background. California administers a number of public assistance programs to assist low-income individuals and families. Many of those programs are housed within the California Department of Social Services (CDSS) and then administered through each county. County human services agencies determine eligibility set forth by federal and state standards and then help disburse the aid to recipients. When a county agency is determining eligibility a county representative must communicate with the applicant or recipient. If there is a question of eligibility, an applicant must provide the requested information or risk being denied eligibility.

CalFresh, California’s version of the federal Supplemental Nutrition Assistance Program or SNAP, provides food assistance to those in need and is administered locally by county human services agencies. Individuals can complete the CalFresh application online, over the phone, in-person at their county CalFresh office, or through the mail.

California Work Opportunity and Responsibility to Kids (CalWORKs), part of the federal Temporary Assistance for Needy Families or TANF, is also administered at the local level through counties. BenefitsCal, which counties under CalSAWs utilize for CalWORKs processing, has the ability for secure document upload. In addition, counties still using the California Welfare Information Network before transitioning to CalSAWs at the end of 2023, also have secure document upload. Counties do not require in-person document or information drop-off, but it remains an option. Documents can also be mailed or dropped off in a secure dropbox.

According to the author and advocates, some applicants and recipients find it challenging to provide required information because a number of counties refuse to accept reports of changes of income or other circumstances or various verifications through email. They report, in some cases, beneficiaries are being accused of failure to report changes, leading to referral for welfare fraud and overpayments. This bill requires counties, to the extent permitted under federal law, to accept change reports and requested verification for social services programs administered by counties by any means the applicant can provide it to the welfare office, including by email.

Public social service applicants are required to disclose sensitive information including, but not limited to, name, address, phone number, and Social Security number. Information improperly collected can be used for scams, identify theft, and financial theft. The Cybersecurity and Infrastructure Security Agency (CISA) lists suggestions to protect sensitive and personal information. Among many, the CISA suggests encrypting sensitive information. This bill requires counties to accept information that is not secure and endangers personal information of applicants. Submitting unprotected data through an email poses a significant risk to the personal information of public social service applicants.

Analysis Prepared by: Jennifer Swenson / APPR. / (916) 319-2081

Date of Hearing: April 25, 2023

ASSEMBLY COMMITTEE ON HUMAN SERVICES

Corey A. Jackson, Chair

ABPCA Bill Id:AB 991 (

Author:Alvarez) – As Introduced Ver:February 15, 2023

SUBJECT: Public social services: reporting and verification

SUMMARY: Requires state and county agencies to accept information from public social service applicants and recipients in any form. Specifically, this bill:

1. Requires state and county agencies to accept reporting by an applicant or recipient of public social services of any lawfully required information, changes, and verification required by law that affect eligibility and benefit amounts, by any means available to the applicant or recipient, including, but not limited to, in person, by telephone, through facsimile, by email, or by any other electronic means.
2. Requires the California Department of Social Services (CDSS) and the Department of Health Care Services to implement this bill through all-county letters, provider bulletins or notices, policy letters, or similar instructions from the director of each department issued no later than July 1, 2024.
3. Prohibits appropriation pursuant to Welfare and Institutions Code Section (WIC) 15200 to implement this bill.
4. Provides, to the extent that this bill has an overall effect of increasing certain costs already borne by a local agency for programs or levels of service mandated by the 2011 Realignment Legislation within the meaning of Section 36 of Article XIII of the California Constitution, it shall apply to local agencies only to the extent that the state provides annual funding for the cost increase. Any new program or higher level of service provided by a local agency pursuant to this act above the level for which funding has been provided shall not require a subvention of funds by the state or otherwise be subject to Section 6 of Article XIII B of the California Constitution. Further, if the Commission on State Mandates determines that this act contains other costs mandated by the state, reimbursement to local agencies shall be made.

EXISTING LAW:

1. Declares that the administration of public social services is a county function and responsibility; requires each county to establish a department or agency to administer and promote public understanding of the public services. (WIC 10800)
2. Requires all applications or records concerning any individual made or kept by a public officer or agency in connection with the administration of this code relating to any form of public social services, including protective services provided through public social services agencies, for which grants-in-aid are received by this state to be confidential, and not be open to examination for any purpose not directly connected with the administration of that program, or any investigation, prosecution, or criminal or civil proceeding conducted in connection with the administration of that program. (WIC 10850)
3. Requires every person administering aid under any public assistance program to conduct themselves with courtesy, consideration, and respect toward applicants for, and recipients of, aid under that program, and to endeavor at all times to perform their duties in such manner as to secure for every person the amount of aid to which they are entitled, without attempting to elicit any information not necessary to carry out the provisions of law applicable to the program, and without comment or criticism of any fact concerning applicants or recipients not directly related to the administration of the program. (WIC 10500)
4. Prohibits a person concerned with the administration of a public assistance program from dictating how any recipient shall expend the aid granted to them. (WIC 10501)
5. Requires any decisions governing eligibility for Medi-Cal, California Work Opportunity and Responsibility for Kids (CalWORKs), or CalFresh are made exclusively by a merit or civil service employee of the county. (WIC 10503)
6. Requires, pursuant to the data breach notification law, that a person, business, or agency in California that owns or licenses computerized data that includes personal information to notify any California resident whose unencrypted personal information was acquired, or reasonably believed to have been acquired, by an unauthorized person by a breach of the security of the system or data. The notice must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as specified. (Civil Code Sections 1798.29(a), (c); 1798.82(a), (c).)

FISCAL EFFECT: Unknown, this bill has not been analyzed by a fiscal committee.

COMMENTS:

Background: California administers a number of public assistance programs to uplift those in poverty. Many of those programs are housed within CDSS and then administered by each county. When counties are determining eligibility to administer the public assistance, a county representative must communicate with the applicant or recipient which likely includes a telephone call. If there is a question of eligibility, an applicant must give the needed information or eligibility could be denied.

At the county level, California administers three federally funded safety net or public assistance programs: CalFresh (federally known as the Supplemental Nutrition Assistance Program or SNAP), CalWORKs (federally known as the Temporary Assistance for Needy Families or TANF), and Medi-Cal (federally known as Medicaid). Each county works to determine eligibility set forth by federal and state standards and then helps disburse the aid to recipients.

CalFresh uses federal funds to provide a nutrition benefit to individuals and families with low incomes. The United States Department of Agriculture (USDA) is responsible for setting specific eligibility requirements for programs like CalFresh including a gross and net income test, work requirements, and other documentation requirements. The maximum allowable gross income is 200% of the Federal Poverty Level (FPL). Households with elderly or disabled members are not subject to gross income criteria but must have a net monthly income at or below 100% of the FPL. Other households must meet both gross and net monthly income tests. CalFresh is administered locally by county human services agencies, and the federal, state, and county governments share in the cost of administration of the program. Individuals can complete the CalFresh application online, over the phone, in-person at their county CalFresh office, or through the mail.

CalFresh benefits are distributed through monthly electronic benefits for food purchase through an automated teller machine (ATM) like electronic benefits transfer (EBT) card. CalFresh recipients cannot access CalFresh funds through withdrawal at point-of-sale terminals or at ATM machines. Instead, CalFresh benefits can only be used to purchase food items to be prepared and consumed at home, as well as seeds and plants that can be grown at home and produce food.

The USDA reports that only 70% of eligible Californians are enrolled in SNAP (or CalFresh) benefits, compared to the national average of 82% of eligible persons in the country that are enrolled.

CalWORKs is also administered at the local level through counties. CalWORKs is funded in part by the federal TANF block grant and aims to help children and families meet basic needs and move out of poverty. Families receive cash assistance and have access to a variety of services, including, where applicable, child care, as well as services aimed at addressing mental health needs, substance use disorders, instances of domestic violence, and learning disabilities, among other issues. Parents are required to develop and participate in a welfare-to-work plan, unless otherwise exempted.

Counties’ current processes. Currently BenefitsCal, which all counties under the California Statewide Automated Welfare System (CalSAWs) utilize, has the ability for secure document upload. In addition, counties still utilizing California Welfare Information Network before transitioning to CalSAWs at the end of 2023, also have secure document upload. Counties do not require in-person document or information drop-off, but it remains an option. Documents can also be mailed or a dropped off in a secure dropbox.

CDSS has cited counties for encouraging any type of email verifications/documents from applicants because of the privacy risk associated with emailing personal, private documents, particularly because counties are liable for any of breach of privacy. When breaches do occur, California has strict requirements of informing those impacted which take time and resources from counties.

Data breaches in government. Government officials worldwide are regularly subjected to data breaches. Most government agencies require strict training to warn and make employees aware of the danger of data breaches. Among many other training points, trainings teach employees to handle sensitive information with caution to avoid data breaches that would cause detriment. A December 21, 2022, New York Times article entitled “How Hackers Used One Software Flaw to Take Down a County Computer System,” detailed how Suffolk County was subject to a cyberattack that forced 10,000 county employees emails to be disabled and private sensitive data was stolen. In another New York Times article entitled, “Hackers Breach U.S. Marshals System With Sensitive Personal Data,” chronicled the recent cyberattacks on government agencies. The article reported:

“There was a Russian attack on 250 federal agencies and businesses including Treasury, State, Commerce and Energy Departments, and even part of the Pentagon during Trump’s final year in office.

“In 2015, a “spate of government computers”…”stole the personal information of about 21.5 million people, including addresses, health and financial history, and other private details, from people who had been subjected to a government background check.”

According to the Attorney General’s Data Security Breach report, since 2013, 42 different county departments in California have reported a security breach to the Attorney General with almost half reporting a breach more than one time. The following are examples in the reports:

In Sacramento County’s Child, Family and Adult Services Department, on June 22, 2021, Sacramento County was the target of a malicious phishing campaign in an unknown threat actor obtained access to several employees’ credentials and began using those credentials to access the users’ Webmail. An internal investigation has determined that the exposed emails contained personally identifiable information.

Contra Costa County reported that, “on March 11, 2022, we completed an investigation regarding an incident of unauthorized access to certain County employee email accounts. Upon first learning of the activity, we immediately took steps to secure the email accounts and began the investigation with the assistance of a cybersecurity firm. The investigation determined that an unauthorized person accessed the accounts at various times between June 24, 2021 and August 12, 2021. The investigation was not able to determine whether any emails or attachments in the accounts were accessed or downloaded by the unauthorized individual; however, we were not able to rule out that possibility.”

California’s data breach notification law (DBNL). Effective 2003, California became the first state in the nation to require businesses and government agencies to notify residents of security breaches if private information was, or was reasonably believed to have been, stolen.

California has very specific guidelines on breach notification, and the notification must include, at a minimum, the following:

• The name and contact information of the reporting person or business;
• A list of the types of private information that were or are reasonably believed to have been the subject of a breach;
• Whether notification was delayed as a result of law enforcement investigation;
• A description of the breach incident;
• Toll-free phone numbers and addresses of the major credit reporting agencies, if the breach exposed a social security number, driver’s license or California identification card number; and,
• If the person or business making the notification was the source of the breach, then it must offer to provide identity theft prevention services at no cost for at least 12 months.

Author’s Statement: According to the Author, “It is important that we modernize the functions of our government that are intended to serve Californians, especially those who are in need to access food to ensure their families don’t go hungry. We know that Cal[Fresh] and CalWORK[s] are two programs that heavily impact low-income families. This bill is necessary to prevent program participants from missing out on these benefits.”

Need for this bill: Advocates claim county workers are denying applicants their aid without warning because information is being sent in an unsecure manner such as via email. This bill is attempting to solve this by requiring counties to accept any form of communication. It is unclear if the bill in-print will solve this problem.

Equity Implications: Access to public social services is key to eradicating poverty. The individuals in need of services come from home lives that may not allow for in-person information verification due to transportation, office hours, or limited physical ability. Electronic submission, that is secure, can provide an alternative way to ensure wider access and create equitable opportunities to receive aid.

Applicants and recipients of public social services are already experiencing a hardship that is causing need for assistance. This population is important to protect when possible including their information.

Policy Concerns: Public social service applicants are required to disclose sensitive information including, but not limited to, name, address, phone number, and Social Security number. Information that is improperly collected can be used for scams, identify theft, and/or financial theft.

According to Comparitech in an article entitled, “Government breaches – can you trust the US Government with your data?”, “Over the last four years, the average number of records involved per government data breach has increased. From 17,400 in 2019 to 42,097 in 2020 and 40,440 in 2021, the average number of records affected per breach in 2022 currently stands at 71,534.” California is not immune to privacy breaches. California has had 24.5 million breached records.

The Cybersecurity and Infrastructure Security Agency (CISA) lists suggestions to protect sensitive and personal information. Among many, the CISA suggests encrypting sensitive information. This bill requires counties to accept information that is not secure and endangers personal information of applicants. Submitting unprotected data through an email poses a significant risk to the personal information of public social service applicants. As such, it is crucial to weigh the cost of allowing public social services applicants to send unsecured emails against the cost of privacy breaches.

In addition to security concerns stated above, requiring counties to accept any form of communication does not solve county workers lack of communication. County workers communicating application deficiencies or incorrect information submitted to applicants is vital to timely services.

This bill in-print could cause more harm than benefit without protections added to the language to ensure consumer information is safe regardless of the modality the applicant chooses to utilize.

RELATED AND PRIOR LEGISLATION:

SB 1386 (Peace), Chapter 915, Statutes of 2002, required businesses and government agencies to notify residents of security breaches if private information was, or was reasonably believed to have been, stolen.

SB 46 (Corbett), Chapter 396, Statutes of 2013, revised certain data elements included within the definition of personal information under the DBNL, by adding certain information that would permit access to an online account and imposed additional requirements on the disclosure of a breach of the security of the system or data in situations where the breach involves personal information that would permit access to an online or email account.

REGISTERED SUPPORT / OPPOSITION:

Support

Coalition of California Welfare Rights Organizations (Co-Sponsor)

Western Center on Law & Poverty (Co-Sponsor)

California Family Resource Association

California OneCare

Child Abuse Prevention Center

Inland Counties Legal Services INC.

Justice in Aging

Law Foundation of Silicon Valley

Legal Aid Foundation of Los Angeles

National Association of Social Workers, California Chapter

Nourish California

Opposition

None on file

Analysis Prepared by: Alexandria Smith / HUM. S. / (916) 319-2089