AAMVA HAVV Agreement template

INFORMATION EXCHANGE AGREEMENT
BETWEEN
THE AMERICAN ASSOCIATION OF MOTOR VEHICLE
ADMINISTRATORS (AAMVA)
AND
THE SOCIAL SECURITY ADMINISTRATION (SSA)
FOR ADMINISTRATION OF
VOTER REGISTRATION INFORMATION
VERIFICATION SYSTEM SERVICES
Effective: October 1, 2022
Expires: September 30, 2027

I.

Purpose
The purpose of this information exchange agreement (Agreement) is to establish the
terms, conditions, and safeguards under which the American Association of Motor
Vehicle Administrators (AAMVA) will provide connectivity, billing services, and staff a
help desk to the Motor Vehicle Administrations (MVA) of States, District of Columbia,
and the territories of the United States, for the Social Security Administration (SSA). In
this Agreement, “State” refers to the states, District of Columbia, and the territories of the
United States. SSA will, through AAMVA’s network, provide partial or full Social
Security number (SSN) verification of certain voter registration information to the State
MVAs for their use in the registration of voters for elections for Federal office.

II.

Legal Authority
SSA will provide partial or full SSN verifications in accordance with the Help America
Vote Act of 2002, Public Law (Pub. L.) No. 107-252, 52 U.S.C. § 21083 (HAVA),
sections 205(r)(9) and 1106 of the Social Security Act (Act) (42 U.S.C. §§ 405(r)(9) and
1306), the regulations promulgated under the Act (20 C.F.R. §§ 401.120 and 401.150(c)),
and the Privacy Act, as amended, 5 U.S.C. § 552a(b)(3).
HAVA requires the official responsible for the State MVA to enter into an agreement
with the Commissioner of Social Security for the purpose of verifying applicable
information under section 205(r)(9) of the Act. 52 U.S.C. § 21083(a)(5)(B)(ii).
Section 205(r)(9)(B) of the Act authorizes the Commissioner of Social Security to
determine appropriate time, place, and manner for SSA to provide the voter registration
verification services to State MVAs under HAVA. 42 U.S.C. § 405(r)(9)(B). Under this
authority, the Commissioner has determined that it is most appropriate for SSA to
provide the voter registration verification by interacting electronically with AAMVA,
which will serve as a conduit between the State MVAs and SSA under this Agreement.
There will be no direct voter registration information verification process between MVAs
and SSA.
As authorized by the Department of Justice and section 205(r)(9) of the Act, SSA may
provide the MVA through the AAMVAnet® network: (1) a partial SSN verification of
applicants for voter registration who provide the last 4 digits of their SSN instead of a
driver’s license number; or (2) SSA may provide a full SSN verification concerning
applicants for voter registration to qualified MVAs that meet the requirements of
52 U.S.C. § 21083(a)(5)(D).

III.

Responsibilities of the Parties
A. SSA’s Responsibilities
1. SSA will provide online verification of partial or full SSNs for new voter
registration as authorized via AAMVA’s AAMVAnet® network, which will serve

as the conduit to transmit information to, and receive information from, SSA on
behalf of MVAs.
2. SSA will compare the information submitted through AAMVAnet® with the
information in SSA’s Master Files of Social Security Number (SSN) Holders and
SSN Applications (Enumeration System) system of records, 60-0058, and respond
to the MVAs with one of the following alphanumeric response codes:
S = Invalid Input Data
T = Multiple Matches deceased
V = Multiple Matches Alive
W = Multiple Matches Mixed
X = Single Match Alive
Y = Single Match Deceased
Z = No Match
9 = System Error
3. SSA will make this service available according to the Service Level Objectives
described in Attachment A.
B. AAMVA’s Responsibilities
1. AAMVA will operate and maintain its AAMVAnet® network to serve as the
conduit between SSA and MVAs that receive from SSA online partial or full SSN
verification service for new voter registration. AAMVA will define SSA as an
authorized user to allow SSA network access to AAMVAnet® for the purpose of
carrying out the verification service as provided in this Agreement.
2. Each MVA will submit a single verification request at a time over the timeframe
deemed appropriate to their voter registration process. The information submitted
to SSA via AAMVA’s AAMVAnet® network must include the following:
a. The applicant’s name (including first name and any family forename or
surname);
b. The applicant’s date of birth (including month, day, year); and
c. The applicant’s SSN as either:
i. the last four digits of the applicant’s SSN; or
ii. the full SSN when applicable from an MVA authorized under
52 U.S.C. § 21083(a)(5)(D).
3. AAMVA will return the verification results from SSA to the appropriate MVAs
for subsequent distribution to the voter registration authorities. AAMVA is
responsible for the timeframe of AAMVA’s distribution of verification results to
the appropriate MVAs.

3

4. AAMVA will devise a method to identify the origin of each request so that
AAMVA can: (a) return verification results to the proper jurisdiction; and (b)
identify the requesting MVA for service usage billing purposes.
5. AAMVA will take all precautions to prevent the information from being
intercepted by other persons or entities, including other entities that may use
AAMVAnet® or utilize AAMVA’s services. AAMVA will comply with all of
the privacy protection and systems security requirements as set forth in Section IV
of this Agreement.
6. AAMVA will transmit information to SSA only for those MVAs that have signed
separate information exchange agreements with SSA that allow MVAs to receive
SSA data for new voter registration. A list of the MVAs with signed information
exchange agreements with SSA is available at https://www.ssa.gov/open/havv/.
AAMVA can also contact SSA’s Project Coordinator with questions regarding the
separate MVA agreements. AAMVA is strictly prohibited from transmitting to
SSA information from private companies or any users outside the U.S.A., except
for MVAs in territories or possessions of the U.S.A., if such entities use
AAMVAnet® to submit to SSA information for verification service for new voter
registration.
7. Upon written notification from SSA that a State Agency has breached or
terminated its agreement with SSA, AAMVA will immediately discontinue
transferring SSA data to that State Agency.
8. AAMVA will provide technical assistance and guidance to SSA relating to this
project, including technical assistance to SSA telecommunications technicians
responsible for implementing and maintaining the network connection and the
application interface processes. AAMVA will provide SSA with an operational
support 7 days a week, 24 hours a day.
9. AAMVA will be responsible for establishing fees, billing, and collection from
MVAs for the full cost of providing SSA’s verification services through
AAMVAnet®. AAMVA will reimburse SSA, in advance, for such services in
accordance with Section VI of this Agreement.
IV.

Privacy Protection and Systems Security Requirements
A. Privacy Protection
1. The data SSA provides through AAMVAnet® under this Agreement will remain
the property of SSA. AAMVA will not save any data pertaining to individuals in
any form after the data exchange with SSA is complete under terms of this
Agreement. AAMVA will only maintain metadata, such as the transaction
date/time, origin, destination, and delivery status to support transaction counts,
billing, and troubleshooting.
4

2. AAMVA will not use the data provided by SSA to extract information concerning
individuals for any purpose not specified in this Agreement.
3. AAMVA will protect the data provided under this Agreement by complying with
the privacy protection restrictions of the Privacy Act; related Office of
Management and Budget (OMB) guidelines; the Federal Information Security
Management Act of 2002, as amended by the Federal Information Security
Modernization Act of 2014; and related National Institute of Standards and
Technology guidelines.
4. AAMVA will inform all employees, contractors, or agents who access, use, or
disclose the data provided under this Agreement that if they use the data in a
manner or for a purpose not authorized by this Agreement, they are subject civil
and criminal sanctions contained in applicable Federal statutes and regulations.
B. Systems Security Requirements
1. AAMVA will safeguard the data provided under this Agreement by complying
with all administrative, technical, and physical security requirements of SSA’s
Systems Security Requirements (SSR) as set forth in Electronic Information
Exchange Security Requirements and Procedures for State and Local Agencies
Exchanging Electronic Information with the Social Security Administration
(Attachment B).
2. If AAMVA does not comply with SSA’s SSR on the effective date of this
Agreement or remain in compliance with SSA’s SSR throughout the life of this
Agreement, SSA has the right to suspend the SSN verification request through
AAMVAnet®. SSA may, at its discretion, allow the AAMVA system to continue
to send and receive SSN verification requests to SSA, provided that AAMVA
submits to SSA a plan to eliminate the deficiencies acceptable to the Director of
the Division of Compliance and Oversight (DCOVer), Office of Information
Security. AAMVA must submit such plan to the Director of DCOVer within 30
days of the effective date of this Agreement if AAMVA is not in compliance with
SSA’s SSR as of the effective date or within 30 days of the time AAMVA
becomes aware that it is not in compliance with SSA’s SSR.
3. SSA and AAMVA will adopt policies and procedures to ensure that they will use
the information obtained from each other in accordance with the terms and
conditions of this Agreement and any applicable laws.
C. Safeguarding and Reporting Responsibilities for Personally Identifiable
Information (PII):
1. AAMVA will ensure that its employees, contractors, and agents:
a. Properly safeguard PII furnished by SSA under this Agreement from loss,
5

b.
c.
d.
e.

theft, or inadvertent disclosure;
Understand that they are responsible for safeguarding this information at
all times, regardless of whether or not its employee, contractor, or agent is
at his or her regular duty station;
Ensure that laptops and other electronic devices/media containing PII are
encrypted and/or password protected;
Send emails containing PII only if encrypted and if to and from addresses
that are secure; and
Limit disclosure of the information and details relating to a PII loss only to
those with a need to know.

2. If an employee of AAMVA or an employee of AAMVA’s contractor or agent
becomes aware of suspected or actual loss of PII, he or she must contact the
AAMVA official responsible for Systems Security designated below, or his or her
delegate, within one hour of learning of the suspected or actual loss of PII. That
AAMVA official or delegate must then notify the SSA Project Coordinator and
the SSA Systems Security Contact identified below. If, for any reason, the
responsible AAMVA official or delegate is unable to notify the SSA Project
Coordinator or the SSA Systems Security Contact within one hour of learning of a
suspected or actual loss of PII, the responsible AAMVA official or delegate must
report the incident by contacting SSA’s National Network Service Center at
1-877-697-4889. The responsible AAMVA official or delegate will use the
worksheet, attached as Attachment C, to quickly gather and organize information
about the incident. The responsible AAMVA official or delegate must provide to
SSA timely updates as any additional information about the loss of PII becomes
available.
3. SSA will file a formal report in accordance with SSA procedures. SSA will
notify the Department of Homeland Security’s United States Computer
Emergency Readiness Team if loss or potential loss of SSA PII related to a data
exchange under this Agreement occurs.
4. If AAMVA’s negligence or willful conduct in carrying out its obligations under
this Agreement results in a loss or breach of SSA data, SSA will determine
whether to provide notice or identity protection services (IPS) to individuals
whose data has been lost or breached. If SSA determines to provide notice or IPS
to individuals, AAMVA will bear the reasonable costs associated with such notice
and IPS, provided that such IPS is procured under a government-wide blanket
purchase agreement for Identity Monitoring Data Breach Response and Protection
Services awarded by the General Services Administration.

6

V.

Duration, Modification, and Termination
A. Duration
This Agreement will be in effect for 5 years, from the effective date of
October 1, 2022, to the expiration date of September 30, 2027. Notwithstanding the
foregoing, this Agreement is effective only upon signature of both parties to this
Agreement and the attached Form SSA-1235 with respect to the fiscal year (FY)
beginning October 1, 2022. Parties to this Agreement must execute a new Agreement
prior to its expiration date for the services to continue undisrupted.
This Agreement does not authorize SSA to incur obligations through the performance
of the services described herein. Performance of such services is authorized only by
execution of Form SSA-1235 for each fiscal year in which the services are provided.
Moreover, SSA may incur obligations by performing services under a reimbursable
agreement only on a fiscal year basis. Accordingly, attached to, and made a part of
this Agreement, is an executed Form SSA-1235 that provides the authorization for
SSA to perform services under this Agreement in FY 2023. The parties must execute
a new Form SSA-1235 on or before the start of each fiscal year that this Agreement is
in effect. SSA’s ability to perform work for fiscal years beyond 2023 is subject to the
availability of funds.
B. Modification
Either party may request, in writing, modifications to this Agreement at any time; no
modification to this Agreement will be effective unless it is in writing and signed by
each of the parties to this Agreement.
C. Termination
Either party may unilaterally terminate this Agreement without cause upon 30 days
advance written notice to the other party. Such termination will be effective 30 days
from the date of the notice or at a later date specified in the notice.
SSA will prepare a final SSA-1038, Statement of Account/Bill for Goods and
Services, within 30 days of the date of termination. If any payment is due SSA,
AAMVA will pay SSA within 30 days. If advances exceed actual costs, SSA will
reimburse AAMVA within 30 days.
Notwithstanding the foregoing, SSA may immediately and unilaterally terminate this
agreement if SSA determines that AAMVA has: (1) violated, or failed to follow, the
terms of this Agreement; or (2) failed to pay SSA in accordance with Section VI.
SSA may immediately and unilaterally suspend services under this Agreement, until
SSA makes a definite determination, if SSA suspects that AAMVA has: (1) incurred
an unauthorized use of the verification service; or (2) failed to comply with the
privacy protection and systems security requirements of this Agreement.
7

VI.

Reimbursement
A. Advance Payment
On behalf of the MVAs, AAMVA will reimburse SSA in advance on a periodic basis
as described below in Section VI.C for the online SSN verification services SSA
provides to the MVAs through AAMVAnet® under this Agreement. In order to
make the required advance payment to SSA, AAMVA will collect from each MVA
payments in advance for SSA’s voter registration verification services to be provided
to them through AAMVAnet® on a periodic basis, as described below in Section
VI.C. Under the finance and budget guidelines issued by OMB in OMB Circular
A-11, SSA cannot incur obligations against customer orders received from nonFederal sources without an advance payment.
For each fiscal year during the term of this Agreement SSA and AAMVA will
execute the attached Agreement Covering Reimbursable Services, Form SSA-1235,
for the estimated costs for this service to the MVA(s). Before July 1 of each fiscal
year, SSA will provide AAMVA with estimated maintenance costs for the following
fiscal year (starting October 1). If SSA provides the new estimated numbers after
July 1, AAMVA will use the previous fiscal year’s estimated numbers. Before
providing online verification services through AAMVA, SSA must receive from
AAMVA: (1) a signed Form SSA-1235 covering the cost estimate for the fiscal year
in which SSA will provide the services; and (2) advance payments in the amount
specified in the SSA-1235 for that fiscal year.
B. Billing and Collection
AAMVA, as SSA’s billing representative, has full rights and responsibilities to bill
and collect, directly and in advance from the MVAs all applicable SSA costs,
together with reasonable charges for AAMVA’s services under this Agreement.
SSA’s costs for providing the voter registration verification services to MVAs under
HAVA will include:
1. Voter Registration Information Verification System development and
start-up costs;
2. Information verification search;
3. Ongoing maintenance/administration of the system; and
4. Overhead and other miscellaneous costs incurred by SSA.
SSA will calculate these costs and provide estimates to AAMVA for the purpose of
billing and collecting advance payments from the MVAs. SSA will determine the
reimbursable amounts by the full cost of the volume of SSNs submitted to SSA on a
fiscal year basis. SSA uses current Federal fiscal year rates to calculate the cost
estimates for services provided under this Agreement; Federal fiscal year rates and
related cost estimates are subject to change in future fiscal years. Transfer of funds
between SSA and AAMVA is independent from the MVAs’ payments to AAMVA.
8

Any fee charged to MVAs by AAMVA for services AAMVA provides to such
MVAs constitutes an agreement between AAMVA and the applicable MVA and is
not covered by this Agreement or any other agreements with SSA.
AAMVA will use all reasonable efforts to obtain advance payment from the MVAs
for SSA of the Program Costs in accordance with the terms and conditions of the
agreements between SSA and the respective MVAs (MVA Agreements). A model
form of the MVA Agreement is attached to this Agreement as Attachment D. MVA
Agreements include provisions that require the MVAs to make timely payment to
AAMVA for SSA’s costs, and AAMVA’s reasonable charges acknowledge
AAMVA’s right to suspend access to the Voter Registration Verification System if
the MVA is delinquent in paying AAMVA for services. Under HAVA, the
individual State MVAs are ultimately responsible for payment to SSA for the voter
registration verification services. If an MVA fails to pay AAMVA in advance for
SSA’s services through AAMVA within 30 days from the date of AAMVA’s invoice,
AAMVA: (1) is not responsible for making advance payment to SSA on behalf of
that MVA; and (2) may suspend that MVA’s access to the Voter Registration
Verification System through AAMVAnet®, provided that AAMVA provides 30 days
prior written notice to SSA and the affected MVA.
SSA will deal directly with AAMVA for all billing and collection for services under
this Agreement. Notwithstanding the foregoing, if the MVA fails to reimburse SSA
voluntarily through AAMVA, the MVA will remain liable to SSA, and SSA reserves
the right to collect reimbursement from the State through any and all legal means
available to it, including but not limited to the MVA Agreement between SSA and the
State MVA.
C. Payment and Financial Terms
AAMVA will pay SSA in three (3) payments throughout the fiscal year (hereinafter
referenced as Payment Period 1, Payment Period 2, and Payment Period 3). Such
payments cover the following periods of operations.
Payment Period 1: 10/1 – 1/31; Payment due by October 1
Payment Period 2: 2/1 – 5/31; Payment due by February 1
Payment Period 3: 6/1 – 9/30; Payment due by June 1
Concurrent with AAMVA’s execution of Form SSA-1235, AAMVA will submit the
payment for Payment Period 1 to SSA.
If a cost adjustment is required during the fiscal year, the SSA Project Coordinator
will promptly make such adjustment by amending the SSA-1235 with AAMVA.
Within 30 days following AAMVA’s receipt of the amended SSA-1235, AAMVA
will submit the appropriate payment adjustment to SSA.

9

SSA will prepare an annual SSA-1038, Statement of Account/Bill for Goods and
Services, within 30 days after the close of the fiscal year. SSA cannot use funds
received from a previous fiscal year for services provided in another fiscal year. If
any payment is due to SSA for that fiscal year, AAMVA will pay SSA within 30 days
of receipt of the bill. If advances exceed actual costs, SSA will reimburse AAMVA
within 30 days after the close of the fiscal year. AAMVA will then take the
appropriate action to true up any MVA account that has any remaining balance on its
payment status.
AAMVA is responsible for maintaining its advance payment status with SSA. SSA
will bill AAMVA if there are insufficient advanced funds at the end of the fiscal
quarter or AAMVA owes SSA at the end of fiscal year closeout. SSA will prepare a
quarterly SSA-1038, Statement of Account/Bill for Goods and Services, within
30 days after the end of the quarter. If any payment is due to SSA at the end of a
quarterly billing period or fiscal year, AAMVA will pay SSA within 30 days of
receipt of the bill. AAMVA will take the appropriate action to collect additional
payment for any MVA account that fails to maintain a balance on its payment status.
VII.

Persons to Contact
SSA Project Coordinator

AAMVA Contract & Billing
Issues

Antoinette Ford
Office of Data Exchange
Office of Data Exchange and Policy
Publications
Social Security Administration
4-B-8-C Annex Building
6401 Security Boulevard
Baltimore, MD 21235
Phone: (410) 966-4422
Email: Antoinette.T.Ford@ssa.gov

Hal Gollos, Director
Contracts Administration 4401
Wilson Boulevard
Suite 700
Arlington, VA 22203
Phone: (703) 908-8286
Fax: (703) 527-2745
Email: hgollos@aamva.org

SSA Systems Contact

AAMVA Operational Support

Angil Escobar, Branch Chief
DDE/Verifications and Exchanges
Analysis Branch of Office of Enterprise
Information Systems
Office of Systems
6401 Security Boulevard, 3-F-3 Robert
M. Ball Building
Baltimore, MD 21235
Phone: (410) 965-7213
Email: Angil.Escobar@ssa.gov

Robert Gondi
IT Senior Director
4401 Wilson Boulevard
Suite 700
Arlington, VA 22203
Phone: (703) 908-2867
Fax: (703) 908-2868
Email: rgondi@aamva.org

10

SSA Systems Security Contact
Jennifer Rutz, Director
Division of Compliance and Oversight
Office of Information Security
Office of Systems
Suite 3383 Perimeter East Building
6201 Security Boulevard
Baltimore, MD 21235
Phone: (410) 966-8253
Email: Jennifer.Rutz@ssa.gov

AAMVA Systems Security
Contact
Pierre Boyer
4401 Wilson Boulevard
Suite 700
Arlington, VA 22203
Phone: (703) 908-2821
Fax: (703) 908-2868
Email: pboyer@aamva.org

SSA Contact for Agreement Issues

AAMVA Project Manager

Donald Scott
Government Information Specialist
Office of Privacy and Disclosure
Office of the General Counsel
G-401 West High Rise
6401 Security Boulevard
Baltimore, MD 21235
Phone: (410) 965-8850
Email: Donald.Scott@ssa.gov

Mekala Joy
4401 Wilson Boulevard
Suite 700
Arlington, VA 22203
Phone: (703) 908-2811
Fax: (703) 527-2745
Email: mjoy@aamva.org

SSA Finance Contact

AAMVA Finance Contact

Tammy Ochlech
Office of Finance
P.O. Box 17042
Baltimore, MD 21235
Phone: (410) 965-0602
Email: Tammy.Ochlech@ssa.gov

Finance Division
4401 Wilson Boulevard
Suite 700
Arlington, VA 22203
Phone: (703) 908-8277
Attn: Accounts Payable
Email: Financeap@aamva.org

VIII. Disclaimer
SSA is not liable for any damages or loss resulting from errors in information transmitted
over AAMVAnet® under this Agreement. Furthermore, SSA is not liable for damages or
loss resulting from the destruction of any materials or data transmitted over
AAMVAnet®. All information transmitted over AAMVAnet® to AAMVA will be
subject to the limitations and qualifications, if any, transmitted with such information.
The performance or delivery by SSA of the goods and/or services described herein and
the timeliness of said delivery are authorized only to the extent that they are consistent
with proper performance of the official duties and obligations of SSA and the relative
importance of this request to others. If for any reason SSA delays or fails to provide
services, or discontinues the services or any part thereof, SSA is not liable for any
damages or loss resulting from such delay or for any such failure or discontinuance.
11

IX.

Comptroller General Access
The Government Accountability Office (Comptroller General) may have access to all
SSA data, as necessary, in order to monitor or verify compliance with this Agreement.

X.

Integration Clause
This Agreement, the Attachments A through D, and Form SSA-1235 constitute the entire
agreement of the parties with respect to its subject matter and supersede all other data
exchange agreements between the parties that pertain to the disclosure of online SSN
verifications for new voter registrations between SSA and MVAs for the purposes
described in this Agreement. SSA and AAMVA have made no representations,
warranties, or promises outside of this Agreement. This Agreement takes precedence
over any other documents that may be in conflict with it including but not limited to
Attachments A through D.

12

XI.

Authorized Signatures
The signatories below warrant and represent that they have the competent authority on
behalf of their respective organizations to enter into the obligations set forth in this
Agreement.
The signatories may sign this document electronically by using an approved electronic
signature process. Each signatory electronically signing this document agrees that his/her
electronic signature has the same legal validity and effect as his/her handwritten signature
on the document, and that it has the same meaning as his/her handwritten signature.
SOCIAL SECURITY ADMINISTRATION
signed by Melissa Feldhan
Melissa Feldhan Digitally
Date: 2022.06.27 22:40:10 -04'00'

______________________________
Melissa Feldhan
Acting Deputy Executive Director
Office of Privacy and Disclosure

_______________
Date

AMERICAN ASSOCIATION OF MOTOR VEHICLE ADMINISTRATORS

___6/15/2022________________

Wendy Sibley

Date

Wendy Sibley
Chief Financial Officer
`

Digitally signed by Wendy Sibley Date: 2022.06.15
11:36:15 -04'00'

Attachments:
A – Service Level Objectives
B – Electronic Information Exchange Security Requirements and Procedures for State
and Local Agencies Exchanging Electronic Information with the Social Security
Administration
C – Worksheet for Reporting Loss or Potential Loss of Personally Identifiable
Information
D – Model HAVA with the State MVAs
13