2805 NIH Web Privacy Policy.pdf

NIH Policy Manual

2805 - NIH Web Privacy Policy

Issuing Office: OD/OM/OMA, OD/OCIO, OD/OCPL Phone: (301) 496-2832

Release Date: 9/12/2019 ?

Transmittal Notice

1. Explanation of Material Transmitted: This chapter establishes policies and procedures for ensuring the privacy and protection of personal information collected, stored, used, maintained and disseminated via NIH Websites. This policy applies to NIH Internet Websites that are developed and/or maintained by NIH staff or by contract personnel and Third-Party Websites or Applications (TPWAs). This revision includes new privacy requirements and policies for Federal Agency public websites and digital services, helping to improve digital services and use emerging technologies to serve the public as effectively as possible. These services and technologies may include Federally run websites such as .gov or .mil, and Third-Party Websites or Applications (TPWAs) such as .com or .org.

2. Filing Instructions:

Remove: Manual Issuance 2805, dated 08/08/11.

Insert: Manual Issuance 2805, dated 09/12/19.

PLEASE NOTE: For information on:

Content of this chapter, contact the issuing offices listed above.

NIH Policy Manual, contact the Division of Management Support, OMA on

301-496-4606, or enter this URL:

https://oma.od.nih.gov/DMS/pages/manualchapters.aspx

A. Purpose

This chapter establishes policies and procedures for ensuring the privacy and protection of personal information collected, stored, used, maintained and disseminated via NIH Websites.

B. Scope

This policy applies to NIH Internet Websites that are developed and/or maintained by NIH staff or by contract personnel and Third-Party Websites or Applications (TPWAs). This policy does not apply to internal agency activities (such as on intranets, applications, or interactions that do not involve the public) or to activities that are part of authorized law enforcement, national security, or intelligence activities.

tel:(301) 496-2832 javascript:void(0);

https://oma.od.nih.gov/DMS/pages/manual-chapters.aspx https://oma.od.nih.gov/DMS/pages/manual-chapters.aspx

C. Background

The Web is a powerful tool for conveying information about the activities, objectives, policies and programs of the Federal Government and NIH. It is important that visitors to federal Websites know that their private information is appropriately protected by the agency when they are accessing these sites, and that agency staff understand their responsibility to safeguard the personally identifiable information (PII) made available, whether solicited or unsolicited, to the agency.

Potential consequences for not adequately protecting privacy in the government include criminal and civil penalties, negative impact on individuals where PII is collected and not appropriately used, reduced mission effectiveness and loss of credibility, confidence, and trust in NIH.

D. Policy

1. General Requirements

a. Privacy Policy – A Web privacy policy shall be clearly posted on all NIH top-level/principal Websites, including NIH and Institute/Center (IC) or OD Office level sites, major on-line public resource sites and any other known major public facing entry points, as well as any Web page that collects or posts personal information. (See URL: http://www.nih.gov/about/privacy.htm).

b. Privacy Act Statement – A comprehensive online privacy statement shall give notice to individuals about the Authority, Purpose, Routine Uses, and communicate the type of information collected through the Website and typically covers the effective date, scope, information collected (both actively and passively), information uses, choices available, how to modify information or preferences, how to contact or register a dispute, and how policy changes will be communicated. They need to be easy to find and at or before the point of collection. They need to be linked from the Website homepage and from each and all information collection pages (e.g. site-wide navigation component, or header/footer), from pop-up or pop-under windows that contain web forms and in email messages that originate from the Website.

c. Privacy Policy Links – Links to the IC or OD office privacy policy shall be clearly labeled and easy to access by all visitors to the Website. If the privacy policy is combined with another mandated or recommended Website statement, the link should be visibly labeled accordingly, e.g., “Privacy Policy/Disclaimer.”

d. Plain Language - Web privacy policies shall conform to the Plain Writing Act of 2010 which defines “plain writing” as writing that is clear, concise, well-organized, and follows other best practices appropriate to the subject or field and intended audience. Web privacy policies shall clearly and concisely inform visitors to the site of:

i. Specific purpose of the agency’s use of the Website;

http://www.nih.gov/about/privacy.htm

ii. How the agency will use PII that becomes available through the use of the Website;

iii. Who at the agency will have access to PII;

iv. With whom PII will be shared outside the agency;

v. Whether and how the agency will maintain PII, and for how long;

vi. How the agency will secure PII that it uses or maintains; and,

vii. What other privacy risks exist and how the agency will mitigate those risks.

viii. NIH staff shall also comply with the following NIH policies: NIH Manual

Chapter 1825, Information Collection from the Public and NIH Manual Chapter 2804, NIH Public-Facing Web Management.

e. Machine-Readable Format – In compliance with OMB M-13-13, Open Data Policy- Managing Information as an Asset, Web privacy policies and statements shall be represented in a machine-readable format (e.g. XML-based standard). A Platform for Privacy Preferences (P3P) is a way to translate a privacy policy into machine-readable format that a browser decodes in order to figure out what the policy says. P3P is designed to provide Internet users with a clear understanding of how PII will be used by a particular Website. It allows Website operators to explain their privacy practices to visitors and allows users to configure their browsers and other software tools to provide notifications about whether Website privacy policies match their preferences.

f. General Layout, Formatting, and Tagging – Web pages and documents will be correctly labeled, including scanned images of text, PDFs, decorative images, and have a functioning table of contents. All items will be formatted in a logical order with correctly mapped tags per Department of Health and Human Services (HHS) requirements (https://www.hhs.gov/web/section508/index.html).

2. Privacy Act Requirements

a. Privacy Act Statement: Any NIH Website or electronic tool (phone/tablet app, surveys, or any other type of mobile data collection instrument) that collects and/or maintains PII that will, in practice, be retrieved by a personal identifier, shall include a Privacy Act Statement. The Statement shall be on or directly linked to the information collection page and contain the following information:

i. Authority (whether granted by statute, regulation, or executive order) which authorizes the solicitation and/or collection of the information;

ii. Purpose of the information collection;

iii. Routine uses for information disclosure (likely or known disclosures of the data made outside of the Department of Health and Human Services (HHS), without the consent of the subject individual, for a purpose which is compatible with the purpose for which the record was collected);

iv. Whether disclosure of the information is mandatory or voluntary; and,

v. What effect, if any, there will be on the individual if they choose to not provide all or part of the requested information.

https://www.hhs.gov/web/section508/index.html

vi. OMB Memorandum M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information (PII), directs agencies to eliminate the unnecessary collection and use of Social Security Numbers (SSNs).

SSNs may only be required when their collection is authorized by statute (see NIH Manual Chapter 1825, Information Collection from the Public) and individuals are informed whether provision of the SSN is optional or required.

b. System of Records Notice (SORN): Any NIH Website, Web page or electronic tool (phone/tablet app, surveys, or any other type of mobile data collection instrument) designed to retrieve information about an individual by a personal identifier linked to them shall have a valid Privacy Act System Notice published in the Federal Register which covers the record system. A SORN refers to the notice which describes the purpose of the system, the legal authority to collect information, the categories of information collected, maintained, retrieved, and used within a set of records, the categories of individuals for whom the information is collected, and to whom the information can be disclosed, and safeguards for protecting the information. The SORNs are written broadly to cover information collections designed to retrieve information about an individual by a name or personal identifier linked to the individual. If a collection of records that includes Privacy Act information is proposed for operation and is NOT covered under an existing SORN, one shall be developed and posted in the Federal Register 40 days prior to collection of the data. If no existing SORN covers the proposed data collection, the IC or OD office System Owner/Manager shall work with the IC Privacy Coordinator or NIH Privacy Act Officer to put one in place. Otherwise, the system of records is unauthorized and shall not be operated.

c. Privacy Impact Assessment: A Privacy Impact Assessment (PIA) shall be conducted on all IT systems (i.e., Websites, databases associated with a Website, etc.) owned, operated or controlled by the NIH or contractor acting on its behalf.

A PIA is a living document that shall be updated when a major change occurs within an IT system as defined in OMB Memorandum M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002. The PIA is an analysis tool designed to identify any privacy or security risk associated with information that is collected, processed, stored, and/or transmitted by an IT system. A PIA collects data on the information to be contained/collected by an IT system, how the information will be used, and what safeguards will be put into place to protect the collected information. The PIA process assists System Owners/Managers in thoroughly assessing all phases of the system development life cycle (SDLC). PIAs should be performed before the development phase of an IT system; however, an initial PIA can be performed on an existing operational IT system if it is found that a PIA is not currently in place.

Departmental policy requires that PIAs be conducted and maintained on all IT systems, whether the system is already in existence, in development, or undergoing modification, as defined by the E-Government Act of 2002, OMB guidance, HHS policy, and supporting guidance. An adapted PIA is required on all NIH uses of a third-party Website or application (TPWA). TPWA can be defined as Web based technologies not exclusively operated or controlled by a government entity, or web-based technologies that involve significant participation of a nongovernment entity. Often, these technologies are located on a “.com” Website or other location that is not part of an official government domain. However, TPWAs can also be embedded or incorporated on an agency’s official Website (e.g. Web 2.0 applications and social media networks such as Facebook, Twitter, YouTube, LinkedIn, Flickr, Instagram, Pinterest, blogs, email subscription services, mobile applications, and mobile Websites).

Each adapted PIA shall be tailored to address the specific functions of the Website or application. It should describe (1) the specific purpose of the agency’s use of the TPWA, (2) any PII that is likely to become available to the agency through public use of the TPWA, (3) the agency’s intended or expected use of PII, (4) with whom the agency will share the PII, (5) whether and how the agency will maintain PII, and for how long, (6) how the agency will secure PII that it uses or maintains, (7) what other privacy risks exist and how the agency will mitigate those risks, and (8) whether the agency’s activities will create or modify a “system of records” under the Privacy Act. IC and OD office staff shall work with their Privacy Coordinator and Information Systems Security Officer (ISSO) to determine if a PIA is needed, when updates are necessary, and to ensure full compliance with OMB, HHS and NIH policies.

3. Establish Integral Digital Governance and E-Authentication Assurance Levels

a. Information Security and Awareness Office (known as the NIH Information Security Program (InfoSec)), in partnership with the NIH Office of the Director (OD)/Office of Management (OM)/Office of Management Assessment (OMA)/Division of Management Support (DMS) (known as the Office of the Senior Official for Privacy (OSOP), shall develop coherent procedures to satisfy public expectations of accountability and quality of service. NIH will establish a plan for overseeing its digital services, including websites and data. NIH shall publicly post a Digital Strategy page at:

https://www.hhs.gov/web/governance/digital-strategy/index.html to reflect the agency’s current digital governance structure in compliance with the White House’s Digital Government Strategy requirements.

b. The U.S. General Services Administration (GSA) will oversee and report on the implementation of the NIH’s Public Website and Digital Services policies.

c. Chief Information Security Officers (CISOs), system owners, and other relevant stakeholders will combine appropriate business and privacy risk management techniques to select applicable EAL levels (Identification, Authentication, and Federated) in accordance with the requirements in the National Institute of Standards and Technology (NIST), Special Publication (SP) 800-63 Revision 3, Digital Identity Guidelines and the HHS Guidance for Selection of e- Authentication Assurance Levels (EAL).

4. Human Subject Requirements https://www.hhs.gov/web/governance/digital-strategy/index.html

a. Websites used for the purpose of recruiting study subjects shall comply with the human subject protection regulations at 45 CFR Part 46 and 21 CFR Part 56 and NIH human subjects protections policies for recruitment of research subjects (https://irbo.nih.gov/confluence/display/IRBO/Policies+and+SOPs). These regulations require that an Institutional Review Board (IRB) review and approve the method and materials used for recruitment of research subjects. In addition, these regulations require that the IRB approve plans for protecting the privacy of subjects and for protecting the confidentiality of subject data. IRB approval is not required for basic descriptive information about a clinical trial website if the clinical trial information is limited to the following: title, purpose of the study, protocol summary, basic eligibility criteria, study site location(s), and how to contact the study site. See Office of Human Research Protections (OHRP), HHS guidance at http://www.hhs.gov/ohrp/policy/clinicaltrials.html, FDA guidance at http://www.fda.gov/RegulatoryInformation/Guidances/ucm126428.htm.

Descriptions of clinical trial risks and potential benefits, or solicitation of identifiable information is not considered basic descriptive information. Because this information is considered part of the informed consent process, it requires IRB review and approval.

5. Children’s Online Protection Requirements

a. NIH Websites that are set up for the intended use by children under the age of 13 or that knowingly collect personal information from them shall comply with the Children’s Online Privacy Protection Act of 1998 (COPPA) which restricts the marketing of products and services online to children under 13. NIH "Kid’s Pages" shall comply with the following standards set forth in the COPPA, specifically:

b. Avoid Unnecessary Data Collection - Websites that collect personally identifiable information from children under age 13 should eliminate or reconsider using instruments that could collect data on “Kid’s Pages” if the information is not essential to the IC or OD office program. Using age gate techniques makes it difficult for younger users to provide personal information.

c. Privacy Notice - Internal or external Websites and Kid’s Pages that are set up for the intended use by children or that knowingly collect personal information from children under the age of 13, shall contain a privacy notice of the information collection practices (i.e., whether or not the Websites collect/store information).

i. The “Kid’s Page” privacy notice shall include:

ii. A description of the specific types of personal information you collect directly from children (e.g., name, age, home address, email address, hobbies, personal characteristics, etc.), and if any additional information is collected passively (e.g., via cookies and other Web measurement and customization technologies);

iii. A description of how you will use the information (e.g., make the information available through a child's participation in a chat room) and, https://irbo.nih.gov/confluence/display/IRBO/Policies+and+SOPs http://www.hhs.gov/ohrp/policy/clinicaltrials.html http://www.fda.gov/RegulatoryInformation/Guidances/ucm126428.htm whether personal information is forwarded to a third-party social network Website and/or application;

iv. How long your IC or OD office will maintain the information;

v. Who will have access to the information; and,

vi. A contact name and information (address, telephone, email address) for the site.

d. Parental Consent – ICs and OD offices shall ensure that a parent (or legal guardian) of the child receives notice of these information collection practices and consents to those practices before personal information is collected from a child (Note: Disclosure of personal information is permitted only to the extent that it has also been included as a “purpose” or “routine use” in an active Privacy Act System of Records). Specifically,

i. The IC or OD office shall obtain parental consent when it collects an email address or other personal information and:

1. Gives a child access to a secondary site that was not originally specified in the Website privacy notice.

2. Uses the information in a way that is different than how it was specified when parental consent was originally obtained; or

3. Offers the information to new or different third-party Website and/or application;

4. Changes how the information is used;

5. Plans to change the kinds of information previously collected;

ii. Parental consent is not necessary if the “Kid’s Page” site collects an email address to:

1. Respond to a one-time request from the child and then the email address from the child is deleted (e.g., research poster, response to a survey or inquiry, and similar requests). Repeated contact with the same child requires consent;

2. Contact the parent;

3. Ensure the safety of the child or the site;

4. Fulfill an NIH newsletter subscription request for one issue. (Note:

Continuation of the subscription requires consent).

e. Provide Instructions to Parents

i. Parents have the right to review, change or revoke their consent and ask that information about their children be deleted from the site's database at any time. When a parent revokes consent, the Website shall immediately stop collecting, using or disclosing information from that child.

ii. It is also advisable that an exit page be placed between the IC or OD office “Kid’s Page” and any external links. This provides clear notification to the child and parent that they are exiting NIH controlled Web space and that NIH can no longer guarantee their privacy or the security of information belonging to them.

6. Email Requirements

a. Email messages have similar privacy issues as Websites. They not only convey information in text or HTML formats, but they may also involve hyperlinks, forms, cookies, Web beacons and active content. Commercial email includes promotional or marketing messages that recipients have indicated they wish to receive. Common privacy principles include no false or misleading header information, no deceptive subject lines, opt-out mechanisms in each message, notification to the recipient that the message contains an advertisement or promotional information, and information about the sending organization. IC and OD offices shall include in their privacy notice, a statement to users about how the site handles unsolicited email, and a notice that the sender should not expect privacy.

b. The following is a sample statement: “Email sent to NIH may be seen by a number of people who are responsible for answering questions. If you send us an email, you are advised that email is not necessarily secure against interception. If your communication includes sensitive information like your Social Security Number or personal health information, it is advisable that you contact us by postal mail or telephone rather than email.”

7. Web Measurement and Customization Technology Requirements

a. To define Web measurement and customization technology, refer to OMB Memorandum M-10-22, Guidance for Online Use of Web Measurement and Customization Technologies:

i. Technologies used to remember a user’s online interactions with a Website or online application in order to conduct measurement and analysis of usage or to customize the user’s experience;

ii. Single-session technologies that remember a user’s online interactions within a single session or visit. Or any identifier correlated to a particular user that is used only within that session, is not later reused, and is deleted immediately after the session ends;

iii. Multi-session technologies that remember a user’s online interactions through multiple sessions, and uses a persistent identifier for each user, which lasts across multiple sessions or visits.

b. Note: NIH will participate in the GSA’s Digital Analytics Program (DAP) and deploy DAP tracking codes on all public facing websites. GSA will maintain a public listing of NIH domains at: https://analytics.usa.gov/. GSA will also provide free quantitative analytics for website management.

c. Appropriate Use and Prohibitions https://analytics.usa.gov/

i. Subject to the limitations described below, Web measurement and customization technologies (e.g. Web server logs, cookies, Web beacons, proxies, etc.) may be used for the purpose of improving IC and OD office services online through conducting measurement and analysis of usage or through customization of the user’s experience. Where information is gathered automatically as the user navigates from page to page on a Website or across Websites, under no circumstances may such technologies be used:

1. To track user individual-level activity on the Internet outside of the Website or application from which the technology originates;

2. To share the data obtained through such technologies, without the user’s explicit consent, with other departments or agencies;

3. To cross-reference, without the user’s explicit consent, any data gathered from Web measurement and customization technologies against PII to determine individual-level online activity;

4. To collect PII without the user’s explicit consent in any fashion; and,

5. For any like usages so designated by the Office of Management and

Budget (OMB).

d. Usage Tiers

i. Below are the defined tiers for authorized use of Web measurement and customization technologies.

1. Tier 1 – Single Session. This tier encompasses any use of single session Web measurement and customization technologies.

2. Tier 2 – Multi-Session without PII. This tier encompasses any use of multisession Web measurement and customization technologies when no PII is collected (including when the IC and OD office is unable to identify an individual as a result of its use of such technologies).

3. Tier 3 – Multi-Session with PII. This tier encompasses any use of multi-session Web measurement and customization technologies when PII is collected (including when the IC or OD office is able to identify an individual as a result of its use of such technologies).

e. Clear Notice and Personal Choice

i. ICs and OD offices shall not use Web measurement and customization technologies from which it is not easy for the public to opt-out. Opt-in/opt-out mechanisms shall be designed to be easily accessible and understandable and be implemented uniformly across all Websites.

ii. ICs and OD offices shall explain in their Privacy Policy the decision to enable Web measurement and customization technologies by default or not, thus requiring users to make an opt-out or opt-in decision. ICs and OD offices shall provide users who decline to opt-in or decide to opt-out with access to comparable information or services.

iii. NIH side opt-out. ICs and OD offices are encouraged and authorized, where appropriate, to use Web tracking and measurement technologies in order to remember that a user has opted out of all other uses of such technologies on the relevant domain or application. Such uses are considered Tier 2. Client side opt-out. If IC and OD office opt-out mechanisms are not appropriate or available, instructions on how to enable client side opt-out mechanisms may be used.

iv. Client side opt-out mechanisms allow the user to opt out of Web measurement and customization technologies by changing the settings of a specific application or program on the user’s local computer. For example, users may be able to disable persistent cookies by changing the settings on commonly used Web browsers. ICs and OD offices should refer to http://www.usa.gov/optout_instructions.shtml which contains general instructions on how the public can opt out of some of the most commonly used Web measurement and customization technologies.

v. Tier 3 restrictions. ICs and OD offices employing Tier 3 uses shall use opt-in functionality. Opt-in functionality shall allow the client complete control over the collection and dissemination of their personal information.

An opt-in functionality requires a client to self-select the services they wish to subscribe to, and how any information they provide may be used.

vi. Privacy Policy. The following items shall be included in the IC and OD office online Privacy Policy, in any instance when Web measurement and customization technologies are used:

1. Purpose of the Web measurement and/or customization technology;

2. Usage Tier, session type, and technology used;

3. Nature of the information collected;

4. Purpose and use of the information;

5. Whether and to whom the information will be disclosed;

6. Privacy safeguards applied to the information;

7. Data retention policy for the information;

8. Whether the technology is enabled by default or not and why;

9. How to opt-out of the Web measurement and/or customization technology;

10. Statement that opting out still permits users to access comparable information or services; and,

11. Identities of all third-party vendors involved in the measurement and customization process.

f. Data Safeguarding and Privacy http://www.usa.gov/optout_instructions.shtml

i. All uses of Web measurement and customization technologies shall comply with existing policies with respect to privacy and data safeguarding standards. If applicable, ICs and OD offices shall cite the PIA and/or SORN in their online Privacy Policy.

g. Comparable Information and Services

i. If ICs and OD offices are using a Website or application hosted on a third-party site using Web measurement and customization technologies to which federal privacy and data safeguarding standards do not apply, they should provide the public with alternatives for acquiring comparable information and services. For example, members of the public should be able to learn about NIH activities or communicate with the IC and OD offices without having to join a third-party social media Website. If the third-party service is used to solicit feedback, ICs and OD offices shall provide an alternative government email address where users can also send feedback.

ii. Additional guidance on the use of social media Websites is addressed in the NIH Social Media Guidelines and OMB Memorandum M-10-23, Guidance for Agency Use of Third-Party Websites and Applications.

h. Data Retention and Access Limits

i. IC and OD offices shall retain data collected from web measurement and customization technologies for only as long as necessary to achieve the specific objective for which it was collected. Moreover, only staff that needs to have access to the data shall be allowed to do so.

ii. Retention Time. The time frame for retention of data shall be both limited and correlated to a specific objective. If not required by law, policy, or a specific need for the web measurement or customization objective, IC and OD offices should limit the retention of such data to one year or less.

iii. Records Disposition Schedule. Information collected from Web measurement and customization technologies that are determined to be a federal record must comply with Federal Records Act regulations. The General Records Schedule (GRS) 3.1, Item 020; Information technology operations and maintenance records pertains to records relate to the activities associated with the operations and maintenance of the basic systems and services used to supply the agency and its staff with access to computers and data telecommunications. Includes the activities associated with IT equipment, IT systems, and storage media, IT system performance testing, asset and configuration management, change management, and maintenance on network infrastructure. GRS 3.1, Item 020 is applicable to information collected from Web measurement and customization technologies, with a Disposition Authority DAA-GRS2013-0005-0004, and with a retention time of 3 years or longer if required for business use.

http://employees.nih.gov/pages/social-media/

Use of GRS 3.1, Item 020 is mandatory for those categories of electronic records described in the schedule unless the IC and OD office have requested an alternative disposition authority from the National Archives and Records Administration (NARA).

i. Enforcement

i. To the extent feasible, technical enforcement mechanisms should be put in place to implement stated retention times and to limit access to authorized personnel. Where technical enforcement mechanisms are not feasible, policy or contractual enforcement mechanisms shall be present.

j. Verification

i. IC and OD offices using Web measurement and customization technology must annually review their systems and procedures to demonstrate that they are in compliance with this policy. The results of this review shall be posted on www.hhs.gov/open.

k. Approval

i. IC and OD offices are authorized to use Tier 1 or Tier 2 technologies as long as they are in compliance with this policy, and provide clear and conspicuous notice in their online Privacy Policy citing the use of such technologies. Any proposed use by an IC or OD office to engage in Tier 3 (Multi-Session with PII) Web measurement and customization technology usage shall be reviewed by the NIH Chief Information Officer (CIO) (See Appendix 1).

ii. The NIH CIO will review the form and forward it to the NIH Senior Official for Privacy (SOP) for review. Following SOP review and CIO approval, the SOP will send the form to the Department. Following HHS review, HHS will post the notice for public comment on the Department’s Open Government Web page at www.hhs.gov/open for 30 days. After the notice and comment period have passed, and approval by the HHS Senior Agency Official for Privacy (SAOP) has been granted, the NIH CIO will notify the IC or OD office to cite the Departmental approval in their online Privacy Policy prior to using the Tier 3 Web measurement and customization technology.

iii. If a contractor develops, operates or manages the Website on behalf of NIH, a copy of the HHS SAOP approval should be kept in the contract file.

iv. If an IC or OD office is found to be using Web measurement and customization technologies outside of the process or parameters specified by this policy, the office shall immediately cease use of such technologies and inform the NIH CIO of the extent of such unauthorized use.

8. Third-Party Websites and/or Applications http://www.hhs.gov/open http://www.hhs.gov/open http://www.hhs.gov/open

a. Privacy Policy

i. Before an IC or OD office uses any third-party Website or application to engage with the public, it should examine the third-party’s privacy policy to evaluate the risks and determine whether the Website or application is appropriate for NIH use. In addition, the IC or OD office shall establish reasonable management controls and a review process to periodically reassess the risks.

b. External Links

i. ICs and OD offices may post a link to external, government and non-government sites that are not part of the official NIH.gov domain, such as a third-party social network site. NIH IC and OD office Web pages containing links to external Web pages not located on the NIH network shall provide a statement adjacent to the link or a “popup” disclaimer that explains that visitors are being directed to an external, government or non-government Website that may have different privacy policies from those of the NIH official Website (OMB Memorandum M-10-23, Guidance for Agency Use of Third-Party Websites and Applications). The visitor should understand they are exiting the NIH domain and that NIH is not responsible for the material found on, or data collection activities of, external Web pages.

c. Disclaimer:

i. NIH Web pages containing links to external Web pages not located on NIH servers should include a link to a statement that releases NIH from responsibility for the material included in the external Web pages. It is important to avoid giving a user the impression that NIH is endorsing information, or a commercial product described in an external site. Notice regarding inclusion of information which may be copyrighted and disclaimers on endorsement (general and external links), liability, and medical information should be used, as appropriate, for individual IC or OD office Websites. In determining appropriate statements, careful consideration should be given to the nature of the specific site and its potential risk. (NIH Guidance, World Wide Web).

d. Embedded Applications

i. If an IC or OD office incorporates or embeds a third-party application on its Website or any other official NIH domain, it shall take the necessary steps to disclose the third-party’s involvement and describe the NIH activities in its privacy policy.

e. Agency Branding

i. When an IC or OD office uses a third-party Website or application that is not part of the official NIH domain, it shall apply appropriate branding to distinguish NIH activities from those of non-government actors. For example, to the extent practicable, NIH should add its seal or emblem to its profile page on a social media Website to indicate that it is an official agency presence.

f. Information Collection

i. If information is collected through the IC or OD office use of a third-party Website or application, NIH shall collect only the information “necessary” for the proper performance of agency functions and which has practical utility. Where a user actively provides PII via an online form, profile, account setting or other technique, the NIH shall collect only the minimum necessary to accomplish its purpose and all applicable policies and regulations governing PII must be followed.

9. Web Form Requirements

a. A Web form is a portion of a Web page that contains fields that users can fill in with data (including personal information). When the user submits the form, it is sent to a Web server that processes the information where it can be stored in a database. When soliciting information from the public, users shall refer to Manual Chapter 1825, Information Collection From the Public, and work with the Project Clearance Branch to determine the applicability of the Paperwork Reduction Act.

b. Web forms shall be designed to only require what is really needed (and make clear what, if anything is optional). They shall be accompanied by a link to the privacy notice or statement at the point of collection. They shall:

i. Use the POST method of form submission (the alternative GET method can inadvertently spill PII to third-parties via the referrer URL);

ii. Place limitations on one-line text boxes to help ensure they are only used as intended (e.g. maximum of 14 characters for first name);

iii. Be cautious in using free text fields where users may make PII available where none is requested;

iv. Use secure https transmission for the collection of sensitive personal information in accordance of OMB M-15-13;

v. Follow encryption guidelines for storing PII in accordance with NIST Special Publication 800-122; and

vi. Turn off Auto complete for all confidential information (e.g., passwords, credit card numbers, PINs, SSNs, etc.)

10. Websites Developed, Maintained and Operated Under Contract

a. "Contract" covers any contract subject to the Federal Acquisition Regulations (FAR). When an agency contracts for the design, development, or operation of a Website or Web page necessary to accomplish an NIH function, the IC or OD office shall apply the requirements of this policy to the contract. Websites or Web pages operated under a contract, which are designed, developed or operated to accomplish an NIH function, are, in effect, deemed to be maintained by the agency.

b. The Contracting Officer is the official who oversees the development of the documentation and discussions of assigned contracts for award and administration, performs the final review of contract actions, and provides final signature authority. Health and Human Services Acquisition Regulation (HHSAR) Section 324.103(a) states that all requests for contract shall be reviewed by the Contracting Officer to determine whether the Privacy Act requirements are applicable.

c. Solicitations and contracts (both prime and sub) that require the contractor to maintain a system of records covered by the Privacy Act (i.e., when the records will contain personal information that is retrieved by an individual identifier), shall state that the Privacy Act applies and include appropriate FAR citations listed below:

i. FAR Clause 52.224-1, Privacy Act Notification

ii. FAR Clause 52.224-2, Privacy Act

iii. FAR Clause 52.224-3, Privacy Training

iv. FAR Clause 52.239-1, Privacy or Security Safeguards

v. HHSAR Clause 324.102 – Applicability of the Privacy Act (please verify)

vi. HHSAR Clause 352.224-70 Confidentiality of Information

vii. HHSAR Clause 352.270-11 Privacy Act

d. Contracts for the development, maintenance, or management of NIH Websites shall include certain language (See Appendix 2, Contract Sample Language).

e. The Project Officer (PO), IC Information Systems Security Officer (ISSO), and the IC Privacy Officer will assist the acquisitions staff in selecting the appropriate language to meet the Federal Information Security Management Act (FISMA) security requirements relevant to the acquisition.

E. Definitions

1. Child and Children: Unless the context otherwise provides, it means individuals under the age of 13. (Children’s Online Privacy Protection Act (COPPA) of 1998)

2. Contract: A contract is a legal instrument used to reflect a relationship between the Federal Government and the recipient whenever the principle purpose of the transaction is to acquire goods or services for the direct benefit or use of the Government. (A Guide to the NIH Acquisition Process 2007)

3. Cookies: A piece of state information supplied by a Web server to a browser, in a response for a requested resource, for the browser to store temporarily and return to the server on any subsequent visits or requests. (NIST SP 800-28 Version 2, Guidelines on Active Content and Mobile Code)

a. Authentication Cookie – A cookie that assists the visitor during the login process, by containing the user ID and possibly, password data. A login cookie is typically persistent but may be session-based and may be linked to other personal information maintained by the Website. Login cookies tied to a name, account number, or personal email address are considered personally identifiable.

b. Personalization Cookie – A cookie that is used to tailor a Website based on the past behavior of the visitor. These cookies are not normally tied to a user’s stated preferences but based on analysis by the Website on user activity. These cookies are normally persistent.

c. Tracking Cookie – A cookie that is used for aggregate visitor tracking. It is non-personally identifiable and not linked to other logs or information about the visitors that are identifiable. A shopping cart cookie is used to maintain state and associate a visitor with a shopping cart or other transaction thread. These cookies may be linked to PII if the visitor has logged in, is in the check-out process, or is otherwise known. Otherwise, they are often non-personally identifiable.

4. Kid’s Pages: NIH Websites directed to children under the age of 13. (Children’s Online Privacy Protection Act (COPPA) of 1998)

5. Machine-Readable Policy File: A privacy policy file that can be read automatically by a Web browser or other software agent to enable an end-user to quickly determine a Website’s privacy practices, and whether that site’s privacy practices are in accordance with the end-user’s privacy preferences, without the end-user having to read the entire privacy policy. (HHS-OCIO, Policy for Machine-Readable Privacy Policies).

6. Make PII Available: Includes any agency action that causes PII to become available or accessible to the agency, whether or not the agency solicits or collects it. In general, an individual can make PII available to an agency when he or she provides, submits, communicates, links, posts, or associates PII while using the Website or application.

“Associate” can include activities commonly referred to as “friending,” “following,” “liking,” joining a “group,” becoming a “fan,” and comparable functions (OMB Memorandum M-10-23, Guidance for Agency Use of Third-Party Websites and Applications)

7. Platform for Privacy Preferences (P3P): A specification created by the World Wide Web Consortium. P3P allows allow users' Web browsers to automatically understand Websites’ privacy practices. (HHS-OCIO, Policy for Machine-Readable Privacy Policies)

8. Personal Identifier: A name, or the identifying number, symbol, or other unique identifier, such as social security number or User ID Number assigned to an individual.

9. Personally Identifiable Information (PII): Information which can be used to distinguish or trace an individual's identity, such as their name, social security number, biometric records, etc. alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc. (OMB M-17-06, Policies for Federal Agency Public Websites and Digital Services)

10. Privacy Act of 1974, as amended: Protects the privacy of individuals by establishing “Fair Information Practices” for the collection, maintenance, use, and dissemination of information by federal agencies. The Privacy Act is the most significant milestone in the history of the protection of the privacy of personal information held by the Federal Government. Many subsequent laws, regulations, and guidance build upon the principles first articulated in the Privacy Act. (Privacy Act of 1974, as amended, 5 U.S.C. 552a)

11. Privacy Act System of Records: A group of any records under the control of any agency where information is retrieved by the name of the individual, by some identifying number or symbol, or other identifiers assigned to the individual. The key to this definition is that the records shall be “retrieved by”, not “retrievable by” an individual’s name and/or personal identifier. (Privacy Act, as amended, 5 U.S.C.

Section 552a(a)(5))

12. Privacy Impact Assessment (PIA): An analysis of how information is handled: (i) to ensure handling conforms to applicable legal, regulatory, and policy requirements regarding privacy, (ii) to determine the risks and effects of collecting, maintaining and disseminating information in identifiable form in an electronic information system, and

(iii) to examine and evaluate protections and alternative processes for handling information to mitigate potential privacy risks. (OMB Memorandum M-03-22, OMB Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002)

13. Privacy Policy: A consolidated explanation of the agency’s general privacy-related practices that pertain to its official Website and its other online activities. Federal agencies shall protect an individual's right to privacy when they collect personal information. This is required by the Privacy Act and OMB Circular No. A-130, Management of Federal Information Resources. Posting a privacy policy helps ensure that individuals have notice and choice about, and thus confidence in, how their personal information is handled when they use the Internet. Privacy policy in standardized machine-readable format means a statement about site privacy practices written in a standard computer language (not English text) that can be read automatically by a Web browser. (OMB Memorandum M-99-18, Privacy Policies on Federal Websites and OMB Memorandum M-03-22, OMB Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002)

14. Privacy Notice: A brief description of how the agency’s Privacy Policy will apply in a specific situation. Because the Privacy Notice should serve to notify individuals before they engage with an agency, a Privacy Notice should be provided on the specific Web page or application where individuals have the opportunity to make PII available to the agency. (OMB Memorandum M-99-18, Privacy Policies on Federal Websites and OMB Memorandum M-03-22, OMB Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002)

15. Senior Agency Official for Privacy (SAOP): A title extended by OMB to HHS to effectively meet the reporting requirements outlined in OMB M-06-20, Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management. (OMB Memorandum M-16-24, Role and Designation of Senior Agency

Officials for Privacy)

16. System of Records: A group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual. (Privacy Act of 1974, as amended)

17. System of Records Notice (SORN): All systems with Privacy Act information contained within them are required to publish a “Records Notice” in the Federal Register that informs the public what information is contained in the system, how it is used, how individuals may gain access to information about themselves, and other specific aspects of the system. SORNs can be internal, such as those which cover NIH records. Central agency SOR notices are those that belong to OPM. Government-wide SOR notices are those that belong to the Equal Employment Opportunity Commission, Federal Emergency Management Agency, General Services Administration, Department of Labor, Office of Government Ethics, etc. and which are also referred to as “umbrella” systems of record notices. Before data can be collected, a SORN shall be published and maintained in the Federal Register for 40 days. (Privacy Act of 1974, as amended, 5 U.S.C. § 552a(e)(4) and OMB A-108, Federal Agency Responsibilities for Review, Reporting, and Publication under the Privacy Act)

18. Third-Party Websites or Applications (TPWA): Web-based technologies that are not exclusively operated or controlled by a government entity, or Web-based technologies that involve significant participation of a nongovernment entity. Often these technologies are located on a “.com” Website or other location that is not part of an official government domain. However, third-party applications can also be embedded or incorporated on an agency’s official Website. (OMB Memorandum M-10-23, Guidance for Agency Use of Third-Party Websites and Applications)

19. Usage Tiers: Below are the defined tiers for authorized use of Web measurement and customization technologies (OMB Memorandum M-10-22, Guidance for Online Use of Web Measurement and Customization Technologies):

a. Tier 1 – Single Session. This tier encompasses any use of single session Web measurement and customization technologies.

b. Tier 2 – Multi-Session without PII. This tier encompasses any use of multisession Web measurement and customization technologies when no PII is collected (including when the agency is unable to identify an individual as a result of its use of such technologies).

c. Tier 3 – Multi-Session with PII. This tier encompasses any use of multi-session Web measurement and customization technologies when PII is collected (including when the agency is able to identify an individual as a result of its use of such technologies).

20. Verifiable Parental Consent: Verifiable parental consent means any reasonable effort (taking into consideration available technology), including a request for authorization for future collection, use, and disclosure described in the notice, to ensure that a parent of a child receives notice of the operator's personal information collection, use, and disclosure practices, and authorizes the collection, use, and disclosure, as applicable, of personal information and the subsequent use of that information before that information is collected from that child. (Children’s Online Privacy Protection Act (COPPA) of 1998)

21. Web 2.0/Social Media Technology: Web 2.0 technologies refer to a second generation of…