The file's text, extracted by GovTribe without its formatting.
Privacy Impact Assessment Form
| 2a |
| Name: |
| Enter System Name |
| 3 |
| The subject of this PIA is which of the following? |
| ☐ General Support System (GSS) |
☐ Major Application ☐ Minor Application (stand-alone) ☐ Minor Application (child) ☐ Electronic Information Collection ☐ Unknown
| 3a |
| Identify the Enterprise Performance Lifecycle Phase of the system. |
| ☐ Initiation |
☐ Concept ☐ Planning ☐ Requirements Analysis ☐ Design ☐ Development ☐ Test ☐ Implementation ☐ Operations and Maintenance ☐ Disposition
| 3b |
| Is this a FISMA-Reportable system? |
| ☐ Yes |
☐ No
| 4 |
| Does the system include a Website or online application available to and for the use of the general public? |
| ☐ Yes |
☐ No (skip questions 39 onwards)
| 5 |
| Identify the operator. |
| ☐ Agency |
☐ Contractor
| 6 |
| Point of Contact (POC): |
| POC Title |
POC Name
POC Organization
POC Email
POC Phone
| 7 |
| Is this a new or existing system? |
| ☐ New (skip questions 9-10) |
☐ Existing
| 8 |
| Does the system have Security Authorization (SA)? |
| ☐ Yes (skip question 8b) |
☐ No (skip question 8a)
| 8a |
| Date of Security Authorization |
| 8b |
| Planned Date of Security Authorization |
☐ Not Applicable
| 9 |
| Indicate the following reason(s) for updating this PIA. Choose from the following options. |
| ☐PIA Validation (PIA Refresh/Annual Review) |
| ☐ Significant System Management Change |
| ☐ Anonymous to Non-Anonymous |
| ☐ Alteration in Character of Data |
| ☐ New Public Access |
| ☐ New Interagency Uses |
| ☐ Internal Flow or Collection |
| ☐ Conversion |
☐ Commercial Sources
| 10 |
| Describe in further detail any changes to the system that have occurred since the last PIA. |
| 11 |
| Describe the purpose of the system. |
| 12 |
| Describe the type of information the system will collect, maintain (store), or share. (Subsequent questions will identify if this information is PII and ask about the specific data elements.) |
| 13 |
| Provide an overview of the system and describe the information it will collect, maintain (store), or share, either permanently or temporarily. |
| 14 |
| Does the system collect, maintain, use or share PII? |
| ☐ Yes |
☐ No (skip questions 15-38)
| 15 |
| Indicate the type of PII that the system will collect or maintain. |
| ☐ Social Security Number |
| ☐ Date of Birth |
| ☐ Name |
| ☐ Photographic Identifiers |
| ☐ Driver's License Number |
| ☐ Biometric Identifiers |
| ☐ Mother's Maiden Name |
| ☐ Vehicle Identifiers |
| ☐ E-Mail Address |
| ☐ Mailing Address |
| ☐ Phone Numbers |
| ☐ Medical Records Number |
| ☐ Medical Notes |
| ☐ Financial Account Info |
| ☐ Certificates |
| ☐ Legal Documents |
| ☐ Education Records |
| ☐ Device Identifiers |
| ☐ Military Status |
| ☐ Employment Status |
| ☐ Foreign Activities |
| ☐ Passport Number |
☐ Taxpayer ID
| 16 |
| Indicate the categories of individuals about whom PII is collected, maintained or shared. |
| ☐ Employees |
☐ Public Citizens ☐ Business Partners/Contacts (Federal, state, local agencies) ☐ Vendors/Suppliers/Contractors ☐ Patients
Other
| 17 |
| How many individuals' PII is in the system? |
| ☐ <100 |
| ☐ 10,000-49,999 |
| ☐ 100-499 |
| ☐ 50,000-99,999 |
| ☐ 500-4,999 |
| ☐ 100,000-999,999 |
| ☐ 5,000-9,999 |
| ☐ 1,000,000 or more |
| 18 |
| For what primary purpose is the PII used? |
| 19 |
| Describe the secondary uses for which the PII will be used (e.g. testing, training or research) |
| 20 |
| Describe the function of the SSN. |
| 20a |
| Cite the legal authority to use the SSN. |
| 21 |
| Identify legal authorities governing information use and disclosure specific to the system and program. |
| 22 |
| Are records on the system retrieved by one or more PII data elements? |
| ☐ Yes |
☐ No (skip question 22a)
| 22a |
| Identify the number and title of the Privacy Act |
System of Records Notice (SORN) that is being used to cover the system or identify if a SORN is being developed.
Published:
Published:
Published:
☐ In Progress
| 23 |
| Identify the sources of PII in the system. |
| Directly from an individual about whom the information pertains |
☐ In-Person ☐ Hard Copy: Mail/Fax ☐ Email ☐ Online ☐ Other Government Sources ☐ Within the OPDIV ☐ Other HHS OPDIV ☐ State/Local/Tribal ☐ Foreign ☐ Other Federal Entities ☐ Other Non-Government Sources ☐ Members of the Public ☐ Commercial Data Broker ☐ Public Media/Internet ☐ Private Sector ☐ Other
| 23a |
| Identify the OMB information collection approval number and expiration date. |
| 24 |
| Is the PII shared with other organizations? |
| ☐ Yes |
☐ No (skip question 24a-c)
| 24a |
| Identify with whom the PII is shared or disclosed and for what purpose. |
| ☐ Within HHS |
☐ Other Federal Agency/Agencies
☐ State or Local Agency/Agencies
☐ Private Sector
24b
Describe any agreements in place that authorizes the information sharing or disclosure (e.g. Computer Matching Agreement, Memorandum of Understanding (MOU), or Information Sharing Agreement (ISA)).
| 24c |
| Describe the procedures for accounting for disclosures |
| 25 |
| Describe the process in place to notify individuals that their personal information will be collected. If no prior notice is given, explain the reason. |
| 26 |
| Is the submission of PII by individuals voluntary or mandatory? |
| ☐ Voluntary |
☐ Mandatory
| 27 |
| Describe the method for individuals to opt-out of the collection or use of their PII. If there is no option to object to the information collection, provide a reason. |
| 28 |
| Describe the process to notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of original collection). Alternatively, describe why they cannot be notified or have their consent obtained. |
| 29 |
| Describe the process in place to resolve an individual's concerns when they believe their PII has been inappropriately obtained, used, or disclosed, or that the PII is inaccurate. If no process exists, explain why not. |
| 30 |
| Describe the process in place for periodic reviews of PII contained in the system to ensure the data's integrity, availability, accuracy and relevancy. If no processes are in place, explain why not. |
| 31 |
| Identify who will have access to the PII in the system and the reason why they require access. |
| ☐ Users |
☐ Administrators
☐ Developers
☐ Contractors
☐ Others
| 32 |
| Describe the procedures in place to determine which system users (administrators, developers, contractors, etc.) may access PII. |
| 33 |
| Describe the methods in place to allow those with access to PII to only access the minimum amount of information necessary to perform their job. |
| 34 |
| Identify training and awareness provided to personnel (system owners, managers, operators, contractors and/or program managers) using the system to make them aware of their responsibilities for protecting the information being collected and maintained. |
| 35 |
| Describe training system users receive (above and beyond general security and privacy awareness training). |
| 36 |
| Do contracts include Federal Acquisition Regulation and other appropriate clauses ensuring adherence to privacy provisions and practices? |
| ☐ Yes |
☐ No
| 37 |
| Describe the process and guidelines in place with regard to the retention and destruction of PII. Cite specific records retention schedules. |
| 38 |
| Describe, briefly but with specificity, how the PII will be secured in the system using administrative, technical, and physical controls. |
| 39 |
| Identify the publicly-available URL: |
| 40 |
| Does the website have a posted privacy notice? |
| ☐ Yes |
☐ No (skip question 40a)
| 40a |
| Is the privacy policy available in a machine-readable format? |
| ☐ Yes |
☐ No
| 41 |
| Does the website use web measurement and customization technology? |
| ☐ Yes |
☐ No (skip question 41a)
| 41a |
| 41a Select the type of website measurement and customization technologies is in use and if it is used to collect PII. (Select all that apply) |
| Technologies |
| Collects PII? |
☐ No
| ☐ Persistent Cookies |
| ☐ Yes |
Other
☐ Yes ☐ No
| 42 |
| Does the website have any information or pages directed at children under the age of thirteen? |
| ☐ Yes |
☐ No (skip question 42a)
| 42a |
| Is there a unique privacy policy for the website, and does the unique privacy policy address the process for obtaining parental consent if any information is collected? |
| ☐ Yes |
☐ No
| 43 |
| Does the website contain links to non- federal government websites external to HHS? |
| ☐ Yes |
☐ No (skip question 43a)
| 43a |
| Is a disclaimer notice provided to users that follow external links to websites not owned or operated by HHS? |
| ☐ Yes |