### Purpose of the Process Guide

CDC projects are required to comply with various CDC and Federal
regulations, mandates, policies, processes, and standards. Information
about these requirements is available from various websites and
supporting documents. However, this information is often not presented
from the perspective of the project team and their roles &
responsibilities in complying with these requirements. CDC UP Process
Guides provide that perspective.

CDC UP Process Guides help project teams comply with CDC and Federal
requirements by:

1.  Setting the requirements in the context of their purpose

2.  Providing step-by-step instructions for completing the activities
    required for compliance

3.  Illustrating potential integration points between processes

4.  Presenting requirements in a concise, easy-to-understand, and
    consistent format

5.  Making that presentation accessible to the CDC community via the CDC
    Unified Process website

The specific purpose of this Process Guide is to describe the **Privacy
Impact Assessment (PIA)** process as it applies to project teams.

### Process Overview

CDC requires all HHS Privacy Impact Assessment (PIAs) to be processed in
the early stages of the system lifecycle. PIA compliance and consistency
with the C&A process will be ensured through the PIA processing
activities.

The PIA process is used to determine what personally identifiable
information (PII) is contained within an IT system, how that information
is used, and how it is protected. It is important to complete the PIA
process early in the planning phase of the project as results of the PIA
could impact design. Systems with PII are subject to a set of
requirements based on privacy laws, regulations, and guidance.

Conducting PIAs will allow CDC to identify which of its systems contain
PII and which do not. For those systems containing PII, the PIA will
serve as a platform to:

-   Ensure information handling conforms to applicable legal,
    regulatory, and policy requirements regarding privacy.

-   Determine the risks and effects of collecting, maintaining, and
    disseminating PII in an electronic information system.

-   Examine and evaluate protections and alternative processes for
    handling information to mitigate potential privacy risks.

The PIA process involves completing the following two (2) sections of
the HHS PIA Form:

1.  1\. **PIA Summary** -- Captures what type of information is
    collected and stored by an IT system, why the information is
    collected and what it is used for. IT system information from the
    PIA Summary is rolled up and published by HHS for public view
    Information
    [http://www.hhs.gov/pia/cdc/](../%20http://www.hhs.gov/pia/cdc/%0D)

> 2\. **PIA Required Information** -- Captures information needed to
> determine privacy impact.

The PIA is part of the Certification & Accreditation (C&A) process and
must be repeated whenever an IT system changes in a way that may create
or reduce new privacy risks. For example:

-   **Conversions** -- Converting paper based records to electronic
    systems

-   **Anonymous to Non-Anonymous** -- Functions applied to existing
    information collection change anonymous information in to IFF

-   **Significant System Management Changes** -- New use of an existing
    IT system, including application of new technologies, which may
    significantly change how IFF is managed in the IT system

-   **Significant Merging** -- Agencies adopt of alter business
    processes and government databases holding IFF are merged,
    centralized, matched with other databases or otherwise significant
    manipulated

-   **New Public Access** -- User-authenticating technology (e.g.,
    password, digital certificate, biometric) is newly applied to an
    information system that is accessed by members of the public

-   **Commercial Sources** -- Agencies systematically incorporate into
    existing information systems databases of IFF that have been
    purchased or obtained from commercial or public sources (Note:
    Merely querying such databases on an ad hoc basis using existing
    technology does not trigger the PIA process)

-   **New interagency Uses** -- Agencies collaborate on shared functions
    involving significant new uses or exchanges of IFF, such as the
    cross-cutting E-government initiatives; in such cases, the lead
    agency should prepare the PIA.

-   **Internal Flow or Collection** -- New IFF is added to an
    information collection and increases risks to personal privacy (for
    example, health or financial information)

-   **Alteration in Character of Data** -- when new information in
    identifiable form added to a collection raises the risks to personal
    privacy (for example, the addition of health or financial
    information)

### Process Attributes

This section provides a list of process attributes to help project teams
better understand the requirements necessary to comply with this process
and to determine when and how they may impact their project.

+---------------------------+-------------------------------------------+
| [Process                  | [Description]{.smallcaps}                 |
| Attribute]{.smallcaps}    |                                           |
+===========================+===========================================+
| **Process Owner(s)**      | Tom Madden                                |
+---------------------------+-------------------------------------------+
| **Process Criteria**      | CDC requires all Privacy Impact           |
|                           | Assessments (PIA) to be part of the C&A   |
|                           | process.                                  |
+---------------------------+-------------------------------------------+
| **Timing of Process in    | Initiate the PIA process in the early     |
| Project Life Cycle**      | stages (initiation phase) of the system   |
|                           | lifecycle.                                |
+---------------------------+-------------------------------------------+
| **Estimated Level of      | It is estimated that conducting each PIA  |
| Effort**                  | template takes two hours assuming that    |
|                           | all information needed is readily         |
|                           | accessible. If an IT system does not      |
|                           | contain PII, it will take approximately   |
|                           | 60 minutes to complete the process.       |
+---------------------------+-------------------------------------------+
| **Associated Costs**      | No cost to the project except the         |
|                           | estimated level of effort described       |
|                           | above.                                    |
+---------------------------+-------------------------------------------+
| **Process Prerequisites** | An understanding of the data that will be |
|                           | collected and/or stored.                  |
+---------------------------+-------------------------------------------+
| **Process Dependencies**  | C&A documents                             |
|                           | <http://intr                              |
|                           | anet.cdc.gov/ociso/CandA/GetStarted.html> |
+---------------------------+-------------------------------------------+
| **Available Training**    | <http                                     |
|                           | ://intranet.hhs.gov/infosec/privacy.html> |
+---------------------------+-------------------------------------------+
| **Additional              | [[http://intranet                         |
| Information**             | .cdc.gov/ociso/privacy/privacy_management |
|                           | .html]{.underline}](http://intranet.cdc.g |
|                           | ov/ociso/privacy/privacy_management.html) |
|                           |                                           |
|                           | <ht                                       |
|                           | tp://intranet.cdc.gov/ociso/CandA/CandAdo |
|                           | cs/HHS_Privacy_Impact_Assessment-CDC.doc> |
+---------------------------+-------------------------------------------+

### Contact List

This section provides a list of individuals and/or offices that are
available to assist the project team in answering questions regarding
the content of this Process Guide and related topics. The information is
correct as of this publication. However, due to the ever-changing nature
of our work environment it is possible some information may be out of
date.

  --------------------------------------------------------------------------------
  [National Center]{.smallcaps}          [Role]{.smallcaps}   [Name]{.smallcaps}
  -------------------------------------- -------------------- --------------------
  CDC Office of the Chief Information    Senior Agency        James D. Seligman
  Officer (OCIO)                         Official for Privacy 

  CDC Office of the Chief Information    Chief Privacy        Thomas P. Madden
  Security Officer (OCISO)               Official for         
                                         Information          
                                         Technology           

  CDC Office of the Chief Information    Compliance &         Felicia Kittles
  Security Officer (OCISO)               Education (C&E)      
                                         Program Manager      
  --------------------------------------------------------------------------------

### 

### 

### Key Terms

The CDC Unified Process Team maintains a comprehensive list of key terms
and acronyms relevant to all Unified Process artifacts maintained on the
CDC UP website. Follow the link below for definitions and acronyms
related to this and other, documents.

<http://www2.cdc.gov/cdcup/document_library/glossary/default.asp>

### 

### 

### Activities Checklist

This section provides a list of steps outlining the activities
associated with complying with this process. Due to the dynamic nature
of the PIA process a website has been established to communicate the
most current information regarding PIA requirements. This website also
contains a list of the related templates that assist in completing PIA
activities. <http://intranet.cdc.gov/ociso/privacy/PIA.html>

### 

### 

### Process Flowchart

This section provides a pictorial view of steps outlining the activities
associated with complying with the PIA process and those responsible for
those activities.

![](media/image1.jpeg){width="6.495138888888889in"
height="8.796527777777778in"}