**USDA PRIVACY IMPACT ASSESSMENT FORM**

**Project Name:** [Emergency Management Response System
(EMRS)]{.underline}

**Description of Your Program/Project:** The EMRS is used by the
Veterinary Service staff to manage and investigate outbreaks of foreign
animal diseases in the United States. In the event a foreign animal
disease were introduced into the domestic livestock or poultry
populations, Veterinary Services responds by activating one of two
Regional Emergency Animal Disease Eradication Organizations (READEO\'s),
operating out of Raleigh, NC and Fort Collins, CO. READEO team members
are highly trained to control and eradicate exotic diseases and
parasites anywhere in the United States. READEO personnel confirm the
presence of exotic disease, inspect infected and exposed animals, and
appraise the value of animals that may have to be destroyed. These
employees conduct vaccination programs and epidemiological studies and
are trained to dispose of animal carcasses, clean and disinfect
premises, set and enforce regulations against disease spread, and
control disease carriers. The EMRS is used to assist READEO team members
in performing these functions. Since the initial deployment of EMRS, an
instance has been set up to store the routine foreign animal disease
investigation data for each state.

DATA IN THE SYSTEM

+-----------------------------------+-----------------------------------+
| #####                             | **Customer-Stored in Inves        |
|                                   | module:** The owner or operator   |
| 1\. Generally describe the        | of the premises where the animals |
| information to be used in the     | are that the investigation is     |
| system in each of the following   | being performed at. Referring     |
| categories: Customer, Employee,   | contact is whoever gave us        |
| and Other.                        | initial premises information.     |
|                                   | Case coordinator is whoever is    |
|                                   | responsible for the premises      |
|                                   | investigation.                    |
|                                   |                                   |
|                                   | **Employee-Stored in admin        |
|                                   | module:** Administrative          |
|                                   | information, current duty         |
|                                   | assignment, forecasted rotations, |
|                                   | past rotations, non-arrivals,     |
|                                   | cancelled rotations, home contact |
|                                   | information, work contact         |
|                                   | information, field contact        |
|                                   | information, and skills &         |
|                                   | experience is stored.             |
+-----------------------------------+-----------------------------------+
| 2a. What are the sources of the   | Data is entered by authorized     |
| information in the system?        | federal, state, or temp hires     |
|                                   | during an animal disease outbreak |
|                                   | or during the course of a routine |
|                                   | FAD investigation. Information is |
|                                   | obtained from either the customer |
|                                   | or the employee and is often      |
|                                   | supplemented during an            |
|                                   | investigation by on-site visit,   |
|                                   | USPS data base, or other          |
|                                   | address-validation data base.     |
+-----------------------------------+-----------------------------------+
| 2b. What USDA files and databases | National Finance Center data base |
| are used? What is the source      | is used to get work information   |
| agency?                           | about employees. USDA is the      |
|                                   | source agency.                    |
+-----------------------------------+-----------------------------------+
| 2c. What Federal Agencies are     | USPS provides address validation  |
| providing data for use in the     | capabilities.                     |
| system?                           |                                   |
+-----------------------------------+-----------------------------------+
| 2d. What State and Local Agencies | The individual State Veterinarian |
| are providing data for use in the | Offices and various Disease       |
| system?                           | Program Laboratories provide data |
|                                   | for use in EMRS.                  |
+-----------------------------------+-----------------------------------+
| 2e. From what other third party   | Private individuals or companies  |
| sources will data be collected?   | who are the subject of the        |
|                                   | programs for whom we keep data.   |
+-----------------------------------+-----------------------------------+
| 2f. What information will be      | **Customer-Stored in Inves        |
| collected from the                | module:** Name, address, city,    |
| customer/employee?                | state, zip code, county, phone    |
|                                   | number, and lat/long coordinates  |
|                                   | are stored for prem               |
|                                   | owner/operator. Name and phone    |
|                                   | number are stored for referring   |
|                                   | contact. Name, phone number,      |
|                                   | email address is stored for case  |
|                                   | coordinator.                      |
|                                   |                                   |
|                                   | **Employee-Stored in admin        |
|                                   | module:** Name, organization,     |
|                                   | group, title, social security     |
|                                   | number, grade, salary, PPE size,  |
|                                   | position number, travel card      |
|                                   | (Y/N), Purchase card (Y/N), home  |
|                                   | address, city, state, zip code,   |
|                                   | county, phone number, email       |
|                                   | address, lat/long coordinates,    |
|                                   | emergency contact name,           |
|                                   | relationship, & number, work      |
|                                   | address, city, state, zip code,   |
|                                   | county, region, phone number,     |
|                                   | supervisor name, phone number,    |
|                                   | and email address. Field address, |
|                                   | city, state, county, zip code,    |
|                                   | phone number, email address,      |
|                                   | existing skills/experience, and   |
|                                   | desired skills/experience.        |
+-----------------------------------+-----------------------------------+
| 3a. How will data collected from  | Authorized federal, state, or     |
| sources other than the USDA       | temp hires who collect and enter  |
| records and the customer be       | the data are responsible for the  |
| verified for accuracy?            | review and accuracy of the data.  |
+-----------------------------------+-----------------------------------+
| 3b. How will data be checked for  | Information is obtained from      |
| completeness?                     | either the customer or the        |
|                                   | employee and is often             |
|                                   | supplemented during an            |
|                                   | investigation by on-site visit,   |
|                                   | USPS data base, or other          |
|                                   | address-validation data base.     |
|                                   | There are also limited data entry |
|                                   | constraints to ensure entry       |
|                                   | completeness.                     |
+-----------------------------------+-----------------------------------+
|                                   |                                   |
+-----------------------------------+-----------------------------------+

##### 

##### ACCESS TO THE DATA

  ----------------------------------- -----------------------------------
  **1.** Who will have access to the  Authorized federal, state, or temp
  data in the system (Users,          EMRS users/managers will have
  Managers, System Administrators,    read-only or input/update access to
  Developers, Other)?                 all investigation or administrative
                                      data as determined by their
                                      taskforce/investigation job. System
                                      administrators and developers have
                                      full access to all data in the
                                      system.

  2\. How is access to the data by a  Authorized federal, state, and temp
  user determined? Are criteria,      personnel have access to EMRS data
  procedures, controls, and           for a specific animal disease
  responsibilities regarding access   instance they are assigned to
  documented?                         according to the job they've been
                                      assigned by outbreak managers.
                                      Selected task force personnel
                                      (usually Disease Reporting
                                      Officers) are able to see all EMRS
                                      data during an outbreak. All
                                      federal personnel in VS area
                                      offices and all state personnel in
                                      their corresponding state office
                                      have access to routine FAD data for
                                      their state. Selected regional
                                      office epidemiologists, EP staff
                                      personnel, and lab personnel are
                                      able to see routine FAD
                                      investigation data for all 50
                                      states.

  3\. Will users have access to all   Authorized federal, state, and temp
  data on the system or will the      personnel have access to EMRS data
  user's access be restricted?        for a specific animal disease
  Explain.                            instance they are assigned to
                                      according to the job they've been
                                      assigned by outbreak managers.
                                      Selected task force personnel
                                      (usually Disease Reporting
                                      Officers) are able to see all EMRS
                                      data during an outbreak. Federal
                                      personnel in VS area offices and
                                      state personnel in their
                                      corresponding state office have
                                      access to routine FAD data for only
                                      their state. Selected regional
                                      office epidemiologists, EP staff
                                      personnel, and lab personnel are
                                      able to see routine FAD
                                      investigation data for all 50
                                      states.

  4\. What controls are in place to   Social security number, grade,
  prevent the misuse (e.g. browsing,  salary, and home contact info is
  unauthorized use) of data by those  only viewable or updatable by the
  having access?                      individual information is being
                                      stored for, or by people with
                                      specific roles to view or update
                                      these fields.

  5a. Do other systems share data or  Data from EMRS is exported & then
  have access to data in this system? spatially enabled to another server
  If yes, explain.                    running Microsoft SQL Server to run
                                      the GIS Mapping component for EMRS.
                                      Data from EMRS is sent to an Oracle
                                      server so reports can be run on
                                      this server for EP staff personnel.
                                      EMRS data will ultimately be
                                      exported directly into a GDB
                                      instance. Data from EMRS is also
                                      analyzed by other CEAH personnel
                                      using their Statistical Analysis
                                      System. One instance of EMRS has
                                      data exported to Microsoft Access
                                      so taskforce personnel can run
                                      local reports. In all cases, EMRS
                                      data is NOT to be changed in the
                                      new environment -- data should be
                                      changed ONLY in the web-access
                                      Lotus Notes environment the normal
                                      user uses.

  5b. Who will be responsible for     The VS management team, EP staff,
  protecting the privacy rights of    Regional Directors, AVIC's, and
  the customers and employees         State Veterinarians are responsible
  affected by the interface.          for protecting the privacy rights
                                      of the customers and employees
                                      affected by the interface.

  6a. Will other agencies share data  National Finance Center data base
  or have access to data in this      is used to get work information
  system (International, Federal,     about employees. Data from NFC is
  State, Local, Other)?               not imported to EMRS until it has
                                      been thoroughly reviewed.

  6b. How will the data be used by    The data base is used for
  the agency?                         management of foreign animal
                                      disease outbreaks and for the
                                      routine reporting of FAD
                                      investigations. EMRS is also used
                                      to track limited information for
                                      domestic disease control programs.

  6c. Who is responsible for assuring The VS management team, EP staff,
  proper use of the data?             Regional Directors, AVIC's, and
                                      State Veterinarians are responsible
                                      for assuring the proper use of EMRS
                                      data.
  ----------------------------------- -----------------------------------

###  

### ATTRIBUTES OF THE DATA

+-----------------------------------+-----------------------------------+
| 1\. Is the use of the data both   | Yes                               |
| relevant and necessary to the     |                                   |
| purpose for which the system is   |                                   |
| being designed?                   |                                   |
+-----------------------------------+-----------------------------------+
| 2a. Will the system derive new    | Potentially.                      |
| data or create previously         |                                   |
| unavailable data about an         |                                   |
| individual through aggregation    |                                   |
| from the information collected?   |                                   |
+-----------------------------------+-----------------------------------+
| 2b. Will the new data be placed   | Potentially.                      |
| in the individual's record        |                                   |
| (customer or employee)?           |                                   |
+-----------------------------------+-----------------------------------+
| 2c. Can the system make           | Potentially.                      |
| determinations about customers or |                                   |
| employees that would not be       |                                   |
| possible without the new data?    |                                   |
+-----------------------------------+-----------------------------------+
| 2d. How will the new data be      | The new data will be verified for |
| verified for relevance and        | relevance and accuracy through    |
| accuracy?                         | agency contact with those         |
|                                   | responsible for collecting the    |
|                                   | data.                             |
+-----------------------------------+-----------------------------------+
| 3a. If data is being              | The VS management team, EP staff, |
| consolidated, what controls are   | and Regional Directors will       |
| in place to protect the data from | determine when data needs to be   |
| unauthorized access or use?       | consolidated and then make sure   |
|                                   | data is protected from            |
|                                   | unauthorized access or use.       |
+-----------------------------------+-----------------------------------+
| 3b. If processes are being        | Yes. The VS management team, EP   |
| consolidated, are the proper      | staff, and Regional Directors     |
| controls remaining in place to    | will determine when data needs to |
| protect the data and prevent      | be consolidated and then make     |
| unauthorized access? Explain.     | sure data is protected from       |
|                                   | unauthorized access or use.       |
+-----------------------------------+-----------------------------------+
| 4a. How will the data be          | Data can be retrieved only by     |
| retrieved? Can it be retrieved by | personnel who have logged in with |
| personal identifier? If yes,      | a user ID and password issued by  |
| explain.                          | APHIS personnel. If data is       |
|                                   | retrieved via the web, log files  |
|                                   | will track exact data queried. If |
|                                   | data is retrieved via the Notes   |
|                                   | client, no record of data queried |
|                                   | is kept.                          |
+-----------------------------------+-----------------------------------+
| 4b. What are the potential        | If higher headquarters directs    |
| effects on the due process rights | that EMRS data is to be           |
| of customers and employees of:    | summarized to support higher      |
|                                   | level systems, they should put in |
| -   consolidation and linkage of  | place filters to protect customer |
|     files and systems;            | and employee data entered into    |
|                                   | EMRS.                             |
| -   derivation of data            |                                   |
|                                   |                                   |
| -   accelerated information       |                                   |
|     processing and decision       |                                   |
|     making;                       |                                   |
|                                   |                                   |
| -   Use of new technologies.      |                                   |
+-----------------------------------+-----------------------------------+
| 4c. How are the effects to be     | Higher headquarters personnel     |
| mitigated?                        | must be knowledgeable enough      |
|                                   | about EMRS and other systems it   |
|                                   | interfaces with to see the        |
|                                   | potential misuse that could be    |
|                                   | made of the data in all           |
|                                   | consolidated/linked systems.      |
+-----------------------------------+-----------------------------------+

### MAINTENANCE OF ADMINISTRATIVE CONTROLS

  ----------------------------------- -----------------------------------
  1a. Explain how the system and its  Data is entered into EMRS only to
  use will ensure equitable treatment help manage an animal disease
  of customers and employees.         outbreak or to help track
                                      information about a routine FAD
                                      investigations. The VS management
                                      team, EP staff, and Regional
                                      Directors will not release
                                      information from EMRS unless it
                                      there is a need to further an
                                      agency disease program.

  2a. If the system is operated in    Lotus Notes has a feature to
  more than one site, how will        automatically replicate (copy) data
  consistent use of the system and    base information to servers based
  data be maintained in all sites?    on information stored in connection
                                      documents. All EMRS data is stored
                                      and replicated every 15 to 60
                                      minutes between 3 master EMRS
                                      servers: emrs02 (in Riverdale),
                                      emrs03, and emrs04 (in Fort
                                      Collins). If EMRS field servers are
                                      set up during an outbreak, field
                                      server(s) data is automatically
                                      replicated to master EMRS servers
                                      as well.

  2b. Explain any possibility of      None determined.
  disparate treatment of individuals  
  or groups.                          

  2c. What are the retention periods  After an animal disease outbreak,
  of data in this system?             data is burned onto a CD and
                                      distributed to outbreak management
                                      personnel and kept for an
                                      indefinite time. Routine FAD EMRS
                                      data is expected to be retained on
                                      the server for an indefinite time.

  2d. What are the procedures for     None determined.
  eliminating the data at the end of  
  the retention period? Where are the 
  procedures documented?              

  2e. While the data is retained in   None determined.
  the system, what are the            
  requirements for determining if the 
  data is still sufficiently          
  accurate, relevant, timely, and     
  complete to ensure fairness in      
  making determinations?              

  3a. Is the system using             N/A
  technologies in ways that the USDA  
  has not previously employed (e.g.   
  Caller-ID)?                         

  3b. How does the use of this        N/A
  technology affect customer/employee 
  privacy?                            

  4a. Will this system provide the    Yes, but only as far as their
  capability to identify, locate, and relation to the monitoring of the
  monitor [individuals]{.underline}?  disease program is concerned.
  If yes, explain.                    

  4b. Will this system provide the    Yes, but only as far as their
  capability to identify, locate, and relation to the monitoring of the
  monitor [groups of                  disease program is concerned.
  people]{.underline}? If yes,        
  explain.                            

  4c. What controls will be used to   The CFR describes what we can and
  prevent unauthorized monitoring?    cannot do with the monitoring of
                                      the data.

  5a. Under which Systems of Record   We do not know if there is an SOR
  notice (SOR) does the system        notice this system operated under.
  operate? Provide number and name.   

  5b. If the system is being          We do not know if there is an SOR
  modified, will the SOR require      notice this system operated under.
  amendment or revision? Explain.     
  ----------------------------------- -----------------------------------