![](media/image1.jpeg){width="7.875in" height="10.479166666666666in"}

> Information Assurance and Privacy Program
>
> Information Assurance and Privacy
>
> Privacy Impact Assessment (PIA)
>
> Guide
>
> July 2006

# Table of Contents {#table-of-contents .unnumbered}

Table of Contents [i](#table-of-contents)

Preface [iii](#preface)

Document Change History [iv](#document-change-history)

1\. Introduction [1](#introduction)

1.1 Purpose [1](#purpose)

1.2 Background [1](#background)

1.3 Scope [2](#scope)

1.4 Document Organization [2](#document-organization)

2\. Federal Privacy Requirements [3](#federal-privacy-requirements)

2.1 Federal Statutes [3](#federal-statutes)

2.1.1 *The Privacy Act of 1974* [3](#the-privacy-act-of-1974)

2.1.2 *The E-Government Act of 2002* [3](#the-e-government-act-of-2002)

2.1.3 *The Children's Online Privacy and Protection Act of* 1998
[4](#the-childrens-online-privacy-and-protection-act-of-1998)

2.1.4 *The Clinger-Cohen Act of 1996*
[4](#the-clinger-cohen-act-of-1996)

2.1.5 *The Health Insurance Portability and Accountability Act (HIPAA)\
of 1996*
[4](#the-health-insurance-portability-and-accountability-act-hipaa-of-1996)

2.1.6 *The Paperwork Reduction Act (PRA) of 1995*
[4](#the-paperwork-reduction-act-pra-of-1995)

2.1.7 *The Computer Matching and Privacy Protection Act of 1988*
[5](#the-computer-matching-and-privacy-protection-act-of-1988)

2.1.8 *The Freedom of Information Act (FOIA) of 1966*
[5](#the-freedom-of-information-act-foia-of-1966)

2.2 Federal Memoranda and Other Guidance
[5](#federal-memoranda-and-other-guidance)

2.2.1 OMB Circular A-130, Appendix III
[5](#omb-circular-a-130-appendix-iii)

2.2.2 OMB Circular A-11 [6](#omb-circular-a-11)

2.2.3 OMB Memorandum 01-05 [6](#omb-memorandum-01-05)

2.2.4 OMB Memorandum 03-22 [7](#omb-memorandum-03-22)

2.2.5 OMB Memorandum 05-08 [8](#omb-memorandum-05-08)

2.2.6 OMB Memorandum 06-16 [8](#omb-memorandum-06-16)

2.2.7 OMB Memorandum 06-20 [8](#omb-memorandum-06-20)

3\. PIA Roles and Responsibilities [9](#pia-roles-and-responsibilities)

3.1 Department Level [9](#department-level)

3.1.1 Senior Agency Official for Privacy
[9](#senior-agency-official-for-privacy)

3.1.2 Inspector General [9](#inspector-general)

3.1.3 HHS Privacy Act Officer [10](#hhs-privacy-act-officer)

3.2 OPDIV Level [10](#opdiv-level)

3.2.1 OPDIV Chief Information Security Officer
[10](#opdiv-chief-information-security-officer)

3.2.2 OPDIV Senior Official for Privacy
[11](#opdiv-senior-official-for-privacy)

3.2.3 OPDIV Privacy Contact [11](#opdiv-privacy-contact)

3.2.4 System PIA Author [11](#system-pia-author)

4\. Privacy Impact Assessment Process
[13](#privacy-impact-assessment-process)

4.1 PIA Overview [13](#pia-overview)

4.1.1 Purpose of the PIA [13](#purpose-of-the-pia)

4.1.2 Benefits of PIA [14](#benefits-of-pia)

4.1.3 Scope [14](#scope-1)

4.1.4 Timing [14](#timing)

4.2 PIA Activities [15](#pia-activities)

4.2.1 Step One: Determining When a PIA Must Be Conducted
[15](#step-one-determining-when-a-pia-must-be-conducted)

4.2.2 Step Two: Assigning Roles and Responsibilities
[15](#step-two-assigning-roles-and-responsibilities)

4.2.3 Step Three: Preparing to Begin the PIA
[15](#step-three-preparing-to-begin-the-pia)

4.2.4 Step Four: Composing a PIA [16](#step-four-composing-a-pia)

4.2.5 Step Five: Characterizing the System
[17](#step-five-characterizing-the-system)

4.2.6 Step Six: Completing the PIA [17](#step-six-completing-the-pia)

4.2.7 Step Seven: Approving and Demoting the PIA
[18](#step-seven-approving-and-demoting-the-pia)

4.2.8 Step Eight: Maintaining the PIA
[18](#step-eight-maintaining-the-pia)

5\. Conclusion [19](#conclusion)

Appendix A: Document Feedback [20](#appendix-a-document-feedback)

Appendix B: References [21](#appendix-b-references)

Appendix C: Acronyms [24](#appendix-c-acronyms)

Appendix D: Glossary [26](#appendix-d-glossary)

Appendix E: Privacy Impact Assessment (PIA)
[29](#appendix-e-privacy-impact-assessment-pia)

Appendix F: PIA Question-by-Question Tutorial
[44](#appendix-f-pia-question-by-question-tutorial)

# Preface {#preface .unnumbered}

As the Department of Health and Human Services (HHS) Information
Assurance and Privacy Program evolves, this document will be subject to
review and update. The *HHS Information Assurance and Privacy Privacy
Impact Assessment (PIA) Guide* will undergo such changes annually, or
whenever alterations occur which suggest that the Guide's content should
be modified. These changes may include the following:

-   Modifications of roles and responsibilities;

-   Release of new executive, legislative, technical, or Departmental
    guidance;

-   Guidance issued from the Office of Management and Budget (OMB);

-   Identification of changes in governing policies;

-   Changes in vulnerabilities, risks or threats; and/or

-   HHS Inspector General findings that stem from a security audit.

The HHS Chief Information Security Officer (CISO) must approve all
revisions to the *HHS PIA Guide*. Revisions are to be highlighted in the
Document Change History table. Each revised guidance document is subject
to HHS' document review and approval process before becoming final. When
it is approved, a new version of the *HHS PIA Guide* will be issued and
all affected parties will be informed of the changes made.

The procedures outlined in the *HHS PIA Guide* are proven practices that
will provide guidance to the Department in meeting or exceeding the
baseline requirements identified in the *HHS Information Security
Program Policy* document. The *HHS PIA Guide* provides specific
information for the recommended implementation of Privacy compliance.
While the specifics of how to undertake the implementations are not
mandatory, any security implementation undertaken by an OPDIV must
result in security controls and processes that are equal to or stronger
than those articulated in the policies, handbooks, and related guides.
If an Operating Division (OPDIV) or Staff Division (STAFFDIV) chooses
not to adopt the baseline guidance set forth in this *HHS PIA Guide*, it
must document this decision and assume responsibility for the creation
of procedures of equal or greater stringency.

# Document Change History {#document-change-history .unnumbered}

  --------- ------------- -------------------- --------------- -------------
  Version   Release Date  Summary of Changes   Section         Changes Made
  Number                                       Number/\        By
                                               Paragraph       
                                               Number          

  1.0       07/12/2004    Final Document       N/A             N/A
                          Release with content                 
                          changes                              

  1.1       03/16/2005    Release with content 1.4,4.2.8,      N/A
                          changes              4.2.9, Appendix 
                                               G               

  2.0       07/19/2005    Updated to reflect   Throughout      HHS CISO
                          new HHS guidance and                 
                          regulatory                           
                          requirements.                        

  3.0       07/26/2006    Updated to reflect   Throughout      Secure One
                          data migration and                   HHS
                          process changes.                     
  --------- ------------- -------------------- --------------- -------------

#  Introduction

The Department of Health and Human Services (HHS) is responsible for
implementing and administering an information assurance program to
protect its information resources. The program will comply with
applicable public laws, federal regulations, and Executive Orders,
including the *Federal Information Security Management Act (FISMA) of
2002*; the *Privacy Act of 1974*; the *Office of Management and Budget
(OMB) Circular A-130*, *Management of Federal Information Resources*,
dated November 28, 2000; OMB Memorandum 06-20; OMB Memorandum 05-08; and
the *Health Insurance Portability and Accountability Act of 1996*
*(HIPAA).* To meet these requirements, the Department has instituted the
*HHS Information Security Program Policy* document and the accompanying
*HHS Information Security Program Handbook*.

The *HHS Information Assurance and Privacy* *Privacy Impact Assessment
(PIA) Guide* is part of the HHS Information Assurance and Privacy
Program and serves as a resource for complying with Title II and III of
the *E-Government Act of 2002* regarding PIA requirements.

For the purposes of this guide, the term "Department" or "Departmental"
is inclusive of HHS and the Operating Divisions (OPDIVs).

## Purpose

This guide outlines a standard approach for conducting a PIA for all
Departmental systems, including developmental, operational, FISMA,
contractor-owned, grantee, Information Technology (IT) general support
systems (GSS), major applications (MA), and non-major applications. It
also provides screenshots of the Department's PIA Form, along with
detailed instructions which aid in properly populating the PIA.
Completing this form will assist the Department in incorporating privacy
protections into every stage of an IT system's life cycle. This guide
also provides a summary of federal legislative, regulatory, and guidance
requirements related to protecting information in identifiable form
(IIF) contained in Departmental systems.

## Background

The federal government has recognized the advantages and risks of IT, as
reflected in new or improved IT security standards for federal
departments and agencies. By providing this guide, the Department also
recognizes the public's growing demand that government entities protect
the privacy of IIF residing in public sector, grantee and
contractor-owned information systems.

Since the Department handles a large amount of IIF that is protected by
federal law, the Department must follow federal privacy guidelines.
Private and public sector organizations interacting with HHS and/or the
OPDIVs must be assured that sensitive information is protected in a
manner that will ensure the confidentiality, integrity, and availability
of the data.

## Scope

All Departmental systems should have a current PIA to ensure compliance
with the *E-Government Act of 2002,* other relevant IT privacy
requirements, and HHS Departmental policy. This guide applies to all
Departmental personnel, which includes the OPDIVs and contractors
responsible for managing and operating systems. This guide will
familiarize Departmental personnel with the IT privacy requirements set
forth in the *Privacy Act of 1974*, *HIPAA,* the *E-Government Act of
2002*, OMB Circulars A-11, *Preparation, Submission and Execution of the
Budget*, and A-130, as well as other applicable information privacy laws
and regulations.

###  {#section .unnumbered}

## Document Organization

The remainder of this guide is structured as follows:

-   Section 2 provides an overview of IT privacy-related legislative and
    regulatory requirements and guidance.

-   Section 3 identifies the roles and responsibilities of PIA
    stakeholders.

-   Section 4 describes the process of completing and submitting a PIA.

-   Section 5 provides a conclusion summarizing the points of this
    guide.

This guide also contains the following appendices:

-   Appendix A provides a feedback form for use in submitting comments
    on this document to HHS.

-   Appendix B lists the references used in this document.

-   Appendix C lists the acronyms used in this document.

-   Appendix D defines terms most frequently used in this document.

-   Appendix E provides screenshots of the PIA Form.

-   Appendix F provides a question-by-question tutorial to assist in
    populating the PIA Form.

#  Federal Privacy Requirements

Privacy and security are closely interrelated and are a source of great
concern for IT managers and system owners. The legislative and
regulatory requirements as well as the guidance summarized in this
section reflect the evolving federal approach of integrating privacy
requirements into overall IT security programs and plans. The PIA
requirement mandated by the E-Government *Act of 2002* is a recent step
in this development. The questions asked in the PIA correspond to
principles and requirements set out by the federal laws and regulations
described in this section.

## Federal Statutes

Public laws require federal agencies to protect the privacy of IIF
residing within their agencies, improve the management of IT resources,
and establish agency IT security programs. Applicable statutes,
including major legislation, such as the *E-Government Act of 2002* and
the *Privacy Act of 1974,* are described below. Other federal
authorities referred to in this guide are listed in Appendix B,
References.

The material in this guide is consistent with federal laws and guidance
existing at the time it was drafted. It will be updated as federal
legislation and regulations change or are made available.

### *The Privacy Act of 1974*

The *Privacy Act of 1974* protects the privacy of individuals by
establishing "Fair Information Practices" for the collection,
maintenance, use, and dissemination of information by federal agencies.
The *Privacy Act*, along with its accompanying case law, is the most
significant milestone in the history of the protection of the privacy of
personal information held by the federal government. Many subsequent
laws, regulations, and guidance build upon the principles first
articulated in the *Privacy Act*.

### *The E-Government Act of 2002*

Title II of the *E-Government Act of 2002* requires federal agencies to
conduct PIAs before developing or procuring IT systems that collect,
maintain, or disseminate IIF. Once completed, the agency's Chief
Information Officer (CIO) or an equivalent official must review the
PIAs. Additional requirements include making PIAs publicly accessible
and posting a machine-readable privacy notice on publicly facing
websites.

Title III of the *E-Government Act*, known as FISMA, superseded and made
permanent some of the provisions of the *Government Information Security
Reform Act of 2000* (GISRA). FISMA amends the *Paperwork Reduction Act
(PRA) of 1995* by adding a new subchapter on information security that
requires certain program management, evaluation, and reporting
activities, such as performing an annual self-assessment and conducting
an independent assessment by each agency's Inspector General (IG).

### *The Children's Online Privacy and Protection Act of* 1998

The *Children's Online Privacy Protection Act (COPPA) of 1998* applies
to private sector websites that collect personal information online from
children under the age of 13. OMB Memorandum (M)-00-13, *Privacy
Policies and Data Collection on Federal Web Sites* (June 22, 2000),
extended the provisions of COPPA to federal websites. COPPA identifies
the content that a website operator must include in a privacy policy,
outlines when and how to seek verifiable consent from a parent, and
specifies the responsibilities an operator has for protecting children's
privacy and safety online.

### *The Clinger-Cohen Act of 1996*

The *Clinger-Cohen Act of 1996* (which includes both the *Information
Technology Management Reform Act* and the *Federal Acquisition Reform
Act*) is intended to improve the productivity, efficiency, and
effectiveness of federal programs through the improved acquisition, use,
and disposal of IT resources. Among other effects, it makes agencies
responsible for IT resource acquisition and management, under the
guidance of the CIO, and emphasizes that value must be maximized and
that risk must be minimized in capital planning and budget processes. In
effect, the *Clinger-Cohen Act* places the burden of incorporating
privacy controls into IT investments at the agency and CIO levels.

### *The Health Insurance Portability and Accountability Act (HIPAA) of 1996* 

HIPAA affects the health insurance industry and contains provisions
under the heading of "Administrative Simplification" that govern how
government and private sector health care institutions handle protected
health information (PHI), a subset of "individually identifiable health
information." Regulations published in 2000, pursuant to these
provisions, establish standards for providing notice of how health
information collected from users of a covered entity's services will be
used and disclosed. These regulations also grant certain rights to
individuals, including the right to see one's health records and to
request corrections or other amendments to those records. These
regulations apply to both written and oral PHI.

Further discussion of HIPAA requirements, compliance, and implementation
can be found in the *HHS HIPAA Compliance Guide* and the HHS Office of
Civil Rights (OCR) HIPAA Privacy Web page at
<http://www.hhs.gov/ocr/hipaa/>.

### *The Paperwork Reduction Act (PRA) of 1995* 

PRA focuses on increasing the efficiency of the federal government's
information collection practices. The PRA specifies that CIOs shall
improve protection for the privacy and security of information under
their agency's control. The PRA also created the Office of Information
and Regulatory Affairs within OMB to provide central oversight of
information management activities across the federal government.
Furthermore, the PRA requires agencies to receive an OMB information
collection approval number (also known as an "OMB control number") for
an information system prior to using that system to collect information
from any person.

### *The Computer Matching and Privacy Protection Act of 1988*

The *Computer Matching and Privacy Protection Act of 1988* added several
new provisions to the *Privacy Act of 1974*. "Computer matching" occurs
when federal and/or state agencies share IIF. Agencies use computer
matching to conduct many government functions, including establishing or
verifying eligibility for federal benefit programs or identifying
payments or debts individuals owe to government agencies. The *Computer
Matching and Privacy Protection Act* requires agencies engaged in
computer matching activities to:

-   Provide individuals notice if their IIF is being computer matched;

-   Allow individuals opportunity to refute adverse information before
    having a benefit denied or terminated; and

-   Establish data integrity boards to oversee computer-matching
    activities.

### *The Freedom of Information Act (FOIA) of 1966* 

FOIA requires all agencies of the executive branch to disclose federal
agency records or information upon receiving a written request for them
from any individual, except for those records (or portions of them) that
are protected from disclosure by certain exemptions and exclusions.[^1]

## Federal Memoranda and Other Guidance

The Department must also comply with OMB guidance when implementing the
previously mentioned legislation. This section highlights important OMB
memoranda on privacy and security.

### OMB Circular A-130, Appendix III

OMB Circular A-130, *Management of Federal Information Resources*,
Appendix III, requires agencies to implement security requirements for,
and to protect personal information in, automated information systems.
Appendix III provides specific guidelines for implementing these
requirements, including a minimum set of controls for federal automated
information programs. Appendix III also assigns federal agency
responsibilities for the security of automated information and links
agency automated information security programs and agency management
control systems established in accordance with OMB Circular A-123,
*Management Accountability and Control*. OMB Circular A-130 requires
agencies to adopt three types of security controls:

-   **Assigning Responsibility for Security**: Responsibility for the
    security of IT systems must be assigned to a person with the
    appropriate qualifications, ability, and authority to provide
    security.

-   **Planning for Security:** System security plans should be
    incorporated into the organization's information resource management
    planning process, consistent with guidance issued by the National
    Institute of Standards and Technology (NIST).

-   **Reviewing Security Controls**: Agencies must review security
    controls whenever significant modifications are made, or at least
    once every three years. The scope and frequency of the review should
    be commensurate with the acceptable level of risk. It is important
    to consider whether personal information is contained in the system
    when assessing risk.

###  {#section-1 .unnumbered}

### OMB Circular A-11

OMB Circular A-11, *Preparation, Submission, and Execution of the
Budget*, provides guidance to federal agencies regarding the preparation
and submission of budget estimates to OMB. Section 31.8 of Circular A-11
requires that agency estimates "reflect a comprehensive understanding of
OMB security policies and NIST guidance." This understanding needs to be
supported by the following measures:

-   Identifying additional security controls for systems that promote or
    permit public access, other externally accessible systems, and those
    that are interconnected with systems over which program officials
    have little or no control;

-   Demonstrating how the agency ensures the effective use of security
    controls and authentication tools to protect privacy for those
    systems that promote or permit public access; and

-   Demonstrating how the agency ensures that handling personal
    information is consistent with relevant government-wide and agency
    processes.

### OMB Memorandum 01-05

###  {#section-2 .unnumbered}

OMB M-01-05 provides guidance on implementing the *Computer Matching and
Privacy Protection Act of 1988*. The guidance states that agencies must
"prior to any data sharing\...review and meet the *Privacy Act*
requirements for computer matching, including developing a computer
matching agreement and publishing notice of the proposed match in the
Federal Register." The memorandum then states that it "puts forth
principles on protecting personal privacy when conducting inter-agency
data sharing," including:

-   Notice

-   Consent, as appropriate

-   Re-disclosure limitations

-   Accuracy

-   Security controls

While M-01-05 stresses these privacy protections, it also discusses
additional privacy protections in a section entitled "Other Guidance."
These additional privacy protections are:

-   Employing the principle of minimization;

-   Employing the principle of accountability; and

-   Conducting PIAs.

### OMB Memorandum 03-22

OMB has provided federal agencies with M-03-22, *Guidance for
Implementing the Privacy Provisions of the E-Government Act of 2002*,
September 2003. This guidance directs agencies to conduct reviews of how
they use technology to collect new information and when they buy or
develop new IT systems to handle the collection of IIF. OMB M-03-22
indicates that PIAs should be conducted if any major changes occur,
including but not limited to:

-   **Conversions**: When converting paper-based methods to electronic
    systems.

-   **Anonymous to Non-Anonymous**: When the system's function, as
    applied to an existing information collection, changes anonymous
    information into IIF.

-   **Significant System Management Changes:** When new uses of an
    existing IT system, including application of new technologies,
    significantly change how IIF is managed in the system.

-   **Significant Merging:** When agencies adopt or alter business
    processes so that government databases holding IIF are merged,
    centralized, matched with other databases, or otherwise
    significantly manipulated.

-   **New Public Access:** When user-authenticating technology (e.g.,
    password, digital certificate, biometric) is newly applied to an
    electronic information system that members of the public can access.

-   **Commercial Sources:** When agencies systematically incorporate
    into existing information systems databases of IIF purchased or
    obtained from commercial or public sources.

-   **New Interagency Uses:** When agencies work together on shared
    functions involving significant new uses or exchanges of IIF.

-   **Internal Flow or Collection**: When alteration of a business
    process results in significant new uses or disclosures of
    information or incorporation into the system of additional IIF.

-   **Alteration in Character of Data:** When new IIF added to a
    collection raises the risks to personal privacy, such as the
    addition of health or privacy information.

### OMB Memorandum 05-08

OMB has provided federal agencies with M-05-08, *Designation of Senior
Agency Officials for Privacy*. This document provides guidance which
aids in establishing the role of the Senior Agency Official for Privacy
as having the overall responsibility for:

-   Overall Department-wide responsibility for information privacy
    issues;

-   Overall responsibility and accountability for ensuring the
    Department's implementation of information privacy protections; and

-   Playing a central role in overseeing, coordinating, and facilitating
    the Department's privacy compliance efforts.

### OMB Memorandum 06-16

OMB has provided federal agencies with M-06-16, *Protection of Sensitive
Agency Information*. This guidance recommends agencies follow a
checklist for protection of remote information provided by NIST as well
as four additional items provided by OMB. This guidance is an effort to
properly safeguard information assets while using information
technology.

### OMB Memorandum 06-20

OMB has provided federal agencies with M-06-20, *FY 2006 Reporting
Instructions for the Federal Information Security Management Act and
Agency Privacy Management*. This document assigns responsibility and
provides guidance for the Senior Agency Official for Privacy on how to
complete the new privacy questions in the annual FISMA report. As a
result, OMB will no longer ask agencies to include privacy related
information in their annual E-Government Act submission. The Department
has extended OMB M-05-08 and M-06-20 roles and responsibilities to the
OPDIV level.

#  PIA Roles and Responsibilities

Federal guidance on conducting PIAs assigns specific responsibilities to
the agency CIO and agency director. However, other staff, such as the
OPDIV Senior Official of Privacy or Privacy Contacts may be responsible
for conducting PIAs or providing information relevant to completing the
PIA.

While much of the focus of privacy at the Department involves IT
security professionals, collaboration should occur with other
Departmental personnel, such as the OPDIV Privacy Contact, to ensure
that IIF is adequately protected and that funding is appropriately
allocated. Further, coordination with budget personnel, for example,
ensures the incorporation of privacy protection into the capital
planning investment control (CPIC) process.

## Department Level

At the Department level, PIAs are collected from OPDIVs using an
automated tool. The PIAs are then reviewed for completeness and
submitted to OMB. They are also made publicly available in accordance
with legislative drivers. The involvement of the following stakeholders
is highly encouraged so that PIAs may meet Departmental PIA requirements
and thus be promoted to the Department.

### Senior Agency Official for Privacy

At HHS, the CIO holds the title of Senior Agency Official for Privacy
(SAOP) and is responsible for:

-   Designating responsibility for oversight of the PIA process to the
    OPDIV Senior Officials for Privacy;

-   Reviewing completed PIAs and attesting that they are adequately and
    accurately completed;

-   Allocating proper resources to permit identification and
    remediation\
    of privacy weaknesses; and

-   Signing off on HHS' submission of the Privacy Management portion of
    the annual FISMA report.

### Inspector General

The HHS Inspector General is responsible for:

-   Signing off on HHS' FISMA and Agency Privacy Management submission
    to OMB.

### HHS Privacy Act Officer

The HHS Privacy Act Officer is responsible for:

-   Focusing on applicable case law;

-   Reviewing HHS Privacy Act System of Records Notices (SORN) prior to
    publication;

-   Responding to and reviewing Privacy Act related questions in the
    Agency Privacy Management Report section of FISMA;

-   Implementing requirements of the *Privacy Act* and corresponding
    operating procedures; and

-   Administering privacy program reviews.

## OPDIV Level

OPDIVs are responsible for conducting an initial PIA on each system, and
maintaining PIAs throughout the system's existence. OPDIVs must complete
each PIA and promote each PIA to the Department for review.

### OPDIV Chief Information Security Officer

The OPDIV Chief Information Security Officers are responsible for:

-   Reporting to the HHS Chief Information Security Officer (CISO) on
    the effectiveness of the organization's information privacy program,
    including progress of remedial actions;

-   Managing internal privacy reviews of the program's business cases,
    alternatives analyses, and other specific investment documents;

-   Establishing and implementing privacy policies, procedures, and
    practices that are consistent with Departmental requirements to
    assure that systems, programs, and data are secure and protected
    from unauthorized access that might lead to the alteration, damage,
    or destruction of automated resources, and unintended release of
    data;

-   Obtaining contractual assurances from third parties to ensure that
    the third party will protect IIF in a manner consistent with the
    privacy practices of the Department and applicable laws, before
    enabling access to IIF;

-   Ensuring that all employees and contractors comply with this policy;

-   Establishing a framework to facilitate the development and
    maintenance of PIAs for all systems;

-   Managing and certifying an inventory of all current and proposed
    investments that contain a privacy control component; and

-   Ensuring that privacy education and awareness is mandatory for all
    personnel using, operating, supervising, or managing computer
    systems.

### OPDIV Senior Official for Privacy

The Senior Official for Privacy title was extended by the Department to
each OPDIV to effectively meet the reporting requirements outlined in
OMB M-06-20. OPDIV CIOs were required to designate this individual. The
agency requirement for the title is outlined in OMB M-05-08. OPDIV
Senior Officials for Privacy are responsible for:

-   Receiving the PIA from the PIA author;

-   Promoting PIAs to the Department and submitting them to the Senior
    Agency Official for Privacy once complete or demoting PIAs back to
    the PIA author if errors are found;

-   Tracking and maintaining all PIA activities in the current PIA tool;

-   Reviewing completed PIAs and attesting that they are adequately and
    accurately completed;

-   Keeping management informed of PIA resource needs and any identified
    privacy weaknesses;

-   Make recommendations to senior level officials with budgetary
    authority who can allocate proper resources to permit identification
    and remediation of weaknesses; and

-   Signing off on the OPDIV FISMA and Privacy Management Report.

### OPDIV Privacy Contact

####  {#section-3 .unnumbered}

The OPDIV Privacy Contact is responsible for:

-   Serving as a point of contact (POC) for issues related to the
    *Privacy Act* within the OPDIV; and

-   Maintaining awareness of privacy laws, regulations, and issues
    within the OPDIV.

### System PIA Author

The role of the PIA author can be filled by the OPDIV Information System
Security Officers (ISSOs), a system owner, or any other designee.
Responsibilities for the PIA author include:

-   Coordinating with appropriate OPDIV privacy stakeholders and
    completing PIAs;

-   Identifying any additional resources needed to complete PIAs;

-   Submitting completed PIAs to the OPDIV Senior Official for Privacy;

-   Working with the OPDIV Senior Official for Privacy and system owners
    to collect information needed to complete PIAs;

-   Updating (at the direction of the OPDIV CIO and the Senior Official
    for Privacy) OPDIV management on the progress of PIA completion,
    which enable the OPDIV CIOs to monitor OPDIV-wide progress and the
    effectiveness of the PIA program;

-   Determining whether the security controls that protect systems are
    adequate for operation; and

-   Considering security controls that protect the privacy of IIF in
    determining whether systems are allowed to operate.

#  Privacy Impact Assessment Process

According to federal requirements and guidance, the Department is
responsible for providing proper protections for IIF contained within
its information systems. To assess whether systems are compliant with
these federal requirements, system owners, system managers, Senior
Officials for Privacy, and other designated PIA authors should use the
PIA methodology detailed in this section. The Department requires that a
PIA be completed for all IT systems regardless of whether or not the
system contains IIF. Systems which only house Federal employee IIF are
similarly bound by this requirement. The tool used to assess compliance
is the PIA Form located within the current PIA tool, which provides an
automated ability to complete the PIA.

## PIA Overview

This section provides a high-level explanation of the purpose,
objective, timing, and scope of PIAs. Reviewing this information will
provide a better understanding of the context and framework for
conducting a PIA.

The PIA methodology consists of completing a PIA Form. The first section
of the PIA Form is the Summary tab, which collects data that is suitable
to be made available via the Internet to the public as required by OMB
M-03-22. The PIA Summary tab must be completed for each system and will
determine if the remaining tabs must also be completed. If required, the
remaining tabs efficiently collect all relevant data necessary to
provide a solid evaluation of the privacy risks, controls, and
requirements of the analyzed system as required by OMB, legislation,
etc.

Refer to Appendix E for screenshots of the PIA Form.

### Purpose of the PIA

Conducting PIAs at the OPDIV level will allow the Department to identify
which of its systems contain IIF and which do not. For those systems
containing IIF, the PIA will serve as a platform to:

-   Ensure that information handling conforms to applicable legal,
    regulatory, and policy requirements regarding privacy;

-   Determine the risks and effects of collecting, maintaining, and
    disseminating IIF in an electronic information system; and

-   Examine and evaluate protections and alternative processes for
    handling information to mitigate potential privacy risks.[^2]

### Benefits of PIA

Once the PIA is complete, knowledgeable Departmental officials, whether
system managers or OPDIV CIOs, can determine strategies and controls to
mitigate the risks and vulnerabilities that were identified. PIAs
provide a number of advantages over ad hoc evaluations. These advantages
include:

-   Producing a PIA capable of meeting the supporting documentation
    requirements for budget and funding documents (i.e., Exhibit 300s
    and Exhibit 53s);[^3]

-   Providing inputs for required reporting documents (e.g., Plan of
    Action and Milestones \[POA&M\]);

-   Providing a reliable basis for policy, system design decision
    making, and system design;

-   Generating and improving public confidence by anticipating and
    addressing privacy concerns;

-   Improving the understanding of an agency's potential privacy risks,
    exposures, and liabilities; and

-   Providing a PIA for the certification and accreditation (C&A)
    package.

### Scope

The Department should use the PIA to examine all procedures that involve
the usage, storage, retrievability, accessibility, retention, and
disposal of IIF. The assessment requires that the system owners and
developers answer privacy-related\
questions on:

-   System characterization and data configuration

-   Information sharing practices

-   Website hosting practices

-   Administrative and technical controls

-   Physical access

### Timing

The PIA process guides OPDIV PIA authors in assessing information
systems through all phases of the system development life cycle (SDLC).
PIAs should be performed before the development phase of a system. An
initial PIA can be performed on an existing operational system.
Departmental policy requires that PIAs be conducted and maintained on
all systems, whether already in existence, in development, or undergoing
modification.

## PIA Activities

This section provides the overarching steps in the PIA activities from
assigning responsibilities for completing PIAs to submitting a completed
PIA.

### Step One: Determining When a PIA Must Be Conducted

Departmental policy requires the Department to complete an initial PIA
on all HHS or contractor-owned systems. Please note, when referring to
an initial PIA, HHS is describing the first complete PIA for a system.
In addition, systems that have undergone major changes will require an
updated PIA to be completed and submitted to OMB. For further details on
what constitutes a major change, see Section 2.2.4 of OMB M-03-22.

### Step Two: Assigning Roles and Responsibilities

The OPDIV Senior Official for Privacy must designate the necessary staff
to complete PIAs for each system. For example, they may choose various
individuals to fulfill the role of the PIA author (e.g., system owner,
business owner, or privacy contact). It is strongly encouraged that the
designee possesses the knowledge and ability to understand all the
issues raised by the PIA and have sufficient understanding of the
Department's IT management structure. The OPDIV Senior Official for
Privacy has the responsibility for approving and promoting the PIAs to
the Department or assigning those responsibilities via the current PIA
tool.

Information in Exhibit 300s, Exhibit 53s, and PIAs must be consistent.
Therefore, it is critical that staff familiar with Exhibit 300s, Exhibit
53s, and the *E-Government Act* collaborate. Such staff may include
privacy experts, IT specialists, system owners, and capital planning
staff. If discrepancies are discovered among these documents, the
Department would need to be prepared to explain the inconsistencies to
OMB. Special attention should be paid to ensure consistent
characterizations of the system, including name and identification
numbers and descriptions of the collection, use, and sharing of
information, to enable appropriate linking of system documentation at
the Department level and to OMB. For example, OMB may not be able to
provide an IT system with credit for conducting a PIA in Exhibit 300
privacy and security scoring, which could potentially impact the
system's funding if it cannot link the PIA to the Exhibit 300 through
the system's unique project identifier (UPI).[^4]

### Step Three: Preparing to Begin the PIA

PIA authors who are assigned responsibility for conducting PIAs must use
the PIA Form located in the current PIA tool. Completed PIAs should be
submitted to the OPDIV Senior Official for Privacy via the current PIA
tool, and maintained as records by the OPDIV. The PIA author's
responsibility for conducting the PIA should also include familiarizing
themselves with the PIA Form prior to attempting to complete PIAs. PIA
Form screenshots are included in Appendix E of this document. If
individuals who will complete the PIA require more information on
specific questions of the PIA Form, they may wish to consult Appendix F,
*PIA Question-by-Question Tutorial*.

The PIA Form contains several questions that will be answered "Yes" or
"No." Often, however, clarification or system details will be required.
When clarification is necessary, the PIA will prompt users for further
elaboration.

As users prepare to fill out the PIA, they will gather documentation
already created for the system, particularly previous PIAs, and security
documentation such as risk assessments or C&A packages. These documents
contain information about the system that will make completing the PIA
documents more efficient.

**TIP**: While much of the information included in a PIA may be included
in a SORN, the SORN may not substitute for the PIA. The PIA is distinct
in terms of what information it requires, how it requires that
information to be presented, and when the PIA must be updated. Even
though a PIA is distinct in many ways, when a SORN needs to be updated,
the PIA must also be updated accordingly to ensure the consistency of
information reported to OMB.

### Step Four: Composing a PIA 

Once the PIA author has been identified to complete the PIA and system
documentation has been gathered, the PIA author is ready to complete the
PIA in the current PIA tool. OPDIVs are required to submit all PIAs to
the Department via the current PIA tool only. The PIA is not accepted by
the Department in other formats. OPDIVs may request access to the
current PIA tool by contacting Secure One HHS at
[SecureOne.HHS@hhs.gov](mailto:ITSecuritydocs@hhs.gov).

The PIA Summary tab gathers preliminary information about the system.
The responses to the PIA questions automatically populate into the
remaining sections of the PIA so that if OPDIVs are required to complete
the remaining tabs of the PIA Form, duplication of information is
minimized. In the Question-by-Question tutorial, in Appendix F, the
questions with asterisks are those that are in the PIA Summary tab.
These questions auto-populate the remaining sections of the PIA Form.

**TIP**: OMB M-03-22 requires the PIA to be published, if possible.[^5]
To meet this requirement the Department posts a summary of each system
PIA. The PIA Summary tab should therefore include only nonsensitive
information that can be released to the public. Descriptions of
unpatched system vulnerabilities, for example, should not be included.
If any such information is discovered while completing the remainder of
the PIA, it should not be described in detail in the PIA Summary tab.

NOTE: If OPDIVs answer "No" to Question 17, (if the system does not
contain IIF), only the remaining Summary tab questions need to be
completed and submitted. **If the system contains IIF, questions in the
remainder of the PIA MUST be completed and submitted.**

### Step Five: Characterizing the System

The PIA includes a section characterizing the identity, components, and
functions of the system under consideration. System characterization may
entail reviewing system documents and conducting interviews to obtain
the information. Especially critical details including:

-   The System Name and Unique Project Identifier (UPI) Number of the
    system. This information must be consistent with reports made for
    Exhibit 300s.

-   **Life-cycle status of the system.** If the Department is at all
    uncertain of the correct designation of the system's life cycle,
    staff should consult NIST Special Publication (SP) 800-64, *Security
    Considerations in the System Development Life Cycle*.

-   **Description of the kind of information collected or maintained.**
    A description of the category of individuals to whom the information
    pertains; "Information about people," for example, is not
    sufficiently descriptive.

Data collected from existing documentation should be reviewed and
analyzed to determine the system boundaries, functionality, and security
requirements. Reviewed documentation should include any *Privacy Act*
SORN published in the Federal Register. A PIA cannot be performed until
the system boundaries are identified and the security requirements are
established.

### Step Six: Completing the PIA

The PIA should be submitted via the current PIA tool. Before submitting,
ensure that:

-   Printouts of the PIA have been reviewed and signed by the OPDIV
    Senior Official for Privacy.

-   Hard copies of the PIA with signatures are retained by each OPDIV in
    the event of an IG, OMB, or Government Accountability Office (GAO)
    inquiry.

Promoting the PIA to the Department requires 100% completion of data
fields and will indicate that the appropriate review of the privacy
documentation has taken place at the OPDIV level. There are two
scenarios where a PIA can be considered 100% complete. If there is no
IIF and question 17 is answered with "No", then once the Summary tab is
filled out the PIA is considered complete and can be promoted. If
question 17 is answered with a "Yes", then all remaining PIA tabs must
be completed for the PIA to be considered 100% complete. HHS policy
requires OPDIVs to submit PIAs to the HHS Office of Chief Information
Officer (OCIO). The OCIO will perform a review of each system PIA to
ensure it is complete, and will generate a system PIA Summary. Each
system PIA Summary will be reviewed to ensure no sensitive information
has been provided. As an OMB requirement the Department will then submit
the PIA Summaries to OMB annually and make the PIA Summaries publicly
available at <http://www.hhs.gov/pia>.

### Step Seven: Approving and Demoting the PIA

To complete the PIA, it must be promoted to the Department via the
current PIA tool. Promoting the PIAs via the current PIA tool confirms
that the review and signature process has been completed and that signed
hard copies of PIAs are maintained by the OPDIV. If the PIA contains
sensitive information, the reviewer should demote the PIA for revision
back to the PIA author.

### Step Eight: Maintaining the PIA

In addition to maintaining the hard copy of the PIA, OPDIVs will
periodically need to review PIAs to ensure they comply with current
system practices. Each OPDIV is responsible for determining when these
reviews take place. A PIA is a living document that must be updated when
a major change in the system occurs. Section 2.2.4 lists several
examples that can be found in OMB M-03-22 of system changes that may
require completing a new PIA. Periodic reviews of the PIA will ensure
that these triggers---or any other changes in a systems management,
operational, or technical environment that may impact IIF---will be
captured as required by law and Department policy.

**TIP:** Once a system expires or is retired and no longer in operation,
the system's PIA may also be retired. For more information on how to
retire a system PIA please contact Secure One HHS at
[SecureOne.HHS@hhs.gov](mailto:ITSecuritydocs@hhs.gov).

#  Conclusion

The Department must perform thorough PIAs to satisfy the requirements of
the *E-Government Act* as set forth in Departmental policy. A well
thought out PIA also presents the Department with the opportunity to
determine whether it is complying with the requirements of the *Privacy
Act*, COPPA, and other federal legislation, regulations, and OMB
memoranda. Furthermore, because the PIA summaries are made publicly
available, the Department is presented with an opportunity to assure the
public that it is providing government services in a manner that
considers the sensitivity of the personal information it receives.

# Appendix A: Document Feedback {#appendix-a-document-feedback .unnumbered}

This form is for reviewer-suggested corrections, revisions, or updates
and is intended to improve the usefulness of the document for possible
inclusion in future versions. Please forward recommended changes and
comments to the Department of Health and Human Services (HHS), Office of
the Chief Information Officer (OCIO).

By E-mail: [SecureOne.HHS@hhs.gov](mailto:ITSecuritydocs@hhs.gov)

Subject Line: Guidance Feedback

  ------------ ----------------- ----------------------------------------------------------
  Document                       
  Title:                         

  \>                             

  Section                        
  Number:                        

  \>                             

  Category of                    
  Comment:                       

  A            Administrative.   
               Administrative    
               comments correct  
               what appear to be 
               inconsistencies   
               between sections, 
               typographical     
               errors, or        
               grammatical       
               errors.           

  S            Substantive.      
               Substantive       
               comments are      
               provided because  
               sections in the   
               publication       
               appear to be or   
               are potentially   
               incorrect,        
               incomplete,       
               misleading, or    
               confusing.        

  C            Critical.         
               Critical comments 
               will cause        
               non-concurrence   
               with the          
               publication if    
               concerns are not  
               satisfactorily    
               resolved.         

  M            Major. Major      
               comments are      
               significant       
               concerns that may 
               result in a       
               non-concurrence   
               of the entire     
               document if not   
               satisfactorily    
               resolved. This    
               category may be   
               used with a       
               general statement 
               of concern with a 
               subject area,     
               thrust of the     
               document, etc.,   
               followed by       
               detailed comments 
               on specific       
               entries in the    
               publication       
               which, taken      
               together,         
               constitute the    
               concern.          

                                 

  Category                       Comment

                                 

                                 

                                 

                                 

                                 

  Name of                        
  Submitting                     
  Operating                      
  Division                       
  (OPDIV):                       

  \>                             

  Your Name                      
  and Title:                     

  \>                             

  Telephone:                     

  \>                             

  E-mail:                        
  ------------ ----------------- ----------------------------------------------------------

\>

  -----------------------------------------------------------------------
  Note: Use an additional blank sheet if needed.

  -----------------------------------------------------------------------

# Appendix B: References {#appendix-b-references .unnumbered}

Federal Trade Commission*, Children's Online Privacy Protection Rule;
Final Rule*, published in the Federal Register (FR) 64, 59887-59915,
November 3, 1999.

*HHS Information Security Program Policy*, July 2005.

*HHS Machine-Readable Privacy Policy Guide*, July 2005.

Internal Revenue Service (IRS), *Model Information Technology Privacy
Impact Assessment*, 1996.

National Institute of Standards and Technology (NIST) Special
Publication (SP) 800-30, *Risk Management Guide for Information
Technology Systems*, January 2002.

NIST SP 800-34, *Contingency Planning Guide for Information Technology
Systems*, June 2002.

Office of Management and Budget (OMB) Bulletin No. 90-08, *Guidance for
Preparation of Security Plans for Federal Computer Systems that Contain
Sensitive Information*, July 9, 1990.

OMB Circular A-11, *Preparing, Submitting, and Executing the Budget*,
updated annually.

OMB Circular A-123, *Management Accountability and Control*, June 21,
1995.

OMB Circular A-130, *Management of Federal Information Resources,*

November 28, 2000.

OMB Circular A-130, *Management of Federal Information Resources,
Appendix III,*

*Security of Federal Automated Information Resources*, November 28,
2000.

OMB Memorandum (M), *Application of Subsection M of the Privacy Act*,

November 30, 1979.

OMB M-99-18, *Privacy Policies on Federal websites*, June 2, 1999.

OMB M-01-05, *Computer Matching and Privacy Protection Act of 1988*,
December 20, 2000.

OMB M-05-08, *Designation of Senior Agency Officials for Privacy*,
February 11, 2005.

OMB M-06-16, *Protection of Sensitive Agency Information*, June 23,
2006.

OMB M-06-20, *FY 2006 Reporting Instructions for the Federal Information
Security Management Act and Agency Privacy Management*, July 17, 2006.

OMB M-05-22, *Transition Planning for Internet Protocol Version 6
(IPv6)*, August 2, 2005.

*OMB Privacy Act Guidelines*, published in the Federal Register (FR) 40,
28934-28978, July 9, 1975.

*OMB Order for the Confidentiality of Statistical Information*, FR 62,
35043-35049, June 27, 1997.

*OMB Revised Supplemental Guidance for Conducting Computer Matching
Programs*, FR 47, 21656-21658, May 19, 1982.

*OMB Supplementary Privacy Act Guidance*, FR 40, 56741-56743, December
4, 1975.

Public Law 93-502, *Freedom of Information Act of 1966* \[5 U.S.C.
552\],

November 21, 1974.

Public Law 93-579, *Privacy Act of 1974*, December 31, 1974.

Public Law 97-255, *Federal Manager\'s Financial Integrity Act of 1982*,

September 8, 1982.

Public Law 99-474, *Computer Fraud and Abuse Act of 1986*, October 16,
1986.

Public Law 100-503, *Computer Matching and Privacy Act of 1988*, October
18, 1988.

Public Law 104-13, *The Paperwork Reduction Act of 1995*, May 22, 1995.

Public Law 104-106, Division E, *Information Technology Management
Reform Act* (ITMRA, also known as the Clinger-Cohen Act), February 10,
1996.

Public Law 104-191, *Health Insurance Portability and Accountability Act
of 1996* (HIPAA), August 21, 1996.

Public Law 106-398, *Defense Authorization Act*, Title X, Subtitle G,
*Government Information Security Reform Act* (GISRA), October 30, 2000.

Public Law 107-347 \[H.R. 2458\], *E-Government Act of 2002*. Title III
of this Act is the *Federal Information Security Management Act of 2002
(FISMA)*,

December 17, 2002.

*Uniform Trade Secrets Act* (Drafted by the National Conference of
Commissioners on Uniform State Laws), as amended 1985.

US Code, 12 U.S.C. 3401 et seq., *Right to Financial Privacy Act of
1978*.

US Code, 15 U.S.C. § 6501 et seq., *Children's Online Privacy Protection
Act of 1998*.

45 Code of Federal Regulations (CFR) pt. 164*, DHS Freedom of
Information*

*Act Regulations.*

45 CFR Subpart 5B*, DHS Privacy Act Regulations.*

# Appendix C: Acronyms {#appendix-c-acronyms .unnumbered}

  -------------- ----------------------------------------------------------
  **C&A**        Certification and Accreditation

  **CFR**        Code of Federal Regulations

  **CIO**        Chief Information Officer

  **CISO**       Chief Information Security Officer

  **COPPA**      Children's Online Privacy Protection Act of 1998

  **CPIC**       Capital Planning and Investment Control

  **DHS**        Department of Homeland Security

  **FISMA**      Federal Information Security Management Act of 2002

  **FOIA**       Freedom of Information Act of 1966

  **FR**         Federal Register

  **FTC**        Federal Trade Commission

  **FY**         Fiscal Year

  **GAO**        Government Accountability Office

  **GISRA**      Government Information Security Reform Act of 2000

  **GSS**        General Support System

  **HHS**        Health and Human Services, U.S. Department of

  **HIPAA**      Health Insurance Portability and Accountability Act of
                 1996

  **IIF**        Information in Identifiable Form

  **IG**         Inspector General

  **IPSO**       Information Processing Service Organization

  **IPv6**       Internet Protocol Version 6

  **IRS**        Internal Revenue Service

  **ISSO**       Information Systems Security Officer

  **IT**         Information Technology

  **ITMRA**      Information Technology Management Reform Act

  **LAN**        Local Area Network

  **M**          Memorandum

  **MA**         Major Application

  **NIST**       National Institute of Standards and Technology

  **OCIO**       Office of the Chief Information Officer

  **OCR**        Office for Civil Rights

  **OMB**        Office of Management and Budget

  **OPDIV**      Operating Division

  **P3P**        Platform for Privacy Preferences

  **PDF**        Portable Data Format

  **PHI**        Protected Health Information

  **PIA**        Privacy Impact Assessment

  **POA&M**      Plan of Action and Milestones

  **POC**        Point of Contact

  **PRA**        Paperwork Reduction Act

  **SAOP**       Senior Agency Official for Privacy

  **SDLC**       System Development Life Cycle

  **SOR**        System of Records

  **SORN**       System of Records Number

  **SP**         Special Publication

  **STAFFDIV**   Staff Division

  **UPI**        Unique Project Identifier

  **URL**        Uniform Resource Locator

  **U.S.C.**     United States Code

  **VPN**        Virtual Private Network

  **W3C**        World Wide Web Consortium
  -------------- ----------------------------------------------------------

# Appendix D: Glossary {#appendix-d-glossary .unnumbered}

**Administrative Controls**---safeguards to ensure proper management and
control of information and information systems. These safeguards include
policy, Privacy Impact Assessments (PIA), and certification and
accreditation programs. (See National Institute of Standards and
Technology \[NIST\] Special Publication \[SP\]

800-12.)

**Availability**---a requirement intended to ensure that systems work
properly, and service is not denied to authorized users. (See NIST SP
800-12.)

**Confidentiality**---a requirement that private or confidential
information not be disclosed to unauthorized individuals. (See NIST SP
800-12, p. 8.)

**Cookie**---information that a website puts on an individual's computer
so that it can remember something about the user at a later time. See
also: persistent cookie, session cookie.

**General Support System (GSS)**---an interconnected set of information
resources under the same direct management control, which shares common
functionality. A GSS normally includes hardware, software, information,
data, applications, communications, and people. A GSS can be, for
example, a local area network (LAN), including smart terminals that
support a branch office, an agency-wide backbone, a communications
network, a departmental data processing center and its operating system
and utilities, a tactical radio network, or a shared information
processing service organization (IPSO). (Defined in Office of Management
and Budget \[OMB\] Circular A-130, (A)(2)(c).)

**Information in Identifiable Form (IIF)**---any representation of
information that permits the identity of an individual to whom the
information applies to be reasonably inferred by either direct or
indirect means. (Defined in the *E-Government Act of 2002*,
Pub.L.107-347, Title II and III.)

**Integrity**---the degree to which information is timely, accurate,
complete, and consistent. Data integrity refers to the quality that is
preserved when information and programs are changed only in a specified
and authorized manner. System integrity refers to the quality that is
demonstrated when a system performs its intended function in an
unimpaired manner, free from deliberate or inadvertent unauthorized
manipulation of the system. (See NIST SP 800-12.)

**Major Application (MA)**---an application that requires special
attention to security because of the risk and magnitude of the harm
resulting from the loss, misuse, or unauthorized access to, or
modification of, the information in the application. A breach in a major
application might comprise many individual application programs and
hardware, software, and telecommunications components. MAs can be either
a major software application or a combination of hardware and software
in which the only purpose of the system is to support a specific
mission-related function. (Defined in NIST SP 800-18.) Note: All federal
applications require some level of protection. Certain applications,
because of the information in them, however, require special management
oversight and should be treated as a "Major Application." Adequate
security for other applications should be provided by security of the
systems in which they operate. (Defined in OMB Circular A-130,
(A)(2)(d).)

**Major Change (concerning certification and accreditations, related to
question 41 of the PIA)**---any change that is made to the system
environment or operation of the system. The following are examples of
major changes as defined by M-03-22:

-   Network, hardware, or software applications that alter the mission,
    operating environment, or basic vulnerabilities of the system;

-   Increase or decrease in hardware, application programs, external
    users, or hardware upgrades;

-   Addition of telecommunications capability;

-   Change to program logic of application systems; and

-   Relocation of system to new physical environment or new
    organization.

**Non-Major Application**---any initiative or investment not meeting the
definition of a major application defined above but is part of the
agency\'s IT Portfolio. (Defined in OMB Circular A-11, Section 53.4)

**Persistent Cookie**---a cookie that is stored on the user's hard drive
and remains there until the user deletes it or it expires.

**Physical Security Controls**---measures taken to protect systems,
buildings, and related supporting infrastructure against threats
associated with their physical environment. These safeguards might
include protections against fire, structural collapse, plumbing leaks,
physical access controls, and controls against the intercept of data.
(See NIST SP 800-12.)

**Privacy Act System of Records Notice (SORN)**---all systems with
*Privacy Act* information contained within them are required to publish
a "Records Notice" in the Federal Register that informs the public what
information is contained in the system, how it is used, how individuals
may gain access to information about themselves, and other specific
aspects of the system.

**Privacy Impact Assessment (PIA)**---a methodology that provides
information technology (IT) security professionals with a process for
assessing whether appropriate privacy policies, procedures, and business
practices---as well as applicable administrative, technical and physical
security controls---have been implemented to ensure compliance with
federal privacy regulations.

**Record**---any item, collection, or grouping of information about
individuals that is maintained by an agency, including, but not limited
to, their education, financial transactions, and/or medical, criminal,
or employment history and that contains their name; or it contains the
identifying number, symbol, or other identifying information assigned to
the individual, such as a finger or voice print or a photograph. (See 5
U.S.C. §552a(a)(4)).

**Routine Use**---regarding the disclosure of a record, the use of such
record for a purpose that is compatible with the purpose for which it
was collected.

**Session Cookie**---a small file, stored in temporary memory,
containing information about a user that disappears when the user's
browser is closed. Unlike a persistent cookie, no file is stored on the
user's hard drive.

**System**---an organized assembly of IT resources and procedures
integrated and regulated by interaction or interdependence to accomplish
a set of specified functions.

**System of Records (SOR)**---a group of records under the control of
any agency where information is retrieved by the name of the individual,
by some identifying number or symbol, or by other identifiers assigned
to the individual.

**Technical Controls**---safeguards that are generally executed by the
computer system. Technical safeguards include password protection,
firewalls, and cryptography. (See NIST SP 800-12.)

Unique Project Identifier (UPI)---an identifier that depicts agency
code, bureau code, mission area (where appropriate), part of the exhibit
where investment will be reported, type of investment, agency four-digit
identifier, year the investment entered the budget, and mapping to the
Federal Enterprise Architecture. For details and explanation, see OMB
Circular A-11, Section 53.8.

**Website**---a collection of interlinked web pages (on either Internet
or intranet sites) with a related topic, usually under a single domain
name, which includes an intended starting file called a "home page."
From the home page, access is gained to all the other pages on the
website.

# Appendix E: Privacy Impact Assessment (PIA) {#appendix-e-privacy-impact-assessment-pia .unnumbered}

The screenshots for the Privacy Impact Assessment (PIA) Form begin on
the following page. The form includes a PIA Summary tab and covers the
four major categories of information required in the PIA: system
characterization, information sharing practices, website practices, and
security controls.

NOTE: The underlined text in the screenshots denotes that a required
question has not been filled out. The red line will disappear after the
required question is filled out in the current PIA tool. Appendix F
provides a question-by-question tutorial for the PIA.

**HHS Privacy Impact Assessment (PIA) Screenshots**

**[PIA Summary Tab]{.underline}**

![](media/image2.png){width="7.375in" height="4.138888888888889in"}

![](media/image4.png){width="7.40625in" height="4.4375in"}**[PIA Summary
Tab (Continued)]{.underline}**

**[PIA Required Information Tab]{.underline}**

![](media/image5.png){width="6.75in" height="3.779861111111111in"}

![](media/image8.png){width="7.375in"
height="4.657638888888889in"}**[System Characterization and Data
Configuration Tab]{.underline}**

![](media/image10.png){width="7.375in" height="3.9763888888888888in"}

![](media/image11.png){width="7.392361111111111in"
height="4.411111111111111in"} **[System Characterization and Data
Configuration Tab (Continued)]{.underline}**

![](media/image13.png){width="7.375in" height="4.574305555555555in"}
**[System Characterization and Data Configuration Tab
(Continued)]{.underline}**

![](media/image15.png){width="7.375in" height="1.2993055555555555in"}
**[Information Sharing Practices Tab]{.underline}**

![](media/image18.png){width="7.375in" height="3.5770833333333334in"}
**[Information Sharing Practices Tab (Continued)]{.underline}**

![](media/image20.png){width="7.5in" height="4.218055555555556in"}
**[Web Hosting Practices Tab]{.underline}**

![](media/image22.png){width="7.427083333333333in"
height="4.717361111111111in"} **[Web Hosting Practices Tab
(Continued)]{.underline}**

![](media/image24.png){width="7.447916666666667in"
height="3.0506944444444444in"} **[Administrative Controls
Tab]{.underline}**

**[Technical
Controls]{.underline}**![](media/image26.png){width="7.4375in"
height="4.364583333333333in"} **[Tab]{.underline}**

![](media/image27.png){width="7.4375in"
height="4.041666666666667in"}**[Physical Access Tab]{.underline}**

![](media/image28.png){width="7.4375in" height="3.220138888888889in"}
**[Approval and Demotion Tab]{.underline}**

# Appendix F: PIA Question-by-Question Tutorial {#appendix-f-pia-question-by-question-tutorial .unnumbered}

The PIA questions provided within this document are intended to be
brief. The PIA author filling out the PIA Form may wish to consult this
step-by-step tutorial when completing the PIA for explanations of terms
and assistance in identifying relevant resources.

The PIA Summary tab includes 20 questions, some of which are open-ended.
The PIA Summary will be made publicly available via
<http://www.hhs.gov/pia>. Information in the PIA Summary tab should not
contain information unsuitable for public release.

Here are some suggested guidelines to follow when preparing a PIA:

-   Open-ended questions should be written concisely and in a way that
    is easily understood by the general public.

-   Spell out each acronym the first time it is used, the acronym should
    be used in all subsequent references.

-   Technical terms and references should be defined.

-   References to governmental publications and other documents should
    include the complete name of the reference the first time it is used
    (e.g. Office of Management and Budget (OMB) Memorandum (M)-03-22,
    [OMB Guidance for Implementing the Privacy Provisions of the
    E-Government Act of
    2002](http://www.whitehouse.gov/omb/memoranda/m03-22.html)).

Sufficient information must be provided in the PIA Summary tab to
identify the system and to ensure that reconciliation with other records
and documentation of the system is possible. The accuracy of this
information is critical to the correct processing and documentation of
the PIA. If the PIA author completing the PIA is at all uncertain
whether the system identification information is correct, he or she
should consult the Operating Division (OPDIV) Senior Official for
Privacy, OPDIV Privacy Contact (POC), or Capital Planning and Investment
(CPIC) Contact.

In this Question-by-Question tutorial, the questions with an asterisk
are a part of the PIA Summary tab.

[PIA Required Information Tab]{.underline}

\*Background Question: Is this a new PIA? If this is an existing PIA,
please provide a reason for the revision. PIAs must be submitted for a
new system. If a system has undergone a major change, then PIAs must be
revised.

**\*Question 1: Date of this Submission.** Please input the projected
date when the PIA will be submitted to the Department from the OPDIV
Senior Official for Privacy.

**\*Question 2: OPDIV Name.** Please indicate the OPDIV where this
system resides or which OPDIV manages the system.

**\*Question 3: Unique Project Identifier (UPI) Number.** The format of
the UPI is established in OMB Circular A-11, Section 53.8. The number
reflects information such as the OPDIV and office where the investment
project was initiated, the type of investment, and other information.
This number is attached to Exhibit 300s and Exhibit 53s, which are
submitted to OMB prior to major investments and budget requests. If the
system has a UPI, this number **must** be included in the PIA or OMB may
not accurately reflect the submission of the PIA documents. A system
would not require a UPI number if, for example, no Exhibit 300 exists or
the system is not classified as a "Major Investment." The Department
should be especially careful to ensure that the correct UPI has been
included.

**\*Question 4: System of Records Notice (SORN) Number.** OMB assigns
this number to the system after an OPDIV submits an SORN request to OMB
pursuant to the *Privacy Act of 1974*. The HHS Privacy Act Officer or
OPDIV Privacy Contact should be able to supply this number if the PIA
author does not know whether the system has already completed a SORN. If
no SORN number exists for the system, please explain the reason in this
space (e.g., the system is in development and not yet submitted or the
system does not constitute a "System of Records" under the *Privacy
Act*).

**\*Question 5: OMB Information Collection Approval Number. OMB
Information Collection Approval Number Expiration Date.** This number
should be identical to the one OMB assigned pursuant to a Paperwork
Reduction Act filing and is sometimes referred to as an OMB control
number. The number reflects OMB's approval for collecting information.
An agency may not conduct nor sponsor a collection of information unless
it displays a valid OMB control number. Likewise, individuals are not
required to respond unless such a number is displayed. If the Department
is unsure of this number, it may wish to consult the HHS Report
Clearance Officer, or the OPDIV Report Clearance Officer

**\*Question 6: Other Identifying Number(s).** If the Department uses
any system identification methodology that is specific to the
Department, such as a purchase order number or an internal inventory
number, please supply that number here. Please **do not** use this
number instead of the unique identifier, SORN number, or OMB information
collection approval number, as this will confuse record keeping and PIA
approval efforts.

**\*Question 7: System Name.** If the system is included in the
Department's Federal Information Security Management Act (FISMA)
submission, the name of the system should be the same as the one
reported to OMB.

**Question 8: System Location: (OPDIV or contractor office building,
room, city, and state).** Fill in as appropriate. The system location
referred to in this question is the physical location of the system. If
a system has multiple locations, indicate at least one physical location
for the system.

**\*Question 9: System POC. The System POC is the person to whom
questions about the system and the responses to this PIA may be
addressed.** Provide the name and/or title of an individual to whom
questions about the system and the information provided in the PIA may
be addressed. The system owner or administrator is acceptable for this
purpose.

**\*Question 10: Provide an overview of the system.** While the PIA's
primary purpose is to convey the impact of privacy on the system in
question, this question provides system owners with an excellent
opportunity to explain the importance of the system and of the work the
system users perform.

[System Characterization and Data Categorization Tab]{.underline}

Once the system is precisely identified, the System Characterization and
Data Categorization (questions 11-21) of the PIA can be answered. These
questions are intended to describe the use, function, information
contained, and other aspects of the system. Completing this tab may
require coordination with the system owner, system users, or others with
knowledge of the operational aspects of the system under consideration.

**Question 11: Does HHS own the system? If no, identify the system
owner.** The Department "owns" a system if it funds the design,
development, or implementation of the system. In situations where the
PIA is being completed pursuant to a system that is in the process of
being procured or developed, the Department should still respond "Yes"
to this question. See OMB M-03-22, section B1.

**Question 12: Does HHS operate the system? If no, identify the system
operator.** The Department "operates" a system if it uses it to perform
a Department function and/or maintains and upgrades the infrastructure
of the system. See OMB M-03-22, section B1. As an example, if an OPDIV
or contractor operates the system and/or manages the system on behalf of
the Department, then HHS operates the system.

**\*Question 13: Indicate if the system is a new or an existing one
being modified.** Select "New" if the system is in development or
"Existing" if the system is currently in operation or has undergone a
major change as described in OMB M-03-22.

**Question 14: Identify the life-cycle phase of this system.** The
Department may wish to fill in more than one box if no single response
adequately describes the life-cycle phase of the system. If the agency
is uncertain what stage the system is in, the OPDIV should consult NIST
SP 800-64, *Security Considerations in the System Development Life
Cycle*.

**Question 15: Have any of the following major changes occurred to the
system since the PIA was last submitted?** Major changes include the
nine triggering events listed in OMB M-03-22 and in Section 2.2.4 of
this document. Please answer "Yes" or "No" to the listed major changes.

**Question 16: Is the system a General Support System (GSS) or a Major
Application (MA)?** If the Department is unsure whether the system meets
this definition, refer to OMB A-130, Appendix III. Definitions for
"General Support System" and "Major Application" are also provided in
Appendix D of this document.

**\*Question 17: Does/Will the system collect, maintain (store),
disseminate, and/or pass through IIF within any database(s), record(s),
file(s), or website(s) hosted by this system?**

**Note: This question seeks to identify all personal information
associated with the system. This includes IIF that is subject to the
Privacy Act; whether the individuals are employees, the public, research
subjects, or business partners; and whether the IIF is provided
voluntarily or collected by mandate. Later questions will try to
understand the character of the data and its applicability to the
requirements under the Privacy Act or other legislation.**

**Note: If no IIF is contained in the system, please answer questions
21, 23, 30, 31, 32, 37, 50 and 54, then promote the PIA to the OPDIV
Senior Official for Privacy who will authorize the PIA.**

**If this system contains IIF, all remaining questions on the PIA Form
Tabs must be completed prior to signature and promotion.**

For question 17, if it is answered "Yes," please fill out all questions
on the remaining tabs of the PIA. If answered "No," please complete the
Summary tab only, and have the PIA approved by the OPDIV PIA Reviewer,
OPDIV Senior Official for Privacy, and HHS Senior Agency Official for
Privacy.

**Please select "Yes" for all applicable IIF categories. If the
applicable IIF category is not listed, please use the Other field to
identify the appropriate category of IIF.** Please see the PIA Summary
tab for instructions. If the response was "Yes" in the Summary tab,
please identify the category of IIF.

**Question 18: Please indicate the categories of individuals about whom
IIF is collected, maintained, disseminated, and/or passed through. Note:
If the applicable IIF category is not listed, please use the Other field
to identify the appropriate category of IIF. Please answer Yes or No to
all of these choices.** Responses must be sufficiently specific to
describe only those individuals whose information is collected.
Individuals may, for example, be limited to recipients of specific
benefits or services, individuals requesting further information
concerning a particular government function or service, or individuals
subject to particular laws or regulations.

**Question 19: Are records on the system retrieved by one or more data
elements?** **If yes, please select all applicable IIF categories. If
the applicable IIF category is not listed, please use the Other field to
identify the appropriate category of IIF.** If the Department ever
retrieves records using IIF data elements, it shall answer "Yes" to
question 19. The Department should answer "Yes" to this question if the
system is in the procurement or development stage and does not yet
contain IIF, but is intended or expected to be populated with IIF. OMB
Guidelines for the *Privacy Act* clarify what it means to "retrieve" a
record by stating that a system of records exists if the capability
exists for \"indexing or retrieval capability using identifying
particulars \[that is\] built into the system\"; and the Department
\"does, in fact, retrieve records about individuals by reference to some
personal identifier." OMB Guidelines, 40 Fed. Reg. 28,948, 28,952
(1975).

**Question 20: Are 10 or more records containing IIF maintained, stored,
or transmitted/passed through this system?** A "record" is any item,
collection, or grouping of information about an individual that is
maintained by an agency. This information includes education, financial
transactions, medical history, and criminal or employment history and
that contains the name, identifying number, symbol, or other identifying
particular assigned to the individual, such as a fingerprint,
voiceprint, or a photograph. (See 5 U.S.C. §552a(a)(4) \[the *Privacy
Act*\]). In general, United States federal courts have construed what
constitutes a "record" fairly broadly. An item, collection, or grouping
of information containing even a single item of information about an
individual has been held to constitute a "record." If the Department is
at all uncertain whether the contents of the system constitute "records"
under the *Privacy Act*, it should consult its Privacy Contact.

**\*Question 21: Is the system subject to the *Privacy Act*?** As noted
in the questionnaire, the system is likely to be subject to the *Privacy
Act* if the answers to questions 17, 19, and 20 are each "Yes." System
owners should contact their OPDIV Privacy Contact for assistance with
this question if they are uncertain about the applicability of the
*Privacy Act*.

**Question 21 A. If yes, but a SORN has not been created, please provide
an explanation.** If the system is subject to the *Privacy Act*, the
system should also have a SORN to comply with the *Privacy Act*, OMB
Guidance, and the Secure One HHS Information Security Program Policy. If
the system does not have a SORN, and is subject to the *Privacy Act*,
please provide an explanation.

[Information Sharing Practices Tab]{.underline}

Questions 22 through 31 concern the way in which information is used,
transferred, stored, and processed. These questions are especially
critical in determining whether the use and operation of the system is
consistent with federal law and regulations.

**Question 22: Does the system share or disclose IIF with other
divisions within this agency, external agencies, or other people or
organizations outside the agency?** **If yes, please identify the
category of IIF shared or disclosed. If the category of personal
information is not listed, please check Other and identify the
category.** This question seeks to find how the system shares
information.

**\*Question 23: If the system shares or discloses IIF please specify
with whom and for what purpose(s).** The Department should provide an
affirmative explanation regardless of whether disclosure is on paper,
electronic, or oral. If no IIF is shared or disclosed, indicate "N/A" in
the text field.

**Question 24: If the IIF in the system is or will be matched against
IIF in one or more other computer systems, are computer data-matching
agreement(s) in place?** No record contained within a system of records
can be disclosed to an agency or non-federal agency for use in a
computer-matching program except pursuant to a written agreement between
the source agency and the recipient agency. If no matching takes place,
the appropriate response is "No." For more information on the
requirements of a computer data matching agreement, see OMB M-01-05.

**Question 25: Is there a process in place to notify organizations or
systems that depend on the IIF contained in this system when major
changes occur (e.g., revisions to IIF or when the system is replaced)?**
Change management, incident response, and continuity of operations
procedures should all include communications plans or procedures that
explicitly address how to inform users, organizations, and other
stakeholders of changes to this system that affect their activities or
operations. If the process for notifying data users is unwritten, the
Department should answer "No" to this question.

**Question 26: Are individuals notified how their IIF is going to be
used? If yes, please describe the process for allowing individuals to
have a choice.** Notification procedures should be explicitly
documented. If the process for notifying individuals is unwritten, users
should answer "No" to this question.

**Question 27: Is there a complaint process in place for individuals who
believe that their IIF has been inappropriately obtained, used, or
disclosed, or that the IIF is inaccurate?** **If yes, please describe
briefly the notification process.** The availability of the complaint
process should be documented and the Department should be able to
demonstrate that it makes reasonable efforts to inform individuals of
the correct procedures to follow in registering a complaint.

**Question 28: Are there processes in place for periodic reviews of IIF
contained in the system to ensure the data's integrity, availability,
accuracy, and relevance?** **If yes, please describe briefly the review
process.** If such processes are in place, the Department may also have
processes for retaining and destroying files, documents, or other
records deemed corrupted, outdated, inaccurate, or irrelevant. The
Department should consider these practices in answering question 50,
which concerns data retention and destruction practices.

**Question 29: Are there rules of conduct in place for access to IIF on
the system? If yes, identify all users with access to IIF on the system
and briefly state the purpose for each user to have access.** If the
Department has informal or unwritten rules only, the agency should
answer "No" to this question. Agencies with "Acceptable Use Policies"
that apply to the system covered by the PIA as well as other systems may
respond "Yes" to this question. "Acceptable Use Policies" must, however,
be comprehensively written. Agencies must also make all users aware of
"Acceptable Use Policies" through awareness and/or training activities.

**\*Question 30: Please describe in detail the information the agency
will collect, maintain, or disseminate and why and for what purpose the
agency will use the information.  In this description, indicate whether
the information contains IIF and whether submitting personal information
is voluntary or mandatory.**

This questions seeks a narrative response similar to information found
in a SORN publication.

**\*Question 31: Please describe in detail any processes in place to:**

• Notify and obtain consent from the individuals whose IIF is in the
system when major changes occur to the system (e.g., disclosure and/or
data uses have changed since the notice at the time of the original
collection)

> **• Notify and obtain consent from individuals on what IIF is being
> collected from them and how the information will be used or shared.**

Note: Please describe in what format individuals will be given notice of
consent (e.g., written notice, electronic notice).

Notification procedures should be explicitly documented. If the process
for notifying individuals is unwritten or the system does not contain
IIF, the PIA author should answer "No" to this question.

[Website Hosting Practices Tab]{.underline}

Questions 32 through 40 concern systems that host websites. If a system
hosts a website, agencies may need to comply with several requirements
involving notice and information collection practices. If the system
does not host a website, the majority of these questions can be answered
"no."

**\*Question 32: Does the system host a website? If yes, please indicate
what type of site the system hosts.** This question applies only to the
system under consideration. If the system under consideration does not
host a website, the Department should answer "No" to this question. If
yes, the Department should indicate whether the website is hosted on an
intranet (available to system users only), Internet (publicly
available), or both. If the site is only available to users via a
Virtual Private Network (VPN), intranet, or other access-limitation
scheme, the Department should still answer "Yes" to this question, even
though many of the requirements that apply to publicly accessible
websites do not apply to these internal-use-only websites. If the
website does not contain IIF, then type "N/A" in the text field.

**Question 33: Is the website accessible by the public or other entities
(e.g., federal, state, and local agencies, contractors, third-party
administrators)?** This question seeks to find if the website is
accessible by any other parties other than HHS.

**Question 34: Is a website privacy policy statement (consistent with
OMB M-03-22 and Title II and III of the E-Government Act) posted on the
website?** OMB M-99-18 requires all federal agencies to ensure websites
that collect "substantial information from the public" include a privacy
policy. The policy must "clearly and concisely inform visitors to the
site what information the agency collects about individuals, why the
agency collects it, and how the agency will use it. Privacy policies
must be clearly labeled and easily accessed when someone visits a
website." OMB M-03-22 adds requirements for consent to collecting and
sharing IIF and explains the rights under the *Privacy Act* and other
laws. If the Department is uncertain of whether its privacy policies
comply with these requirements, see OMB M-99-28 and Section III of OMB
M-03-22.

**Question 35: Is the website's privacy policy in a machine-readable
format, such as that provided by Platform for Privacy Preferences (P3P)?
If no, please indicate when the website will be P3P compliant.** P3P is
a tool for reporting a website's privacy practices to users that access
those websites. P3P-enabled websites make this information available in
a standard, machine-readable format. P3P-enabled browsers can "read"
this snapshot automatically and compare it to the viewer's own set of
P3P privacy preferences. More information on P3P and ways to implement
it is available at the website of the World Wide Web Consortium (W3C),
the developer of P3P: <http://www.w3.org/P3P/>. For specific assistance
at HHS, please see the *HHS Machine-Readable Privacy Policy Guide*.

**Question 36: Does the website use persistent tracking technologies?**
Persistent tracking technologies are small amounts of information that a
website puts on an individual's computer so that it can remember
something about the user at a later time. Examples include persistent
cookies, Web bugs, and Web beacons. This differs from tracking
technologies such as session cookies, which are removed from a user's
computer once that session ends. If the Department's website sends any
form of persistent tracking technology to a user's computer, the
Department should answer "Yes" to this question. Using persistent
tracking technologies is forbidden unless there is a compelling need for
their use and an agency head (or sub-agency head specifically authorized
by an agency head) approves of their use. For more information on
persistent tracking technologies, see Section III (D)(2)(v) of OMB
M-03-22.

**\*Question 37: Does the website have any information or pages directed
at children under the age of thirteen? If yes, is there a unique privacy
policy for the site, and does the unique privacy policy address the
process for obtaining parental consent if any information is
collected?** If the Web page has any material that is intended for
school-age children, especially children under the age of 13, the
Department should answer "Yes" to this question. The answer to this
question determines whether the website must comply with COPPA. The
Federal Trade Commission (FTC), which is charged with enforcing COPPA,
states that in determining whether a website or online service is
targeted at children, the FTC will consider the website's "subject
matter, visual or audio content, age of models, language or other
characteristics of the website or online service, as well as whether
advertisements promoting or appearing on the website or online service
is directed at children." The FTC will also consider "evidence regarding
audience composition; evidence regarding the intended audience, and
whether a site uses animated characters and/or child-oriented activities
and incentives."[^6]

**Question 38: Does the website collect IIF from individuals? If yes,
please indicate the category of IIF.** If users of the website fill out
forms that result in collecting the IIF items listed through the
website, the Department should answer "Yes" to this question. If the
website merely provides portable data formats (PDF) of standard forms
for printout or publishes addresses where information may be mailed, it
is not necessary to answer "Yes" to this question. If the website is
under development, but is intended or expected to collect IIF from
individuals, the Department should answer "Yes" to this question. If the
response is "Yes," please also answer "Yes" for the categories of IIF
that is collected from individuals.

**Question 39: Are rules of conduct in place for access to IIF on the
website?** The Department may answer "Yes" to this question only if
rules of conduct are written, apply to all users who have access to IIF
on the website, and are distributed to all users of IIF on the website.

**Question 40: Does the website contain links to sites external to the
OPDIV that owns and/or operates the system? If yes, note whether the
system provides a disclaimer notice for users that follow external links
to websites not owned or operated by the OPDIV.** "Link" refers to a
"hyperlink"---a text, graphic, or other feature on a website---that,
when the user clicks on it with a mouse or cursor, automatically directs
the viewer to another Web page or site. If the site contains links that
take the user to a website that is not owned and/or operated by the
Department, a link must be provided to a disclaimer stating that the
information the user is about to view is not under the control of the
Department.

[Administrative Controls Tab]{.underline}

Administrative controls are safeguards to ensure proper management and
control of information and information systems. These safeguards include
policies, the PIA itself, and certification and accreditation (C&A)
programs. Questions 41 through 50 are relevant to the administrative
controls in place to protect the IIF in the system in question.

**Question 41: Has the system been certified and accredited (C&A)? If
the system requires a C&A and one has not been completed, please
indicate when the C&A is scheduled for completion.** For more
information on process authorization, see National Institute of
Standards and Technology (NIST) Special Publication (SP) 800-37, *Guide
for the Security Certification and Accreditation of Federal Information
Systems***.**

**Question 42: Is there a system security plan for this system?**
Developing a system security plan is part of the C&A process for federal
information systems. For more information on developing a system
security plan, see NIST SP 800-18, *Guide for Developing Security Plans
for Information Technology Systems*.

**Question 43: Is there a contingency (or back up) plan for the
system?** For more information on contingency plans for federal systems,
see NIST SP 800-34, *Contingency Planning Guide for Information
Technology Systems*.

**Question 44: Are files backed up regularly?** For more information on
back-up strategies, see NIST SP 800-34, *Contingency Planning Guide for
Information Technology Systems*.

**Question 45: Are the back-up files stored off-site?** For more
information on back-up strategies, see NIST SP 800-34, *Contingency
Planning Guide for Information Technology Systems*.

Question 46: Are there user manuals for the system? This question
concerns specific instructions for using the system to carry out its
intended function, rather than general privacy, security, or acceptable
use policies.

**Question 47: Have personnel (system owners, managers, operators,
contractors, and/or program managers) using the system been trained and
made aware of their responsibilities for protecting personal information
that is being collected and maintained?** For more information on
developing a security awareness and training program for users of
federal information systems, see NIST SP 800-50*, Building an
Information Technology Security Awareness and Training Program*.

**Question 48: If contractors operate or use the system, do the
contracts include clauses ensuring adherence to privacy provisions and
practices?** Answering this question may require coordination with the
contract office. The CIO's office should be able to provide the correct
information or POC to gather the information.

**Question 49: Are methods in place to ensure least privilege (*i.e.*,
"need to know" and accountability)? If yes, please specify method(s).**
"Least privilege" refers to the security objective of granting users
only those accesses they need to perform their official duties. For more
on the concept of least privilege, see NIST SP 800-12, *An Introduction
to Computer Security: The NIST Handbook*, pages 109-110.

**\*Question 50: Are there policies or guidelines in place concerning
the retention and destruction of IIF? If yes, please provide some detail
about these policies/practices.** This question is specifically
concerned with OPDIV-level, specific policies and procedures. At the
Department level, policy guidelines are established by the *HHS
Information Security Program Policy*, Section 4.4 ("Media Control"),
July 2005. OPDIV-level policies should be consistent with or stricter
than the Departmental policy. For more information on which retention
schedule pertains to the collection contact the OPDIV Records Management
Office.

[Technical Controls Tab]{.underline}

Technical controls are safeguards that the computer system generally
executes. Technical safeguards include password protection, firewalls,
and cryptography. Questions 51 and 52 focus on the technical controls of
the system.

**Question 51: Are technical controls in place to minimize the
possibility of unauthorized access, use, or dissemination of the data in
the system?** **If yes, check all technical controls that are currently
in place.** For more information on technical controls, see NIST SP
800-12, *An Introduction to Computer Security: The NIST Handbook*; NIST
SP 800-14, *Generally Accepted Principles and Practices for Securing
Information Technology Systems*; and NIST SP 800-53, *Recommended
Security Controls for Federal Information Systems*. For technical
controls that are currently in place, please answer "Yes" from the list.

**Question 52: Is a process in place to monitor and respond to privacy
and/or security incidents? If yes, please briefly describe the
process.** For more information on security incident handling programs,
see NIST SP 800-61, *Computer Security Incident Handling Guide*.

[Physical Access Tab]{.underline}

Physical controls are measures taken to protect systems, buildings, and
related supporting infrastructure against threats associated with their
physical environment. These safeguards might include protections against
fire, structural collapse, plumbing leaks, physical access controls, and
controls against the intercept of data.

**Question 53: Are physical access controls in place? If yes, check all
physical controls that are currently on the system.** For more
information on physical security, see NIST SP 800-12, *An Introduction
to Computer Security: The NIST Handbook*; NIST SP 800-14, *Generally
Accepted Principles and Practices for Securing Information Technology
Systems*; and NIST SP 800-53, *Recommended Security Controls for Federal
Information Systems*. For all physical controls that are currently on
the system, please respond "Yes" on the list below.

**\*Question 54. Briefly describe in detail how the IIF will be secured
on the system using administrative, technical, and physical controls.**
Please provide general information about security practices, rather than
detailed information about information security. If no IIF is collected,
maintained, or disseminated, please answer "No" to the question.

[^1]: For more information on FOIA, its exemptions, and exclusions, see
    the Department of Justice, *FOIA Reference Guide* available at
    http://www.usdoj.gov/04foia/04_3.html.

[^2]: Taken from the definition of "PIA" in OMB M-03-22, "*OMB Guidance
    for Implementing of the Privacy Provisions of the E-Government Act
    of 2002*," September 26, 2003.

[^3]: Two of the Exhibits required by A-11 affect IT. Exhibit 53 is the
    Agency IT Investment Portfolio, which provides budget estimates for
    overall IT investments and for major and significant IT systems.
    Exhibit 300 is a Capital Asset Plan completed for major IT systems
    and IT budget initiatives.

[^4]: For discussion of the UPI, see Appendix F.

[^5]: OMB M-03-22 states that "\[a\]gencies may determine to not make
    the PIA document or summary publicly available to the extent that
    publication would raise security concerns, reveal classified (i.e.,
    national security) information or sensitive information\...contained
    in an assessment." See OMB M-03-22, Attachment A, Section II.C.3,
    "Review and Publication."

[^6]: See 16 CFR Part 312, *Children's Online Privacy Protection Rule*.