# Presentation: 202156

## PRIVACY ACT BASICS

**What You Need to Know **
**About Protecting Personally**
**Identifiable Information (PII)**

## DEFINITIONS:  WHAT IS PII?

**PII** **stands for Personally Identifiable Information.**
***Definition*****:  Information which can be used to identify a person uniquely and reliably, including but not limited to name, social security number, address, telephone number, e-mail address, mother’s maiden name, etc.**** **

## YOU NEED TO KNOW ABOUT PRIVACY BECAUSE...

**It’s information we are collecting, maintaining, distributing and disposing of about you!**
**It also requires you to take precautions when collecting, maintaining, distributing, and disposing of  PII required by your job.**
**It’s a factor in developing best business practices.**
**It contains both civil and criminal penalties for non-compliance.**

## IHS PRIVACY ACT (PA) RESPONSIBILITIES

**Establish rules of conduct for collecting, maintaining, distributing, and disposing of  personal information.**
**Publish PA system of records notice in the Federal Register for all approved privacy collections of information.**
**Ensures collection of data that is only authorized by law.**
**Data is only shared with those individuals having an official need-to-know.**

## IHS PA RESPONSIBILITIES

**Establish and apply data safeguards to protect information from unauthorized disclosure.**
**Allow individuals to review records about themselves for completeness and accuracy.**
**Allow individuals to amend their personal records regarding factual information that is in error.**
**Keep a record of disclosures made outside of IHS to authorized “routine users” described in the PA system notice.**

## What is Privacy Sensitive and Requires Protection

**Financial, credit, and medical data**
**Security clearance level **
**Leave balances; types of leave used**
**Home address and telephone numbers (including home web addresses)**
**Social Security Number**
**Mother's maiden name; other names used**

**Drug test results and the fact of  participation in rehabilitation programs**
**Family data**
**Religion, race, national origin**
**Performance ratings**
**Names of employees who hold government-issued travel cards, including card data**

## WHY DO WE COLLECT PII ABOUT YOU?

**We need it to **
**hire you**
**retain you**
**pay you**
**separate you**
**compensate you**
**locate you**
**educate you**
**discipline you**
**rate you**
**provide services to you**

## YOU HAVE THE RIGHT TO:

**Request copies of the records we are maintaining on you.**
**To designate a person to have access to information about you:  parent, spouse, friend, attorney, congressman, colleague, etc.**
**To seek amendment of any factual inaccuracies (not opinions).**
**To understand how long records will be maintained before being accessioned or destroyed.**
**Appeal any denial of information.**

## WHEN MOVING FROM PAPER TO ELECTRONIC: THINK PRIVACY

**Moving from a paper process into an electronic process requires you to identify any risks that would subject personal information to compromise.  In other words, yesterday’s MR when moved from paper to an electronic means may open us up to a potential privacy breach.**
**For Example Using a DOD/Navy Scenario:  Promotion lists for FLAG OFFICERS containing full names and SSNs were sent to Congress in paper form and placed in the Congressional Record which was not readily available/accessible.  Once the Congressional Record was placed on the Internet, its contents were available for all to see.  This resulted in credit cards being opened up on those FLAG OFFICERS which resulted in identity theft.**
**Result:  DOD had to change their business practice.**
**IHS is/will be changing their business practice on transmission of PII/PHI via email – HOW: **_**Encryption**_

## MORE BEST PRACTICES

**When you receive an email and it contains personal information about another individual, do not forward that document to others without first assessing whether each recipient has an official need to know.**
**Use training to educate your personnel on Privacy.**
**Ensure all newly assigned personnel receive orientation training on the Privacy Act so they fully understand their role in ensuring that personal information is protected from unauthorized disclosure.**
**Ensure all personnel receive refresher training once a year or more often should they be involved in a breach (loss) of personal information.**
**Ensure that new supervisors and employees take Privacy Act training**
**Ensure all personnel who deal with personal information contained in a Privacy Act system of records are properly trained on the systems notice and the safeguards addressed therein and the restrictions regarding access to the information.**

## PROTECTING PII

**Think about ways to ensure that PII is properly protected.**
**Think about your computer, memory stick, PDA, etc., and what PII information you store on it.  What would you do if they were stolen?  **
**Think about emails – if you receive emails that contain PII – are they properly marked alerting you to treat them as FOR OFFICIAL USE ONLY – PRIVACY SENSITIVE – Any misuse or unauthorized access may result in both civil and criminal penalties?  Do you properly mark your emails?**
**Think privacy when you create documents, do you need to include the entire SSN or will the last four digits work?**** **

## PROTECTING PII (continued)

**Think privacy and do not include the entire SSN in the subject line of an email for all to see.**** **
**Think privacy and do not place PII in public folders in Outlook for others to see.**
**Think privacy and do not place PII information on public web sites.**
**Think privacy and identify ways to ensure PII is not compromised!**

## DISPOSAL OF PII

**Don’t assume that documents containing PII that are placed in a recycle bin are being shredded prior to being recycled..**
**Best practice – cross cut shredding.**
**Dispose of PII in a manner that does not result in a privacy breach.**

## MAINTAINING INFORMATION

**If you maintain information that is retrieved by a person’s name and/or personal identifier, you must identify a Privacy Act system of records that permits that collection and follow the rulemaking set forth in the systems notice.**
**All IHS PA systems of records notices are listed at ** _[http://www.ihs.gov](http://www.ihs.gov/)_
- 	Click on _[Resources for I H S Management](http://www.ihs.gov/AdminMngrResources/ManageResources_index.asp)_Click on _[Privacy Act](http://www.ihs.gov/AdminMngrResources/PrivacyAct/)_

## IHS PA RESPONSIBILITIES

**Upon written request, provide a copy of the record to the subject of the file.**
**Maintain only accurate, timely, and complete information.**
**When directly soliciting personal information, provide a PA Statement that addresses the authority for the collection, purpose for the collection, routine uses that will be made of the information, and whether collection is voluntary or mandatory****. **

## WHAT ARE YOUR RESPONSIBILITIES?

**As an employee, you play a very important **
**role in assuring IHS complies with the **
**provisions of the Privacy Act.  Accordingly,**
**DO NOT collect personal data without authorization.**
**DO NOT distribute or release personal information to other employees unless they have an official need-to-know****.**

## WHAT ARE YOUR RESPONSIBILITIES?<<Continued>>

**DO NOT be afraid to challenge “anyone” who asks to see PA information for which you are responsible.**
**DO NOT maintain records longer than permitted under records disposal. **
**DO NOT destroy records before disposal requirements are met.**
**DO NOT place unauthorized documents in PA systems of records.**

## WHAT ARE YOUR RESPONSIBILITIES?<<Continued>>

**DO NOT commingle information about different individuals in the same file.**
**DO NOT transmit personal data without ensuring it is properly marked.  Use ‘FOR OFFICIAL USE ONLY – PRIVACY SENSITIVE.’**
**DO NOT use interoffice envelopes to mail Privacy data.**
**DO NOT place privacy data on shared drives, multi-access calendars, the Intranet or Internet that can be accessed by individuals who do not have an official need to know.**

## WHAT ARE YOUR RESPONSIBILITIES?<<Continued>>

**DO NOT create a new system of records without first consulting your Privacy Officer**
**DO NOT hesitate to offer recommendations on how to better effectively manage privacy data.**
**   **_**YOUR INSIGHT COUNTS!!!  YOU DEDICATION TO PROTECTING PRIVACY IS PARAMOUNT TO OUR SUCCESS!!!**_

## LET’S RECAP

- Privacy Act of 1974, as amended             (5 U.S.C. 552a)
- 12 Conditions of Disclosures
- Maintain an Accounting of Disclosures (i.e., ROI  software application or IHS 505)
- Individual - Rights to Access, Copy, Amend/Correction
- Safeguards

## LET’S CONTINUE TO RECAP

- If Collecting PII in a Record Set – Publish a SORN.   NO SECRET RECORDS
- PA covers U.S. Citizens and Resident Aliens (Does not cover Illegal Aliens, Deceased, Organization, and Tribal Governments)
- SSN is voluntary for MR. If Statutes or other authority requires then collect

## LET’S CONTINUE TO RECAP

- IHS has 3 PASORN(s) – Go to the IHS Privacy Act Website for more info
- Civil Remedies
- Criminal Penalties
- HIPAA Privacy Rule Comparison to the Privacy Act and PHI (i.e., IHS Medical, Health, and Billing Records)

## TEN RULESTo Protect Personal Information

- 1. **DO NOT **be afraid to challenge “anyone” who asks to see Privacy
- 	    Act information that you are responsible for.
- 2. **DO NO**T maintain records longer than permitted under records
- 	    disposal.
- 3. **DO NOT **destroy records before disposal requirements are met.
- 4. **DO NOT **place unauthorized documents in Privacy Act record
- 	    systems.
- 5. **DO NOT **commingle information about different individuals in the
- 	    same file.

## TEN RULESTo Protect Personal Information---->>>Continued

- 6. **DO NOT **transmit personal data without ensuring it is properly marked.  Use “**FOR OFFICIAL USE ONLY –PRIVACY SENSITIVE**.”
- 7. **DO NOT **use interoffice envelopes to mail Privacy data.
- 8. **DO NOT **place privacy data on shared drives, multi-access calendars, the Intranet or Internet that can be accessed by individuals who do not have an official need to know
- 9. **DO NOT **create a new system of records without first consulting your Privacy Office
- 10. **DO NOT **hesitate to offer recommendations on how to better effectively manage privacy data.

## BOTTOM LINE 

**If you collect it...you must protect it **
**If in doubt...leave it out **
**Just because you’ve always handled personal information one way...doesn’t mean that is the best- way.**

## THANK YOU