Privacy Impact Assessment (PIA) 

for the 

Connecting Adults to Success: Evaluation of Career Navigator 

Training 

October 26, 2023 

Point of Contact 

Contact Person: Melanie Ali 

Title: Education Research Analyst 

Email: Melanie.Ali@ed.gov 

System Owner 

Name: Melanie Ali 

Title: Education Research Analyst 

Principal Office: Institute of Education Sciences (IES) 

Submit completed Privacy Impact Assessments to the Privacy Office at 

privacysafeguards@ed.gov 

FY 2022 
 

 

 

 

 

 

 

 

 

 

Please complete this Privacy Impact Assessment (PIA), which describes how personally 

identifiable information (PII) is collected, stored, protected, shared, and managed electronically 

by your system. You may wish to consult with your ISSO in completing this document. 

If a question does not apply to your system, answer with N/A. 

• Please ensure all responses are written in plain language. Write out all acronyms on 

first use and use acronyms consistently thereafter. 

• For questions that are identical to those in the Privacy Threshold Analysis (PTA), 

please review the responses provided in the most recently approved PTA, determine 

whether the responses remain accurate, and, if so, use the same response in the PIA. 

1. Introduction 

1.1. Describe the project or program that uses this information technology (IT) system, 

including the purpose of the project or program. 

The Connecting Adults to Success: Evaluation of Career Navigator Training (CATS 

Study) is a U.S. Department of Education (Department) study that will examine the 

implementation of a model of training for career navigators at adult education sites and 

the impact of the training on learners’ education and employment outcomes. This study 

is being conducted by Mathematica Policy Research, under contract to the Department. 

The information in this system will be used to assess whether providing career 

navigators with training leads to improved education and employment outcomes among 

adult learners. The study will examine whether outcomes measured at 18 and 30 months 

of beginning participation in the study differ on average between learners in sites that are 

assigned by lottery to receive the study’s career navigator training and learners in study 

sites that are assigned by lottery to a control group. 

The system consists of a set of linked files that include study data. These data will 

include descriptive information regarding the adult education sites participating in the 

study, as well as individual-level data pertaining to the adult learners and career 

navigators participating in the study. 

Staff at Mathemtica Policy Research will be responsible for the collection of the 

following study data and will upload files containing these data through secure transfer 

to the IES Data Center (IESDC). 

• Descriptive information on site characteristics and practices. Mathematica Policy 

Research will obtain this information through interviews with site directors. 

• Information on career navigators, the services they provide, and their experiences 

with the study’s training. This information will be collected through online 

Fiscal Year 2023 Privacy Impact Assessment -Page 1 
 

 

 

 

 

 

 

 

 

 

 

 

 

surveys of the career navigators. Surveys will be administered by Mathematica 

Policy Research through its ConfirmIT application. ConfirmIT is a survey 

software platform through which single- or multi-mode, 508-compliant surveys 

can be built and launched. ConfirmIT web surveys are hosted on secure HTTP 

with a security certificate from a recognized vendor. The surveys also have 

standard password authentications and be transmitted through 256-bit encryption. 

• Information on learners. This information will be collected online by 

Mathematica Policy Research through data entered by learners and program 

intake staff at study sites into RAPTER, a cloud-based case management system 

that uses encryption of data in transit and at rest, restrictive firewalls, and multifactor authentication. Continuous monitoring and logging measures are used to 

ensure data availability and integrity. Learner information will also be obtained 

through matching with the records of the adult education site at which the learner 

is enrolled, the National Student Clearinghouse, the National Directory of New 

Hires, the Central Processing System and National Student Loan Data System of 

the Office of Federal Student Aid (FSA), and the databases of high school 

equivalency test vendors. 

In order to match with the administrative databases of FSA and the U.S. Department of 

Health and Human Services (i.e., the National Directory of New Hires), staff from 

Mathematica Policy Research will upload a file with learner identifiers (names, dates of 

birth, Social Security numbers(SSN)) through secure transfer to the IESDC. With this 

file, IES staff will receive files containing the matched data from FSA and the U.S. 

Department of Health and Human Services through secure transfer from the IESDC. 

Study staff from Mathematica Policy Research will have access to all study data on the 

IESDC, where all data analysis will take place. Data will be accessed by contract staff to 

conduct statistical analyses to describe the background characteristics of the career 

navigators and adult learners at study sites, describe the implementation of the study’s 

training, examine the services provided by the navigators, and estimate the impact of the 

training on learners’ basic skills, high school equivalency credential attainment, college 

enrollment, employment, and earnings. 

Mathematica Policy Research will provide IES with two reports on study findings. These 

reports, which will not contain individual-level information, will be made publicly 

available by IES. 

Two sets of data files will be stored long-term on the IESDC: 

1. A set of restricted-use data files. These files will contain study-created identifiers 

Fiscal Year 2023 Privacy Impact Assessment -Page 2 
 

 

 

 

 

 

 

 

 

and will be made available to researchers who are approved license holders and 

are in compliance with the National Center for Education Statistics’ data security 

procedures. The data file will exclude direct identifiers, including participant 

name, date of birth, and SSN, but will include other individual-level data 

collected for the study. 

2. A set of data files that contain all data in the restricted use data set, plus names, 

dates of birth, and SSNs for learners in the study. IES may use these data in order 

to follow learners over time and examine any long-term impacts of the career 

navigator training. 

1.2. How does the IT system function to support the project or program as described in 

Question 1.1? 

The system consists of a set of linked files that include study data. These data will 

include descriptive information regarding the adult education sites participating in the 

study, as well as individual-level data pertaining to the adult learners and career 

navigators participating in the study. 

Information on site directors will be obtained directly through interviews with these 

directors. 

Information on career navigators, the services they provide, and their experiences with 

the study’s training will be collected through online surveys of the career navigators. 

Information on learners will be collected online through data entered by learners and 

program intake staff at study sites as well as through matching with the records of the 

adult education site at which the learner is enrolled, the National Student Clearinghouse, 

the National Directory of New Hires, the Central Processing System and National 

Student Loan Data System of FSA, and the databases of high school equivalency test 

vendors. 

This study will leverage two IT systems that the contractor uses: RAPTER and 

ConfirmIT. 

1. RAPTER is a management information system and will contain study data 

entered by staff and learners at study sites. RAPTER is a cloud-based case 

management system that uses encryption of data in transit and at rest, restrictive 

firewalls, and multi-factor authentication. These security measures and rolebased access control protect against unauthorized viewing of and access to data, 

and unauthorized alteration, disclosure, or destruction of data. Continuous 

Fiscal Year 2023 Privacy Impact Assessment -Page 3 
 

 

 

 

 

 

 

 

 

 

 

monitoring and logging measures are used to ensure data availability and 

integrity. 

2. Surveys will be administered by the contractor through its ConfirmIT 

application. ConfirmIT is a survey software platform through which single- or 

multi-mode, 508-compliant surveys can be built and launched. Surveys authored 

in one mode in ConfirmIT can be deployed across other modes – including web, 

Computer-assisted personal interviewing1 (CAPI), telephone, mobile, and paper. 

ConfirmIT web surveys are hosted on secure HTTP with a security certificate 

from a recognized vendor. The surveys also have standard password 

authentications and be transmitted through 256-bit encryption. 

Data will be accessed by contract staff to conduct statistical analyses to describe the 

background characteristics of the career navigators and adult learners at study sites, 

describe the implementation of the study’s training, examine the services provided by 

the navigators, and estimate the impact of the training on learners’ basic skills, high 

school equivalency credential attainment, college enrollment, employment, and earnings. 

Only contracting staff at Mathematica Policy Research will have direct access to data 

through RAPTER and ConfirmIT. Data access on Mathematica’s network is granted on 

a need-to-know basis. Only employees with Mathematica network IDs and passwords 

have access to the data. This access is enforced through access control lists linked to the 

user’s login information. Access to the information system is revoked immediately when 

a staff member leaves Mathematica. 

Contractor staff at Mathematica Policy Research will upload study data collected 

through RAPTER and ConfirmIT through secure transfer to the IESDC, where all data 

analysis will take place. 

1.3. What are the technical elements and/or components of the IT system? Mark all that 

apply. 

☐ Website ☐ Portal ☒ Application 

☒ Database ☐ Server ☐ Other (Specify 

Below) 

If you have been directed to “specify below,” describe the type of technical elements 

and/or component: 

1 Computer-assisted personal interviewing (CAPI) is an interviewing technique in which the respondent 

or interviewer uses an electronic device to answer the questions. 

Fiscal Year 2023 Privacy Impact Assessment -Page 4 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

1.4. Describe the purpose for which the personally identifiable information (PII)2 is created, 

collected, used, processed, stored, maintained, disseminated, or disclosed by the IT 

system. If there is more than one type of individual from whom PII is collected (e.g., 

grantees, parents, Federal employees, contractors), specify the purpose for each type of 

individual. 

In order to successfully carry out this study, PII is needed to assess the implementation 

of the career navigator training and to rigorously estimate the impacts of the training on 

adult learner outcomes, as well as to describe the background characteristics of study 

participants (including career navigators and adult learners) and to create subgroups for 

analysis based on these characteristics. This information can only be obtained by 

collecting survey data from individuals and administrative data from adult education 

sites, high school equivalency test vendors, the National Student Clearinghouse, the 

National Directory of New Hires, and FSA. 

Ultimately, the findings from this evaluation will be used to describe the implementation 

of the career navigator training and examine whether the training is a viable strategy to 

improve adult learner education and workforce outcomes. Data from the evaluation that 

includes PII will not be publicly released. 

1.5. Is the IT system operated by the agency or by a contractor? 

Contractor 

1.6. If the IT system is operated by a contractor, describe the contractor’s role in operating 

the system. 

N/A

Study staff from Mathematica Policy Research will have access to all study data on the 

IESDC, where all data analysis will take place. Data will be accessed by contract staff to 

conduct statistical analyses to describe the background characteristics of the career 

navigators and adult learners at study sites, describe the implementation of the study’s 

training, examine the services provided by the navigators, and estimate the impact of the 

training on learners’ basic skills, high school equivalency credential attainment, college 

enrollment, employment, and earnings. 

2 The term “personally identifiable information” refers to information which can be used to distinguish or trace an 

individual’s identity, such as their name, Social Security number, biometric records, etc., alone, or when combined 

with other personal or identifying information which is linked or linkable to a specific individual, such as date and 

place of birth, mother’s maiden name, etc. OMB Circular A-130, page 33 

Fiscal Year 2023 Privacy Impact Assessment -Page 5 
 

 

 

 

 

 

 

 

Mathematica Policy Research will provide IES with two reports on study findings. These 

reports, which will not contain individual-level information, will be made publicly 

available by IES. 

1.7. If the IT system is operated by a contractor, does the contract and other acquisitionrelated documents include privacy requirements? 

Yes 

N/A

2. Legal Authorities and Other Requirements 

If you are unsure of your legal authority, contact your program attorney. 

2.1. What specific legal authorities permit and regulate the collection and use of data by the 

IT system? Include name and citation of each authority. 

This study is authorized under Section 242 of Title II of the Workforce Innovation and 

Opportunity Act of 2014. It is also authorized under Section 173 of the Education 

Sciences Reform Act of 2002. 

System of Records Notice (SORN) 

2.2. Has the Department’s Privacy Program determined that the PII maintained by the IT 

system is or will be maintained as part of a Privacy Act system of records? Refer to the 

“SORN” item in the “Privacy Program Determination” section of the PTA if unsure. 

☒ Yes 

☐ No 

2.3. If yes, provide the full name(s), number(s), and Federal Register citation of the 

applicable SORN(s) and/or a statement indicating that a new or modified SORN is being 

prepared. 

The SORN, titled “Connecting Adults to Success: Evaluation of Career Navigator 

Training” 18-13-46, 88 FR 72446, was published in the Federal Register on October 20, 

2023. 

Records Management 

Fiscal Year 2023 Privacy Impact Assessment -Page 6 
 

 

 

 

 

 

 

 

 

If you do not know your records schedule, consult with your records liaison, or send an 

email to RMHelp@ed.gov 

2.4. Is there an applicable records retention schedule(s) for the information maintained in the 

IT system? Note: If no records schedule is in place or you are unsure of the applicable 

records schedule, reach out to your records liaison or the Records Management Office. 

☐ Yes, there is/are approved records retention schedule(s) for the information. 

List the schedule(s): 

☒ No, there are currently no approved records retention schedules, but there is a 

proposed schedule or plan to establish a schedule. Explain: 

2.5. Is the PII contained in this system disposed of appropriately, and in accordance with the 

timelines in the records disposition schedule ? 

☐ Yes 

☒ No 

IES is working with the Records Management Division to draft an appropriate records 

retention schedule for the data collected. Until a retention schedule is approved, all 

records will be held indefinitely. 

3. Information Collection, Maintenance, Use, and/or Disclosure 

Collection 

3.1. Select the types of PII that are collected, maintained, used, and/or disclosed by 

the IT system. Note: PII includes any information that is linked or linkable to an 

individual, including business or contact information, information that is publicly 

accessible elsewhere, and ordinarily non-sensitive information. 

Biographical and Contact Information 

☒ Name ☒ Date of Birth ☒ Gender or Sex 

☐ City, State, or 

County of Birth 

☐ Country of Birth ☒ Home Address 

☐ Personal Phone ☐ Work Phone ☐ Personal Email 

Number Number Address 

Fiscal Year 2023 Privacy Impact Assessment -Page 7 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

☒ Work Email ☐ Work Address ☐ Personal Fax 

Address Number 

☐ Work Fax Number ☐ Digital Signature ☐ Mother’s Maiden 

☐ Hand Signature 

Name 

Other Demographic Information 

☒ Citizenship and/or ☐ Military Service ☒ Marital Status, 

Alien Registration Spouse, and/or Child 

Number (A-Number) Information (Specify 

below) 

☒ Educational 

Background/Records 

☐ Group/ 

Organization 

Membership 

☒ Employment 

Information 

☐ Physical ☒ Race/Ethnicity ☐ Religion 

Characteristics or 

Biometrics (Height, 

Weight, etc.) 

Identification Numbers 

☒ Social Security ☐ Truncated/Partial ☐ Driver’s License 

Number Social Security Number 

Number 

☐ Passport Number ☐ Employee ☐ Professional 

Identification Number License Number 

☐ Credit/Debit Card ☐ Bank/Financial ☐ Personal Device 

Number Account Number Identifiers/Serial 

Numbers 

☐ License Plate ☐ File/Case ID ☐ Federal Student 

Number Number Aid Number 

☐ Student ID Number ☐ Student Loan 

Number 

☐ Grant Number 

☐ Other ID That Can 

Be Traced to 

Individual 

(Specify below) 

Fiscal Year 2023 Privacy Impact Assessment -Page 8 
 

 

 

 

 

 

 

 

 

Electronic and Miscellaneous Information 

☒ Username/User ID ☒ Password ☐ IP Address 

☐ MAC Address ☐ Complaint Information 

(Specify below) 

☐ Medical 

Information 

(Specify below) 

☐ Location Data ☐ Log Data That Can Be 

Traced to Individual 

☐ Photographs of 

Individuals 

☐ Videos of 

Individuals 

☐ Criminal history ☒ Other 

(Specify below) 

If you have been directed to “specify below,” describe the PII: The career 

navigator’s salary and benefits at the adult education site. 

3.2. Select the category of individuals from whom information is collected, maintained, used, 

or disclosed by the IT system and, if applicable, list what information from Question 3.1 

is collected from each. Check all that apply: 

☐ Federal Employees 

Specify types of information collected from Federal employees: 

☒ Federal Contractors 

Specify types of information collected from Federal contractors: 

Contracting staff at Mathematica Policy Research require login 

credentials (username and password) to access study data collected 

through its systems. 

☒ General Public (Any individual not employed by the Department). 

Specify categories of the general public (e.g., teachers, students, 

parents, institution representatives, grantees, State and local 

Fiscal Year 2023 Privacy Impact Assessment -Page 9 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

government employees), and the types of information collected from 

each:3 

Information from site directors will include the names and email addresses 

of program intake staff and career navigators at the site. This information 

will be used to create and send usernames and passwords for RAPTER to 

these staff and to send unique survey links through ConfirmIT. 

Information from career navigators will include work and training 

experience, educational background, race, age, ethnicity, gender, types of 

career navigation services the navigator provides, the navigator’s salary 

and benefits at the adult education site, perceptions of the study’s training, 

and records of the navigator’s participation in the study’s training and 

provision of navigation services to learners. 

3.3. What are the sources of PII collected, maintained, used, or disclosed by the IT system 

(e.g., individual, school, another agency, commercial sources)? 

For administrative access, PII will be collected from contracting staff at Mathematica 

Policy Research to access study data collected through its systems. 

For the study, PII will be obtained from surveys of adult learners and career navigators, 

and from administrative records including those the National Student Clearinghouse, the 

National Directory of New Hires, FSA, high school equivalency test vendors, and local 

adult education provider study sites. 

3.4. How is the PII collected from the stated sources listed in Question 3.3 (e.g., paper form, 

webpage, database)? 

PII will be collected through online surveys and computer-based matching with 

administrative databases. 

Information on career navigators, the services they provide, and their experiences with 

the study’s training will be collected through online surveys of the career navigators. 

Information on adult learners will be collected online through data entered by the adult 

learners and program intake staff at study sites as well as through matching with the 

records of the adult education site at which the adult learner is enrolled, the National 

Student Clearinghouse, the National Directory of New Hires, the Central Processing 

3 For example: 

From students: name, email address, phone number. 

From institution representatives: name, email address, username, password. 

Fiscal Year 2023 Privacy Impact Assessment -Page 10 
 

 

 

 

 

 

 

 

 

 

 

 

 

System and National Student Loan Data System of FSA, and the databases of high 

school equivalency test vendors. 

This study will leverage two IT systems that the contractor uses: RAPTER and 

ConfirmIT. 

Contractor staff at Mathematica Policy Research will have access to IESDC and upload 

study data collected through RAPTER and ConfirmIT through secure transfer to IESDC, 

where all data analysis will take place. 

In order to match with the administrative databases of FSA and the U.S. Department of 

Health and Human Services (i.e., the National Directory of New Hires), contracting staff 

at Mathematica Policy Research will upload a file with learner identifiers (names, dates 

of birth, SSNs) through secure transfer to IESDC. IES staff will receive files containing 

the matched data from FSA and the U.S. Department of Health and Human Services 

through secure transfer from IESDC, where contracting staff will also have access for 

the purpose of data analysis. 

3.5. Privacy law and policy generally requires agencies to collect or maintain only the 

minimum amount of PII necessary to accomplish an authorized purpose. For each of the 

PII elements that are indicated in Question 3.1, please describe why the information is 

necessary. 

The study requires contact information of adult learners and career navigators in order to 

provide these individuals with the notices contained in Section 4.3. Adult learners’ 

names and addresses are necessary to notify learners of their inclusion in the study and 

give them an opportunity to opt out. Similarly, the names and work email addresses of 

the career navigators are necessary to notify these individuals of their inclusion in the 

study and provide them access to the study’s voluntary survey. 

Adult learners’ names as well as other identifying information including date of birth 

and SSN are also required in order for the study to match records with administrative 

data sources. Without these, the study would not be able to obtain information regarding 

learners’ education and employment outcomes. Without these outcome data, the study 

would not be able to examine whether the training leads to improvements on these 

outcomes. 

Other biographical and demographic information regarding learners and career 

navigators is needed in order for the study to be able to describe the characteristics of the 

participants in the study, examine equivalency between the groups assigned by lottery to 

Fiscal Year 2023 Privacy Impact Assessment -Page 11 
 

 

 

 

 

 

 

 

 

 

 

receive the study’s training or not, and to increase the precision of estimates of the 

impact of the training on learner outcomes. This includes learners’ gender/sex, 

race/ethnicity, citizenship, marital status, and educational background. For navigators, 

this includes gender/sex, race/ethnicity, and year of birth. 

The study requires navigator’s employment information (salary and benefits) in order to 

estimate the costs of navigators’ time participating in the study’s training. This is 

necessary in order for the study to estimate the full cost of implementation of the 

training. 

Finally, the system maintains user IDs and passwords for career navigators and other 

program intake staff in order to allow those individuals with access to RAPTER. 

3.6. Who can access the information maintained in the IT system? 

☒ Federal Employees 

☒ Federal Contractors 

☐ General Public (Any individual not employed by the Department) 

3.7. How is the PII validated or confirmed to ensure the integrity or quality of the 

information (e.g., form restricting, verifying newly collected information matches 

previously collected information, account verification, periodically requesting system 

users verify their own information in the system)? 

All data will undergo quality-control checks. For example, programmatic checks will be 

built into online surveys including alpha-numeric and range restrictions and validations; 

numeric fields such as SSNs will not allow letters and name fields will not allow 

numbers. For administrative data collected as files (not entered manually by individuals 

on a survey), non-conforming values such as basic skills test scores that fall outside the 

range of possible scores will be flagged for review and correction. 

Information Use for Testing 

3.8. Is the PII maintained in the IT system used for internal testing, training, and researching 

new applications or information systems? 

No 

3.8.1. If the above answer to question 3.9 is YES, are you authorized to use PII when 

such information is used for internal testing, training, and research? 

N/A

Fiscal Year 2023 Privacy Impact Assessment -Page 12 
 

 

 

 

 

Click here to select. 

3.8.2. If the above answer to question 3.9 is YES, what controls are in place to minimize 

the privacy risk and protect the data? 

N/A

Social Security Numbers 

It is the Department’s Policy that, in order to collect Social Security numbers, the System Owner 

must state the collection is: 1) authorized by law, 2) necessary for an agency purpose, and 3) 

there is no reasonable alternative. 

3.9. Does the IT system collect or maintain Social Security numbers (SSNs)? 

Yes 

3.9.1. If the above answer to question 3.10 is YES, cite the authority for collecting or 

maintaining the SSNs. 

N/A

The collection of SSNs for this study are authorized under Section 242 of Title II of 

the Workforce Innovation and Opportunity Act of 2014. It is also authorized under 

Section 173 of the Education Sciences Reform Act of 2002 and Executive Order 

9397, as amended by Executive Order 13478 (November 18, 2008). 

3.10.2. If the above answer to question 3.10 is YES, explain the purpose for the 

collection/maintenance and how the SSNs are used. 

N/A

SSNs will be used to match with national administrative databases including those 

of the National Student Clearinghouse, the National Directory of New Hires, FSA, 

and vendors of high school equivalency tests. This matching will allow the study to 

obtain education and employment-related data on learners in order to examine 

whether providing a promising model of training to career navigators leads to 

improved learner outcomes in these areas. 

3.10.3. If the above answer to question 3.10 is YES, specify whether the collection of the 

SSNs is mandatory or voluntary. What are the consequences for the individual of 

not providing the SSN, if any? 

Fiscal Year 2023 Privacy Impact Assessment -Page 13 
 

 

 

 

 

 

 

 

 

 

 

N/A

The collection of SSNs is voluntary. There are no consequences to adult learners for 

not providing an SSN. 

3.10.4. If the above answer to question 3.10 is YES, specify any alternatives to SSNs that 

were considered and explain why they were not used. 

N/A

While alternatives were considered, the study would not be able to adequately 

assess the impact of the career navigator training on learners’ education and 

employment outcomes without the collection of SSNs. SSNs provide the most 

reliable method of matching learners to administrative databases. 

4. Notice 

4.1. How does the IT system provide individuals with a privacy notice about the collection, 

maintenance, use, and disclosure of PII prior to its collection? For example, does the IT 

system provide a Privacy Act Statement (if applicable) or other privacy notices provided 

at the point of collection? If a notice is not provided, explain why not. 

Learners and career navigators at study sites will be provided with direct notice of the 

intention of the study to collect PII. This will occur via an opt-out form sent to learners 

upon their enrollment in adult education courses at study sites and a form provided to 

career navigators through RAPTER and ConfirmIT at the start of the study, A System of 

Records Notice as well as this PIA will also be publicly posted. 

4.2. If you, or a partner, maintain a program website that is not hosted on the ed.gov domain 

and is accessible to the public, does the program website have a webpage privacy 

policy? 

N/A

Yes 

4.3. Provide a link to the webpage where the privacy notice referenced in Question 4.1 is 

posted. If there is no publicly accessible link, provide the text of the privacy notice. Do 

not include security banners, security notices, Paperwork Reduction Act statements, or 

other notices not specifically related to privacy. 

N/A

Fiscal Year 2023 Privacy Impact Assessment -Page 14 
 

 

 

 

 

 

 

 

 

 

 

 

For learners, the opt-out form will contain the following text: 

Dear [INSERT FIRST, LAST NAME]: 

You recently enrolled in an adult education program at [PROGRAM NAME]. This adult 

education program and its career navigator(s) are taking part in a national study that the 

U.S. Department of Education is sponsoring. This study will help the agency learn more 

about the effects of providing training for career navigators who work with adult learners. 

Mathematica is leading this study and partnering with Manhattan Strategy Group and 

Social Policy Research. Once you enrolled in Your Program, you automatically became a 

participant in the Study and will remain a participant in the Study unless and until you 

choose to “opt out” as described below. 

Navigators are people who provide services to help students transition to jobs, college, 

and other training. Other names for career navigators are college navigators, coaches, 

transition coordinators, counselors, or case managers. The study will compare two groups 

of career navigators. One group will receive training as part of the study now. The other 

group will receive the training two years from now. The study team will randomly choose 

the group of navigators that receives the training now using a process like a coin flip. All 

career navigators at your adult education program are in the same group. You will not 

know whether they have received the training. 

We would like to welcome you as a participant in the study. Your participation in this 

study is extremely valuable because it will help ED learn about how career navigators 

may help adult learners succeed in achieving their education and employment goals. As a 

participant in this study: 

• Your adult education program may share information with the study team 

about you and the services you receive from the program. 

• The Study Team may share a file that contains limited personally identifiable 

information (PII) such as your name, date of birth, and/or Social Security 

number with various federal agencies and other data providers. The data 

providers will use the file to provide information to the Study Team about 

your employment, earnings, and education for the duration of the Study. This 

Study Data could include: 

o Information about your job(s) from the National Directory of New 

Hires (NDNH) 

o Information about your education from the National Student 

Clearinghouse (NSC), Federal Student Aid (FSA), and high school 

equivalency test providers (e.g., GED TASC and HiSET) 

Here are some other things to know about the Study: 

• The researchers conducting this study follow the confidentiality and data 

protection requirements of the U.S. Department of Education’s Institute of 

Fiscal Year 2023 Privacy Impact Assessment -Page 15 
 

 

 

 

 

 

 

Education Sciences (The Education Sciences Reform Act of 2002, Title I, Part 

E, Section 183). 

• The study is authorized under Section 242 of Title II of the Workforce 

Innovation and Opportunity Act of 2014 and Section 173 of the Education 

Sciences Reform Act of 2002. The collection of social security numbers is 

authorized under Executive Order 9397, as amended by Executive Order 

13478 (November 18, 2008). 

• The study will use your data for research purposes only. 

• Study reports will summarize all learners’ findings and will not identify you. 

None of the reports prepared for this study will include information that 

identifies you. 

Although there are always some risks when personal information is collected, the Study 

Team has put many safeguards in place to securely store this data and maintain the 

confidentiality and privacy of the personal information being collected. 

There are also no direct benefits. 

OPTING OUT. As a current enrollee in [PROGRAM NAME] who received this form, 

you presently are a participant in the Study. Participation in the Study, however, is 

voluntary. If you do not wish to participate in the Study you may “opt out” of the Study 

at any time by contacting the Study Team via email to adultedstudy@mathematicampr.com or by toll-free phone call to (XXX) XXX-XXXX. For more information about 

the Study or answers to any questions, you also may contact the Study Team at 

adultedstudy@mathematica-mpr.com. 

Thank you in advance for your assistance with this important research. 

For career navigators, the opt-in form will include the following text: 

The U.S. Department of Education is sponsoring a study of career navigation training 

called Connecting Adults to Success: Evaluation of Career Navigator Training. The study 

is authorized under Section 242 of Title II of the Workforce Innovation and Opportunity 

Act of 2014 and Section 173 of the Education Sciences Reform Act of 2002. 

Mathematica is conducting this study for the Department in partnership with Manhattan 

Strategy Group and Social Policy Research. As a reminder, [ADULT EDUCATION 

PROVIDER SITE] agreed to participate in this study. 

The purpose of the study is to understand the effects of training for career navigators on 

learners’ education and employment outcomes. 

• Career navigators may also be referred to as career coaches, career advisors, 

career consultants, career counselors, college navigators, transition coordinators, 

or case managers, among others. 

Fiscal Year 2023 Privacy Impact Assessment -Page 16 
 

 

 

 

 

 

 

• Learners may also be referred to as students, clients, or customers. 

The study will compare learners enrolled in adult education services in two different 

groups of providers, one where career navigators receive training in the fall of 2022, and 

one where career navigators receive training two years later. Your provider was assigned 

to a group based on a random process, like a coin flip. All career navigators at your site 

are in the same group. 

Today, you are being asked to take a short survey about your background and training as 

well as your experience as a career navigator. Your participation in this survey is 

important and will help us learn about the different experiences of career navigators. This 

survey will take about 30 minutes to complete, depending on your responses. 

Participation in the survey is completely voluntary and you may choose to skip any 

question you prefer not to answer. There are no consequences if you decide not to answer 

If you are unsure of how to answer a question, please give the best answer you can rather 

than leaving it blank. 

As part of the study, you will also be asked to complete short, 3-minute, logs after each 

meeting with learners enrolled in the study. You will receive a training on the process at a 

later date. 

The researchers conducting this study follow the confidentiality and data protection 

requirements of the U.S. Department of Education’s IES (The Education Sciences 

Reform Act of 2022, Title I, Part E, Section 183). All your responses will be kept private 

and used only for research purposes, and will not be disclosed outside of IES. Your 

responses will be combined with the responses of other respondents and no individual 

names will be reported. While there are no direct benefits to participants, your 

participation will help us learn about career navigators and how career navigation training 

relates to student outcomes. 

 By clicking this box, you are confirming that you understand that the information 

you provide will be kept private and used only for research purposes. You further 

understand that your answers will be combined with the responses of other 

navigators so that no individuals will be identified. 

4.4. What opportunities are available for individuals to consent to uses of their PII, decline to 

provide PII, or opt out of the project? If these options are not available, state why not. 

Participation in the study’s data collection is voluntary. Learners can decline to 

participate in the study, decline to take the study’s background survey, or to provide 

particular pieces of information requested in the survey. Career navigators can also 

decline to take the study’s surveys or provide particular pieces of information requested 

on the surveys. More generally, participation in the study itself by adult education sites, 

Fiscal Year 2023 Privacy Impact Assessment -Page 17 
 

 

 

 

 

 

career navigators and learners is voluntary; and these participants are allowed to drop out 

of the study after it has begun. 

4.5. Is the notice referenced in Question 4.1 reviewed and revised when there are changes in 

the practices, policies, or activities that affect the PII and the privacy risks to ensure that 

individuals are aware of and, where feasible, can consent to, these changes? 

Yes 

5. Information Sharing and Disclosures 

Internal 

5.1. Is PII maintained in the IT system shared internally with any other Department IT 

system(s) and/or principal offices? If the answer is NO, skip to Question 5.4. 

Yes 

5.2. Which categories of PII from Question 3.1 are shared and with which Department IT 

system(s) and/or principal offices? 

N/A

Learners’ names, dates of birth, and SSNs will be shared with FSA. 

5.3. What is the purpose for sharing the specified PII with each Department IT system(s) 

and/or principal office specified in Question 5.2? 

N/A

This is for the purpose of matching with FSA’s Central Processing System and National 

Student Loan Data System to obtain information on learners’ college enrollment. Because 

the National Student Clearinghouse does not provide comprehensive coverage of all 

postsecondary institutions in the country, supplementing data with that of FSA provides 

more accurate estimates of college enrollment than relying on the National Student 

Clearinghouse alone. 

External 

5.4. Is PII maintained in the IT system shared with any external entities (e.g., another agency, 

grantee, school district, the public)? If the answer is NO, skip to Question 6.1. 

Fiscal Year 2023 Privacy Impact Assessment -Page 18 
 

 

 

 

 

 

Yes 

5.5. Which categories of PII from Question 3.1 are shared and with whom? 

N/A

Learners’ names, dates of birth, and SSNs will be disclosed to the National Student 

Clearinghouse, vendors of tests for high school equivalency credentials, and the U.S. 

Department of Health and Human Services (which houses the National Directory for 

New Hires). These disclosures are for the purpose of obtaining data on learners’ high 

school equivalency credential attainment, postsecondary enrollment, employment status, 

and earnings. 

As required by the Education Sciences Reform Act of 2002 (ESRA) (20 U.S.C. 9561(b) 

and 9563), a restricted use data file with study-created identifiers will be available to 

researchers who are approved license holders and are in compliance with NCES’ data 

security procedures. The data file will exclude direct identifiers, such as participant 

name, date of birth, and SSN, but will include other individual-level data collected for 

the study. 

5.6. What is the purpose for sharing the PII with each external entity specified in Question 

5.5? 

N/A

The names, dates of birth, and SSNs of study participants will be shared with the 

National Student Clearinghouse, high school equivalency testing vendors, and the U.S. 

Department of Health and Human Services in order to match with the administrative 

records of these entities. This will allow the study to obtain data on learners’ education 

and employment outcomes and thus to estimate the impacts of the career navigator 

training on these outcomes. 

The restricted use data file will be for the purpose of allowing licensed researchers to 

replicate the study’s findings and conduct further analyses of the study’s data. 

5.7. What are the specific authorities that authorize sharing the PII with the external entities 

specified in Question 5.5? 

N/A

Fiscal Year 2023 Privacy Impact Assessment -Page 19 
 

 

 

 

 

 

 

This study and sharing of data is authorized under Section 242 of Title II of the 

Workforce Innovation and Opportunity Act of 2014. It is also authorized under Section 

173 of the Education Sciences Reform Act of 2002. 

5.8. Does the IT system maintain an accounting of any disclosures made to an external 

entity? 

N/A

Yes 

5.8.1. If so, is the accounting of disclosures made to external entities available in 

response to a Privacy Act request? 

Yes 

5.9. How is the PII shared with the external entity (e.g., encrypted email, transport layer 

security (TLS) line)? Specify whether the PII is encrypted in transit and state the 

encryption method that is used. 

N/A

Learners’ names, dates of birth, and SSNs will be transmitted electronically from the 

contractor to the external entity using a secure file transfer protocol. 

The restricted use data file will be provided to licensed researchers on encrypted, 

password-protected CD. 

5.10 Is the sharing conducted pursuant to a Computer Matching Agreement (CMA), 

Memorandum of Understanding (MOU), or other type of approved sharing agreement with 

the external entities? 

N/A

Yes 

5.11 Does the project allow for the PII to be redisclosed by the external entities or require the 

external entities to request permission prior to its redisclosure? If so, describe the limitations 

on redisclosure and how they are documented and enforced. 

N/A

No 

Fiscal Year 2023 Privacy Impact Assessment -Page 20 
 

 

 

 

 

 

 

6. Redress 

6.1. What are the procedures that allow individuals to access their own information in the IT 

system? If there are no such procedures, state why not. 

If an individual wishes to gain access to a record in this system, they can contact the 

system manager at the address listed in the SORN. The request must provide necessary 

particulars of their full name, address, telephone number, and any other identifying 

information requested by the Department, to distinguish between individuals with the 

same name. The request must meet the requirements of regulations at 34 CFR 5b.5. 

In addition, study participants may call or send an email to the contact provided on the 

opt-out and informed consent forms. The participants may also send an email to: 

IES_SORN@ed.gov. 

6.2. What procedures are in place to allow individuals to correct or amend inaccurate or 

erroneous information? 

If an individual wishes to contest the content of a record regarding themselves, they can 

contact the system manager at the address listed in the SORN. Requests must contain 

their full name, address, and telephone number. The request must meet the requirements 

of the regulations at 34 CFR 5b.7. 

In addition, study participants may call or send an email to the contact provided on the 

opt-out and informed consent forms. The participants may also send an email to: 

IES_SORN@ed.gov. 

6.3. How does the program or IT system notify individuals about the procedures for 

accessing or correcting their information? 

The procedures for accessing and amending record(s) for external users are outlined in 

the SORN entitled “Connecting Adults to Success: Evaluation of Career Navigator 

Training” (18-13-46). 

7. Safeguards 

If you are unsure which safeguards will apply, please consult with your ISSO. 

7.1. Does the principal office work with their ISSO to build privacy and security safeguards 

into the IT system? 

Yes 

Fiscal Year 2023 Privacy Impact Assessment -Page 21 
 

 

 

 

 

 

 

7.2. Is an authorization to operate (ATO) required for the IT system? 

No 

CATS will be covered under the IES Data Center (IESDC) ATO. Contractor systems 

will be used for the original data collection phase of this work. Once collected, those 

data will be transferred to the IES Analysis Server, housed on IESDC. Administrative 

data linkage, data analysis, reporting, and long-term data storage will all occur within 

IESDC. 

7.2.1. If the answer to Question 7.2 is YES, does the IT system have an active ATO? 

IESDC has an active ATO. 

Yes 

7.3. What is the NIST Federal Information Processing Standard 199 security categorization 

of this IT system? 

☐Low 

☒Moderate 

☐High 

7.4. What administrative, technical, and physical safeguards are in place to protect the 

information? 

Security protocols for this system of records meet all required security standards. Data 

are collected and stored in compliance with Federal standards for the use, protection, 

processing, and storage of data consistent with the Education Sciences Reform Act of 

2002. Access to individually identifying data will be strictly controlled. The contractor is 

required to ensure that electronic files identifying individuals are separated from other 

electronic research data files. The contractor and IES will maintain security of the 

complete set of all master data files and documentation. 

Contractor staff at Mathematica Policy Research will upload study data collected 

through RAPTER and Confirmit through secure transfer to the IESDC, where all data 

analysis will take place. 

Only the contractor’s employees who have a demonstrated need to access the protected 

data will be given access. In order to access such data, each relevant employee must 

receive a “moderate” 5c security clearance. Receiving such clearance includes 

Fiscal Year 2023 Privacy Impact Assessment -Page 22 
 

 

 

 

 

 

 

 

 

 

undergoing a background check, background interview, and credit check. Each 

contractor employee must receive approval from the Project Officer of the contract, who 

is a Department employee, before beginning the clearance process. Each contractor 

employee must describe their specific proposed role on the contract (for example, 

someone who has statistical programming expertise and would be responsible for 

analyzing the data to produce findings), and why that requires access to the protected 

data (and therefore a moderate 5c security clearance). The Project Officer will review 

each request and ensure that the contractor employee’s request is valid for the stated 

purpose. 

All protected data are stored on secure computers with encryption and password 

protection, so that contractor employees cannot gain access to protected data until the 

appropriate security clearance is granted. The contractor’s employees who “maintain” 

(collect, maintain, use, or disseminate) data in this project will comply with the 

requirements of the confidentiality standards in section 183 of the ESRA (20 U.S.C. 

9573). The contractor employees undergo privacy awareness and protecting information 

training. The training includes information on what constitutes PII and Sensitive PII 

(SPII) and how to maintain, protect, and safeguard it, as well as the steps to perform if 

PII/SPII is unlawfully accessed. 

8. Auditing and Accountability 

8.1. How does the ISO assess and ensure that the PII is used in accordance with stated 

practices in this PIA? 

The system owner is in frequent contact with the contractor. An updated list is kept that 

identifies individuals on the contractor's staff with access to the data and the contractor 

must clear with the system owner any addition of data elements or use of data for 

analysis. As part of this regular contact with the contractor, the system owner is also 

apprised of any problems that may be detected based on the specific controls that 

contractors routinely implement, such as self-assessments of security controls and 

performance of periodic vulnerability scans; updating all information system and 

security documentation as changes occur; and other continuous monitoring activities. 

8.2. How does the ISO continuously monitor and audit the security and privacy controls to 

ensure effective implementation and safeguarding of PII? 

IESDC is required to obtain and maintain an ATO. This process includes an independent 

assessment of all required security and privacy controls and produces plans of action and 

milestones (POA&Ms) to ensure any deficiencies are remediated. IEDC also participates 

in the Ongoing Security Authorization (OSA) Program and continuous monitoring 

program. The OSA, which reviews security and privacy controls, is conducted quarterly, 

Fiscal Year 2023 Privacy Impact Assessment -Page 23 
 

 

 

 

 

 

 

 

and the system is scanned continuously to ensure that security and privacy controls are 

in place and working properly. 

8.3. What are the specific privacy risks associated with this program or IT system and how 

are those risks mitigated? 

There are potential privacy risks associated with collecting survey data from adult 

learners and career navigators and obtaining administrative data regarding learners. Data 

breaches involving PII are potentially hazardous to both individuals and organizations. 

Individual harm may include identity theft, embarrassment, or financial loss. 

Organizational harm may include a loss of public trust, legal liability, or remediation 

costs. 

The primary risk is that learners and navigators in the study will be identified, and the 

information collected on them compromised. To mitigate these risks, access to 

information is granted only to authorized individuals based on their respective position 

and need-to-know basis, limiting users to those who are screened, utilizing least 

privilege principles, and encrypting all data in transmission. If there is a suspected or 

known breach/disclosure of PII due to lost, theft, intercepted transfer, or other, the 

contractor will ensure that this breach is reported to the Department as soon as the 

contractor has knowledge of it. Follow-up reports of the final status of loss events will 

also be prepared by the contractor within a reasonable period of time as advised by the 

Department. The risks of disclosure are also mitigated by ensuring that there are proper 

procedures and controls on how the data are collected, handled, stored, and retained. 

These procedures were described in the prior sections and comply with all applicable 

laws and regulations. 

Fiscal Year 2023 Privacy Impact Assessment -Page 24