Privacy Impact Assessment (PIA) 

for the 

Graduate Assistance in Areas of National Need (GAANN) 

January 24, 2022 

For PIA Certification Updates Only: This PIA was reviewed on Enter date by Name of reviewer 

certifying the information contained here is valid and up to date. 

Contact Point 

Contact Person/Title: Name/Title: Rebecca Ell/System Owner 

Contact Email: Rebecca.Ell@ed.gov 

System Owner 

Name/Title: Rebecca Ell/System Owner 

Principal Office: Office of Postsecondary Education (OPE) 

Please submit completed Privacy Impact Assessments to the Privacy Office at 

privacysafeguards@ed.gov 

FY 2020 
Please complete this Privacy Impact Assessment (PIA) on how personally identifiable 

information (PII) is collected, stored, protected, shared, and managed electronically by your 

system. You may wish to consult with your ISSO in completing this document. 

If a question does not apply to your system, please answer with N/A. 

1. Introduction 

1.1. Describe the system including the name, acronym, and a brief description of the program 

or purpose for the system. 

The Graduate Assistance in Areas of National Need (GAANN) program awards 

fellowships through academic institutions of higher education to assist graduate students 

with excellent academic records who demonstrate financial need and plan to pursue the 

highest degree available in their course of study at the institution in a field designated as 

an area of national need. 

GAANN is a web-based data management application that supports the collection and 

processing of performance data required by the U.S. Department of Education 

(Department) Office of Postsecondary Education (OPE). Information collected from 

grantee institutions includes fellows’ individual student records. Each funded institution 

is responsible for identifying and selecting participants in the program. 

The Annual Performance Report (APR) and the Final Performance Report (FPR) are 

generated from GAANN’s data and analysis for reporting purposes. The APR is 

completed at the end of each funded year to determine successful performance of the 

institution. The FPR is conducted at the end of the grant, allowing the institution to show 

overall performance during the entire grant funding period. Institutions are provided 

detailed instructions on the process for accessing and completing both reports. Once the 

Project Director is ready to submit the report, they must include the following: grant 

number (PR Number) and the Project Director’s name and email address to register for 

an account. Once registered, they will be able to proceed with the data collection. 

The GAANN APR and FPR collect data (listed below) needed to report to the 

Department’s budget services to show progress by cohort for that period. A cohort is the

group of institutions approved for GAANN funding during the current award cycle. The 

information collected is tied directly to certain Government Performance and Results 

Act (GPRA) measures. The following measures will be used by the Department in 

assessing the performance of the GAANN program and for Department reporting: 

• Graduate school completion: the percentage of GAANN fellows completing the 

terminal degree in the designated areas of national need. 

Fiscal Year 2020 Privacy Impact Assessment -Page 1 
 

 

 

 

 

• Time to completion: the median time to completion of master’s and doctoral 

degrees for GAANN students. 

• Employment: the percentage of GAANN fellows who have placements in faculty 

or professional positions in the area of their studies within one year of 

completing the degree. 

1.2. Describe the purpose for which the personally identifiable information (PII)1 is collected, 

used, maintained or shared. 

This system captures long- and short-term performance data that monitor the funds 

allocated to recipient institutions and track the time-to-degree completion and graduation 

rates of GAANN fellows. System data include individual student data, financial data, 

graduation rate data, and employment data of all GAANN fellows. 

This system contains records on individuals who apply for fellowships and receive 

admission to a GAANN project. This system contains information including the 

individual’s name, gender, ethnicity, field of study, source of student’s GAANN 

Fellowship (Federal or institutional matching), amount of stipend per year of student’s 

GAANN Fellowship, amount of institutional contribution to tuition per year of student’s 

GAANN Fellowship, amount of support the student received after the GAANN 

Fellowship (optional), year and term the student entered institution’s graduate program, 

current education status, current employment status, cost of attendance, tuition and fees 

(if included in financial need), and expected family contribution. The system also 

collects Project Director information such as name, department, email, phone, and 

address information. 

1.3. Is this a new system, or one that is currently in operation? 

Currently Operating System 

1.4. Is this PIA new, or is it updating a previous version? 

Updated PIA 

This PIA is being updated as part of the regular biennial review process. 

1.5. Is the system operated by the agency or by a contractor? 

1 The term “personally identifiable information” refers to information which can be used to distinguish or trace an

individual's identity, such as their name, social security number, biometric records, etc. alone, or when combined 

with other personal or identifying information which is linked or linkable to a specific individual, such as date and 

place of birth, mother's maiden name, etc. OMB Circular A-130, page 33 

Fiscal Year 2020 Privacy Impact Assessment -Page 2 
 

 

 

Contractor 

1.5.1. If the system is operated by a contractor, does the contract or other acquisitionrelated documents include privacy requirements? 

N/A

Yes 

2. Legal Authorities and Other Requirements 

If you are unsure of your legal authority, please contact your program attorney. 

2.1. What specific legal authorities and/or agreements permit and regulate the collection and 

use of data by the system? Please include name and citation of the authority. 

The information is collected under the authority of Title VII, Part A, Subpart 2, Section 

711 of the Higher Education Act of 1965, as amended; the program regulations in 34 

CFR 648; and the Education Department General Administrative Regulations (EDGAR) 

in 34 CFR 74.51. Further, the performance report form lends itself to the collection of 

quantifiable data needed to respond to the requirements of the GPRA. Grantees are 

required to provide the data requested in order to obtain or retain grant funding 

according to 20 U.S.C. 1135, 34 CFR Section 648.66. 

SORN 

2.2. Is the information in this system retrieved by an individual’s name or personal identifier 

such as a Social Security Number or other identification? 

No 

2.2.1. If the above answer is YES, this system will need to be covered by Privacy Act 

System of Records Notice(s) (SORN(s)).2 Please provide the SORN name, number, 

Federal Register citation and link, or indicate that a SORN is in progress. 

N/A

Click here to enter text. 

2.2.2. If the above answer is NO, explain why a SORN was not necessary. For 

example, the information is not retrieved by an identifier, the information is not 

2 A System of Records Notice (SORN) is a formal notice to the public that identifies the purpose for which PII is 

collected, from whom and what type of PII is collected, how the PII is shared externally (routine uses), and how to 

access and correct any PII maintained by ED. https://connected.ed.gov/om/Documents/SORN-Process.pdf 

Fiscal Year 2020 Privacy Impact Assessment -Page 3 
 

maintained in a system of records, or the information is not maintained by the 

Department, etc. 

N/A

Information is retrieved by the grant’s PR Number, which is a unique identifier 

assigned to every grant. The identifier contains a code that identifies the program 

under which the grant was awarded along with a number that tracks back to the 

original grant application. The PR Number does not directly identify the institution 

or any individuals associated with the institution. 

Records Management 

If you do not know your records schedule, please consult with your records liaison or send 

an email to RMHelp@ed.gov 

2.3. What is the records retention schedule approved by National Archives and Records 

Administration (NARA) for the records contained in this system? Please provide all 

relevant NARA schedule numbers and disposition instructions. 

The records disposition schedule is ED 254 (NARA Disposition Authority: N1-441-11-

001): Grant Administration and Management Files. Disposition: Records on successful 

applications are destroyed five years after the final payment from the Department to the 

institution or after completion of audit-related activities or litigation, whichever is later. 

The schedule can be located here: https://www.archives.gov/files/recordsmgmt/rcs/schedules/departments/department-of-education/rg-0441/n1-441-11-

001_sf115.pdf 

2.4. Is the PII contained in this system disposed of appropriately, and in accordance with the 

timelines in the records disposition schedule? 

Yes 

3. Characterization and Use of Information 

Collection 

3.1. List the specific PII elements (e.g., name, email, address, phone number, date of birth, 

Social Security, etc.) that the system collects, uses, disseminates, or maintains. 

The system contains the following GAANN fellow information, provided by the 

institution: 

Fiscal Year 2020 Privacy Impact Assessment -Page 4 
• Name 

• Gender 

• Ethnicity 

• Race 

• Institution 

• Department 

• Field of study 

Information related to GAANN Fellowship: 

• Amount of stipend per year of student’s GAANN Fellowship 

• Amount of institutional contribution to tuition per year of student’s GAANN 

Fellowship 

• Amount of support the student received after the GAANN Fellowship (optional) 

• Year and term the student entered institution’s graduate program

• Current education status 

• Current employment status 

• Cost of attendance 

• Tuition and fees (if they were included in determination) 

• Estimated family contribution 

GAANN also collects Project Director information such as name, department, email 

address, phone number, and address. 

3.2. Does the system collect only the minimum amount required to achieve the purpose 

stated in Question 1.2? 

Yes 

GAANN collects only the minimum information necessary. Contact information, such as 

the individual’s name, email address, and phone number, is used to communicate with 

the grantees. Information such as gender, ethnicity, race, and field of study is collected 

because GPRA has specific requirements for applicants in fellowship programs such as 

GAANN. 

3.3. What are the sources of PII collected (e.g., individual, school, another agency, 

commercial sources, etc.)? 

GAANN collects student information directly from a participant’s education institution. 

The information is provided by Project Directors, not students. 

Fiscal Year 2020 Privacy Impact Assessment -Page 5 
 

 

 

 

3.4. How is the PII collected from the stated sources listed in Question 3.3 (e.g., paper form, 

web page, database, etc.)? 

The information is collected online via a Department website. Information contained in 

this system is obtained from the institutions that the fellows attend. Grantees enter 

annual and final performance report information in the GAANN system. Information is 

provided to the program officer by the Project Director at the educational institution and 

not by the students. 

3.5. How is the PII validated or confirmed to ensure the integrity of the information 

collected?3 Is there a frequency at which there are continuous checks to ensure the PII 

remains valid and accurate? 

The Project Director and certifying official of each institution must certify the accuracy 

and completeness of all information in the report. Information is collected by the 

institution and is gathered either from institution senior leadership or the institution 

financial aid office. 

Use 

3.6. Describe how the PII is used to achieve the purpose stated in Question 1.2 above. 

The Department uses APR and FPR data to: (1) evaluate program accomplishments, (2) 

demonstrate program effectiveness, and (3) aid in compliance monitoring. Collecting 

performance report data on an annual basis provides the Department with the ability to 

assess each grantee’s progress in meeting the program’s goals and objectives and to 

determine compliance with the statute and program regulations. APR and FPR data have 

also been instrumental in determining whether grantees are entitled to continuation of 

funding by analyzing financial data submitted by grantees. 

3.7. Is the system using PII for testing/researching new applications or information systems 

prior to deployment or for training employees? 

No 

3.7.1. If the above answer is YES, what controls are in place to minimize the risk and 

protect the data? 

N/A

3 Examples include restricted form filling, account verification, editing and validating information as it’s collected,

and communication with the individual whose information it is. 

Fiscal Year 2020 Privacy Impact Assessment -Page 6 
Click here to enter text. 

Social Security Numbers 

It is the Department’s Policy that, in order to collect Social Security Numbers, the System Owner 

must state the collection is: 1) authorized by law, 2) necessary for an agency purpose, and 3) 

there is no reasonable alternative. 

3.8. Does the system collect Social Security Numbers? Note that if the system maintains 

Social Security Numbers but does not explicitly collect them, answer 3.8.1 to address the 

purpose for maintaining them. 

No 

3.8.1. If the above answer is YES, explain the purpose for its collection, and how the 

SSN will be used. 

N/A

Click here to enter text. 

3.8.2. Specify any alternatives considered in the collection of SSNs and why the 

alternatives were not selected. 

N/A

Click here to enter text. 

4. Notice 

4.1. How does the system provide individuals with notice about the collection of PII prior to 

its collection (e.g., direct notice, such as a Privacy Act Statement (if applicable) or 

public notice, such as a SORN, PIA,)? If notice is not provided, explain why not. 

The GAANN website does not currently have a link to a privacy notice, but one will be 

added as a link from the home page. The privacy notice is located in section 4.2. 

4.2. Provide the text of the notice or the link to the webpage where the notice is posted if 

notice is provided other than by SORN or PIA. 

N/A Fiscal Year 2020 Privacy Impact Assessment -Page 7 
Authorities: Collection of this information is required under the Education Department 

General Administrative Regulations (EDGAR) volume 75.590, 75.720, and 75.730-732 

and under 2 CFR 200.328 (Monitoring and reporting program performance). 

Purpose - The primary purpose of the information collected is for use in the performance 

monitoring of the Department of Education’s (the Department's) GAANN program. 

Information Collected: 

• GAANN Fellow: Name, Gender, Ethnicity, Race, Institution, Race, Department, 

Field of Study. 

• Information related to GAANN Fellowship: Amount of stipend per year of 

student’s GAANN Fellowship, amount of institutional contribution to tuition per 

year of student’s GAANN Fellowship, amount of support the student received 

after the GAANN Fellowship (optional), year and term the student entered 

institution’s graduate program, current education status, current employment 

status, cost of attendance, tuition and fees (if they were included in 

determination), estimated family contribution. 

• Information about the Project Director: name, department, email address, 

phone number and address. 

Purpose: This system captures long and short-term performance data that monitor the 

funds allocated to recipient institutions, tracks the time-to-degree completion, and 

graduation rates of GAANN fellows. 

Disclosures: The information will not be disclosed outside of the Office of 

Postsecondary Education. 

Consequences of Failure to Provide information: Further funding or other benefits 

may be withheld under this program unless all required reports are completed and filed 

as mandated under the U.S. Code of Federal Regulations. 

Additional information about this system can be found in the Privacy Impact 

Assessment. 

4.3. What opportunities are available for individuals to consent to uses (including new uses 

of previously collected PII), decline to provide PII, or opt out of the project? 

Project Directors submit information to GAANN voluntarily and may decline to report 

data. However, this may result in termination of funding for the institution if relevant 

information is not reported. 

Fiscal Year 2020 Privacy Impact Assessment -Page 8 
 

 

 

4.4. Is the notice referenced in Question 4.1 reviewed and revised when there are changes in 

the practice, policy, or activities that affect the PII and privacy to ensure that individuals 

are aware of and can consent to, where feasible, these changes? 

Yes 

5. Information Sharing and Disclosures 

Internal 

5.1. Will PII be shared internally with other ED principal offices? If the answer is NO, please 

skip to Question 5.4. 

No 

5.2. What PII will be shared and with whom? 

N/A

Click here to enter text. 

5.3. What is the purpose for sharing the specified PII with the specified internal 

organizations? 

N/A

Click here to enter text. 

External 

5.4. Will the PII contained in the system be shared with external entities (e.g. another agency, 

school district, the public, etc.)? If the answer is NO, please skip to Question 6.1. 

No 

5.5. What PII will be shared and with whom? List programmatic disclosures only.

4 

Note: If you are sharing Social Security Numbers externally, please specify to 

whom and for what purpose. 

N/A

Click here to enter text. 

4 If this information is covered by Privacy Act System of Records Notice (SORN) please list only relevant 

programmatic disclosures listed under the Routine Uses section. 

Fiscal Year 2020 Privacy Impact Assessment -Page 9 
5.6. What is the purpose for sharing the PII with the specified external entities? 

N/A

Click here to enter text. 

5.7. Is the sharing with the external entities authorized? 

N/A

Click here to select. 

5.8. Is the system able to provide and retain an account of any disclosures made and make it 

available upon request? 

N/A

Click here to select. 

5.9. How is the PII shared with the external entity (e.g., email, computer match, encrypted 

line, etc.)? 

N/A

Click here to enter text. 

5.10. Is the sharing pursuant to a Computer Matching Agreement (CMA), 

Memorandum of Understanding (MOU), or other type of approved sharing agreement 

with another agency? 

N/A

Click here to select. 

5.11. Does the project place limitation on re-disclosure? 

N/A

Click here to select. 

6. Redress 

6.1. What are the procedures that allow individuals to access their own information? 

Grantees (institutions) can log into the GAANN system and access their accounts. 

GAANN fellows wishing to access their own information must contact their institution. 

Only institutions (the grant’s Project Director) update information in the GAANN 

system. 

6.2. What procedures are in place to allow the subject individual to correct inaccurate or 

erroneous information? 

Fiscal Year 2020 Privacy Impact Assessment -Page 10 
 

Prior to submission, grantees may make as many edits to their reports as they like. Once 

a report is submitted, it is locked to prevent further editing. To make changes after 

submission, grantees must contact their Department Program Officer or the Help Desk 

and request that their report be unsubmitted. GAANN fellows can make a formal request 

to correct information via the educational institution. 

6.3. How does the project notify individuals about the procedures for correcting their 

information? 

Grantees are notified how to correct information via an online User Guide and onscreen 

guidance during the report submission process. 

7. Safeguards 

If you are unsure which safeguards will apply, please consult with your ISSO. 

7.1. Does the principal office work with their CSO/ISSO to build privacy & security into the 

system and build privacy extensions to the extent feasible? 

Yes 

7.2. Is an Authority to Operate (ATO) required? 

Yes 

7.3. Under NIST FIPS Pub. 199, what is the security categorization of the system: Low, 

Moderate, or High? 

N/A

Moderate 

7.4. What administrative, technical, and physical safeguards are in place to protect the 

information? 

GAANN is maintained on secure computer servers located in one or more secure 

contractor network server facilities. Access to GAANN is limited to authorized 

contractors and Department employees. In accordance with the Federal Information 

Security Modernization Act of 2014 (FISMA) and Office of Management and Budget 

(OMB) policy, GAANN must receive a signed Authorization to Operate (ATO) from a 

designated Department authorizing official. Security and privacy controls implemented 

Fiscal Year 2020 Privacy Impact Assessment -Page 11 
by GAANN are comprised of a combination of administrative, physical, and technical 

controls. 

All users accessing the system are given unique user identification. The Department 

requires the enforcement of a complex password policy and two-factor authentication. In 

addition to the enforcement of the two-factor authentication and complex password 

policy, users are required to change their password at least every 90 days in accordance 

with the Department’s information technology standards. Physical security of electronic

data is maintained in a secured data center, access to which is controlled by multiple 

access controls. Cryptographic solutions are in place to prevent unauthorized disclosure 

of information and to protect the integrity of data at rest and in transmission. 

7.5. Is the information in the system appropriately secured in accordance with the IT 

security requirements and procedures as required by Federal law and policy? 

Yes 

7.6. Has a risk assessment been conducted where appropriate security controls to protect 

against that risk have been identified and implemented? 

Yes 

7.7. Please describe any monitoring, testing or evaluation conducted on a regular basis to 

ensure the security controls continue to work properly at safeguarding the PII. 

The following tasks are performed to safeguard GAANN information: 

• Monthly vulnerability scans performed 

• Annual contingency plan test performed 

• Annual self-assessments conducted; and/or annual security 

assessments performed by the Department Security 

AuthorizationTeam 

• Annual updates to system security documents 

• Annual mandatory Cybersecurity and Privacy Training for 

employeesand contractors 

• Monthly Continuous Monitoring is in place with vulnerability 

scans (RA-05), hardware/software inventories (CM-08), and 

configuration management database updates (CM-06) are posted to 

CSAM. 

Fiscal Year 2020 Privacy Impact Assessment -Page 12 
 

System and data hosting are provided by Amazon Web Services (AWS) as a 

Federal Risk and Authorization Management Program (FedRAMP)-certified 

cloud. 

8. Auditing and Accountability 

8.1. How does the system owner assess and ensure that the PII is used in accordance with 

stated practices in this PIA? 

The system owner works with the Department’s Privacy Office to complete a PIA and to 

ensure the PIA is accurate and updated as required. The system owner also completes the 

Department Risk Management Framework process to secure an ATO. The system owner 

works with contractors to ensure the system is being used appropriately and in 

accordance with the practices detailed in this document. 

8.2. Does the system owner continuously monitor and audit the privacy controls to ensure 

effective implementation? 

Yes 

8.3. What are the privacy risks associated with this system and how are those risks 

mitigated? 

Privacy risks associated with GAANN include unencrypted data being transmitted, lost, 

stolen, or compromised. Data breaches involving PII are potentially hazardous to both 

individuals and organizations. Individual harm may include identity theft, 

embarrassment, or financial loss. Organizational harm may include a loss of public trust, 

legal liability, or remediation costs. 

The risks are mitigated by the above-mentioned safeguards, limiting access to only those 

with a legitimate need to know, and working closely with the security and privacy staff at 

the Department. To further mitigate this risk, the following safeguards have been 

implemented: 

• Monthly vulnerability scans 

• Annual contingency plan test 

• Annual or ongoing security assessments 

Risks are also mitigated by updating security patches per the patch scheduling and 

updating devices operating software, amongst other software. System patching is 

performed monthly, and scans are run on the production environment each month in 

Fiscal Year 2020 Privacy Impact Assessment -Page 13 
support of the monthly patching cycle. Collecting the minimum PII necessary to achieve 

the system’s purpose also mitigates privacy risks. 

Fiscal Year 2020 Privacy Impact Assessment -Page 14