RECOVERY POLICY 

9420.1

Page 1 

I. TITLE: Secure Data Sharing

II. DATE OF ISSUANCE: September 9, 2013 

III. POLICY STATEMENT: The Federal Emergency Management Agency (FEMA) will share 

FEMA-collected disaster assistance data (FEMA Recovery Data) with Trusted Partners in a 

secure and expedient manner. Sharing seeks to: (1) enhance partners’ abilities to make wellinformed and rapid decisions based upon sound data, and (2) enable the delivery of 

additional, non-federal assistance to disaster survivors. FEMA Recovery Data may include 

Personally Identifiable Information (PII) and Sensitive PII (SPII). As such, it will only be 

shared as authorized by the Privacy Act 1 and FEMA’s relevant public notice.2

To maximize security and expedience, FEMA bases requirements and processes for sharing 

data on the recipient of the data. This policy authorizes the release of FEMA Recovery Data 

to Trusted Partners as listed in FEMA’s public notice. FEMA’s National Processing Service 

Center, as coordinated by FEMA’s Joint Field Offices (JFOs) and Regional Offices, will share 

data with these Trusted Partners in accordance with this policy.

IV. PURPOSE: The purpose of this policy is to ensure secure and expedient sharing of FEMA 

Recovery Data. This policy provides guidelines under which FEMA will share data with

Trusted Partners. 

V. SCOPE: This policy applies to requests for FEMA Recovery Data stemming from a 

presidentially declared disaster or emergency. It focuses on sharing of FEMA Recovery Data 

in accordance with the Routine Use3 and research provisions of the Privacy Act. FEMA

employees, contractors, and other personnel involved in the administration of recovery 

programs will use this policy to guide sharing of FEMA Recovery Data.

4

This policy does not apply to data sharing when individuals specifically authorize FEMA to 

release their information to a specific entity or individual.5 This policy does not apply to 

sharing data with state or tribal governments where the state or tribe access FEMA systems 

 

1 Privacy Act of 1974, 5 U.S.C. § 552a.

2 FEMA Disaster Recovery Assistance Files System of Records Notice, 78 Fed. Reg. 25,282 (Apr. 30, 2013). 

3 5 U.S.C. § 552a(b)(3). This policy applies to sharing under routine uses (H), (J), and, in certain instances, (F) of 

FEMA’s Disaster Recovery Assistance Files System of Records Notice, 78 Fed. Reg. 25,282 (Apr. 30, 2013). Until 

amended, this policy applies to future System of Records Notices related to FEMA’s disaster recovery assistance files.

4 5 U.S.C. at § 552a(b)(5).

5 Independent of the process described in this policy, individuals and entities may also obtain data pertaining to 

specific survivors who provide written consent to disclose their data to third parties. Id. at § 552a(b). Any written 

consent must satisfy DHS regulatory requirements. See 6 C.F.R. § 5.21(d) and (f).
FEMA Recovery Policy 9420.1 

Page 2 

to administer programs on FEMA’s behalf.6 This policy does not apply to sharing data with

law enforcement entities for law enforcement purposes.7

VI. AUTHORITY: 

• The Robert T. Stafford Disaster Relief and Emergency Assistance Act (Stafford Act), as 

amended, 42 U.S.C. §§ 5121 et. seq.; 

• The Privacy Act of 1974 (Privacy Act), as amended, 5 U.S.C. § 552a; 

• DHS Privacy Act Regulations, 6 C.F.R. pt. 5.20 – 5.36. (2012); 

• Federal Disaster Assistance Regulations, 44 C.F.R. pt. 206.110(j) (2012); 

• FEMA’s Disaster Recovery Assistance System of Records Notice (DRA SORN), 78 Fed. Reg. 

25,282 (Apr. 30, 2013); 

• DHS Directive 0470.2, Privacy Act Compliance (Oct. 2005); 

• DHS Directive 4500.1, DHS E-mail Usage (Jan. 2003); 

• DHS Directive 11042.1, Safeguarding Sensitive but Unclassified Information (Jan. 2005); 

• FEMA Directive 109-2, Privacy Program (May 16, 2013);

• FEMA Directive 140-1, Information Technology Security Policy (Jan. 2012); 

• FEMA Directive 262-2, Email Policy and Guidance (Nov. 2010);

• FEMA Manual 5400.2, Records Management Files Maintenance and Records Disposition 

(Feb. 29, 2000); and

• DHS Privacy Incident Handling Guidance (Jan. 26, 2012). 

VII. DEFINITIONS AND ABBREVIATIONS: 

• Computer Matching Agreement: Covenant between FEMA and another federal or nonfederal agency that provides the terms and conditions of any computerized comparison of 

two or more automated Systems of Records, or a System of Records with non-federal 

records. The Privacy Act requires these agreements when computerized comparison occurs

for the purpose of establishing or verifying eligibility or compliance related to cash or inkind assistance or payments under federal benefit programs.8 

• Disaster Assistance Survivor/Registrants: Individuals who as a result of a presidentially 

declared disaster or emergency,9 apply for or express an interest in receiving assistance from 

FEMA’s various Stafford Act programs. This term is synonymous with “applicant,” 

“recipient,” “registrant,” and other terms that are used in related FEMA authorities. 

 

6 In certain instances a state or tribe may receive FEMA Recovery Data in order to administer the Other Needs 

Assistance (ONA) program. The processes set out in Appendix B part III.A apply for this access. The state or tribe 

should contact the head of the Individual Assistance Division at the Joint Field Office or FEMA Region in which it the 

state or tribe is located to discuss entering into an agreement to share data for the administration of this program.

7 For questions about sharing data for these purposes, please contact FEMA’s Office of Chief Counsel (OCC).

8 See 5 U.S.C. § 552a(o).

9 For definitions of major disasters and emergencies, see FEMA’s Declaration Process Regulations, 44 C.F.R. pt. 

206.31-48 (2012).
FEMA Recovery Policy 9420.1 

Page 3 

10 78 Fed. Reg. 25,282 (Apr. 30, 2013). FEMA's Disaster Assistance Improvement Program (DAIP), National 

Emergency Management Information System-Individual Assistance (NEMIS-IA), and Enterprise Data 

Warehouse/Operational Data Store (EDW/ODS) information technology systems maintain FEMA Recovery Data. 

FEMA may have other relevant data for Trusted Partners from other systems such as Hazard Mitigation and Public 

Assistance Grants. That information is covered by different published notices. Partners may direct questions 

regarding sharing of data from those programs to the respective programs and FEMA’s Office of Chief Counsel. 

11 See 44 C.F.R. § 206.44. 

12 See 5 U.S.C. § 552a(a)(7). 

• FEMA Recovery Data: For the purposes of this policy, this includes PII, SPII and other 

information associated with Disaster Recovery Assistance Survivor/Registrants that is 

maintained in FEMA’s System of Records and covered by FEMA’s relevant public notice.10

• FEMA-State (or FEMA-Tribe) Agreement: Covenant between FEMA and a state or tribe 

that provides the understandings, commitments, and conditions for FEMA assistance. It 

imposes legally binding obligations on FEMA, states and tribes, their local governments, 

and private nonprofit organizations within the state or tribal area in the form of conditions 

for assistance. An agreement is a prerequisite to all forms of supplemental federal assistance 

unless the Regional Administrator finds it necessary to begin the process of providing 

essential emergency services or housing assistance before an agreement is in place.11 

• Information Sharing Access Agreement (ISAA): Covenant between FEMA and non-FEMA 

parties that provides the terms and conditions of any information sharing. FEMA uses 

ISAAs to facilitate and memorialize the exchange and receipt of FEMA Recovery Data. 

• Personally Identifiable Information (PII): Information that permits the identity of an 

individual to be directly or indirectly inferred, including information linked or linkable to 

that individual. Examples include: name, personal address, and personal telephone number. 

• Routine Use: The legal mechanism in the Privacy Act that FEMA uses to share Recovery 

Data with Trusted Partners. Under the Privacy Act a Routine Use is a “use of [a] record for a 

purpose which is compatible with the purpose for which it was collected.” FEMA publishes 

Routine Uses in the Federal Register. Sharing data with Trusted Partners as laid out in this 

policy is compatible with FEMA’s overall mission, responsibilities under the Stafford Act, 

and the purpose for which FEMA collected the data.12 

• Sensitive Personally Identifiable Information (SPII): PII, that if lost, compromised, or 

disclosed without authorization, could result in substantial harm, embarrassment, 

inconvenience, or unfairness to an individual. FEMA always considers some information 

Sensitive PII even if not coupled with additional PII or contextual information including: 

complete social security number, and biometric identifier (e.g., fingerprint). Further, FEMA 

considers some information Sensitive PII when coupled with the person’s name or other 

unique identifier (e.g., personal address, telephone number) including: driver’s license or 

passport number, full date of birth, authentication information such as mother’s maiden 

name or passwords, portions of social security numbers, and financial information such as 

account numbers. 

• State: Any state of the United States, the District of Columbia, Puerto Rico, the Virgin 

Islands, Guam, American Samoa, and the Commonwealth of the Northern Mariana Islands. 
FEMA Recovery Policy 9420.1 

Page 4 

• System of Records: Group of any records under the control of any agency of which 

information is retrieved by the name of the individual or by some other identifying number, 

symbol, or other identifying particular assigned to the individual. The Privacy Act governs 

records and information maintained in a System of Records.13

• Tribe: Any American Indian or Alaska Native tribal entity that is recognized by the Federal 

Government as having a government-to-government relationship with the United States

and is eligible for funding and services from the U.S. Bureau of Indian Affairs.

• Trusted Partner: Any governmental or non-governmental entity described and defined in 

Routine Uses (H), (J), or, in certain instances, (F) of the Disaster Recovery Assistance System of 

Records Notice.14 This policy breaks down Trusted Partners into various groups. 

VIII. POLICY: Under the terms of this policy, FEMA will share FEMA Recovery Data with the 

general public and emergency management partners. FEMA will limit data sharing with the 

general public to Non-Personally Identifiable Information (PII) and Non-Sensitive 

Personally Identifiable Information (SPII). Data sharing with emergency management 

partners may include PII and SPII, but FEMA will only share this data once a partner 

qualifies as a “Trusted Partner” under the terms of this policy.

A. Sharing Non-PII and Non-SPII. FEMA will share aggregate FEMA Recovery Data that 

does not include PII or SPII via the OpenFEMA initiative. This information will be made 

available to the general public as authorized by the Privacy Act.

1. Background. OpenFEMA is FEMA's vision for open government that embraces the 

tenants of transparency, participation, and collaboration to support citizens and first 

responders to increase government accountability, innovation, and effectiveness. As 

a part of that vision, one of FEMA’s goals is to release non-PII and non-SPII data sets 

to the public on an ongoing basis.15

2. Available Data. For all major disasters in which the President authorizes Individual 

Assistance, FEMA will release multiple sets of aggregated, non-PII and non-SPII data 

in major program areas: Housing and Other Needs Assistance, Inspection 

Management, and Registration Intake and Helpline. 

3. Process. FEMA will post data sets for public use on FEMA’s website 

at http://www.fema.gov/data. 

4. Timeline. During active disasters FEMA will attempt to publish data sets as soon as 

feasible in light of ongoing response and recovery operations. Notwithstanding this 

effort, FEMA will: 

a. Initially publish data sets for all Individual Assistance major disaster 

declarations no later than 60 days after the close of the disaster period of 

 

13 Id. at § 552a(a)(5).

14 78 Fed. Reg. 25,282 (Apr. 30, 2013). There are other Routine Uses listed in the Disaster Recovery Assistance System of 

Record Notice that identify other potential Trusted Partners. This policy does not focus on those Routine Uses because 

those types of sharing occur less frequently. For other Routine Uses, contact the head of the Individual Assistance 

Division at the JFO, Regional office, or FEMA Headquarters who will consult attorneys to process the request.

15 Additional information is available at http://www.fema.gov/open. 
FEMA Recovery Policy 9420.1 

Page 5 

16 The “period of assistance” is defined at 44 C.F.R. § 206.110(e) and typically lasts 18 months from the date of 

declaration. 

17 Groups E and F both involve data related to emergency medical needs. The difference between the groups is how 

FEMA will provide data. For Group E, FEMA will proactively provide the data to the Trusted Partner—without a 

specific request from the partner—so that the partner may assist in addressing an emergency need. For Group F, 

FEMA will provide this same information, but only in response to a request from the entity because FEMA does not 

have a prior relationship with the entity and must verify its status as a Trusted Partner before data can be shared. 

assistance;16

b. Update datasets one year after the close of the disaster assistance period; and 

c. Update other datasets with significant changes as warranted. 

B. Sharing PII. FEMA will also share Recovery Data that includes PII with Trusted 

Partners under the following conditions: 

1. Trusted Partners. To maximize security and expedience, FEMA bases its 

requirements and processes for sharing data on the recipient of the data. FEMA may 

share data with entities that qualify as a Trusted Partner in the following groups: 

a. Group A: Other Federal Agencies. Any federal executive department, military 

department, government corporation, government controlled corporation, or 

other establishment in the executive branch of the government, or any 

independent regulatory agency that provides disaster assistance. 

b. Group B: State and Tribal Governments. Any department, agency, or other 

lawful government entity of any State or Tribe. 

c. Group C: Local Governments and Voluntary Organizations. Any entity that: 

i. Executes local government functions in the disaster or emergency declared 

area; or 

ii. Operates as a volunteer organization in the disaster or emergency declared 

area and is member of: 

1) The National Voluntary Organizations Active in Disasters (NVOAD) or a 

state subsidiary of NVOAD; or 

2) A FEMA, state, or tribe sponsored Long Term Recovery Committee. 

d. Group D: Utility Companies, Hospitals, and Health Care Providers. Any entity 

that: 

i. Lawfully provides utility or health care services; 

ii. Serves and operates in a disaster or emergency declared area; and 

iii. Possesses a bona fide need for FEMA Recovery Data as determined by the 

disaster’s Federal Coordinating Officer (FCO). 

e. Group E: Voluntary organizations able to provide durable medical equipment 

or assistive technology (proactive disclosure).17 Any entity qualifying in Group 

C that FEMA knows to provide durable medical equipment or assistive 

technology. 

f. Group F: Other entities able to provide durable medical equipment or assistive 
FEMA Recovery Policy 9420.1 

Page 6 

technology (requested disclosure).18 Any entity that demonstrates to FEMA an 

ability to provide durable medical equipment or assistive technology as 

determined by the head of Individual Assistance at the JFO or FEMA Region. 

g. Group G: Private sector businesses that employ disaster survivors. Any entity

that:

i. At the time of the disaster, employs the individual(s) whose data it seeks;

ii. Details efforts to provide tangible assistance to individual(s) whose data it

seeks; and

iii. Possesses a bona fide need for FEMA Recovery Data as determined by the

disaster’s FCO.

h. Other Entities. For any entity not described in this policy, please contact FEMA’s

Individual Assistance Division Director.

2. Limits. The data available to an entity depends on what group of Trusted Partners

they qualify under.

a. Appendices A-G discuss the data available to each group under certain limits. In

general, all FEMA Recovery Data elements are available to Groups A and B, but

only a limited number of elements are available to Groups C-G.

b. As detailed in Appendix B, state and tribal governments that qualify as Trusted

Partners under Group B may elect to share data with other parties only if:

i. Such parties would independently qualify as a Trusted Partner under the

relevant part of this policy;19

ii. Such parties have: (1) a contractual agreement with the state or tribe to

perform disaster-related functions, or (2) federal, tribal, state, or local

statutory authority to perform disaster-related functions;

iii. Such parties are identified in a Legal Agreement, or an independent

subsequent agreement between the state or tribal, and federal coordinating

officers; and

iv. Such parties agree to adhere to the information protection protocols and

safeguards contained in the Legal Agreement.

3. Authorization. FEMA will only share PII with Trusted Partners when authorized by:

a. For Groups A, B,C, E, and F: the head of the Individual Assistance Division at the

Joint Field Office (JFO) or FEMA Region if a JFO is not operational; or

b. For Groups D and G: the declaration’s FCO.

4. Request and Access. Appendixes A-G detail procedures for requesting and

accessing FEMA Recovery Data that includes PII.

C. Sharing SPII. In limited instances, FEMA will also share Recovery Data that includes 

18 See footnote 17. 

19 For example, if a tribe seeks to share data with a voluntary organization, that organization must meet the

requirements of Group C.
FEMA Recovery Policy 9420.1 

Page 7 

SPII. In addition to the terms and requirements for sharing PII discussed above, FEMA 

will share SPII under the following conditions: 

1. Trusted Partners. FEMA will only make SPII available to other federal agencies and 

state and tribal governments that qualify as Trusted Partners under Groups A and B 

or to other Trusted Partners who the state or tribe wishes to directly share 

information as discussed in part VIII.B.2.b. 

2. Default Limit. Reports and datasets will not include SPII such as social security and 

bank account numbers unless specifically authorized. 

3. Authorization. FEMA will only share SPII with Trusted Partners who qualify to 

receive PII and submit a written request detailing the need for SPII. Release of SPII 

must be authorized by FEMA’s Assistant Administrator, Recovery based on the 

determination that no other available data would adequately enhance a Trusted 

Partner’s ability to make well-informed and rapid decisions.

4. Request and Access. Appendixes A and B detail procedures for requesting and 

accessing FEMA Recovery Data that includes SPII.

D. Safeguards for Disclosure of PII and SPII.20

1. Notice. FEMA will notify all Trusted Partners that receive FEMA Recovery Data of 

the terms and conditions for receiving the data, security procedures for accessing 

and handling the data, and penalties for improperly releasing it. This will be 

conveyed through the Legal Agreement memorializing such sharing (e.g., FEMAState Agreement, ISAA) or via a response email or letter.

2. Breach. If any FEMA Recovery Data provided to a Trusted Partner is inadvertently 

shared with a party not authorized by this policy, lost, or otherwise compromised, 

the Trusted Partner shall immediately report the incident to the FCO, or FEMA 

Regional Administrator if the JFO is not operational, or FEMA IA Director, who in 

turn shall report to the FEMA Privacy Office in accordance with the DHS Privacy 

Incident Handling Guidance.21

3. Penalties. Trusted Partners that improperly handle FEMA Recovery Data will no 

longer be allowed to receive data and may be required to pay mitigation costs 

associated with the breach. Trusted Partners and FEMA personnel that “willfully 

disclose [PII or SPII] in any manner to any person or agency not entitled to receive it, 

shall be guilty of a misdemeanor and fined not more than $5,000.”22

E. Accounting for Disclosures. FEMA will account for all disclosures discussed in this 

policy.23 Disclosures of FEMA Recovery Data will be logged by disaster number. 

Survivors may contact FEMA to request information regarding with whom FEMA 

 

20 Under 5 U.S.C. § 552a(e)(10), FEMA can establish these appropriate administrative safeguards to insure that the 

disclosure of Recovery Data does not extend beyond Trusted Partners. 

21 Available at http://www.dhs.gov/privacy-policy-guidance.

22 Id. at § 552a(i)(1).

23 See 5 U.S.C. § 552a(c).
FEMA Recovery Policy 9420.1 

PageS 

shared their Pll. FEMA's National Processing Service Center will maintain appropriate 

disclosure logs. 

F. Data and Records Retention. FEMA's Records Disposition Schedule governs all FEMA 

Recovery Data, FEMA-State(fribe Agreements, other Legal Agreements, other 

memorialized sharing agreements,Z4 and logs of disclosures.z.<; Data and copies of 

disclosed reports to Trusted Partners will be retained in accordance with FEMA's record 

retention schedule. Further, access to historical data will be provided only to the extent it

has not been retired or destroyed as detailed in Record Disposition Schedule. 

IX. RESPONSIBLE OFFICE: FEMA Recovery Directorate, Individual Assistance Division. 

X. SUPERSESSION: This policy supersedes all past FEMA-issued formal guidance and informal

memoranda regarding sharing of disaster applicant data. 

XI. REVIEW DATE: FEMA will review this policy three years from the date in paragraph II. 

2:::;~ Assistant Administrator 

Recovery Directorate 

24 See FEMA Manual5400.2.at 96, File Number DAP-7. 

2s Id. at 218, File Number REM -12. 

Date 
FEMA Recovery Policy 9420.1 Appendix A

Page A-1

Trusted Partner Group A: Other Federal Agencies

Other federal agencies that qualify as a Group A Trusted Partner may receive access to:

1. All FEMA Recovery Data, including PII and SPII, related to specific survivors through 

written consent of the individual(s) to whom the information pertains subject to the terms in 

part V of this policy; or

2. All FEMA Recovery Data, including PII and SPII, subject to the terms of this appendix.

I. Available Data. Other federal agencies may receive access to all FEMA Recovery Data. 

A. Active Disasters. Other federal agencies may receive access to all FEMA Recovery Data related to 

survivors anywhere in the United States including registration records, eligibility determinations, 

assistance from other sources, correspondence, survey responses, and initial pre-registration 

information. 

B. Historic Disasters. To assist in comparative analysis, other federal agencies may receive access to 

all FEMA Recovery Data related to survivors for historic disasters declared anywhere in the 

United States. 

C. Limits. Reports and datasets will not include SPII such as social security and bank account numbers 

unless specifically authorized. SPII will only be made available to Trusted Partners who qualify to 

receive PII and submit a written request detailing the need for SPII. Release of SPII must be 

authorized by FEMA’s Assistant Administrator, Recovery based on the determination that no 

other available data would adequately enhance a Trusted Partner’s ability to make well-informed 

and rapid decisions.

II. Data Format. Other federal agencies may choose from two options to access the data:

A. Standard Reports. To support quick analysis and use, other federal agencies may elect to receive 

a standard suite of reports that provide aggregate or survivor-specific FEMA Recovery Data 

including Individual Housing and Other Needs Assistance data;1 or

B. Datasets. To support in-depth analysis, other federal agencies may elect to receive large machine 

readable datasets with some or all survivor-specific FEMA Recovery Data. 

III. Sharing Process.

A. Request. Another federal agency that wants access to FEMA Recovery Data should contact:

1. For a specific disaster, contact the head of the Individual Assistance Division at the JFO or

FEMA Region in which they are located or operating, or

2. For multiple disasters, contact the head of the Individual Assistance Division at FEMA 

Headquarters, who will coordinate with the relevant JFOs and FEMA Regions.

B. Eligibility Verification. The head of Individual Assistance at the JFO or Region or FEMA 

headquarters, working with the FEMA attorneys, shall confirm and verify the other federal 

agency’s status as a Trusted Partner. To qualify in Group A an entity must: 

1. Be a federal executive department, military department, government corporation, 

government controlled corporation, or other establishment in the executive branch of the 

 

1 For more information on these programs, see FEMA’s Assistance to Individuals and Households Fact Sheet, available at

http://www.fema.gov/public-assistance-local-state-tribal-and-non-profit/recovery-directorate/assistance-individuals-and. 
FEMA Recovery Policy 9420.1 Appendix A

Page A-2

government, or any independent regulatory agency; and

2. Provide disaster assistance.

C. Legal Agreement. Once FEMA determines the other federal agency is a Trusted Partner, the 

partner must memorialize a request for data through a Legal Agreement. Agreements must 

include requirements for how the data should be handled as well as disclaimers that the 

receiving federal agency is responsible for costs associated with mitigating any privacy breaches 

committed by the receiving federal agency. Three agreements are available:

1. Computer Matching Agreement. Trusted Partners should use these agreements when 

computerized comparison occurs for the purpose of establishing or verifying eligibility or 

compliance as it relates to cash or in-kind assistance or payments under federal benefit 

programs. The process under subpart 2 below will be used to develop these agreements.

2. Information Sharing Access Agreement. Trusted Partners should use these agreements 

when data is requested for multiple disasters, a data set of over 1000 records is requested, or 

the Trusted Partner wants access to FEMA’s secure online portal where data can be shared 

and periodically updated.

a. For a single disaster:

i. The FEMA Office of Chief Counsel, JFO/Regional Individual Assistance head, and 

Trusted Partner will work together to draft an ISAA and ensure compliance with the 

Privacy Act.

ii. If FEMA deems the ISAA legally sufficient, the FCO or Regional Administrator will

sign the ISAA and the JFO/Regional Individual Assistance head will forward the 

agreement to NPSC to provide the Trusted Partner with access to the secure online 

portal.

iii. If FEMA deems an ISAA legally insufficient, attorneys will notify the JFO/Regional 

Individual Assistance head and requesting entity of the reasons that the request 

cannot be processed.

b. For multiple disasters: The process will mirror steps 1-3 above with Headquarters Office 

of Chief Counsel, the Director of Individual Assistance, and the Assistant Administrator, 

Recovery replacing their respective field counterparts.

3. Request Letter or Email. Trusted Partners may also request FEMA Recovery Data via written 

letter or email that describes the information sought, and outlines the unmet disaster needs it 

plans to provide. Such requests are appropriate for one-time or minor data requests for a 

specific disaster where less than 1000 records are requested. Other data requests should occur 

through an ISAA. 

a. The FEMA Office of Chief Counsel, JFO/Regional Individual Assistance head, and the 

Trusted Partner will work together to scope the data request and ensure compliance with 

the Privacy Act.

b. If FEMA deems the request legally sufficient, the FCO or Regional Administrator will 

sign the request response letter and the JFO/Regional Individual Assistance head will 

forward the request to the NPSC to provide the Trusted Partner with appropriate FEMA 

Recovery Data.

c. If FEMA deems a request legally insufficient, attorneys will notify the JFO/Regional 
FEMA Recovery Policy 9420.1 Appendix A

Page A-3

Individual Assistance head and requesting partner of the reasons why the request cannot 

be processed.

D. Accessing Data. Once a Legal Agreement is signed or a letter/email request approved, sharing 

may occur using:

1. For Computer Matching and ISAAs: FEMA will attempt to share all requested data through 

its secure online portal.

a. After signing a Legal Agreement, the Trusted Partner will provide the FCO with the 

names of individuals that should be given access to FEMA’s secure online portal where 

they can access FEMA Recovery Data. 

b. Those individuals will request access to FEMA’s secure online portal through an online 

request at www.fema.gov/isa and receive a confirmation number for their request.

c. FEMA will follow internal security procedures to issue and assign a login and password 

for the individuals identified above in order to access the secure online portal.

d. FEMA will upload Recovery Data to the requestor’s account in the secure online portal 

according to time periods mutually agreed upon by Trusted Partner and the head of the 

Individual Assistance Division at the JFO or FEMA Region. 

2. For letter or email requests, or if the volume of FEMA Recovery Data is too large for the 

secure online portal, or if the Trusted Partner is unable to access the online portal, or if some 

elements of FEMA Recovery Data are not transferable online, FEMA will ensure the 

transmission of FEMA Recovery Data through other secure and expedient means including 

password-protected, machine-readable files sent via hardware, email, or Secure File Transfer 

Protocol.

IV. Sharing information with other parties. Other federal agencies that access FEMA Recovery Data 

may not share the data with other parties. Other parties requesting access should be referred to the 

head of the Individual Assistance Division at the JFO or FEMA Region. 

V. Time Limits. Other federal agencies may receive access to FEMA Recovery Data at any time 

consistent with FEMA’s applicable records retention schedule.2

 

2 See part VIII.F of this policy.
FEMA Recovery Policy 9420.1 Appendix B

Page B-1 

Trusted Partner Group B: State and Tribal Governments

Government agencies of a declared state or tribe that qualify as a Group B Trusted Partner may receive 

access to:

1. All FEMA Recovery Data, including PII and SPII, related to specific survivors through 

written consent of the individual(s) to whom the information pertains subject to the terms in 

part V of this policy; 

2. All FEMA Recovery Data, including PII and SPII, in order to administer the Disaster Case 

Management Program (DCMP) and Crisis Counseling Program (CCP); 1 or

3. All FEMA Recovery Data, including PII and SPII, subject to the terms of this appendix.

I. Available Data. Pursuant to the Stafford Act,2 states and tribes may receive access to all FEMA 

Recovery Data related to survivors in the state or tribal area.

A. Active disasters. States and tribes may receive access to all FEMA Recovery Data related to 

survivors in the state or tribal area including registration records, eligibility determinations, 

assistance from other sources, correspondence, survey responses, and initial pre-registration 

information. 

B. Historic disasters. To assist in comparative analysis, states and tribes may receive access to all 

FEMA Recovery Data related to survivors for historic disasters declared in the state or tribal area.

C. Limits. Reports and datasets will not include SPII such as social security and bank account numbers 

unless specifically authorized. SPII will only be made available to Trusted Partners who qualify to 

receive PII and submit a written request detailing the need for SPII. Release of SPII must be 

authorized by FEMA’s Assistant Administrator, Recovery based on the determination that no 

other available data would adequately enhance a Trusted Partner’s ability to make well-informed 

and rapid decisions. 

II. Data Format. States and tribes may choose from three options to access the data:

A. Standard Reports. To support quick analysis and use, states and tribes may elect to receive a 

standard suite of reports that provide aggregate or survivor-specific FEMA Recovery Data 

including Individual Housing and Other Needs Assistance data; 

B. Customized reports. To assist with interpretation of Recovery Data, states and tribes may elect to 

access a program on FEMA’s secure online portal that allows users to customize data requests. 

Within the portal, states and tribes can interact with FEMA National Processing Service Center 

analysts to determine the data elements and reports that will best suit their needs.

C. Datasets. To support in-depth analysis, states and tribes may elect to receive large machinereadable datasets with some or all survivor-specific FEMA Recovery Data. 

III. Sharing Process. 

A. Legal Agreement. Once FEMA determines the state or tribe is a Trusted Partner, the partner 

must memorialize a request for data through a Legal Agreement. These must include 

 

1 The processes set out in this appendix apply for this access. The state or tribe should contact the head of the Individual Assistance 

Division at the Joint Field Office or FEMA Region in which it the state or tribe is located to discuss entering into an agreement to 

facilitate data sharing for the administration of those programs.

2 42 U.S.C. § 5174(f)(2).
FEMA Recovery Policy 9420.1 Appendix B

Page B-2 

requirements for how the data should be handled as well as disclaimers that the receiving federal 

agency is responsible for costs associated with mitigating any privacy breaches committed by the 

receiving federal agency. Three agreements are available:

1. FEMA-State or FEMA-Tribe Agreement. FEMA and the state or tribe may include a clause 

in the disaster’s FEMA-State or FEMA-Tribe Agreement stating the terms of sharing FEMA 

Recovery Data.3 

a. The agreement will: 

i. Identify which state or tribe departments or agencies are authorized to request and 

receive FEMA Recovery Data on behalf of the state or tribe; 

ii. Detail how, if at all, other parties will be able to access the data; 4

iii. Require the state or tribe to follow information security protocols to protect the 

information including refraining from further disseminating the Recovery Data to 

unauthorized recipients; and 

iv. Detail penalties for improperly handling the data including criminal penalties, 

assumption of financial responsibility for mitigating any privacy breach, potential 

de-obligation of FEMA funds, and revocation of data sharing privileges. 

b. To process the agreement or an amendment to an existing FEMA-State or FEMA-Tribe 

Agreement, the state or tribe should contact the Federal Coordinating Officer.

2. Information Sharing Access Agreement. Trusted Partners should use these agreements 

when data is requested for multiple disasters, or an amendment to an existing FEMA-State or 

FEMA-Tribe Agreement is inappropriate. To process an ISAA:

a. The FEMA Office of Chief Counsel, JFO/Regional Individual Assistance head, and 

Trusted Partner will work together to draft an ISAA and ensure compliance with the 

Privacy Act.

b. If FEMA deems the ISAA legally sufficient, the FCO or Regional Administrator will sign 

the ISAA and the JFO/Regional Individual Assistance head will forward the agreement to 

NPSC to provide the Trusted Partner with access to the secure online portal.

c. If FEMA deems an ISAA legally insufficient, attorneys will notify the JFO/Regional 

Individual Assistance head and requesting entity of the reasons that the request cannot 

be processed.

3. Request Letter or Email. Trusted Partners may also request FEMA Recovery Data via written 

letter or email that describes the information sought, and outlines the unmet disaster needs it 

plans to provide. Such requests are appropriate for one-time or minor data requests for a 

specific disaster where less than 1000 records are requested. Other data requests should occur 

through an ISAA or amendment to an existing FEMA-State or FEMA-Tribe Agreement.

a. The FEMA Office of Chief Counsel, JFO/Regional Individual Assistance head, and 

Trusted Partner will work together to scope the data request and ensure compliance with 

 

3 For historic disasters where the state or tribe previously signed a FEMA-State or FEMA-Tribe Agreement, the state or tribe may 

elect to enter into an Information Sharing Access Agreement (ISAA) instead of amending the historic FEMA-State or FEMA-Tribe 

Agreement. FEMA will then share this historical data with the state or tribe via part III.B.1 of II.B.2.

4 See part IV below.
FEMA Recovery Policy 9420.1 Appendix B

Page B-3 

the Privacy Act.

b. If FEMA deems the request legally sufficient, the FCO or Regional Administrator will 

sign the request response letter and the JFO/Regional Individual Assistance head will 

forward the request to the NPSC to provide the Trusted Partner with appropriate FEMA 

Recovery Data.

c. If FEMA deems a request legally insufficient, attorneys will notify the JFO/Regional 

Individual Assistance head and requesting partner of the reasons why the request cannot 

be processed.

B. Accessing Data. Once a Legal Agreement is signed or a letter/email request approved, sharing 

may occur using:

1. For FEMA-State or FEMA-Tribe Agreement and ISAAs: FEMA will attempt to share all 

requested data through its secure online portal.

a. After signing a Legal Agreement, the Trusted Partner will provide the FCO with the 

names of individuals that should be given access to FEMA’s secure online portal where 

they can access FEMA Recovery Data. 

b. Those individuals will request access to FEMA’s secure online portal through an online 

request at www.fema.gov/isa and receive a confirmation number for their request.

c. FEMA will follow internal security procedures to issue and assign a login and password 

for the individuals identified above in order to access the secure online portal.

d. FEMA will upload Recovery Data to the requestor’s account in the secure online portal 

according to time periods mutually agreed upon by the state or tribe and the head of the 

Individual Assistance Division at the JFO or FEMA Region. 

2. For letter or email requests, or if the volume of FEMA Recovery Data is too large for the 

secure online portal, or if the Trusted Partner is unable to access the online portal, or if some 

elements of FEMA Recovery Data are not transferable online, FEMA will ensure the 

transmission of FEMA Recovery Data through other secure and expedient means including 

password-protected, machine-readable files sent via hardware, email, or Secure File Transfer 

Protocol.

IV. Sharing information with other parties. State or tribal governments that access FEMA Recovery 

Data may share the data with other state or tribal government agencies, and other parties such as 

local governments, contractors, grantees, or agents (such as voluntary organizations). However, the 

state or tribal government may share Recovery Data with these parties only if:

A. Such parties would independently qualify as a Trusted Partner under the relevant part of this 

policy;5

1. Such parties have:

a. Contractual agreement with the state or tribe to perform disaster-related functions, or

b. Federal, tribal, state or local statutory authority to perform disaster-related functions;

2. Such parties are identified in the Legal Agreement mentioned above, or independent 

 

5 For example, if a tribe seeks to share data with a voluntary organization, that organization must qualify as a Trusted Partner under 

Appendix C of this policy.
FEMA Recovery Policy 9420.1 Appendix B

Page B-4 

subsequent agreement between the state/tribal and federal coordinating officers; and

3. Such parties agree to adhere to the information protection protocols and safeguards 

contained in the Legal Agreement.

V. Time Limits. States and tribes may receive access to FEMA Recovery Data at any time consistent with 

FEMA’s applicable records retention schedule.6

6 See part VIII.F of this policy.

 
FEMA Recovery Policy 9420.1 Appendix C

Page C-1 

Trusted Partner Group C: Local Governments and Voluntary Organizations

Local governments and voluntary organizations that qualify as a Group C Trusted Partner may receive 

access to: 

1. All FEMA Recovery Data, including PII and SPII, related to all survivors if the state or tribe 

in which they are located has signed a FEMA-State or FEMA-Tribe Agreement allowing other 

parties to access FEMA Recovery Data through the state or tribe subject to the terms in 

Appendix B; 

2. All FEMA Recovery Data, including PII and SPII, related to specific survivors through 

written consent of the individual(s) to whom the information pertains subject to the terms in 

part V of this policy; or

3. Certain FEMA Recovery Data, including PII, related to all survivors subject to the terms of 

this appendix.

I. Available Data. Local governments and voluntary organizations that qualify as Trusted Partners 

Group C may receive the following Recovery Data elements:

A. Active Disasters. Trusted Partners in Group C may receive access to limited FEMA Recovery 

Data:

1. General Data Elements: Name; contact information; inspected loss amount; amounts 

received; award category; Small Business Loan Administration (SBA) loan status; and initial 

pre-registration information. FEMA may disclose this data according to different subcategories of disaster applicants (e.g., those that received maximum amounts, those that have 

flood insurance coverage, those with medical needs, or those over a certain age).

2. Specific Follow-Up Data Elements: Trusted Partners in Group C may receive access to other 

FEMA Recovery Data elements listed in a follow-up request after the Trusted Partner makes 

contact with the survivor. For these situations, a Trusted Partner must submit a written or 

email request with (1) the survivor's name, date of birth, FEMA registration/application 

number (if applicable), and damaged dwelling address (or geospatial location of dwelling); 

and (2) and explanation of the type of tangible assistance being provided and verification 

procedure used by the Trusted Partner to confirm the identity of the survivor.

B. Historic Disasters. To assist in comparative analysis, Trusted Partners may receive access to 

FEMA Recovery Data for historic disasters in the same area in which they are located or 

operating. This data is limited to the data elements listed in part I.A.1.

II. Data Format. Trusted Partners will receive the data as standard reports that provide aggregate or 

survivor-specific FEMA Recovery Data.

III. Sharing Process.

A. Request. A local government or voluntary agency that wishes to receive access to FEMA 

Recovery Data should contact the head of the Individual Assistance Division at the JFO or FEMA 

Region in which they are located or operating.

B. Eligibility Verification. The head of Individual Assistance at the JFO or Region, working with 

the FEMA attorneys, shall confirm and verify the local government or voluntary organizations 

status as a Trusted Partner. To qualify in Group C an entity must:

1. Execute local government functions in the disaster or emergency declared area; or
FEMA Recovery Policy 9420.1 Appendix C

Page C-2 

2. Operate as a volunteer organization in the disaster or emergency declared area and be 

member of: 

a. The National Voluntary Organizations Active in Disasters (NVOAD) or a state subsidiary 

of NVOAD; or 

b. A FEMA or state or tribe sponsored Long Term Recovery Committee.

C. Legal Agreement. Once FEMA determines the local government or voluntary organization is a 

Trusted Partner, the partner may memorialize data sharing terms and conditions. This agreement 

will: (1) outline security protocols the Trusted Partner must meet to protect the Recovery Data, 

including refraining from further disseminating the Recovery Data to unauthorized recipients 

and (2) detail penalties for improperly handling the data, including potential criminal penalties, 

and revocation of data sharing privileges. This can be accomplished through: 

1. Annual or Single Disaster Information Sharing Access Agreement. Trusted Partners that 

are national in scope (e.g., the American Red Cross, Salvation Army) may memorialize an 

annual Information Sharing Access Agreement (ISAA) to cover all subsequent declared 

disasters for that year. Other entities that are confined to a single state or tribal area or an 

area within a single state may enter into an ISAA for incidents occurring in their state or 

tribal area on a declaration-by-declaration basis.

a. The FEMA Office of Chief Counsel, JFO/Regional Individual Assistance head, and 

Trusted Partner will work together to draft an ISAA and ensure compliance with the 

Privacy Act.

b. If FEMA deems the ISAA legally sufficient, the FCO or Regional Administrator will sign 

the ISAA and the JFO/Regional Individual Assistance head will forward the agreement to 

NPSC to provide the Trusted Partner with access to the secure online portal.

c. If FEMA deems an ISAA legally insufficient, attorneys will notify the JFO/Regional 

Individual Assistance head and requesting entity of the reasons that the request cannot 

be processed.

2. Request Letter or Email Message: Trusted Partners may also request FEMA Recovery Data 

via written letter or email that describes the information sought, and outlines the unmet 

disaster needs it plans to provide. Such requests are appropriate for one-time or minor data 

requests where less than 1000 records are requested. Other data requests should occur 

through an ISAA. 

a. The FEMA Office of Chief Counsel, JFO/Regional Individual Assistance head, and 

Trusted Partner will work together to scope the data request and ensure compliance with 

the Privacy Act.

b. If FEMA deems the request legally sufficient, the FCO or Regional Administrator will 

sign the request response letter and the JFO/Regional Individual Assistance head will 

forward the request to the NPSC to provide the Trusted Partner with appropriate FEMA 

Recovery Data.

c. If FEMA deems a request legally insufficient, attorneys will notify the JFO/Regional 

Individual Assistance head and requesting partner of the reasons why the request cannot 

be processed.
FEMA Recovery Policy 9420.1 Appendix C

Page C-3 

D. Accessing Data. Once a request is approved or an ISAA is signed,1 FEMA will deliver requested 

data in secure fashion through one of the following means: 

1. For Trusted Partners with a signed ISAA, sharing may occur using FEMA’s secure online 

portal described in Appendix B; or

2. For Trusted Partners with a signed response letter, sharing may occur using passwordprotected, machine-readable files sent via hardware, email, or Secure File Transfer Protocol.

IV. Sharing Information with Other Parties. Local governments and voluntary organizations may not 

share the data with other parties. Other parties requesting access should be referred to the head of the 

Individual Assistance Division at FEMA Headquarters or the Joint Field Office (JFO) or FEMA 

Region where the local government or voluntary organization is located or operating.

V. Time Limit. FEMA may only release this information during the period of assistance plus an 

additional 90 days.2

 

1 The FCO at the relevant JFO will sign an ISAA or response letter. If there is no JFO operating at the time of processing the inquiry, 

the relevant Regional Administrator can sign an ISAA or response letter. For requests made directly to FEMA headquarters, the 

Individual Assistance Director may sign an ISAA or response letter.

2 The “period of assistance” is defined at 44 C.F.R. § 206.110(e) and typically lasts 18 months from the date of declaration. 
FEMA Recovery Policy 9420.1 Appendix D

Page D-1 

Trusted Partner Group D: Utility Companies, Hospitals, and Healthcare Providers

Utility companies, hospitals, and healthcare providers that qualify as a Group D Trusted Partner may 

receive access to: 

1. All FEMA Recovery Data, including PII and SPII, related to specific survivors through 

written consent of the individual(s) to whom the information pertains subject to the terms in 

part V of this policy; or

2. Certain FEMA Recovery Data, including PII, related to all survivors subject to the terms of 

this appendix.

I. Available Data. Utility companies, hospitals, and healthcare providers that qualify as Trusted 

Partners in Group D may receive up to the following Recovery Data elements: 

A. Active Disasters. Trusted Partners may receive access to limited FEMA Recovery Data: name; 

contact information; and information regarding emergency/special needs. 

B. Historic Disasters. Upon request, and to assist in comparative analysis, Trusted Partners may 

receive access to FEMA Recovery Data for historic disasters in the same area in which they are 

serving and operating. This data is limited to the data elements listed in part I.A.

C. Limits. Data will be limited to survivors located in the area in which the Trusted Partner serves 

and operates.

II. Data Format. Trusted Partners will receive the data as standard reports that provide aggregate or 

survivor-specific FEMA Recovery Data.

III. Sharing Process. 

A. Request. A utility company, hospital, or healthcare provider that wishes to access FEMA 

Recovery Data should contact the heads of the Operations and Individual Assistance Divisions at 

the JFO or FEMA Region in which they are serving or operating. 

B. Eligibility Verification. The FCO or Regional Administrator shall consult with relevant state 

regulators and confirm and verify the entity:

1. Lawfully provides utility or health care services;

2. Serves and operates in a disaster or emergency declared area; and 

3. Possesses a bona fide need for FEMA Recovery Data as determined by the disaster’s Federal 

Coordinating Officer (FCO).

C. Legal Agreement. Once FEMA determines a Trusted Partner’s eligibility the procedures for 

memorializing data sharing are the same as for Trusted Partner Group C detailed above.

D. Accessing Data. Once a request is approved or an ISAA is signed the procedures for accessing 

FEMA Recovery Data are the same as for Trusted Partner Group C detailed above.

IV. Sharing Information with Other Parties. Trusted Partners in Group D may not share the data with 

other parties.

V. Time Limit. FEMA may only release this information during the period of assistance plus an 

additional 90 days.1

 

1 The “period of assistance” is defined at 44 C.F.R. § 206.110(e) and typically lasts 18 months from the date of declaration. 
FEMA Recovery Policy 9420.1 Appendix E

Page E-1 

Trusted Partner Group E: Voluntary Organizations Able To Provide Durable Medical Equipment or 

Assistive Technology

Voluntary organizations that qualify as a Group E Trusted Partner may receive access to: 

1. All FEMA Recovery Data, including PII and SPII, related to specific survivors through 

written consent of the individual(s) to whom the information pertains subject to the terms in 

part V of this policy; or

2. Certain FEMA Recovery Data, including PII, related to all survivors subject to the terms of 

this appendix.

I. Available Data. Voluntary organizations that qualify as Trusted Partners in Group E may receive up 

to the following Recovery Data elements: name, telephone number, email address, current address or 

geospatial location data (if not located at a shelter), and details of medical need or emergency. This 

data is limited to active disasters. 

II. Data Format. Trusted Partners will receive the data as standard reports that provide aggregate or 

survivor-specific FEMA Recovery Data.

III. Sharing Process. 

A. Proactive Disclosure. FEMA may proactively disclose this information and not wait for a specific 

request.

B. Eligibility Verification. The head of Individual Assistance at the JFO or Region shall confirm and 

verify the voluntary organization’s status as a Trusted Partner. To qualify in Group E an entity 

must independently qualify under Group C and the following conditions must be present:

1. A survivor indicates to FEMA staff that they need durable medical equipment or assistive 

devices; and

2. The head of the Individual Assistance Division at the JFO or FEMA Region, in consultation 

with FEMA OCC, determines that absence of these will place the health and safety of the 

survivor in jeopardy. 

C. Legal Agreement and Accessing Data. Once FEMA determines the voluntary organization is a 

Trusted Partner, FEMA may send the Trusted Partner a written letter or email along with the 

relevant Recovery Data via password protected hardware; or password protected, machine 

readable file files sent via email or Secure File Transfer Protocol. 

1. In turn, the Trusted Partner will provide email confirmation or otherwise acknowledge that it 

has received the Recovery Data and has contacted the Survivor; and

2. The Trusted Partner will provide email confirmation or otherwise acknowledge that it has 

taken steps to protect the Recovery Data provided.

IV. Sharing Information with Other Parties. Trusted Partners in Group E may not share the data with 

other parties.

V. Time Limit. FEMA may only release this information during the period of assistance plus an 

additional 90 days.1

 

1 The “period of assistance” is defined at 44 C.F.R. § 206.110(e) and typically lasts 18 months from the date of declaration. 
FEMA Recovery Policy 9420.1 Appendix F

Page F-1 

Trusted Partner Group F: Other Entities Able To Provide Durable Medical Equipment or Assistive 

Technology

Entities that qualify as a Group F Trusted Partner may receive access to: 

1. All FEMA Recovery Data, including PII and SPII, related to specific survivors through 

written consent of the individual(s) to whom the information pertains subject to the terms in 

part IV of this policy; or

2. Certain FEMA Recovery Data, including PII, related to all survivors subject to the terms of 

this appendix.

I. Available Data. Other entities that qualify as Trusted Partners in Group F may receive up to the 

following Recovery Data elements: name and contact information. This data is limited to active 

disasters.

II. Data Format. Trusted Partners will receive the data as standard reports that provide aggregate or 

survivor-specific FEMA Recovery Data.

III. Sharing Process. 

A. Request. An entity that wishes to receive access to FEMA Recovery Data should contact the head 

of the Individual Assistance Division at the JFO or FEMA Region in which they are located or 

operating. The request should include information describing what durable medical equipment 

and/or assistive technology it can offer, and specifically, what type of survivor information is 

needed in order to accommodate the request. 

B. Eligibility Verification. The head of Individual Assistance at the JFO or Region shall confirm and 

verify the entity’s status as a Trusted Partner. To qualify in Group F:

1. The entity is able to provide durable medical equipment and/or assistive technology to those 

in need of such devices as a result of a declared disaster; and

2. The head of the Individual Assistance Division at the JFO or FEMA Region, in consultation 

with FEMA OCC, determines that the entity has a bona fide need for the data.

C. Legal Agreement and Accessing Data. Once FEMA determines the entity is a Trusted Partner, 

FEMA may send the Trusted Partner a written letter or email along with the relevant Recovery 

Data via password protected hardware; or password protected, machine readable file files sent 

via email or Secure File Transfer Protocol.

D. In turn, the Trusted Partner will provide email confirmation or otherwise acknowledge that it has 

received the Recovery Data and has contacted the Survivor; and

E. The Trusted Partner will provide email confirmation or otherwise acknowledge that it has taken 

steps to protect the Recovery Data provided.

IV. Sharing Information with Other Parties. Trusted Partners in Group F may not share the data with 

other parties.

V. Time Limit. FEMA may only release this information during the period of assistance plus an 

additional 90 days.1

 

1 The “period of assistance” is defined at 44 C.F.R. § 206.110(e) and typically lasts 18 months from the date of declaration. 
FEMA Recovery Policy 9420.1 Appendix G

Page G-1 

Trusted Partner Group G: Private Sector Businesses that Employ Disaster Survivors

Entities that qualify as a Group G Trusted Partner may receive access to: 

1. All FEMA Recovery Data, including PII and SPII, related to specific survivors through 

written consent of the individual(s) to whom the information pertains subject to the terms in 

part V of this policy; or

2. Certain FEMA Recovery Data, including PII, related to all survivors subject to the terms of 

this appendix.

I. Available Data. Businesses that qualify as Trusted Partners in Group G may receive contact 

information about their own employees. This data is limited to active disasters.

II. Data Format. Trusted Partners will receive the data as standard reports that provide aggregate or 

survivor-specific FEMA Recovery Data.

III. Sharing Process. 

A. Request. An entity that wishes to receive access to FEMA Recovery Data should contact the head 

of the Private Sector and Individual Assistance Divisions at the JFO or FEMA Region in which 

they are located or operating. The request should include its employees' names, dates of birth, 

damaged dwelling addresses, and the types of tangible assistance the business is offering its 

employees. 

B. Eligibility Verification. The head of Private Sector at the JFO or Region and OCC shall verify the 

business’ status as a Trusted Partner. To qualify in Group G:

1. At the time of the disaster, the business employed the individual whose information it seeks;

2. The business details efforts to provide tangible assistance to employee survivors.

C. Legal Agreement and Accessing Data. Once FEMA determines the entity is a Trusted Partner, 

FEMA may send the Trusted Partner a written letter or email along with the relevant Recovery 

Data via password protected hardware; or password protected, machine readable file files sent 

via email or Secure File Transfer Protocol.

1. In turn, the Trusted Partner will provide email confirmation or otherwise acknowledge that it 

has received the Recovery Data and has contacted the Survivor; and

2. The Trusted Partner will provide email confirmation or otherwise acknowledge that it has 

taken steps to protect the Recovery Data provided.

IV. Sharing Information with Other Parties. Businesses may not share the data with other parties.

V. Time Limit. FEMA may only release this information during the period of disaster assistance.1

1 The “period of assistance” is defined at 44 C.F.R. § 206.110(e) and typically lasts 18 months from the date of declaration.