Privacy and Civil Liberties Impact Assessment 

Template version 4.4 

Electronic Data Interchange (EDI) Service Program 

February 28, 2020 

Bureau Certifying Official 

David J. Ambrose 

Chief Security Officer and Chief Privacy Officer 

Bureau of the Fiscal Service 

Department of the Treasury 

The mission of the Bureau of the Fiscal Service (Fiscal Service) is to promote the financial 

integrity and operational efficiency of the federal government through exceptional accounting, 

financing, collections, payments, and shared services.

This Privacy and Civil Liberties Impact Assessment (PCLIA) is a public document and will be 

made available to the general public via the Fiscal Service Privacy and Civil Liberties Impact 

Assessment (PCLIA) webpage (PCLIA WEBPAGE). 
1 

Section 1: Introduction 

personally 

identifiable information is maintained in a system or by a project. PCLIAs are required 

for all systems and projects that collect, maintain, or disseminate PII, regardless of the manner in 

which the information is retrieved. 

This assessment is being completed pursuant to Section 208 of the E-Government Act of 2002

-

Memorandum 03- OMB Guidance for Implementing the Privacy Provisions of the EGovernment Act of 2002 -07, Privacy and Civil Liberties Impact 

Assessment (PCLIA).

Section 2: Definitions

Agency

defined in 31 U.S.C. § 102. 

Business Associate As described at 45 C.F.R. § 160.103 includes: (i) A Health Information 

Organization, E-prescribing Gateway, or other person that provides data transmission services 

with respect to protected health information to a covered entity and that requires access on a 

routine basis to such protected health information; (ii) A person that offers a personal health 

record to one or more individuals on behalf of a covered entity; (iii) A subcontractor that creates, 

receives, maintains, or transmits protected health information on behalf of the business associate. 

Certifying Official The Bureau Privacy and Civil Liberties Officer(s) who certify that all 

requirements in TD and TD P 25-07 have been completed so a PCLIA can be reviewed and 

approved by the Treasury Deputy Assistant Secretary for Privacy, Transparency, and Records. 

Coll means the retrieval, receipt, gathering, or acquisition of any 

PII and its storage or presence in a Treasury system. This term should be given its broadest 

possible meaning. 

Contractors and service providers are private companies that provide goods or services 

under a contract with the Department of the Treasury or one of its bureaus. This includes, but is 

not limited to, information providers, information processors, and other organizations providing 

information system development, information technology services, and other outsourced 

applications. 

Covered Entity As described at 45 C.F.R. § 160.103 means: (1) A health plan; (2) A health 

care clearinghouse; (3) A health care provider who transmits any health information in electronic 

form in connection with a transaction covered by this subchapter. 
2 

Data mining means a program involving pattern-based queries, searches, or other analyses of 

1 or more electronic databases, where (a) a department or agency of the federal government, 

or a non-federal entity acting on behalf of the federal government, is conducting the queries, 

searches, or other analyses to discover or locate a predictive pattern or anomaly indicative of 

terrorist or criminal activity on the part of any individual or individuals; (b) the queries, searches, 

or other analyses are not subject-based and do not use personal identifiers of a specific 

individual, or inputs associated with a specific individual or group of individuals, to retrieve 

information from the database or databases; and (c) the purpose of the queries, searches, or other 

analyses is not solely (i) the detection of fraud, waste, or abuse in a government agency or 

program; or (ii) the security of a government computer system. 

Disclosure

to the public in response to a request under the Freedom of Information Act (5 U.S.C. § 552, 

ted in that manner. 

Otherwise, the term should be interpreted 

 

Dissemination

FOIA/Privacy Act disclosure). 

E-Government means the use of digital technologies to transform government operations to 

improve effectiveness, efficiency, and service delivery. 

Federal information system means a discrete set of information resources organized for the 

collection, processing, maintenance, transmission, and dissemination of information owned or 

under the control of a federal agency, whether automated or manual. 

Final Rule After the NPRM comment period closes, the agency reviews and analyzes the 

comments received (if any). The agency has the option to proceed with the rulemaking as 

proposed, issue a new or modified proposal, or withdraw the proposal before reaching its final 

decision. The agency can also revise the supporting analyses contained in the NPRM (e.g., to 

address a concern raised by a member of the public in response to the NPRM).

Government information means information created, collected, used, maintained, processed, 

disseminated, or disposed of by or for the federal government. 

Health care clearinghouse means a public or private entity, including a billing service, 

repricing company, community health management information system or community health 

information system, and value-added networks and switches, that does either of the following 

functions: (1) Processes or facilitates the processing of health information received from another 

entity in a nonstandard format or containing nonstandard data content into standard data 

elements or a standard transaction.; (2) Receives a standard transaction from another entity and 

processes or facilitates the processing of health information into nonstandard format or 

nonstandard data content for the receiving entity. 
3 

Individual means a citizen of the United States or an alien lawfully admitted for permanent 

residence. If a question does not specifically inquire about or an issue does not clearly involve a 

Privacy Act system of records, the term should be given its common, everyday meaning. In 

certain contexts, the term individual may also include citizens of other countries who are covered 

by the terms of an international or other agreement that involves information stored in the system 

or used by the project. 

Information means any representation of knowledge such as facts, data, or opinions in any 

medium or form, regardless of its physical form or characteristics. This term should be given the 

broadest possible meaning. This term includes, but is not limit to, information contained in a 

Privacy Act system of records. 

Information technology (IT) means any equipment or interconnected system or subsystem of 

equipment, used in the automatic acquisition, storage, analysis, evaluation, manipulation, 

management, movement, control, display, switching, interchange, transmission, or reception of 

data or information by the executive agency, if the equipment is used by the executive agency 

directly or is used by a contractor under a contract with the executive agency that requires the 

use: (i) of that equipment; or (ii) of that equipment to a significant extent in the performance of a 

service or the furnishing of a product. It includes computers, ancillary equipment (including 

imaging peripherals, input, output, and storage devices necessary for security and surveillance), 

peripheral equipment designed to be controlled by the central processing unit of a computer, 

software, firmware and similar procedures, services (including support services), and related 

resources; but does not include any equipment acquired by a federal contractor incidental to a 

federal contract. Clinger-Cohen Act of 1996, 40 U.S.C. § 11101(6). 

Major Information system

agency mission; its high development, operating, or maintenance costs; or its significant role in 

-

130, § 6.u. This definition includes all systems that contain PII

r Federal Information Processing Standard 199. 

National Security systems a telecommunications or information system operated by the 

federal government, the function, operation or use of which involves: (1) intelligence activities, 

(2) cryptologic activities related to national security, (3) command and control of military forces, 

(4) equipment that is an integral part of a weapon or weapons systems, or (5) systems critical to 

the direct fulfillment of military or intelligence missions, but does not include systems used for 

routine administrative and business applications, such as payroll, finance, logistics, and 

personnel management. Clinger-Cohen Act of 1996, 40 U.S.C. § 11103. 

Notice of Proposed Rule Making (NPRM) the Privacy Act (Section (J) and (k)) allow 

agencies to use the rulemaking process to exempt particular systems of records from some of the 

-andThe agency publishes an NPRM to notify the public that the agency is proposing a rule and 

provides an opportunity for the public to comment on the proposal before the agency can issue a 

final rule. 
4 

Personally Identifiable Information (PII) any information that can be used to distinguish or 

trace an in

information that is linked or linkable to a specific individual. 

Privacy and Civil Liberties Impact Assessment (PCLIA) a PCLIA is: 

(1) a process conducted to: (a) identify privacy and civil liberties risks in systems, 

programs, and other activities that maintain PII; (b) ensure that information systems, 

programs, and other activities comply with legal, regulatory, and policy requirements; 

(c) analyze the privacy and civil liberties risks identified; (d) identify remedies, 

protections, and alternative or additional privacy controls necessary to mitigate those 

risks; and (e) provide notice to the public of privacy and civil liberties protection 

practices. 

(2) a document that catalogues the outcome of that privacy and civil liberties risk 

assessment process. 

Protected Information as the term is used in this PCLIA, protected information the same 

definition given to that term in TD 25-10, section 4. 

Privacy Act Record any item, collection, or grouping of information about an individual that 

is maintained by an agency, including, 

transactions, medical history, and criminal or employment history and that contains the 

the individual, such as a finger or voice print or a photograph. 5 U.S.C. § 552a (a)(4). 

Reviewing Official The Deputy Assistant Secretary for Privacy, Transparency, and Records 

who reviews and approves all PCLIAs as part of her/his duties as a direct report to the Treasury 

Senior Agency Official for Privacy. 

Routine Use with respect to the disclosure of a record outside of Treasury (i.e., external 

sharing), the sharing of such record for a purpose which is compatible with the purpose for 

which it was collected 5 U.S.C. § 552a(a)(7). 

Sharing any Treasury initiated distribution of information to government employees or agency 

contractors or grantees, including intra- or inter-agency transfers or exchanges of Treasury 

information, regardless of whether it is covered by the Privacy Act. It does not include responses 

to requests for agency records under FOIA or the Privacy Act. It is synonymous with the term 

used in this assessment unless it is clear from the context in which the term is used that it refers 

to disclosure to the public in response to a request for agency records under FOIA or the Privacy 

Act. 

System as the term used in this manual, includes both federal information systems and 

information technology. 
5 

System Owner Official responsible for the overall procurement, development, integration, 

modification, or operation and maintenance of a system. 

System of Records a group of any records under the control of Treasury from which 

information is retrieved by the name of the individual or by some identifying number, symbol, or 

other identifying particular assigned to the individual. 5 U.S.C. § 552a (a)(5). 

System of Records Notice Each agency that maintains a system of records shall publish in the 

Federal Register upon establishment or revision a notice of the existence and character of the 

system of records, which notice shall include: (A) the name and location of the system; (B) the 

categories of individuals on whom records are maintained in the system; (C) the categories of 

records maintained in the system; (D) each routine use of the records contained in the system, 

including the categories of users and the purpose of such use; (E) the policies and practices of the 

agency regarding storage, retrievability, access controls, retention, and disposal of the records; 

(F) the title and business address of the agency official who is responsible for the system of 

records; (G) the agency procedures whereby an individual can be notified at her/his request if the 

system of records contains a record pertaining to him; (H) the agency procedures whereby an 

individual can be notified at her/his request how she/he can gain access to any record pertaining 

to him contained in the system of records, and how she/he can contest its content; and (I) the 

categories of sources of records in the system. 5 U.S.C. § 552a (e)(4). 

Section 3: System Overview 

Section 3.1: System/Project Description and Purpose 

The purpose of the EDI Program is to provide information processing and fiscal intermediary 

services for third party insurer claims, remittances, and payments. These services are supported 

by a financial agent/healthcare clearinghouse provider acting as a business associate for the 

following ntities : Veterans Health Administration and Indian Health Service. 

PII is used to the extent necessary to support the billing claim adjudication process by third 

party insurers, as well as collection and facilitating the delivery of information required by the 

healthcare agency provider for posting of reimbursement payments to appropriate patient 

accounts that are maintained outside the scope of the EDI Program service . 

It supports the mission of the Bureau by managing the appropriate data processing needs of 

healthcare transactions to deliver timely receipt of payments, as well as providing information 

required to support posting of receivables associated to third party insurer reimbursements by 

healthcare agency providers. 

Estimated Number of Individuals Whose Personally Identifiable Information is 

Maintained in the System or by the Project

 0 999 1000 9,999 10,000 99,999 

 100,000 499,999 

 10,000,000 99,999,999 

 500,000 999,999 

100,000,000 999,999,999

 1,000,000 9,999,999 

 1,000,000,000 + 
6 

Section 3.2: Authority to Collect 

The authorities for operating this system or performing this project are: 

31 U.S.C chapter 33 depositing, keeping, and paying money 

31 U.S.C 3720 Collection of Payments 

31 CFR Part 206 Management of Federal Agency Receipts, disbursements, and operation 

of the cash management improvement act 

31 CFR Part 202 Depositaries and Financial Agents of the US Government 

Section 4: Information Collection 

Section 4.1: Relevant and Necessary 

Section 4.1(a) Please check all of the following that are true: 

1. None of the PII maintained in the system or by the project is part of a Privacy Act 

system of records; As a service supporting business associate activities, records are not 

formatted or stored in a manner to retrieve at an individual grouping.

2. All of the PII maintained in the system or by the project is part of a system of records

and none of it is exempt from the Privacy Act relevant and necessary requirement; 

3. All of the PII maintained in the system or by the project is part of a system of records

and all of it is exempt from the Privacy Act relevant and necessary requirement; 

4. Some, but not all, of the PII maintained in the system or by the project is part of a 

system of records and the records to which the Privacy Act applies are exempt from the 

relevant and necessary requirement; and 

5. Some, but not all, of the PII maintained in the system or by the project is part of a 

system of records and none of the records to which the Privacy Act applies are exempt 

from the relevant and necessary requirement. 

Section 4.1(b) Yes No N/A With respect to PII maintained in the system or by the 

project that is subject to the Privacy Act relevant and necessary requirement, was an 

assessment conducted prior to collection (e.g., during Paperwork Reduction Act analysis) to 

determine which PII types (see Section 4.2 below) were relevant and necessary to meet the 

As a service supporting business associate 

activities, information collection is limited to what is needed to carry out Covered Entity 

obligations under Subpart E of 45 CFR Part 164. Only information required to be compliant 

with legislatively-mandated transaction standard and code sets for healthcare ANSI ASC 

X12N EDI file formats is received and transmitted. 

Section 4.1(c) Yes No N/A With respect to PII currently maintained in the system or 

by the project that is subject to the Privacy Act relevant and necessary requirement, is the PII

requirements? 
7 

Section 4.1(d) Yes No N/A With respect to PII maintained in the system or by the 

project that is subject to the Privacy Act relevant and necessary requirement, is there a 

process to continuously reevaluate and ensure that the PII remains relevant and necessary? 

As a service supporting business associate activities, information collection is limited to what 

is needed to carry out Covered Entity obligations under Subpart E of 45 CFR Part 164. Only 

information required to be compliant with legislatively-mandated transaction standard and 

code sets for healthcare ANSI ASC X12N EDI file formats is received and transmitted. A 

Covered Entity will promptly notify Business Associate in writing of any restrictions on Covered 

PHI or otherwise affect its ability to fulfill its obligations under current agreement. 

Section 4.2: PII and/or information types or groupings 

To perform their missions, federal agencies must necessarily collect various types of 

information. The checked boxes below represent the types of information maintained in the 

system or by the project. Information identified below is used by the system or project to fulfill 

the purpose stated in Section 3.2 Authority to Collect. 

Biographical/General Information 

 Name Gender Group/Organization 

Membership (Insurance Plan)

 Date of Birth Race Military Service Information 

 Home Physical/Postal 

Mailing Address 

 Ethnicity Personal Home Phone or Fax 

Number 

 Zip Code Personal Cell Number Alias (including nickname) 

 Business Physical/Postal 

Mailing Address

 Business Cell Number Business Phone or Fax Number 

 Personal e-mail address Nationality 

 Business e-mail address Country of Birth Spouse Information (Potential 

Subscriber)

 Personal Financial 

Information (including loan 

information)

 City or County of Birth Children Information 

 Business Financial 

Information (including loan 

information)

 Immigration Status Information about other 

relatives. 

 Marital Status Citizenship Professional/personal references 

or other information about an 

acquaintances.

 Religion/Religious 

Preference 

 Device settings or preferences 

(e.g., security level, sharing 

options, ringtones).

 Global Positioning System 

(GPS)/Location Data 

 Sexual Orientation User names, avatars, etc. Secure Digital (SD) Card or 

Other Data stored on a card or other 

technology

 Cell tower records (e.g., logs. 

user location, time etc.)

 Network communications data Cubical or office number 
8 

 Contact lists and directories 

(known to contain personal 

information) 

 Contact lists and directories 

(not known to contain personal 

information, but uncertain) 

 Contact lists and directories 

(known to contain only business 

information) 

 Education Information Resume or curriculum vitae Other (please describe): 

 Other (please describe): Other (please describe): 

______________________ 

 Other (please describe): 

 ______________________ 

Identifying Numbers 

 Full Social Security number Health Plan Beneficiary Number 

 Truncated/Partial Social Security number (e.g., 

last 4 digits) 

 Alien Registration Number 

 Personal Taxpayer Identification Number Business Taxpayer Identification Number (If 

known: sole proprietor; non-sole proprietor) 

 Personal Credit Card Number Business Credit Card Number (If known: sole 

proprietor; non-sole proprietor) 

 Personal Vehicle Identification Number Business Vehicle Identification Number (If 

known: sole proprietor; non-sole proprietor) 

 Personal License Plate Number Business License Plate Number (If known: 

sole proprietor; non-sole proprietor) 

 File/Case ID Number (individual) File/Case ID Number (business) (If known: 

sole proprietor; non-sole proprietor) 

 Personal Professional License Number Business Professional License Number (If 

known: sole proprietor; non-sole proprietor) 

 Employee Identification Number Patient ID Number 

 Business Bank Account Number Personal Bank Account Number 

 Commercially obtained internet 

navigation/purchasing habits of individuals

 Government obtained internet 

navigation/purchasing habits of individuals

 Business License Plate Number (non-soleproprietor) 

 Personal device identifiers or serial numbers Other Identifying Numbers (please 

describe):____________________________

 Passport Number and Passport information 

(including full name, passport number, DOB, POB, 

sex, nationality, issuing country photograph and 

ut not all elements 

are collected)

 Other Identifying Numbers (please 

describe):____________________________ 

Medical/Emergency Information Regarding Individuals

 Medical/Health Information 

Information

 Patient ID Number 

 Mental Health Information Disability Information Emergency Contact Information 

(e.g., a third party to contact in case 

of emergency)

 Other (please describe): ____________________________________________________ 

Biometrics/Distinguishing Features/Characteristics of Individuals 

 Physical description/ 

characteristics (e.g., hair, eye 

color, weight, height, sex, 

gender)

 Signatures Vascular scans 
9 

 Fingerprints Photos Retina/Iris Scans 

 Palm prints Video Dental Profile 

 Voice audio recording Scars, marks, tattoos DNA Sample or Profile 

 Other (please describe): 

______________________ 

 Other (please describe): 

_______________________ 

 Other (please describe): 

_______________________ 

Specific Information/File Types 

 Taxpayer Information/Tax 

Return Information 

 Law Enforcement Information Security Clearance/Background 

Check Information 

 Civil/Criminal History 

Information/Police Records 

(government source) 

 Credit History Information 

(government source) 

 Bank Secrecy Act Information 

 Civil/Criminal History 

Information/Police Records 

(commercial source) 

 Credit History Information 

(commercial source) 

 National Security/Classified 

Information 

 Protected Information (as 

defined in Treasury Directive 25-

10) 

 Case files Personnel Files 

 Information provided under a 

confidentiality agreement 

 Information subject to the 

terms of an international or other 

agreement 

 Other (please describe): 

______________________ 

Audit Log and Security Monitoring Information 

 User ID assigned to or 

generated by a user of Treasury IT 

 Date and time an individual 

accesses a facility, system, or 

other IT 

 Files accessed by a user of 

Treasury IT (e.g., web navigation 

habits) 

 Passwords generated by or 

assigned to a user of Treasury IT

 Internet or other queries run 

by a user of Treasury IT

 Contents of files accessed by a 

user of Treasury IT

 Biometric information used to 

access Treasury facilities or IT

 Video of individuals derived 

from security cameras

 Public Key Information (PKI). 

 Information revealing an 

particular location as derived from 

security token/key fob, employee 

identification card scanners or 

other IT or devices

 Still photos of individuals 

derived from security cameras. 

 Internet Protocol (IP) Address 

 Other (please describe): Other (please describe): Other (please describe): 

_____________________

Other 

 Other (please describe: ______________ Other (please describe: _______________ 

 Other (please describe: ______________ Other (please describe: _______________ 

Section 4.3: Sources of information and the method and manner of collection 

Third Party 

Insurance Plan 

Payers 

Veterans Health 

Administration Financial Institutions <<Source name>> 

Specific PII identified in 

Section 4.2 that was 

Specific PII identified in 

Section 4.2 that was 

Specific PII identified in 

Section 4.2 that was 

Specific PII identified in 

Section 4.2 that was 
10 

acquired from this 

source:_Applicable PII 

fields are based on what 

is required in ANSI ASC 

X12N v5010 835 EDI 

format: Patient Name, 

Health Plan Beneficiary 

Number, Patient ID 

Number, Membership 

Plan, Medical/Health 

Info 

acquired from this 

source:_Applicable PII 

fields are based on what 

is required in ANSI ASC 

X12N 837 v5010 EDI 

format: Patient Name, 

DOB, Gender, Patient 

Address, Zip Code, 

Spouse Info (only if 

subscriber), Health Plan 

Beneficiary Number, 

Patient ID Number, 

Membership Plan, 

Medical/Health Info 

acquired from this 

source:_May contain 

Business Taxpayer 

Identification Number, 

not explicit field for 

Third party insurance 

plan payers and 

provider in ACH

acquired from this 

source:__________ 

(identify all). 

Manner in which 

information is acquired 

from source by the 

Treasury project/system: 

(select all that apply): 

Manner in which 

information is acquired 

from source by the 

Treasury project/system: 

(select all that apply): 

Manner in which 

information is acquired 

from source by the 

Treasury project/system: 

(select all that apply): 

Manner in which 

information is acquired 

from source by the 

Treasury project/system: 

(select all that apply): 

 From a paper or 

electronic form provided 

to individuals, the public 

or members of a 

particular group 

 From a paper or 

electronic form provided 

to individuals, the public 

or members of a particular 

group 

 From a paper or 

electronic form provided 

to individuals, the public 

or members of a particular 

group 

 From a paper or 

electronic form provided 

to individuals, the public 

or members of a 

particular group 

Please identify the form 

name (or description) 

and/or number (e.g., 

OMB Control Number): 

_________________

Please identify the form 

name (or description) 

and/or number (e.g., OMB 

Control Number): 

_________________

Please identify the form 

name (or description) 

and/or number (e.g., OMB 

Control Number): 

_________________

Please identify the form 

name (or description) 

and/or number (e.g., 

OMB Control Number): 

_________________

 Received in paper 

format other than a form. 

 Received in paper 

format other than a form. 

 Received in paper 

format other than a form. 

 Received in paper 

format other than a form. 

 Delivered to the 

project on disk or other 

portable device and 

uploaded to the system. 

 Delivered to the project 

on disk or other portable 

device and uploaded to the 

system. 

 Delivered to the project 

on disk or other portable 

device and uploaded to the 

system. 

 Delivered to the 

project on disk or other 

portable device and 

uploaded to the system. 

 Accessed and 

downloaded or otherwise 

acquired via the internet 

 Accessed and 

downloaded or otherwise 

acquired via the internet 

 Accessed and 

downloaded or otherwise 

acquired via the internet 

 Accessed and 

downloaded or otherwise 

acquired via the internet 

 Email Email Email Email 

 Scanned documents 

uploaded to the system. 

 Scanned documents 

uploaded to the system. 

 Scanned documents 

uploaded to the system. 

 Scanned documents 

uploaded to the system. 

 Bulk transfer Bulk transfer Bulk transfer Bulk transfer 

 Extracted from 

particular technology 

(e.g., radio frequency 

identification data 

(RFID) devices, video or 

photographic cameras, 

 Extracted from 

particular technology (e.g., 

radio frequency 

identification data (RFID) 

devices, video or 

photographic cameras, 

 Extracted from 

particular technology (e.g., 

radio frequency 

identification data (RFID) 

devices, video or 

photographic cameras, 

 Extracted from 

particular technology 

(e.g., radio frequency 

identification data 

(RFID) devices, video or 

photographic cameras, 
11 

biometric collection 

devices). 

biometric collection 

devices). 

biometric collection 

devices). 

biometric collection 

devices). 

 Fax Fax Fax Fax 

 Extracted from notes 

of a phone interview or 

face to face contact 

 Extracted from notes of 

a phone interview or face 

to face contact 

 Extracted from notes of 

a phone interview or face 

to face contact 

 Extracted from notes 

of a phone interview or 

face to face contact 

 Other: Please describe:

_________________ 

 Other: Please describe: 

_________________ 

 Other: Please describe: 

_________________ 

 Other: Please describe:

_________________ 

 Other: Please describe:

_________________ 

 Other: Please describe: 

_________________ 

 Other: Please describe: 

_________________ 

 Other: Please describe:

_________________ 

Section 4.4: Privacy and/or civil liberties risks related to collection

Notice of Authority, Principal Uses, Routine Uses, and Effect of not Providing 

Information

When federal agencies use a form to obtain information from an individual that will be 

maintained in a system of records

authority (whether granted by statute, or by executive order of the President) which authorizes 

the solicitation of the information and whether disclosure of such information is mandatory or 

voluntary; (B) the principal purpose or purposes for which the information is intended to be 

used; (C) the routine uses which may be made of the information as published pursuant to 

paragraph (4)(D) of this subsection; and (D) the effects on her/him, if any, of not providing all or 

any part of the requested § 522a(e)(3). 

Section 4.4(a) Yes No Is any of the PII maintained in the system or by the project 

collected directly from an individual? The covered entity is responsible for the collection of 

information from the individual. The business associate agreement outlines obligations of 

the covered entity to have obtained or will obtain from Individuals any authorization necessary 

for Business Associate to fulfill its obligations under current agreement.

Section 4.4(b) Yes No N/A Was the information collected from the individual using 

a form (paper or electronic)? 

Section 4.4(c) Yes No 

individual notified (on the form in which the PII was collected or on a separate form that can 

be retained by the individual) about the following at the point where the information was 

collected (e.g., in a form; on a website). 

 The authority (whether granted by statute, or by Executive order of the President) 

which authorizes the solicitation of the information. 

 Whether disclosure of such information is mandatory or voluntary. 
12 

 The principal purpose or purposes for which the information is intended to be used. 

 The individuals or organizations outside of Treasury with whom the information 

may be/ will be shared. 

The effects on the individual, if any, if they decide not to provide all or any part of 

the requested information. 

Use of Social Security Numbers

acts against individuals. The SSN is one data element that has a heightened ability to harm the 

individual and requires more protection when used. Therefore, in an effort to reduce risk to 

individuals and federal agencies, government-wide initiatives aimed at eliminating unnecessary 

collection, use, and display of SSN have been underway since OMB required agencies to review 

their SSN practices in 2007. 

In addition, the Privacy Act federal, state or local 

government agency to deny to any individual any right, benefit, or privilege provided by law 

93 579, § 7. This provision does not apply to: (1) any disclosure which is required by federal 

statute; or (2) any disclosure of an SSN to any federal, state, or local agency maintaining a 

system of records in existence and operating before January 1, 1975, if such disclosure was 

required under statute or regulation adopted prior to such date to verify the identity of an 

individual. Id. at § 7(a)(2)(A)-(B). 

Section 4.4(d) Yes No N/A Does the system or project maintain SSNs? 

Section 4.4(e) Yes No N/A Are there any alternatives to the SSNs as a personal 

identifier? 

Section 4.4(f) Yes No N/A Will an individual be denied any right, benefit, or 

privilege provided by law if the individual refuses to disclose their SSN? If yes, please 

check the applicable box::

 SSN disclosure is required by Federal statute or Executive Order. ; or 

 the SSN is disclosed to any federal, state, or local agency maintaining a system of 

records in existence and operating before January 1, 1975, and disclosure was 

required under statute or regulation adopted prior to such date to verify the identity of 

an individual. If checked, please provide the name of the system of records below. 

Section 4.4(g) Yes No N/A When the SSN is collected, are individuals given notice 

whether disclosure is mandatory or voluntary, the legal authority such number is solicited, 

and what uses will be made of it? 

First Amendment Activities
13 

The Privacy Act provides that f

individual exercises rights guaranteed by the First Amendment unless expressly authorized by 

statute or by the individual about whom the record is maintained or unless pertinent to and within 

the scope § 552a(e)(7). 

Section 4.4(h) Yes No Does the system or project maintain any information 

describing how an individual exercises their rights guaranteed by the First Amendment? 

Section 4.4(i) If the system or project maintains information describing how an individual 

exercises their rights guaranteed by the First Amendment, do any of the following 

exceptions apply (the information may be maintained if any of the exceptions apply)? 

 N/A (system or project does not maintain any information describing how an 

individual exercises their rights guaranteed by the First Amendment so no exceptions 

are needed) 

 The individual about whom the information was collected or maintained expressly 

authorizes its collection/maintenance. 

 The information maintained is pertinent to and within the scope of an authorized 

law enforcement activity. 

 There is a statute that expressly authorizes its collection. 

Section 5: Maintenance, use, and sharing of the information 

. 

Section 5.1: Describe how and why the system or project uses the information it 

collects and maintains 

Please describe all of the uses of the information types and groupings collected and maintained 

by the system or project (see Section 4.2), including a discussion of why the information is used 

for this purpose and how it relates to the mission of the bureau or office that owns the system. 

 

General Biographical and Medical PII information received and maintained in the system 

is used for the following purpose: (1) are used for the billing of, and collections from, a 

third party (insurance carriers). 

bureau to promote the financial integrity and operational efficiency of the U.S. 

government through exceptional accounting, financing, collections, payments, and shared 

services. 

The use of electronic claims processing increases the efficiency of third party billing. In 

order to electronically submit claims, the third parties (health insurance carriers) require 

enrollment of health care providers from each IHS and VA health care facility. This 
14 

enrollment process enables the third party payers to set up electronic databases to 

recognize claims from a specific VA or IHS health care facility, and to grant permission 

to the their health care clearinghouse to submit claims and receive remittance and 

payment from a third party payer on behalf of each VA and IHS health care facility. 

For the purposes of health care billing and payment activities to and from third party 

payers, Bureau of the Fiscal Service EDI Program supporting VA and IHS providers will 

disclose information in accordance with the legislatively-mandated transaction standard 

and code sets promulgated by the United States Department of Health and Human 

Services (HHS) under the Health Insurance Portability and Accountability Act (HIPAA).

Collecting Information Directly from the Individual When Using it to Make Adverse 

Determinations About Them 

The Privacy Act requires that f

practicable directly from the subject individual when the information may result in adverse 

f

U.S.C. § 552a(e)(2). 

Section 5.1(a) Yes No Is it possible that the information maintained in the system or 

by the project may be used by Treasury to make an adverse determination about an 

whether the individual will receive a financial benefit, get a clearance or access to a Treasury 

facility, obtain employment with Treasury)? Use and disclosure is limited to what is needed 

to carry out Covered Entity obligations under Subpart E of 45 CFR Part 164

Section 5.1(b) Yes No Is it possible that Treasury will share information maintained 

in the system or by the project with a third party external to the Department that will use the 

information to make an adverse 

privileges under federal programs? 

Section 5.1(c) Yes No N/A If information could potentially be used to make an 

adverse determination 

programs, does the system or project collect information (to the greatest extent practicable) 

directly from the individual? 

Data Mining 

As required by Section 804 of the Implementing the 9/11 Commission Recommendations Act of 

2007 - Treasury reports annually to Congress on its data mining 

http://www.treasury.gov/privacy/annualreports. 
15 

Section 5.1(d) Yes No Is information maintained in the system or by the project used 

- Implementing the 9-11 

Commission Act? 

Section 5.2: Ensuring accuracy, completeness, and timeliness of information 

collected, maintained, and shared 

 

Exemption from Accuracy, Relevance, Timeliness, and Completeness Requirements 

The Privacy Act requires that federal agencies 

agency in making any determination about any individual with such accuracy, relevance, 

timeliness, and completeness as is reasonably necessary to assure fairness to the individual in the 

. § 552a(e)(5). If a particular system of records meets certain 

requirements (including the NPRM process defined in Section 2 above), an agency may exempt 

the system of records (or a portion of the records) from this requirement. 

Section 5.2(a) Yes No Is all or any portion of the information maintained in the 

system or by the project: (a) part of a system of records and (b) exempt from the accuracy, 

relevance, timeliness, and completeness requirements in sections (e)(5) of the Privacy Act? 

Information maintained within this service is not part of a system of record and is not used to 

make a determination about an individual. 

Computer Matching

The Computer Matching and Privacy Protection Act of 1988 amended the Privacy Act, imposing 

additional requirements when Privacy Act systems of records are used in computer matching 

programs. 

Matching programs must be conducted pursuant to a matching agreement between the source 

and recipient agencies. The matching agreement describes the purpose and procedures of the 

matching and establishes protections for matching records. 

Section 5.2(b) Yes No Is any of the information maintained in the system or by the 

project (a) part of a system of records and (b) used as part of a matching program? 

Section 5.2(c) Yes No N/A Is there a matching agreement in place that contains 

the information required by Section (o) of the Privacy Act? 

Section 5.2(d) Yes No N/A Are assessments made regarding the accuracy of the 

records that will be used in the matching program? 

Section 5.2(e) Yes No N/A Does the bureau or office that owns the system or 

project independently verify the information, provide the individual notice and an 
16 

opportunity to contest the findings, or obtain Data Integrity Board approval in accordance 

with Section (p) of the Privacy Act before taking adverse action against the individual? 

Ensuring Fairness in Making Adverse Determinations About Individuals 

any determination about any individual with such accuracy, relevance, timeliness, and 

completeness as is reasonably necessary to assure fairness to the individual in the 

5 U.S.C. § 552a(e)(5). This requirement also applies when merging records 

from two or more sources where the merged records are used by the agency to make any 

determination about any individual. 

Section 5.2(f) Yes No With respect to the information maintained in the system or 

by the project, are steps taken to ensure all information used to make a determination about 

an individual is maintained with such accuracy, relevance, timeliness, and completeness as 

 is reasonably necessary to assure fairness to the individual in the determination? 

Information maintained in the service is not part of a system of record and is not used to 

make a determination about an individual.

Merging Information About Individuals

Section 5.2(g) Yes No Is information maintained in the system or by the project 

merged with electronic or non-electronic information from internal or external sources (e.g., 

other files or systems)? 

Section 5.2(h) Yes No N/A Once merged, is the information used in making 

determinations about individuals (e.g., decisions about whether the individual will receive a 

financial benefit or payment, get a clearance or access to a Treasury facility, obtain 

employment with Treasury, etc.)? 

Section 5.2(i) Yes No N/A Are there documented policies or procedures for how 

information is merged? 

Section 5.2(j) Yes No N/A Do the documented policies or procedures address 

how to proceed when partial matches (where some, but not all of the information being 

merged matches a particular individual) are discovered after the information is merged? 

Section 5.2(k) Yes No N/A If information maintained in the system or by the 

project is used to make a determination about an individual, are steps taken to ensure the 

accuracy, relevance, timeliness, and completeness of the information as is reasonably 

necessary to assure fairness to the individual?

Policies and Standard Operating Procedures or Technical Solutions Designed to 

Ensure Information Accuracy, Completeness, and Timeliness 
17 

Section 5.2(l) Yes No N/A If information maintained in the system or by the 

 project is used to make any determination about an individual (even if it is an exempt 

system of records), are there documented policies or standard operating procedures for the 

system or project that address the accuracy, completeness, and timeliness of the information? 

Section 5.2(m) Yes No Does the system or project use any software or other technical 

solutions designed to improve the accuracy, completeness, and timeliness of the information 

used to make an adverse determination about an individual's rights, benefits, and/or privileges 

(regardless of if it is an exempt system of records)? 

Accuracy, Completeness, and Timeliness of Information Received from the Source

Section 5.2(n) Yes No Did Treasury or the bureau receive any guarantee, assurance, 

or other information from any information source(s) regarding the accuracy, timeliness and 

completeness of the information maintained in the system or by the project? 

Disseminating Notice of Corrections of or Amendments to PII

Section 5.2(o) Yes No N/A Where feasible and appropriate, is there a process in 

place for disseminating corrections of or amendments to the PII maintained in the system or 

by the project to all internal and external information-sharing partners? 

As Business Associate for this service, the program may not take any action concerning an 

Entity. The service will make available information for Covered Entity to respond to 

request for amendment of PHI about him/her and, as determined by and under the direction of 

Covered Entity, incorporate any amendment to the PHI.

Section 5.2(p) Yes No N/A Where feasible and appropriate, does the process for 

disseminating corrections or amendments include notifying the individual whose information 

is corrected or amended? This is the responsibility of the Covered Entity, the scope of this 

service or project is for Business Associate responsibilities.

Section 5.3: Information sharing within the Department of the Treasury

Internal Information Sharing

Section 5.3(a) Yes No Is PII maintained in the system or by the project shared with 

other Treasury bureaus? 

Section 5.3(b) Yes No Does the Treasury bureau or office that receives the PII limit 

access to those Treasury officers and employees who have a need for the PII in the 

PII is not shared with other Treasury Bureaus and is not applicable.
18 

Memorandum of Understanding (MOU)/Other Agreements Limiting Treasu

Internal Use/Disclosure of PII

Section 5.3(c) Yes No N/A Is any of the PII maintained in the system or by the 

project subject to the requirements of a Memorandum of Understanding or other agreement 

(e.g., agreement with another federal or state agency that provided the information to the 

Treasury or subject to an international agreement or treaty) that limits or places conditions on 

PII? 

Section 5.4: Information sharing with external (i.e., outside Treasury) organizations 

and individuals

External Information Sharing

Section 5.4(a) Yes No Is PII maintained in the system or by the project 

shared with agencies, organizations, or individuals external to Treasury? 

Accounting of Disclosures

Section 5.4(b) Yes No N/A With respect to records maintained in the system or by 

the project that are subject to the Privacy Act, do you maintain a paper or electronic log or 

other record of the date, nature, and purpose of each disclosure (not including intra-agency 

disclosures and FOIA disclosures) of a record to any person or to another agency (outside of 

Treasury) and the name and address of the person or agency to whom the disclosure is made? 

See 5 U.S.C § 552a(c). 

Section 5.4(c) Yes No N/A If you do not keep a running tabulation of every 

disclosure at the time it is made, are you able to reconstruct an accurate and complete 

accounting of disclosures so as to be able to respond to Privacy Act requests in a timely 

fashion? 

Section 5.4(d) Yes No N/A With respect to records maintained in the system or by 

the project that are subject to the Privacy Act, do you retain the log or other record of the 

date, nature, and purpose of each disclosure, for at least five years or the life of the record, 

whichever is longer, after the disclosure for which the accounting is made? 

Section 5.4(e) Yes No N/A With respect to records maintained in the system or by 

the project that are subject to the Privacy Act, does your bureau or office exempt the system 

of records (as allowed by the Privacy Act in certain circumstances) from the requirement to 
19 

make the accounting available to the individual named in the record? This service does not 

maintain system of records as defined in Privacy Act 

Section 5.4(f) Yes No N/A With respect to records maintained in the system or by 

the project that are subject to the Privacy Act, does your bureau or office exempt the system 

of records (as allowed by the Privacy Act in certain circumstances) from the requirement to 

inform any person or other agency about any correction or notation of dispute made by the 

agency of any record that has been disclosed to the person or agency if an accounting of the 

disclosure was made? 

Statutory or Regulatory Restrictions on Disclosure

Section 5.4(g) Yes No In addition to the Privacy Act, are there any other statutory or 

regulatory restrictions on the sharing of any of the PII maintained in the system or by the 

project (e.g., 26 U.S.C § 6103 for tax returns and return information)? 

45 CFR Part 164 Section E Privacy of Individually Identifiable Health Information 

Memorandum of Understanding Related to External Sharing

Section 5.4(h) Yes No N/A Has Treasury (including bureaus and offices) executed 

a Memorandum of Understanding, or entered into any other type of agreement, with any 

external agencies, organizations, or individuals with which/whom it shares PII maintained in 

the system or by the project?

Section 5.4(i) Yes No Is any of the PII maintained in the system or by the project 

subject to the requirements of a Memorandum of Understanding or other agreement (e.g., 

agreement with another federal or state agency, an international agreement or treaty, or 

contract with private vendor that provided the information to Treasury or one of its bureaus) 

sharing of the PII? 

Section 5.4(j) Yes No Is any of the PII maintained in the system or by the project 

subject to the requirements of a Memorandum of Understanding or other agreement in which 

disclosure of PII shared by Treasury? 

Obtaining Consent Prior to New Disclosures Not Included in the SORN or Authorized 

by the Privacy Act
20 

Section 5.4(k) Yes No 

appropriate, prior to any new disclosures of previously collected records in a system of 

records (those not expressly authorized by the Privacy Act or contained in the published 

SORN (e.g., in the routine uses))? 

 currently. Business 

associate agreements specify Covered Entity will not request Business Associate to make any Use or 

Disclosure of PHI in a manner that would not be permissible under Subpart E of 45 C.F.R. Part 

164. Agreement specifies that Covered Entities will obtain from individuals any authorization 

necessary for Business Associate to fulfill its obligations under the agreement.

Section 6: Compliance with federal information management 

requirements

Responses to the questions below address the practical, policy, and legal consequences of 

failing to comply with one or more of the following federal information management 

requirements (to the extent required) and how those risks were or are being mitigated: (1) the 

Privacy Act System of Records Notice Requirement; (2) the Paperwork Reduction Act; (3) the 

Federal Records Act; (4) the E-Gov Act security requirements; and (5) Section 508 of the 

Rehabilitation Act of 1973. 

Section 6.1: Privacy Act System of Records Notice (SORN)

For collections of PII that meet certain requirements, the Privacy Act requires that the agency 

publish a SORN in the Federal Register. 

System of Records

Section 6.1(a) Yes No Does the system or project retrieve records about an individual 

using an identifying number, symbol, or other identifying particular assigned to the 

individual? (See items selected in Section 4.2 above). 

(Treasury/Fiscal Service SORNs: https://www.fiscal.treasury.gov/fsabout/fs_privacy.htm) 

Section 6.1(b) Yes No N/A Was a SORN published in the Federal Register for 

this system of records? 

Section 6.2: The Paperwork Reduction Act

The PRA requires OMB approval before a federal agency may collect standardized data from 10 

or more respondents within a 12 month period. OMB requires agencies to conduct a PIA (i.e., 

PCLIA) when initiating, consistent with the PRA, a new electronic collection of PII for 10 or 

more persons (excluding agencies, instrumentalities, or employees of the federal government). 
21 

Paperwork Reduction Act Compliance

Section 6.2(a) Yes No Does the system or project maintain information obtained 

from individuals and organizations who are not federal personnel or an agency of the federal 

government (i.e., outside the federal government)? The service does not obtain information 

directly from the individual

Section 6.2(b) Yes No N/A Does the project or system involve a new collection 

of information in identifiable form for 10 or more persons from outside the federal 

government? 

Section 6.2(c) Yes No N/A Did the project or system complete an Information 

 

Section 6.3: Records Management - NARA/Federal Records Act Requirements

Records retention schedules determine the maximum amount of time necessary to retain 

information in order to meet the needs of the project or system. Information is generally either 

disposed of or sent to the NARA for permanent retention upon expiration of this period. 

NARA Records Retention Requirements

Section 6.3(a) Yes No Are the records used in the system or by the project covered 

Schedule (SRS)? 

Section 6.3(b) Yes No N/A Did NARA approved a retention schedule for the 

records maintained in the system or by the project? 

Section 6.3(c) Yes No N/A If NARA did not approve a retention schedule for the 

records maintained in the system or by the project and the records are not covered by 

as a draft retention schedule (approved by all 

applicable Treasury and/or Bureau officials) been developed for the records used in this 

project or system?

All Treasury owned data maintained by this system is retained and destroyed in accordance 

with the Fiscal Service File Plan. All Treasury owned records schedules and categories 

within the Fiscal Service File Plan are approved by NARA.

Section 6.4: E-Government Act/NIST Compliance 

The completion of Federal Information Security Modernization Act (FISMA) Security 

Assessment & Authorization (SA&A) process is required before a federal information system 

may receive Authority to 

Security Systems. 
22 

Federal Information System Subject to FISMA Security Assessment and Authorization

Section 6.4(a) Yes No N/A Is the system a federal information system subject to 

FISMA requirements? This is classified as a Service 

Section 6.4(b) Yes No N/A Has the system or project undergone a SA&A and 

received an ATO? 

Access Controls and Security Requirements

Section 6.4(c) Yes No Does the system or project include access controls to ensure 

limited access to information maintained by the system or project? 

Security Risks in Manner of Collection

Section 6.4(d) Yes No In Section 4.3 above, you identified the sources for information 

used in the system or project and the method and manner of collection. Were any security, 

privacy, or civil liberties risks identified with respect to the manner in which the information 

is collected from the source(s)? 

Security Controls When Sharing Internally or Externally

Section 6.4(e) Yes No N/A Are all Treasury/bureau security requirements met in 

the method of transferring information (e.g., bulk transfer, direct access by recipient, portable 

disk, paper) from the Treasury project or system to internal or external parties? 

Monitoring of Individuals

Section 6.4(f) Yes No Will this system or project have the capability to identify, 

locate, and monitor individuals or groups of people? 

Audit Trails

Section 6.4(g) Yes No Are audit trails regularly reviewed for appropriate 

use, handling, and disclosure of PII maintained in the system or by the project inside 

or outside of the Department? 

Section 6.5: Section 508 of the Rehabilitation Act of 1973

When federal agencies develop, procure, maintain, or use Electronic and Information 

Section 508 of the Rehabilitation Act of 1973 (as amended in 1998) 

requires that individuals with disabilities (including federal employees) must have access and use 
23 

(including privacy policies and directives as well as redress opportunities) that is comparable to 

that which is available to individuals who do not have disabilities. 

Applicability of and Compliance With the Rehabilitation Act

Section 6.5(a) Yes No Will the project or system involve the development, 

procurement, maintenance or use of EIT as that term is defined in Section 508 of the 

Rehabilitation Act of 1973 (as amended in 1998)? 

Section 6.5(b) Yes No N/A Does the system or project comply with all Section 

508 requirements, thus ensuring that individuals with disabilities (including federal 

employees) have access and use (including access to privacy and civil liberties policies) that 

is comparable to that which is available to individuals who do not have disabilities? 

Section 7: Redress

Access Under the Freedom of Information Act and Privacy Act

Section 7.0(a) Yes No Does the agency have a published process in place by which 

individuals may seek records under the Freedom of Information Act and Privacy Act? 

The Treasury FOIA and PA disclosure regulations can be found at 31 C.F.R. Part 1, 

Subtitle A, Subparts A and C. 

Privacy Act Access Exemption

Section 7.0(b) Yes No Was any of the information that is maintained in system of 

records and used in the system or project exempted from the access provisions of the Privacy 

Act? 

Additional Redress Mechanisms

Section 7.0(c) Yes No With respect to information maintained by the project or 

system (whether or not it is covered by the Privacy Act), does the bureau or office that owns 

the project or system have any additional mechanisms other than Privacy Act and FOIA 

remedies (e.g., a customer satisfaction unit; a complaint process) by which an individual may 

request access to and/or amendment of their information and/or contest adverse 

determinations about denial of their rights, benefits, and privileges under federal programs 

(e.g., decisions about whether the individual will receive a financial benefit, get a clearance 

or access to a Treasury facility, obtain employment with Treasury)? 

45 CFR Subpart E - Privacy of Individually Identifiable Health Information 

amendment, or accounting other than as instructed by Covered Entity per business associate 

agreements.