Privacy Impact Assessment 

Animal Care Information 

System (ACIS 3.0)

 Version: 1.4

 Date: February 20, 2019

 Prepared for: USDA OCIO TPA&E

 

 

Technology, Planning, 

Architecture, & E-Government 
Privacy Impact Assessment

 USDA-APHIS-AC, ACIS 3.0

3 

Privacy Impact Assessment for the

Animal Care Information System (ACIS 3.0) 

February 20, 2019

Contact Point 

Kay Carter-Corker 

APHIS Animal Care (AC)

301-851-3748

Reviewing Official 

Tonya G. Woods 

APHIS Privacy Act Officer 

United States Department of Agriculture

(301) 851-4076

Danna L. Mingo 

Privacy Compliance Officer

Information Security Branch

United States Department of Agriculture

(301) 851-2487
Privacy Impact Assessment

 USDA-APHIS-AC, ACIS 3.0

4 

Abstract 

System Name Animal Care Information System (ACIS 3.0)

System Description ACIS 3.0 is used by Animal Care (AC) personnel for 

inspections, data collection, data analysis, data management, 

monitoring and reporting to ensure compliance with Animal 

Welfare Act (AWA) and Horse Protection Act (HPA). 

Reason for PIA Based on the ACIS 3.0 Privacy Threshold Analysis (PTA), a 

full Privacy Impact Assessment is required. 

Overview 

Agency Animal and Plant Health Inspection Service (APHIS), 

Animal Care (AC) 

System Name Animal Care Information System (ACIS 3.0) 

System Owner Betty J. Goldentyer 

(301) 851-3744

betty.j.goldentyer@aphis.usda.gov

Purpose of the System The purpose of the system is to provide a standard 

approach to collect, record, analyze, maintain, and 

report information to cooperating and regulatory 

entities. 

General Description The system is used by Animal Care organization to 

maintain a record of activities conducted by regulated 

entities and the agency pursuant to the Animal Welfare 

Act (AWA, 7 U.S.C. 2131-2159), the Horse Protection 

Act (HPA, 15 U.S.C. 1821-1831) and the regulations 

issued thereunder. 

Description of Typical 

Transaction Conducted

ACIS 3.0 collects and manages customer data for 

license, registration, and research facility annual report 

data, which are part of the Animal Care collection. AC 

personnel access the customer’s address, site address, 

inspections, animal inventory, and contact phone 

numbers of the regulated entities. It provides AC 

personnel with the capability to enter and retrieve 

licensing, registration, inspection, and research facility 

data. The system allows Horse Industry Organizations 

(HIOs) to electronically complete the reporting 

requirements for the Horse Protection Act (HPA) with 

data gathered from horse events around the country 

and serves as a repository for various management 

reports and business process documentation.
Privacy Impact Assessment

 USDA-APHIS-AC, ACIS 3.0

5

Information Sharing ACIS 3.0 also serves as a central point for Animal 

Care management system support and content 

management whereby AC business processes 

documentation and standard operational procedures 

can be shared internally. There are no interconnections 

or information sharing with other system. 

Description of ACIS 3.0 

subsystems

The ACIS 3.0 database is designed to support the 

Animal Welfare Act (AWA), the Horse Protection Act 

(HPA), and Management Support system (MSS). 

1. The AWA portion contains information on 

individuals with certificates and others that 

have applied for a license or registration under 

the AWA. AWA inspection reports are 

generated by the database with data that is 

entered in to ACIS 3.0 by AC personnel. 

2. The HPA portion contains information on 

Horse Industry Organizations (HIO) and 

persons licensed to inspect horses under the 

HPA and data on these alleged violations. The 

ACIS 3.0 information flow for online and 

offline application can be found in ACIS 3.0 

Application Design document. 

3. MSS is a reporting module used by the AC 

Management Team and AC staff members that 

need the information for planning and 

management purposes that are vital to 

measuring work performance, operations, 

spending, resource allocation and distribution, 

and others. The MSS includes the following 

subsystems: (1) ACIS 3.0 Reports and Add 

Hoc; (2) Weekly Activity Management; (3) 

Budget Management; (4) Strategic/Operating 

Plans Management; (5) Performance 

Management; (6) Asset Management; (7) 

Documents Management; (8) Travel 

Management; and (9) Projects and Issues 

Management. 

4. AC-CMS provides a central point for 

information sharing whereby ACIS 3.0 

business processes, standard operational 

procedures, and data can be shared internally 

among AC staffs in AC offices. The 

information presented to AC staffs is in the 

form or report generation or read only screen 
Privacy Impact Assessment

 USDA-APHIS-AC, ACIS 3.0

6 

display. The reports consist of information 

related to AWA and HPA regulations, policies, 

and guidance issues thereunder. 

Legal Authority to operate 

the system ACIS 3.0 is a steady-state system. It had an ATO and 

is categorized as a “Moderate” system

1 Section 1.0 Characterization of the Information 

The following questions are intended to define the scope of the information requested and/or 

collected as well as reasons for its collection as part of the program, system, rule, or technology 

being developed. 

1.1 What information is collected, used, disseminated, or 

maintained in the system? 

Animal Welfare Act Records: 

The system includes paper and electronic records that include:

o Licensing and Registrations records, including, but not limited to, name and

business or address, telephone number, fax number, email address, and other contact 

information; tac identification number, customer number, license or registration 

certificate number, licensee and research facility annual reports related to persons who 

seek or hold an AWA license or registration, persons responsible to ensure humane 

care of the animals (i.e. attending veterinarians) located at AWA regulated facilities; 

payment details such as name, last four digits of credit card and expiration date, or 

check numbers and amount for those who have applied for license of renewal of 

license requiring a payment; and other records required for regulatory purposes under 

the AWA. 

o Compliance records, including but not limited to, inspection reports, itineraries, 

enforcement actions, and other compliance records required to be maintained by the 

facility and supporting documents, compliance- and –enforcement-related activities, 

and other records required from regulator purpose under the AWA.

o Regulatory correspondence, including but not limited to, information related to the 

denial or termination of a license or permit, and notices or advisories regarding alleged 

violations or noncompliance with the AWA, records, related to administrative and 

court litigation, correspondence between APHIS and a licensee/registrant or applicant, 

and other records required for regulatory purposed under the AWA. 

o Compliant records, including, but not limited to, witness or person who has submitted 

information, and statements to alleged violations and violations by persons who are 

subject to AWA.
Privacy Impact Assessment

 USDA-APHIS-AC, ACIS 3.0

7 

o Permit records, including, but not limited to, name, address, and other information for 

the permittee, permit application, health certificate, rabies vaccination certificate, etc.; 

and other records required for regulatory purpose under the AWA. 

Horse Protection Act Records: The system includes paper and electronic records includes the 

following records: 

o Management records, including, but not limited to, name, business, and/or home 

address, and other contact information for managers or other management 

representatives, sponsoring organizations, person designated to maintain management 

records, show judges, etc.; details of the events and locations, including, but not limited 

to, dates and addresses; and other records required for regulatory purposes under the 

HPA. 

o Transporter records including, but not limited to, the name and address, and other 

contact information of the horse owner and of the shipper, the trainer, the carrier 

transporting the horse, a the driver of the means of conveyance used; the origin of the 

shipment and date thereof; and the destination of shipment; and other records required 

for regulatory purposed under the HIPA. 

o HIO records, including, but not limited to, the name, address, and other contact 

information of each certified HIO, officers or persons charged with the management of 

the HIO, and the HIO’s formal request for certification and detailed outline for such 

program submitted for Department approval, rulebooks, and industry-implemented 

disciplinary procedures, and associated correspondence, the name and address of any 

person qualified to detect and diagnose a horse that is sore or to otherwise inspect 

horses for purposes of enforcing the HPA or the management of any horse show, 

exhibition, sale, or auction; identity of all horses at each event that management 

disqualified or excused for any reason, including the registered name of each horse and 

the name and address of the owner, trainer, rider, exhibitor, or other person having 

custody of or responsibility for the care of each such horse; the exhibitor’s number and 

class number, or the sale or auction tag number of the horse, the name and any 

applicable registered name and number (if the horse is registered), age, sex, color, and 

markings of the horse; disciplinary actions taken by the HIO against any exhibitor; 

photographs and videos depicting inspections conducted by HIO-licensed designated 

qualified person, HIO performance evaluations and statistics; and records required for 

regulatory purpose under the HPA. 

o Designated qualified persons records (persons qualified to detect and diagnose a horse 

that is sore or to otherwise inspect horses for purposes of enforcing the HPA) 

including, but not limited to the name, address, and other contact information, and each 

license number of each person who applies and/or is licensed to inspect horses in 

accordance with the HPA and regulations, information related to the disqualification of 

a person from holding a license to detect soreness in horses, and correspondences, 

including notice of performance concerns or license cancellation, details of inspections 

and identity of all horses at each event that the person recommended to management be 

disqualified or excused for any reason, including the registered name of each horse and 

the name and address of the owner, trainer, rider, exhibitor, or other person having 

custody of or responsibility for the care of each such horse; the exhibitor’s number and 

class number, or the sale or auction tag number of the horse, the name and any 
Privacy Impact Assessment

 USDA-APHIS-AC, ACIS 3.0

8 

applicable registered name and number (if the horse is registered), age, sex, color, and 

markings of the horse; photographs and videos depicting inspections conducted by 

designated qualified persons; performance evaluations and statistics; and other records 

required for regulatory purpose under HPA 

o Compliance and Regulatory Correspondence records, including, but not limited to, 

inspection findings, compliance, regulatory correspondence, investigations, and 

enforcements under the HPA, as well as records related to administrative, civil, and 

criminal litigation and other records required for regulatory purposes under HPA. 

o Compliance records, including, but not limited to, the name and address of a witness or 

person who has submitted a compliant concerning potential alleged violations and 

violations by persons who are subject to the HPA and nature of their complaint. 

1.2 What are the sources of the information in the system? 

The AWA information is received from the applicant for a license registration, or permit; 

the licensee, registrant, or permittee; the attending veterinarian; observations by APHIS 

inspectors; APHIS Investigative and Enforcement Service officials; or other person 

responsible for or who has information about the humane care of the animals.

The HPA information is received from the HIO and other entities that issue license; the 

HIO records submitted to APHIS; the management of the horse show, exhibition, auction, 

or sale; the horse management records submitted to APHIS; records submitted to APHIS 

by persons qualified to detect and diagnose a horse that is sore or otherwise inspect horses 

for purposes of enforcing the HPA; and the horse owner, trainer, custodian, rider, shipper, 

carrier, and transporter. Information may also be received from the witness or person who 

has submitted a complaint concerning potential alleged violations and violations by 

persons who are subject to the AWA or HPA, and APHIS employee. 

1.3 Why is the information being collected, used, 

disseminated, or maintained? 

The information collected is necessary to administer and enforce the AWA and HPA Act. 

1.4 How will the information be checked for accuracy? 

Information is checked for accuracy through data entry validation and audit reports prior to 

release to public. Additionally, during inspections and audits spot checks are done to validate 

the accuracy of records in the database.
Privacy Impact Assessment

 USDA-APHIS-AC, ACIS 3.0

9 

1.5 What specific legal authorities, arrangements, and/or 

agreements defined the collection of information? 

The Animal Welfare Act (AWA), 7 U.S.C. 2131 et seq., and the regulations issued 

thereunder, 9 C.F.R. parts 1 through 4; and the Horse Protection Act (HPA), 15 U.S.C. 

1821 et seq., and the regulations issued thereunder, 9 C.F.R. parts 11 and 12. 

1.6 Privacy Impact Analysis: Given the amount and type of data 

collected, discuss the privacy risks identified and how they were 

mitigated. 

Cyber-attacks on individuals with access to sensitive information in the system is the only risk 

identified. APHIS has implemented the following safeguards. Access to the restricted portions 

of the database system requires certain levels of authorization through USDA eAuthentication, 

which is a system that enables individuals to obtain user-identification accounts with 

password-protected access to certain USDA Web- based applications and services through the 

Internet. APHIS personnel who input data must have a high-level eAuthentication account. 

Persons who apply for a license or registration or are licensed or registered pursuant to the 

AWA have a lower level eAuthentication account and will only have access to their own 

records to input certain information. These individuals can also apply for, pay, or check the 

status of their application for a license, and their license or registration status. HIOs and 

persons qualified to detect and diagnose a horse that is sore or otherwise inspect horses for 

purposes of enforcing the HPA will only have access to input certain information in their own 

records, such as but not limited to information entered in the system by HIOs regarding 

disciplinary actions taken and information on sore horses that were disqualified or prohibited 

by management from participating in shows, exhibitions, sales, or auctions. The general public 

will have read-only access to system generated reports and query results through APHIS’ 

website that contains appropriate redactions to protect personal information. 

2 Section 2.0 Uses of the Information 

The following questions are intended to delineate clearly the use of information and the accuracy 

of the data being used. 

2.1 How is the information collected? 

AWA customers submit the information to APHIS via license or registration applications, 

a Federal debt collection act notice (SSN/EIN sheet), and a credit card payment 

authorization form. Members of the public and other entities submit to APHIS complaints 

on persons engaged in regulated activities. Inspectors collect information during the 

inspection. HIOs, persons qualified to detect and diagnose a horse which is sore or 
Privacy Impact Assessment

 USDA-APHIS-AC, ACIS 3.0

10

otherwise inspect horses for purposes of enforcing the HPA, and management of horse 

events submit the information to APHIS. The information is entered into ACIS 3.0 data 

entry fields by AC personnel. When the system is updated, persons who seek or hold a 

license or registration under the AWA will have access to their own records to input 

certain information. Registered research facilities may directly submit the annual report of 

animal use under the AWA. They will have access to only their own records. When fully 

developed, HIOs and persons qualified to detect soreness in a horse are also able to input 

certain information into the system from their own records, but do not have access to other 

non-public information. 

2.2 Describe all the uses of information. 

o ACIS 3.0 collects and manages customer data related to licensing, registration, and 

permitting under the AWA, which are part of the Animal Care collection. The 

system also collects information from individuals who import dogs into the United 

States for resale purposes. The system shares research facility annual report of 

animal use data with efile. 

o AC personnel access the customer’s address, site address, inspections, animal 

inventory, and contact phone number and other information of the regulated 

entities. It provides AC personnel with the capability to enter and retrieve 

licensing, registration, and inspection. 

o The system allows Horse Industry Organizations (HIOs) to electronically complete 

the reported requirements for the Horse Protection Act (HPA) with data gathered 

from horse events around the country and serve as a repository for various 

management reports and business process documentation 

o ACIS 3.0 also serves as a central point for Animal Care management system 

support and content management whereby AC business process documentation 

and standard operational procedures can be shared internally.

2.3 What types of tools are used to analyze data and what type of 

data may be produced? 

ACIS 3.0 utilizes the Oracle Weblogic framework for the web presentation driven by 

user roles and using a single interface for authorized users. Oracle Application Express 

(APEX) and Oracle Business Intelligence Publisher are used to analyze data. The data 

are produced in the form of PDF file, Excel spreadsheet and text file for various types 

of reports such as Inspection reports, Research Facility Annual Report, Complaints, 

Horse Industry Organization, Designated Qualified Persons (DQPs) and Horse 

Protection Program Report. 
Privacy Impact Assessment

 USDA-APHIS-AC, ACIS 3.0

11

2.4 If the system uses commercial or publicly available data please 

explain why and how it is used. 

ACIS 3.0 does not use commercial or publicly available data. 

2.5 Privacy Impact Analysis: Describe any types of controls that 

may be in place to ensure that information is handled in 

accordance with the above described uses. 

ACIS 3.0 has the following security controls to ensure that PII information is handled in 

accordance with the above described uses: 

o Access to the application must be authenticated via USDA eAuthentication requiring 

user ID and password. 

o Privileges and permissions assigned to enter, view, update, modify or delete the 

information given to individual user account are based on their job’s roles and 

responsibilities. 

o Individuals that handle PII take USDA Role-based Privacy training. 

o Sensitive data such as social security number or tax identification number are 

encrypted at rest and in transit. 

o The laptop has the APHIS approved standard image that is PIV card enabled. 

o We placed security controls and proper redaction methods on the inspection reports 

and research facility annual reports to prevent manipulation of the reports and 

exposure of PII. 

3 Section 3.0 Retention 

The following questions are intended to outline how long information will be retained after the 

initial collection. 

3.1 How long is information retained? 

Paper and electronic records will be retained in accordance with disposition authority NI463-09-9 which is currently being updated. Some records considered as permanent will be 

maintained in accordance with NARA requirements. 

3.2 Has the retention period been approved by the component 

records officer and the National Archives and Records 

Administration (NARA)? 

Yes, but are in the process of updating and ensuring all of the data is approved. 
Privacy Impact Assessment

 USDA-APHIS-AC, ACIS 3.0

12

3.3 Privacy Impact Analysis: Please discuss the risks associated 

with the length of time data is retained and how those risks are 

mitigated. 

There are no additional risks associated with the length of time the data is retained. Data 

are maintained and disposed of in accordance with APHIS records retention schedules 

(except where litigation and other holds apply), access control procedures and APHIS 

Directive 3440.2 which outlines the appropriate procedures for disposing of media and 

data on media in a manner that makes it impossible to recover.

4 Section 4.0 Internal Sharing and Disclosure

The following questions are intended to define the scope of sharing within the United States 

Department of Agriculture. 

4.1 With which internal organization(s) is the information shared, 

what information is shared and for what purpose?

The information from ACIS 3.0 is shared with: 

APHIS Investigative and Enforcement Services and USDA Office of General Counsel to: 

o Share inspection findings and generate regulatory correspondence (including 

information related to the denial or termination of a license, and notices or advisories 

regarding alleged violations with the AWA, and information regarding complianceand enforcement-related activities (including copies of pre-litigation settlement 

agreements, stipulations, and records related to formal administrative enforcement 

proceedings). 

o Share information on Department-certified HIOs, management of horse shows or other 

regulated events, and persons who are qualified to detect and diagnose a horse which is 

sore or otherwise inspect horses for the purposes of enforcing the HPA and the 

regulations thereunder; 

o Share information regarding any person who is under disqualification and therefore 

ineligible to participate in a horse event; the identity of all horses that a qualified 

person recommended to be disqualified or excused for any reason; and generate 

regulatory correspondence (including information related to the disqualification of a 

person from holding a license to detect soreness in horses, and notices or advisories 

regarding alleged violations or violations with the HPA), and information about 

compliance- and enforcement-related activities (including copies of pre-litigation 

settlement agreements, stipulations, and records related to formal administrative 

enforcement proceedings), in accordance with the HPA and regulations and to promote 

compliance. 
Privacy Impact Assessment

 USDA-APHIS-AC, ACIS 3.0

13

o APHIS Legislative and Public Affairs to respond to requests for information to comply 

with the Freedom of Information Act. 

o National Finance Center to process required fees 

4.2 How is the information transmitted or disclosed? 

Animal Care transmits/discloses PDF or read only web display to APHIS programs 

. 

4.3 Privacy Impact Analysis: Considering the extent of internal 

information sharing, discuss the privacy risks associated with 

the sharing and how they were mitigated. 

There is an inherent risk associated with the sharing of privacy data internally. However, 

APHIS internal staff whose responsibilities involve the handling of privacy data is 

required to undergo privacy awareness training. 

5 Section 5.0 External Sharing and Disclosure 

The following questions are intended to define the content, scope, and authority for information 

sharing external to USDA, which includes Federal, state and local government, and the private sector. 

5.1 With which external organization(s) is the information 

shared, what information is shared, and for what 

purpose? 

Routine uses of records maintained in the system, including categories of users and the purposes 

of such uses: 

In addition to those disclosures generally permitted under 5 U.S.C. 552a (b) of the Privacy Act, 

records maintained in the system may be disclosed outside USDA as follows: 

1. APHIS may disclose, the name, city, and State, license or registration type and/or status, 

or change of a licensee and registrant to any person pursuant to 9 CFR 2.38(c) and 2.127; 

2. APHIS may disclose annual reports submitted to APHIS by licenses and research facilities 

to any person pursuant to 9 CFR 2.7 and 2.36; 

3. APHIS may disclose inspection reports and other regulatory correspondences issued to 

licensees and registrants [from the agency] to any attending veterinarian in order to carry 

out duties under AWA pursuant to 9 CFR 2.33 and 2.40 

4. APHIS may disclose the name, telephone number, and other contact information, location, 

inspection reports, and regulatory correspondences of licensees, registrants, permitees, and 

applicants for the same, to appropriate Federal, foreign, State, local, Tribal, or other public 

authority agencies or officials, in order to carry out duties under the AWA or State, local, 

Tribal or other public authority on the same subject pursuant to 7 U.S.C. 2145(b); 
Privacy Impact Assessment

 USDA-APHIS-AC, ACIS 3.0

14

5. APHIS may disclose the inspection reports of licensees and registrants, and permit status, 

to any pet store or other entity that is required under State, local, Tribal, or other public 

authority to verify a licensee, registrant, or permitee’s compliance with the AWA;

6. APHIS may disclose information to the National Academies of Science, Engineering, and 

Medicine, and any other research institution engaged or approved by the Department, to 

the extent APHIS deems the disclosure necessary to complete research and/or compile a 

report in the furtherance of the Departments Mission 

7. APHIS may disclose final adjudicatory AWA and HPA decisions or order by an 

appropriate authority to any person 

8. APHIS may disclose to any person the name, city, and State or other information to the 

extent necessary for proper identification of persons (referred to as “Designated Qualified 

Persons” or “DQPs”) that are or have been qualified to detect and diagnose a horse that is 

sore or otherwise inspect horses for the purpose of enforcing the HPA and of horse 

industry organizations or associations (referred to as HIOs) that have currently or had in 

the past D1P programs certified by USDA; 

9. APHIS may disclose to any regulated horse owner, HIO, and other entities responsible for 

licensure or required to verify compliance with the HPA, HPA inspection findings and 

regulatory and other correspondence issued to persons or entities regulated under the 

HPA;

10. APHIS may disclose to any person the name, city, State or other information to the extent 

necessary for proper identification of any person or entity who has been disqualified, 

suspended, and/or otherwise prohibited from showing or exhibiting any horse, or judging 

or managing any horse show, horse exhibition, horse sale, or horse auction under the HPA 

and the terms of such action; 

11. APHIS may disclose to any person the name, city, and State or other information to the 

extent necessary for the proper identification of nay regulated individuals or entity whose 

license or permit has been suspended, revoked, expired, terminated, or denied, under the 

AWA and the term of such action; 

12. APHIS may disclose to appropriate law enforcement agencies, entities, and persons, 

whether Federal, foreign, State, local, or Tribal, or other public authority responsible for 

enforcing, investigating, or prosecuting an alleged violation or a violation of law or 

charged with enforcing, implementing, or complying with a statute, rule, regulation, or 

order issued pursuant thereto, when a record in this system on its face, or in conjunction 

with other records, indicates a violation or potential violation of law, whether civil, 

criminal, or regulatory in nature, and whether arising by general statute or particular 

program statute, or by regulation, rule, or court order issued pursuant thereto, if the 

information disclosed is relevant to any enforcement, regulatory, investigative, or 

prospective responsibility of the receiving entity. 

13. APHIS may disclose to the Department of Justice when the agency, or any component 

thereof, or any employee of the agency in his or her official capacity, or any employee of 

the agency in his or her individual capacity where the Department of Justice has agreed to 

represent the employee, or the United States, in litigation, where the agency determines 

that litigation is likely to affect the agency or any of its components, is a party to litigation 

or has an interest in such litigation, and the use of such records by the Department of 

Justice is deemed by the agency to be relevant and necessary to the litigation; provided, 

however, that in each case, the agency determines that disclosure of the records to the 
Privacy Impact Assessment

 USDA-APHIS-AC, ACIS 3.0

15

Department of Justice is a use of the information contained in the records that is 

compatible with the purpose for which the records were collected; 

14. APHIS may disclose information in a systems of records to a court or adjudicative body in 

administrative, civil, or criminal proceedings when: (a)The agency or any component 

thereof; or (b) any employee of the agency in his or her official capacity; or (c) any 

employee of the agency in his or her individual capacity where the agency has agreed to 

represent the employee; or (d) the United States Government, is a party to litigation or has 

an interest in such litigation, and by careful review, the agency determines that the records 

is therefore deemed by the agency to be for a purpose that is compatible with the purpose 

for which the agency collected the records;

15. APHIS may disclose information from this system or records to appropriate agencies, 

entities, and persons when: (a) USDA suspects or has confirmed that there has been a 

breach of the system of records; (b) USDA has determined that as a result of the suspected 

or confirmed breach there is a risk of harm to individuals, USDA (including its 

information systems, programs, and operations), the Federal Government, or national 

security; and (c) the disclosure made to such agencies, entities, and persons is reasonably 

necessary to assist in connection with USDA’s efforts to respond to the suspected or 

confirmed compromise and prevent, minimize, or remedy such harm; 

16. APHIS may disclose information from this system or records to another Federal agency or 

Federal entity, when information from this system of records is reasonably necessary to 

assist the recipient agency or entity in (a) responding to a suspected or confirmed breach 

or (b) preventing, minimizing, or remedying the risk of harm to individuals, the agency 

(including its information systems, programs and operations), the Federal Government, or 

national security. 

17. APHIS may disclose information in the systems of records to USDA contractors and other 

parties engaged to assist in administering the program, analyzing data, and conducting 

audits. Such contractors and other parties will be bound by the nondisclosure provisions of 

the Privacy Act;

18. APHIS may disclose information in the system or records to USDA contractors, partner 

agency employees or contractors, or private industry employed to identify patterns, trends, 

or anomalies indicative of fraud, waste, or abuse; 

19. APHIS may disclose information from the system of records to a Congressional office 

from the record of an individual in response to any inquiry from that Congressional office 

made at the written request of the individual to whom the record pertains; 

20. APHIS may disclose information in this system or records to the National Archives and 

Records Administration or to the General Services Administration for records 

management inspections conducted under 44 U.S.C. 2904 and 2906; and 

21. APHIS may disclose information in this system or records to the National Finance Center 

and Treasury Department as necessary to carry out any and all functions within their 

jurisdiction, including but not limited to, processing payments, fees, and collections, 

penalties, and offsets

5.2 Is the sharing of personally identifiable information outside the 

Department compatible with the original collection? If so, is it 

covered by an appropriate routine use in a SORN? If so, please 
Privacy Impact Assessment

 USDA-APHIS-AC, ACIS 3.0

16

describe. If not, please describe under what legal mechanism 

the program or system is allowed to share the personally 

identifiable information outside of USDA. 

Yes. The routine uses is covered in the SORN Animal Welfare Act and Horse Protection Act 

USDA/APHIS-8, pending final approval on the amended SORN. 

5.3 How is the information shared outside the Department and 

what security measures safeguard its transmission?

 

Information is shared via read-only PDF document and/or read-only web browser display. 

Public accesses the APHIS website to search for the read-only display of ACIS 3 data and 

information, with appropriate redactions to protect personal information. 

5.4 Privacy Impact Analysis: Given the external sharing, explain 

the privacy risks identified and describe how they were 

mitigated. 

Persons may attempt to manipulate the computer generated inspection reports and research 

facility annual reports to reveal PII. We placed security controls and proper redaction methods 

on the documents to prevent manipulation of the reports and exposure of PII. 

6 Section 6.0 Notice 

The following questions are directed at notice to the individual of the scope of information 

collected, the right to consent to uses of said information, and the right to decline to provide 

information. 

6.1 Was notice provided to the individual prior to collection 

of information? 

Yes. The public was provided notice in the SORN USDA/APHIS-8 published in the 

Federal Register, pending final approval of the amended SORN. Information is collected 

on approved APHIS forms, which all forms contain paper work reduction act statements 

as required by the paperwork reduction act (PRA). The forms contain a privacy act notice, 
Privacy Impact Assessment

 USDA-APHIS-AC, ACIS 3.0

17

pending final approval of the Privacy Impact Assessment and the SORN. The forms 

include: APHIS 7001 US Interstate and International Certificate of Health Examination 

for Small Animals; APHIS 7001a Continuation sheet for US Interstate and International 

Certificate of Health Examination for Small Animals; APHIS 7002 Animal Care Program 

of Veterinary Care for Research Facilities or Exhibitors/Dealers; APHIS 7003 Application 

for License Renewal; APHIS 7003A Application for New License; APHIS 7005 Record 

of Acquisition for Dogs and Cats on Hand; APHIS 7006 Record of Disposition of Dogs 

and Cats; APHIS 7006a Continuation Sheet for Record of Disposition of Dogs and Cats; 

APHIS 7007-License Certificate; APHIS 7011 Application for Registration Update; 

APHIS 7011A Application for New Registration; APHIS 7019 Record of Animal on 

Hand; APHIS 7020 Record of Acquisition, Disposition, or Transport of Animals (other 

than dogs and cats); APHIS 7020a Continuation Sheet for Record of Acquisition, 

Disposition, or Transport of Animals (other than dogs and cats); 7021-Registration 

Certificate; APHIS 7023 Research Facility Annual Report; APHIS 7023a Continuation 

Sheet for Annual Report of Research Facility; 7060-Official Warning Violations of 

Federal Regulations, APHIS 7077 USDA, APHIS, Summary of Alleged Violations (Horse 

Protection Act); APHIS 7030 Federal Debt Collection Act form; APHIS 7031-Credit Card 

Payment Authorization; APHIS 7033-Notification of Change; APHIS 7040-Live Dog 

Import Application and Permit; APHIS-7040B-Live Dog Import Application Permit 

Additional Information; APHIS 7041-Live Dog Import Health and Rabies Certificates; 

APHIS 7060-Official Warning Violations of Federal Regulations, APHIS 7077 USDA, 

APHIS, Summary of Alleged Violations (Horse Protection Act), 

6.2 Do individuals have the opportunity and/or right to 

decline to provide information? 

Individuals who are subject to be in compliance with the AWA and HPA regulations are 

required to provide the requested information. 

6.3 Do individuals have the right to consent to particular 

uses of the information? If so, how does the individual 

exercise the right? 

No because the information is used to determine compliance with the AWA and HPA. 

6.4 Privacy Impact Analysis: Describe how notice is 

provided to individuals, and how the risks associated 
Privacy Impact Assessment

 USDA-APHIS-AC, ACIS 3.0

18

with individuals being unaware of the collection are 

mitigated. 

The System of Record Notice (SORN) Animal Welfare Act and Horse Protection Act 

USDA-APHIS-8 is the official notice. No information is collected without an individual’s 

awareness. The forms contain a privacy act notice, pending final approval of the Privacy 

Impact Assessment and the SORN. At the time of data collection, a form is being 

completed or the individual is speaking with a Federal employee. 

7 Section 7.0 Access, Redress and Correction 

The following questions are directed at an individual’s ability to ensure the accuracy of the 

information collected about them. 

7.1 What are the procedures that allow individuals to gain 

access to their information? 

The Agency has exempted this system of records from the notification, access, and 

amendment provisions of the Privacy Act. The Agency has exempted this system from 

subsections (c)(3); (d); (e)(1), (4)(G), (H), and (I); and (f) of the Privacy Act pursuant to 5 

U.S.C. § 552a(k)(2). The exemptions will be applied only to the extent that the 

information in the system is subject to exemption pursuant to 5 U.S.C. § 552a(k)(2). An 

individual who is the subject of a record in this system may seek access to those records 

that are not exempt from the access provisions. A determination whether a record may be 

accessed will be made at the time a request is received. All inquiries should be addressed 

to the Chief FOIA Officer, Department of Agriculture, 1400 Independence Avenue, SW, 

Washington, D.C. 20250. 

7.2 What are the procedures for correcting inaccurate or 

erroneous information? 

Individuals seeking to contest or amend information maintained in the system should 

direct their requests to the address indicated in section 7.1 above. Some information may 

be exempt from the amendment provisions, as described in section 7.1 above. An 

individual who is the subject of a record in this system may seek amendment of those 

records that are not exempt. A determination whether a record may be amended willbe 

made at the time a request is received. 
Privacy Impact Assessment

 USDA-APHIS-AC, ACIS 3.0

19

7.3 How are individuals notified of the procedures for 

correcting their information? 

Individuals are notified of procedures for correcting their information in the 

USDA/APHIS-8 SORN that published in the Federal Register, pending final approval of 

the amended SORN. 

7.4 If no formal redress is provided, what alternatives are 

available to the individual? 

Individuals seeking to contest or amend information maintained in the system should 

direct their requests to the address indicated in section 7.1 above. Some information may 

be exempt from the amendment provisions, as described in section 7.1 above. An 

individual who is the subject of a record in this system may seek amendment of those 

records that are not exempt. A determination whether a record may be amended will be 

made at the time a request is received.

7.5 Privacy Impact Analysis: Please discuss the privacy 

risks associated with the redress available to 

individuals and how those risks are mitigated. 

APHIS has a formal redress procedure in place and there is minimum risk. 

8 Section 8.0 Technical Access and Security 

The following questions are intended to describe technical safeguards and security measures. 

8.1 What procedures are in place to determine which users 

may access the system and are they documented? 

Access to ACIS 3.0 is based on the need to conduct business with Animal Care. Access 

must be requested in writing and approved by Animal Care Information System Security 

Manager (ISSM)
Privacy Impact Assessment

 USDA-APHIS-AC, ACIS 3.0

20

8.2 Will Department contractors have access to the 

system? 

Yes Department contractors have access to ACIS 3.0. 

8.3 Describe what privacy training is provided to users 

either generally or specifically relevant to the program 

or system? 

All USDA/APHIS employees provided access to the ACIS 3.0 are required to complete 

annual Information Technology (IT) Security Awareness Training and must sign APHIS 

Rules of Behavior form prior to receiving access to the information system. 

Individuals that handle PII take USDA Role-based Privacy training. 

All non-APHIS users (customers) are required to read the eAuthentication login screen 

before they login to input data into ACIS 3.0. 

8.4 Has Certification & Accreditation been completed for 

the system or systems supporting the program? 

Yes *(Note the Assessment and Authorization (A&A) on ACIS is completed and it is on a 

continuous monitoring required an A&A review annually) 

8.5 What auditing measures and technical safeguards are 

in place to prevent misuse of data?

Auditing is enabled within the application for defined auditable events including data 

uploads, modification to ACIS 3.0 schema objects, administrative access, unsuccessful 

and unauthorized access. Audit monitoring, analysis and reporting are reviewed weekly by 

AC Information System Security Manager (ISSM). 

8.6 Privacy Impact Analysis: Given the sensitivity and 

scope of the information collected, as well as any 

information sharing conducted on the system, what 
Privacy Impact Assessment

 USDA-APHIS-AC, ACIS 3.0

21

privacy risks were identified and how do the security 

controls mitigate them? 

There is a risk that personal information collected on individuals may be distributed 

beyond the intended audiences. ACIS 3.0 has access controls in place to ensure that only 

individuals with a valid need-to-know/need-to-share have access to the information in the 

database.

9 Section 9.0 Technology 

The following questions are directed at critically analyzing the selection process for any technologies 

utilized by the system, including system hardware and other technology. 

 9.1 What type of project is the program or system?

The project is a “web-enabled” application allowing USDA personnel, as well as external 

users with limited privileges, to access the application via the USDA eAuthentication 

system. Internal users login to the application using their PIV card and external users login 

with their eAuthentication account and password. 

9.1 Does the project employ technology which may raise 

privacy concerns? If so please discuss their 

implementation. 

No

10 Section 10.0 Third Party Websites/Applications 

The following questions are directed at critically analyzing the privacy impact of using third party 

websites and/or applications.
Privacy Impact Assessment

 USDA-APHIS-AC, ACIS 3.0

22

10.1 Has the System Owner (SO) and/or Information 

Systems Security Program Manager (ISSPM) reviewed 

Office of Management and Budget (OMB) 

memorandums M-10-22 “Guidance for Online Use of 

Web Measurement and Customization Technology” 

andM-10-23 “Guidance for Agency Use of Third-Party 

Websites and Applications”? 

Yes

10.2 What is the specific purpose of the agency’s use of 3rd 

party websites and/or applications? 

ACIS 3.0 does not use 3rd party websites and/or applications. 

10.3What personally identifiable information (PII) will 

become available through the agency’s use of 3rd party 

websites and/or applications.

ACIS 3.0 does not use 3rd party websites and/or applications. 

10.4 How will the PII that becomes available through the 

agency’s use of 3rd party websites and/or applications 

be used? 

ACIS 3.0 does not use 3rd party websites and/or applications. 

10.5 How will the PII that becomes available through the 

agency’s use of 3rd party websites and/or applications be 

maintained and secured? 

ACIS 3.0 does not use 3rd party websites and/or applications. 
Privacy Impact Assessment

 USDA-APHIS-AC, ACIS 3.0

23

10.6 Is the PII that becomes available through the agency’s 

use of 3rd party websites and/or applications purged 

periodically? 

ACIS 3.0 does not use 3rd party websites and/or applications. 

10.7 Who will have access to PII that becomes available 

through the agency’s use of 3rd party websites and/or 

applications? 

ACIS 3.0 does not use 3rd party websites and/or applications. 

10.8 With whom will the PII that becomes available 

through the agency’s use of 3rd party websites and/or 

applications be shared - either internally or externally? 

ACIS 3.0 does not use 3rd party websites and/or applications. 

10.9 Will the activities involving the PII that becomes 

available through the agency’s use of 3rd party websites 

and/or applications require either the creation or 

modification of a system of records notice (SORN)?

ACIS 3.0 does not use 3rd party websites and/or applications. 

10.10 Does the system use web measurement and 

customization technology? 

No 
Privacy Impact Assessment

 USDA-APHIS-AC, ACIS 3.0

24

10.11 Does the system allow users to either decline to 

opt-in or decide to opt-out of all uses of web 

measurement and customization technology? 

No 

10.12 Privacy Impact Analysis: Given the amount and 

type of PII that becomes available through the agency’s 

use of 3rd party websites and/or applications, discuss the 

privacy risks identified and how they were mitigated. 

N/A, ACIS 3.0 does not use 3rd party websites or applications. 

Responsible Officials 

Betty J. Goldentyer, APHIS-AC Associate Deputy Administrator 

United States Department of Agriculture