Version: 3.2018

Date: August 2018

Prepared for: USDA OCIO-Policy, E-Government 

and Fair Information Practices (PE&F)

Policy, E-Government and Fair Information Practices

Privacy Impact Assessment 

Veterinary Services 

NCAH NITC Platform (N2P)
Privacy Impact Assessment – NCAH NITC Platform (N2P)

Page 3

Privacy Impact Assessment for the

NCAH NITC Platform (N2P)

Contact Point 

Rod Chitty

N2P Program Manager

United States Department of Agriculture

515-337-7816

Reviewing Official 

Danna Mingo

APHIS Privacy Compliance Officer

United States Department of Agriculture

301-851-2487
Privacy Impact Assessment – NCAH NITC Platform (N2P)

Page 4

Document Revision and History

Revision Date Author, Title & Office Comments

1.2018 2 Feb 2018 Jon Hasse, ISSO, APHIS/VS

2.2018 29 Mar 2018 Jon Hasse CVB edits from Bonnie

3.2018 29 Aug 2018 Jon Hasse Applied USDA Privacy checklist
Privacy Impact Assessment – NCAH NITC Platform (N2P)

Page 5

Abstract

This Privacy Impact Assessment (PIA) is for the USDA, Animal and Plant Health Inspection 

Service (APHIS), Veterinary Services (VS), National Centers for Animal Health (NCAH) 

National Information Technology Center (NITC) Platform (N2P). N2P allows USDA to 

deliver and manage general capabilities to support day-to-day internal business operations for 

VS and ARS National Animal Disease Center (NADC). All capabilities are managed from 

Ames, IA. This PIA is being completed following the Privacy Threshold Analysis (PTA) 

conclusion requiring a PIA for N2P.

NCAH Portal is the only service in N2P that collects Personally Identifiable Information 

(PII). This assessment addresses NCAH Portal when the assessment question addresses 

collection of PII. The information collected or stored in the other N2P services is either not 

PII or will not be retrieved from the files by using the name or personal identifier of the 

individuals and is, therefore, in the opinion of the Department, not subject to provisions of the 

Privacy Act of 1974. 

Overview

The purpose of the N2P information system is to use NITC to deliver and manage general 

capabilities to support day-to-day internal business operations for VS and ARS NADC. N2P 

capabilities are mainly used at NCAH in Ames, IA. NITC allows VS and NADC to perform 

these primarily administrative tasks in an enterprise environment that is reliable and cost 

effective. VS has procured and configures an application server and database service offered 

by NITC to deliver the following capabilities to VS and NADC:

Internal Capabilities

NCAH BioSafety Application (BIOSAFETY): BIOSAFETY improves the NCAH ability 

to meet federal, USDA, and external reporting requirements on biologically contaminated 

equipment management, biosafety management, select agent certifications and biosafety 

training.

Field Activity Report (FAR): FAR supports monitoring and reporting of field work efforts 

in support of key VS program and mission areas.

Glassware Repository and Media Service (GRAMS): GRAMS records the formulations, 

ordering, production, delivery and inventory of glassware and media supplies needed to 

support NCAH testing and research laboratories.

Information Technology (IT) Governance Application (ITGOV): ITGOV allows portfolio 

and project management personnel to predict, request, execute, and report expense related 

information concerning governed IT investments. ITGOV supports the APHIS and USDA 

governance requirements.
Privacy Impact Assessment – NCAH NITC Platform (N2P)

Page 6

User Management Service (UMS): UMS automates application user access authorization 

and user recertification. Employee supervisors can request and certify the need for 

application access. Application owners can authorize, validate, and manage recertification 

for access to integrated systems.

Licensing, Serial Release, & Testing Information Service (LSRTIS): LSRTIS manages 

regulatory program information associated with the Virus, Serum, and Toxin Act required 

for CVB to make decisions about the safety and efficacy of veterinary biologics products 

produced and distributed in the United States and exported throughout the world.

External Capabilities

NCAH Portal (Portal): Portal provides a secure gateway for external customers allowing 

digital communication with the NCAH programs. Submissions are validated and directly 

entered into VS internal information systems. Customers can get near real-time status 

updates on their diagnostic, biologic, and licensing submissions as well as historical search 

capabilities. 

The information in the system is either non-PII (e.g. training titles, chemical names, 

equipment names, document names, and animal information), USDA employee information 

(e.g. name, phone, and email), animal/specimen information (e.g. weight, slaughter date, flock 

size), liaison information (e.g. business contact), or animal owner/sample submitter PII that is 

limited to name and contact information.

Typical transactions are either completely internal to the USDA, or include internet facing 

data submissions. Internal transactions include tracking equipment, reporting work tasks, 

ordering glassware, authorizing employee roles, and notifying USDA employees by email.

Center for Veterinary Biologics

The first type of transaction originating over the internet support submitting information to 

USDA and receiving results, all electronically. Biologic firms can submit digital forms and 

respond to USDA processing to support the USDA regulation of biologic firms. USDA 

Center for Veterinary Biologics (CVB) maintains this transaction, dataflow, and information 

entirely inside N2P.

National Veterinary Services Laboratories

In the second transaction over the internet, animal owners or sample submitters can submit 

request forms for laboratory tests from National Veterinary Services Laboratories (NVSL). 

Test results can be returned to submitter or owners through N2P. All internet facing 

transactions are protected by USDA e-Authentication. E-Authentication uniquely identifies 

each user of N2P. Submitters can only access the submissions and their test results. Given 

the complexity of the laboratory testing, laboratory testing in managed in a different system, 
Privacy Impact Assessment – NCAH NITC Platform (N2P)

Page 7

VS Laboratory Information System (VS LIMS) (CSAM #1226). Test results are moved from 

VS LIMS to N2P in order to return results to the animal owner or submitter.

Authorities

CVB has a specific legal authority supporting the use of N2P Under the 1913 Virus–Serum–

Toxin Act where USDA APHIS is responsible for ensuring that all veterinary biologics 

produced in or imported into the United States are pure, safe, potent, and effective. This 

regulatory activity is accomplished by Title 9, Code of Federal Regulations, Parts 101 to 123 

by the CVB in Ames, IA.

The NVSL safeguards U.S. animal health and contribute to public health by ensuring that 

timely and accurate laboratory support is provided by their nationwide animal-health 

diagnostic system.

Section 1.0 Characterization of the Information 

The following questions are intended to define the scope of the information requested and/or 

collected as well as reasons for its collection as part of the program, system, rule, or 

technology being developed. 

1.1 What information is collected, used, disseminated, or maintained in 

the system? 

The following information is collected with N2P:

Customer:

• Veterinary Biologics Firm Name

 Subsidiary/Division Names

 Firm Address (Multiple Administrative & Production Sites)

 Firm Contact Name

 Firm Contact Phone No.

 Firm Contact e-mail

 Firm Contact Educational Credentials

 Firm Contact Position at Firm and no. of years at Firm

• Submitters of Diagnostic samples (Customers)

 Shipping Address o Invoice Address o Contact Name

 Contact Phone Number

 Contact e-mail

 NVSL Submitter ID

US Government Employee:

• Employee Information

 Employee Name

 Employee Job Title

 Employee Business Phone no.
Privacy Impact Assessment – NCAH NITC Platform (N2P)

Page 8

 Employee E-mail

 Employee Supervisor

 Employee Organizational Group within NADC, NVSL and CVB

Diagnostic sample information:

•Wildlife/ Zoo/ owner 

• If owner then:

 Owner Name

 Owner City

 Owner State

 Owner Zip

 Owner Country 

•Location of Animal

•Total Numbers of Animals 

•Herd or Flock size

•Herd or Flock affected 

•Herd or Flock Dead 

•Date collected 

•Collected by Authorized by Preservation

• Purpose 

•Country origin

•Country destination 

• FAD Number 

•Referral Number

•Total Number of Specimens 

•Total Number of Animals 

•Testing information

• Sample information 

•Comments

Slaughtering Establishment Information:

•Establishment ID 

•Establishment Name 

•Establishment Address 

•Establishment City 

•Establishment State 

•Establishment Zip 

•Establishment Country 

•Establishment email 

•Establishment Fax 

•Establishment Phone
Privacy Impact Assessment – NCAH NITC Platform (N2P)

Page 9

Tuberculosis Sample Information:

• Food Inspector Name

•Veterinarian Name

•Market Buyer Name

•Market Buyer Address

•Market Buyer City

•Market Buyer State

•Market Buyer Zip

•Market Buyer Country

•Lot number

•Number in Lot

•Number with Lesions

• Slaughter Date

• Species Type

•Age Number, Unit, and Class

• Sex

•Carcass Number and Tag Number

•Dressed Weight

•Live Weight

• Specimen Type

• Preservation Type

•Animal ID and Type

• Post Mortem Report – Tissue and Condition

•Comments

Salmonella Sample Information:

•Owner/Location Information including name, address, premises ID, and 

Accession/Referral Number

•Type of Exam Requested

• Sample Information – Specimen Cultured, Species, Clinical Role, Culture Number, O 

Group, and Serotype

•National Poultry Improvement Plan (Y/N)

•Comments

Diagnostic testing information:

•Tests requested

•Disease

•Concentration

• Sex

• Sample ID

•Animal ID

•Age

•Age Unit
Privacy Impact Assessment – NCAH NITC Platform (N2P)

Page 10

•Age Classification

1.2 What are the sources of the information in the system? 

The sources of the information are USDA employees, biologic firm employees, State animal 

health partners, and roles listed above (e.g. food inspector).

1.3 Why is the information being collected, used, disseminated, or 

maintained? 

The information is being collected so that USDA:

• Can complete its mission of regulation veterinary biologics and ensure pure, safe, 

potent, and effective biologics.

• Process samples in the laboratory and return results to customer

• Track routine tasks and equipment for USDA employees 

1.4 How is the information collected? 

The information is collected directly from the USDA employee, firm employee, animal health 

partner, or other contact person (e.g. food inspector). It is collected as digital input at a webbased user interface with keyboard.

1.5 How will the information be checked for accuracy? 

All data entered is validated by APHIS Veterinary Services. VS employees review and 

validate the information before the information is used in the CVB LSRTIS or VS LIMS. 

USDA employees ensure data is free of typographical errors (e.g. place names and biomedical 

terms), formatting errors (e.g. email, zip, and phone number formats), and logical errors (e.g. 

animal counts are in integers). VS employees will not make any changes to the data entered. 

If there are any issues with the accuracy of the data, the submitted request is returned to the 

submitter unprocessed. VS will ask for it to be reviewed and resubmitted. The webpage also 

validates inputted information while the user is entering the information (e.g. only certain 

types of characters can be entered into specific fields, security control SI-10, etc.).

1.6 What specific legal authorities, arrangements, and/or agreements 

defined the collection of information? 

For CVB, the 1913 Virus–Serum–Toxin Act. Specific regulations are located in Title 9, Code 

of Federal Regulations, Parts 101 to 123. For NVSL, the collection of information is 

authorized by U.S Legal Code: Title 7, Chapter 9, #8308 is invoked to validate the collection 

of information and U.S Legal Code: Title 7, Chapter 9 #8308: Detection, control and 

eradication of diseases and pests.
Privacy Impact Assessment – NCAH NITC Platform (N2P)

Page 11

1.7 Privacy Impact Analysis: Given the amount and type of data 

collected, discuss the privacy risks identified and how they were 

mitigated. 

Unauthorized access to this data is the privacy risk. This is mitigated by using capabilities 

common to USDA and the commercial products used. This includes:

• System access control by USDA E-Authentication

• User based role access

• Separation of duties

• Limiting web access

• Audit logging

Section 2.0 Uses of the Information 

The following questions are intended to delineate clearly the use of information and the 

accuracy of the data being used. 

2.1 Describe all the uses of information. 

Internal Capabilities

NCAH BioSafety Application (BIOSAFETY): BIOSAFETY improves the NCAH ability 

to meet federal, USDA, and external reporting requirements on biologically contaminated 

equipment management, biosafety management, select agent certifications and biosafety 

training.

Field Activity Report (FAR): FAR supports monitoring and reporting of field work efforts 

in support of key VS program and mission areas.

Glassware Repository and Media Service (GRAMS): GRAMS records the formulations, 

ordering, production, delivery and inventory of glassware and media supplies needed to 

support NCAH testing and research laboratories.

Information Technology (IT) Governance Application (ITGOV): ITGOV allows portfolio 

and project management personnel to predict, request, execute, and report expense related 

information concerning governed IT investments. ITGOV supports the APHIS and USDA 

governance requirements.

User Management Service (UMS): UMS automates application user access authorization 

and user recertification. Employee supervisors can request and certify the need for 

application access. Application owners can authorize, validate, and manage recertification 

for access to integrated systems.
Privacy Impact Assessment – NCAH NITC Platform (N2P)

Page 12

Licensing, Serial Release, & Testing Information Service (LSRTIS): LSRTIS manages 

regulatory program information associated with the Virus, Serum, and Toxin Act required 

for CVB to make decisions about the safety and efficacy of veterinary biologics products 

produced and distributed in the United States and exported throughout the world.

External Capabilities

NCAH Portal (Portal): Portal provides a secure gateway for external customers allowing 

digital communication with the NCAH programs. Submissions are validated and directly 

entered into VS internal information systems. Customers can get near real-time status 

updates on their diagnostic, biologic, and licensing submissions as well as historical search 

capabilities.

2.2 What types of tools are used to analyze data and what type of data 

may be produced? 

None.

2.3 If the system uses commercial or publicly available data please 

explain why and how it is used. 

The system does not use commercially or publically available data.

2.4 Privacy Impact Analysis: Describe any types of controls that may be 

in place to ensure that information is handled in accordance with the 

above described uses. 

The following controls are in place to ensure information is handled in accordance with the 

described uses:

• System access control by USDA E-Authentication

• User based role access

• Separation of duties

• Limiting web access

• Encryption

• Audit logging

Section 3.0 Retention 

The following questions are intended to outline how long information will be retained after the 

initial collection. 
Privacy Impact Assessment – NCAH NITC Platform (N2P)

Page 13

3.1 How long is information retained? 

Internal Capabilities

NCAH BioSafety Application (BIOSAFETY): BIOSAFETY does not have an approved 

NARA schedule. Alternatively, it can be retained under direction of the USDA Office of 

General Counsel for any suspension of disposal.

Field Activity Report (FAR): FAR does not have an approved NARA schedule. 

Alternatively, it can be retained under direction of the USDA Office of General Counsel for 

any suspension of disposal.

Glassware Repository and Media Service (GRAMS): GRAMS does not have an approved 

NARA schedule. Alternatively, it can be retained under direction of the USDA Office of 

General Counsel for any suspension of disposal.

Information Technology (IT) Governance Application (ITGOV): ITGOV does not have an 

approved NARA schedule. Alternatively, it can be retained under direction of the USDA 

Office of General Counsel for any suspension of disposal.

User Management Service (UMS): does not have an approved NARA schedule. 

Alternatively, it can be retained under direction of the USDA Office of General Counsel for 

any suspension of disposal.

Licensing, Serial Release, & Testing Information Service (LSRTIS): LSRTIS information 

is retained as directed by the NARA approved scheduled. Alternatively, it can be retained 

under direction of the USDA Office of General Counsel for any suspension of disposal. 

External Capabilities

NCAH Portal (Portal): Portal does not have an approved NARA schedule. Alternatively, it 

can be retained under direction of the USDA Office of General Counsel for any suspension 

of disposal.

3.2 Has the retention period been approved by the component records 

officer and the National Archives and Records Administration 

(NARA)? 

The records retention approval is pending further work with the APHIS Records Officer.

3.3 Privacy Impact Analysis: Please discuss the risks associated with the 

length of time data is retained and how those risks are mitigated. 
Privacy Impact Assessment – NCAH NITC Platform (N2P)

Page 14

An excessive length of time for retaining data increases the risk of unauthorized access. This 

is mitigated by using capabilities common to USDA and the commercial products used. This 

includes:

• System access control by USDA E-Authentication

• User based role access

• Separation of duties

• Limiting web access

• Audit logging

Section 4.0 Internal Sharing and Disclosure 

The following questions are intended to define the scope of sharing within the United States 

Department of Agriculture.

4.1 With which internal organization(s) is the information shared, what 

information is shared and for what purpose? 

None. Information is kept internal to the VS organization.

4.2 How is the information transmitted or disclosed? 

Information is not transmitted or disclosed within USDA.

4.3 Privacy Impact Analysis: Considering the extent of internal 

information sharing, discuss the privacy risks associated with the 

sharing and how they were mitigated. 

Information is not transmitted or disclosed within USDA.

Section 5.0 External Sharing and Disclosure 

The following questions are intended to define the content, scope, and authority for information 

sharing external to USDA which includes Federal, state and local government, and the private sector. 

5.1 With which external organization(s) is the information shared, what 

information is shared, and for what purpose? 

Information is not transmitted or disclosed to organizations external to the USDA.

5.2 Is the sharing of personally identifiable information outside the 

Department compatible with the original collection? If so, is it 

covered by an appropriate routine use in a SORN? If so, please 

describe. If not, please describe under what legal mechanism the 
Privacy Impact Assessment – NCAH NITC Platform (N2P)

Page 15

program or system is allowed to share the personally identifiable 

information outside of USDA. 

Not applicable.

5.3 How is the information shared outside the Department and what 

security measures safeguard its transmission? 

Not applicable.

5.4 Privacy Impact Analysis: Given the external sharing, explain the 

privacy risks identified and describe how they were mitigated. 

Not applicable.

Section 6.0 Notice 

The following questions are directed at notice to the individual of the scope of information collected, 

the right to consent to uses of said information, and the right to decline to provide information. 

6.1 Does this system require a SORN and if so, please provide SORN 

name and URL. 

No.

6.2 Was notice provided to the individual prior to collection of 

information? 

Not applicable.

6.3 Do individuals have the opportunity and/or right to decline to provide 

information? 

Not applicable.

6.4 Do individuals have the right to consent to particular uses of the 

information? If so, how does the individual exercise the right? 

Not applicable.

6.5 Privacy Impact Analysis: Describe how notice is provided to 

individuals, and how the risks associated with individuals being 

unaware of the collection are mitigated. 
Privacy Impact Assessment – NCAH NITC Platform (N2P)

Page 16

Not applicable.

Section 7.0 Access, Redress and Correction 

The following questions are directed at an individual’s ability to ensure the accuracy of the 

information collected about them. 

7.1 What are the procedures that allow individuals to gain access to their 

information? 

A person may submit a Freedom of Information Act request. All inquiries should be 

addressed in one of the following manners:

VIA MAIL: Animal and Plant Health Inspection Service Director, Freedom of Information 

and Privacy Act Staff 4700 River Road, Unit 50 Riverdale, MD 20737

VIA FACSIMILE: 301-734-5941

VIA E-MAIL: foia.officer@aphis.usda.gov (NOTE: While e-mail attachments are often an 

important and legitimate means of conducting business, they also have the potential to cause 

great harm to our e-mail infrastructure, as well as to individual workstations. Please place the 

text of your FOIA request into the 'body' of the email message.)

VIA Web Request Form: Located at the following link: https://efoiapal.usda.gov/palMain.aspx.

7.2 What are the procedures for correcting inaccurate or erroneous 

information? 

Any individual may contest information contained within a record in the system that pertains to 

them by submitting a written request to the system manager at the address above. Include the 

reason for contesting the record and the proposed amendment to the information with supporting 

documentation to show how the record is inaccurate.

7.3 How are individuals notified of the procedures for correcting their 

information? 

All public or regulated entities that enter information into NCAH Portal are not notified of the 

procedures to correct that information. However, the Contact Us link is available on most Portal 

webpages. The Contact Us page includes address, email, and phone number information to allow 

for a quick response from APHIS. This Contact Us webpage serves as a broad collection point for 

all concerns and questions, including corrections needed by the entities that use Portal.

7.4 If no formal redress is provided, what alternatives are available to the 

individual? 

Not applicable.
Privacy Impact Assessment – NCAH NITC Platform (N2P)

Page 17

7.5 Privacy Impact Analysis: Please discuss the privacy risks associated 

with the redress available to individuals and how those risks are 

mitigated. 

APHIS has a formal redress procedure in place and there is minimum risk.

Section 8.0 Technical Access and Security 

The following questions are intended to describe technical safeguards and security measures. 

8.1 What procedures are in place to determine which users may access 

the system and are they documented? 

Any public and regulated entity that wishes to conduct business with the NCAH (CVB or NVSL) 

can gain access to the application. All users must have an E-Authentication account in order to 

gain access to the application. All CVB submitters must then complete and submit APHIS Form 

2007 (OMB 0579-0013) Contact and Qualifications of Veterinary Biologics Personnel. Once 

access is authorized, N2P users are provide the least amount of privilege (roles) to access their 

data.

8.2 Will Department contractors have access to the system? 

No.

8.3 Describe what privacy training is provided to users either generally 

or specifically relevant to the program or system? 

All users are required to complete Information Technology (IT) Security Awareness Training. 

USDA employees must additionally sign APHIS Rules of Behavior form prior to receiving access 

to the information system. Additionally, those employees with functions that play a key security

role in the IT system must complete annual specialized role-based training and a Privileged Rules 

of Behavior. All users must then complete annual Security Awareness Training.

8.4 Has Certification & Accreditation been completed for the system or 

systems supporting the program? 

Yes. The capabilities described in Section 2.1 of this PTA where authorized with these 

information systems in CSAM:

Information System ATO expiration date USDA PII Status?

LSRTIS (UMS) 22 August 2020 No

FOSS (BIOSAFTEY, FAR, 

GRAMS, ITGOV) 2 January 2021 No
Privacy Impact Assessment – NCAH NITC Platform (N2P)

Page 18

NCAH Portal 18 September 2018 Yes

8.5 What auditing measures and technical safeguards are in place to 

prevent misuse of data? 

Formal auditing measures for N2P will include independent security assessments 

performed annually in support of A&A efforts. The independent assessments will be 

performed per the timeframe of the N2P continued authorization.

As to technical safeguards:

• N2P is continuously monitored in several different ways. NITC performs scans to 

identify possible threats and provides results to the VS CIO Technology staff. The 

vulnerabilities identified are required to be remediated by the responsible parties.

• Security related incidents are reported to the ISSM and requires an investigation. 

APHIS Cyber Incident Response Team and USDA Agriculture Security Operations 

Center work together to respond and handle all incidents.

• Operational technical safeguards to prevent data misuse begin with access control. 

Access to N2P is protected by role-based access which is managed by the network 

firewall, E-Authentication, and the backend systems that are queried. Users must have 

a Level 1 or Level 2 E-Authentication account. Users are only able to view 

information on previous submissions that they submitted (i.e. linked to their 

username).

• Auditing logs are enabled at both the application and database levels.

8.6 Privacy Impact Analysis: Given the sensitivity and scope of the 

information collected, as well as any information sharing conducted 

on the system, what privacy risks were identified and how do the 

security controls mitigate them? 

Unauthorized disclosure of personal information, as identified in Section 1.1 above, is the 

primary privacy risk to information shared. This risk is mitigated through technical and 

procedural information security controls levied on internal holders. N2P and NITC GSS 

technical security controls are delineated in the current N2P System Security Plan.

Section 9.0 Technology 

The following questions are directed at critically analyzing the selection process for any technologies 

used by the system, including system hardware and other technology. 

9.1 What type of project is the program or system? 

This information system uses commercially available programing languages, and software. 

The operating system platform, hardware, and infrastructure are all provided by the USDA 

government cloud, NITC, in Kansas City..
Privacy Impact Assessment – NCAH NITC Platform (N2P)

Page 19

9.2 Does the project employ technology which may raise privacy 

concerns? If so please discuss their implementation. 

No.

Section 10.0 Third Party Websites/Applications 

The following questions are directed at critically analyzing the privacy impact of using third 

party websites and/or applications. 

10.1 Has the System Owner (SO) and/or Information Systems Security 

Program Manager (ISSPM) reviewed Office of Management and 

Budget (OMB) memorandums M-10-22 “Guidance for Online Use of 

Web Measurement and Customization Technology” and M-10-23 

“Guidance for Agency Use of Third-Party Websites and 

Applications”?

Yes.

10.2 What is the specific purpose of the agency’s use of 3rd party websites 

and/or applications?

Google reCAPTURE service is used on the publically accessible portion of the website. It is 

located on the Contact Us webpage. reCAPTURE is used to protect the Contact Us from 

spam and other abuse.

10.3 What personally identifiable information (PII) will become available 

through the agency’s use of 3rd party websites and/or applications.

None.

10.4 How will the PII that becomes available through the agency’s use of 

3rd party websites and/or applications be used?

Not applicable.

10.5 How will the PII that becomes available through the agency’s use of 

3rd party websites and/or applications be maintained and secured?

Not applicable.

10.6 Is the PII that becomes available through the agency’s use of 3rd party 

websites and/or applications purged periodically? 
Privacy Impact Assessment – NCAH NITC Platform (N2P)

Page 20

Not applicable.

If so, is it done automatically?

Not applicable.

If so, is it done on a recurring basis?

Not applicable.

10.7 Who will have access to PII that becomes available through the 

agency’s use of 3rd party websites and/or applications?

Not applicable.

10.8 With whom will the PII that becomes available through the agency’s 

use of 3rd party websites and/or applications be shared - either 

internally or externally?

Not applicable.

10.9 Will the activities involving the PII that becomes available through 

the agency’s use of 3rd party websites and/or applications require 

either the creation or modification of a system of records notice 

(SORN)?

Not applicable.

10.10 Does the system use web measurement and customization technology?

Not applicable.

If so, is the system and procedures reviewed annually to demonstrate compliance to 

OMB M-10-23?

Not applicable

10.11 Does the system allow users to either decline to opt-in or decide to 

opt-out of all uses of web measurement and customization 

technology?

Not applicable.
Privacy Impact Assessment – NCAH NITC Platform (N2P)

Page 21

If so, does the agency provide the public with alternatives for acquiring comparable 

information and services?

Not applicable.

10.12 Privacy Impact Analysis: Given the amount and type of PII that 

becomes available through the agency’s use of 3rd party websites 

and/or applications, discuss the privacy risks identified and how they 

were mitigated. 

Not applicable.
Privacy Impact Assessment – NCAH NITC Platform (N2P)

Page 22

Approval Signatures

Byron Rippke

NCAH NITC Platform System Owner

Veterinary Services

United States Department of Agriculture

Rajiv Sharma

APHIS ISSPM

Marketing and Regulatory Programs Business Services

United States Department of Agriculture

Tonya Woods

APHIS Privacy Act Officer

Legislative and Public Affairs

United States Department of Agriculture