1 

Privacy and Civil Liberties Impact Assessment Template

Privacy and Civil Liberties Impact Assessment

for the

HRConnect System

December 16, 2021

Reviewing Official

Ryan Law

Deputy Assistant Secretary for Privacy, Transparency, & Records

Departmental Offices

Department of the Treasury
2 

Section 1: Introduction

PCLIAs are required for all systems and projects that collect, maintain, or disseminate personally 

identifiable information (PII). The system owner completed this assessment pursuant to Section 208 of the 

E-Government Act of 2002 (“E-Gov Act”), 44 U.S.C. § 3501, Office of the Management and Budget 

(OMB) Memorandum 03-22, “OMB Guidance for Implementing the Privacy Provisions of the EGovernment Act of 2002,” and Treasury Directive 25-07, “Privacy and Civil Liberties Impact Assessment 

(PCLIA),” which requires Treasury Offices and Bureaus to conduct a PCLIA before: (1) developing or 

procuring information technology (IT) systems or projects that collect, maintain or disseminate PII from or 

about members of the public, or (2) initiating a new collection of information that: (a) will be collected, 

maintained, or disseminated using IT; and (b) includes any PII permitting the physical or online contacting 

of a specific individual, if identical questions have been posed to, or identical reporting requirements 

imposed on, 10 or more persons (not including agencies, instrumentalities, or employees of the federal 

government). 

It is the policy of the Department of the Treasury (“Treasury” or “Department”) and its Bureaus to conduct a 

PCLIA when PII is maintained in a system or by a project. This PCLIA provides the following information 

regarding the system or project: (1) an overview of its purpose and functions; (2) a description of the 

information collected; (3) a description of the how information is maintained, used, and shared; (4) an 

assessment of whether the system or project is in compliance with federal requirements that support 

information privacy; and (5) an overview of the redress/complaint procedures available to individuals who 

may be affected by the use or sharing of information by the system or project.

Section 2: System Overview 

Section 2.1: System/Project Description and Purpose

HRConnect is the Treasury’s Government-wide Human Resources Line of Business (HRLoB) 

Shared Services Center (SSC) online personnel management system that provides managers, 

supervisors, employees, and personnel specialists with desktop access to personnel and payroll 

data. HRConnect consists of a general support system (GSS) and a Major Application (MA) (also 

known as Platform as a Service or Software as a Service); customized PeopleSoft HR software 

residing on the Oracle Cloud Infrastructure’s GovCloud Infrastructure as a Service Cloud Service 

Provider. 

The purpose of the HRConnect system is to support the human resources functions for the 

Department of the Treasury and other federal agencies that use HRConnect (non-Treasury 

HRConnect users) as part of a cross- services initiative to reduce federal government

expenditures. The following are the non-Treasury HRConnect users (or components of those

users): 

• Department of Agriculture, Office of the Chief Information Officer – CTS (Client Technology Services)

• U. S. Agency for International Development (USAID)

• Architectural and Transportation Barriers Compliance Board (US Access Board) 

• Department of Commerce:

o Office of the Secretary 

o Economic Development Administration 

o Bureau of Economic Analysis 
3 

o National Oceanic and Atmospheric Administration 

o International Trade Administration 

o U. S. Patent and Trademark Office 

o National Institute of Standards and Technology 

o Minority Business Development Agency 

o National Telecommunications and Information Administration 

o National Technical Information Service 

o Bureau of the Census

o Office of the Inspector General

o Office of Inspector General 

o Economics and Statistics Administration 

o Bureau of Industry and Security 

• Department of Justice, Bureau of Alcohol, Tobacco, Firearms, and Explosives

• Department of Labor

• Denali Commission

• Federal Reserve, Bureau of Consumer Financial Protection (BCFP)

• Gulf Coast Ecosystem Restoration Council (GCERC)

• Office of Government Ethics (OGE)

• Federal Housing Finance Agency OIG (FHFA OIG)

• Department of Homeland Security, U.S. Secret Service (USSS)

• Department of Housing and Urban Development(HUD)

• Department of Housing and Urban Development, HUD Office Inspector General

• Government Accountability Office (GAO)

• United States Congress, Commission on Security and Cooperation in Europe (CSCE)

• Armed Services Retirement Home (AFRH)

• Federal Mine Safety and Health, Fed Mine Safety Health Rev Com

• Commission on People's Republic of China (CECPRC)

• Veterans Affairs Office of Inspector General (VA OIG). 

The information collected and maintained in the system is used by Treasury and non-Treasury HR 

Connect users to: 

(1) record deductions, leave accrued and taken; maintain and display Leave and Earnings 

statements; commence and terminate allotments; answer inquiries; and process claims;

(2) maintain current and historical personnel records and prepare individual administrative 

transactions relating to education and training; job assignment; career development; 

evaluation; promotion, compensation, separation and retirement; 

(3) provide data for the production of reports, statistical surveys, rosters, documentation, and 

studies required for orderly personnel administration within Treasury and its components;

(4) maintain and administer organizational setup, such as organizational hierarchy; reporting 

hierarchy; job codes and classification; pay plans and associated salary (including locality pay); 

work locations; and position budget management; 

(5) perform personnel functions for Federal agencies for which Treasury is a cross-services

provider and provide information necessary to enable the payroll provider, National Finance Center

(NFC), to perform the activities necessary to calculate and distribute pay.

Treasury is updating this PCLIA to include the collection, use, and disclosure of Employee/Onboarding 

Employees’ vaccination status and proof of vaccination information in HRConnect. Treasury (except the 

Office of the Comptroller of the Currency) and participating non-Treasury users of HRConnect (except the 

General Accountability Office, the Department of Labor, the Bureau of Alcohol, Tobacco, and Firearms, 

and the United States Agency for International Development) are collecting employee/onboarding employee 

vaccination status information in HR Connect (non-Treasury agencies that are using HRConnect to collect 

vaccination status information are referred to in this PCLIA as non-Treasury users “participating in 

vaccination status collection using HRConnect”). Treasury completed and published a separate PCLIA 
4 

covering Treasury’s Collection, Use, and Disclosure of Employee/Onboarding Employees’ Vaccination 

Status and Proof of Vaccination Information (“Treasury Vaccination Status PCLIA”). By this reference, 

Treasury is incorporating the content of the Treasury Vaccination Status PCLIA into the HR Connect 

PCLIA as it relates to Treasury. Other non-Treasury HR Connect users may also incorporate the Treasury 

Vaccination Status PCLIA into the HRConnect PCLIA by posting a link to both the Treasury HRConnect 

and Treasury Vaccination Status PCLIAs on their public-facing website where they post Privacy Impact 

Assessments (PIAs) or PCLIAs. Non-Treasury HRConnect users may also choose to draft their own 

vaccination status PCLIAs or adapt the language in the Treasury Vaccination Status PCLIA to reflect 

information unique to their agency. Employees of non-Treasury HRConnect users should visit the website 

where their agency publishes its PIAs/PCLIAs and consult with their privacy officials as needed.

In accordance with Executive Order No. 14043, Treasury will collect and store vaccination status 

information of Federal employees and onboarding Treasury employeesto align with the guidance, 

principles, and best health practices provided by the Centers for Disease Control and Prevention (CDC) and 

the Occupational Safety and Health Administration (OSHA). The collection of this information will be 

used for purposes of determining which safety measures individual Federal employees must follow while 

working in a Treasury facility. Treasury will collect vaccine type and date of final vaccine dose (required to 

establish a full dose) to allow Treasury to notify employees when a booster/supplemental vaccine becomes 

available with respect to the particular vaccine they received and to ensure that Treasury continues to meet 

CDC requirements for vaccinated/unvaccinated employees. The information currently collected for these 

purposes is based on an evolving understanding of the pandemic and safety protocols for individuals who 

are fully vaccinated and not fully vaccinated. These principles will be reassessed over time, as conditions 

warrant and as CDC guidelines are updated. 

PII is used to identify employees for the purpose of carrying out the system objectives, as described 

above. 

1. ☐ A PCLIA is being done for this system for the first time.

2. ☒ This is an update of a PCLIA previously completed and published under this same 

system or project name. The date the earlier PCLIA was published was December 19,

2019. 

3. ☐ This is an update of a PCLIA previously completed and published for a similar system 

or project that is undergoing a substantial modification or migration to a new system or 

project name. The name of that previous PCLIA was [Name the PCLIA here] and the date 

of its publication was 1.1.2020

Section 2.2: Authority to Collect

Federal agencies must have proper authority before initiating a collection of information. The authority is 

sometimes granted by a specific statute, by Executive order (EO) of the President or other authority. The 

following specific authorities authorize HRConnect to collect information:

• Homeland Security Presidential Directive 12 (HSPD-12) – requires the development and 

agency implementation of a mandatory, government-wide standard for secure and reliable 

forms of identification for Federal employees and contractors.

• Treasury Directive 80-05, Records and Information Management Program – establishes the 

policy of the Department of the Treasury to manage records effectively and efficiently 

throughout their life cycle in order to facilitate accomplishment of the agency's 

programmatic and administrative missions, to preserve official agency records in 

accordance with applicable statutory and regulatory requirements, and to ensure access to 

information by Treasury officials, and the public as appropriate.
5 

• The authority to collect vaccination status information is derived from the General Duty 

Clause, Section 5(a)(1) of the Occupational Safety and Health (OSH) Act of 1970, 

Executive Order 12196, Occupational safety and health programs for Federal employees 

(Feb. 26, 1980), OMB Memorandum M-20-23, Aligning Federal Agency Operations with 

the National Guidelines for Opening Up America Again (Apr. 20, 2020), and 5 U.S.C. § 

6329c(b).

• EO 14043, Requiring Coronavirus Disease 2019 Vaccination for Federal Employees.

OPM Guidance on Applying Coronavirus Disease 2019 Vaccination Requirements to New Hires – 

Executive Order 14043. The information may also be collected pursuant to a more general requirement or 

authority. All Treasury systems and projects derive general authority to collect information from:

• 31 U.S.C. 321 – General authorities of the Secretary establish the mission of the 

Department of the Treasury

• 5 U.S.C. 301 – Department regulations for the operations of the department, conduct of 

employees, distribution and performance of its business, the custody, use, and preservation 

of its records, papers, and property.

Section 2.3: Privacy Act Applicability; SORN Requirement 

Under certain circumstances, federal agencies are allowed to exempt a system of records from certain 

provisions in the Privacy Act. This means that, with respect to information systems and papers files that 

maintain records in that system of records, the agency will not be required to comply with the requirements 

in Privacy Act provisions that are properly exempted. If this system or project contains records covered by 

the Privacy Act, the applicable Privacy Act system of records notice(s) (SORNs) (there may be more than 

one) that cover the records in this system or project must list the exemptions claimed for the system of 

records (it will typically say: “Exemptions Claimed for the System” or words to that effect). 

Helpful Hint for answering questions in this section and later questions about Privacy Act exemptions: If 

you know there is a SORN covering the PII in this system, the answer is probably “yes.” If the system 

maintains PII, but that PII is not actually retrieved by a personal identified, the answer is “no.” At the 

bottom of the applicable SORN(s), you will find a section that says: “Exemptions Claimed for the System.” 

If the answer is “None” (or anything that indicates no exemptions are claimed): (1) your bureau or office 

does not exempt the system of records from any Privacy Act requirements; and (2) when you are asked in 

this template whether your bureau or office exempts the system of records from certain provisions in the 

Privacy Act, your answer will always be “No.”

All answers in this section must be provided in the space as instructed after checking the 

appropriate box(es). 

Section 2.3(a) Please check ALL statements below that apply to your system or project and 

provide any additional information requested. Please read all possible responses before 

selecting an answer.

1. ☐ The system or project does not retrieve records about an individual using an identifying 

number, symbol, or other identifying particular assigned to the individual. A SORN is not 

required with respect to the records in this system.

2. ☒ The system or project does retrieve records about an individual using an identifying 

number, symbol, or other identifying particular assigned to the individual. A SORN is

required with respect to the records in this system. 

3. ☐ A SORN was identified in the original PCLIA and a determination was made during this 

current PCLIA update that modifications [choose one] ☐ were ☐ were not required to that 
6 

SORN. [If modifications were made, generally describe them here]. The current applicable 

SORN is: [Provide here the SORN number(s), system of records name(s) and the citation to 

the SORN(s) in the Federal Register.]

4. ☐ A SORN(s) was not identified or required in the original PCLIA, but a determination 

was made during this current PCLIA update that a SORN(s) is now required. The 

applicable SORN(s) is:[Provide here the SORN number(s), system of records name(s) and 

the citation to the SORN(s) in the Federal Register]. 

5. ☒ A SORN was published and no exemptions are taken from any Privacy Act 

requirements. Treasury .001 - Treasury Payroll and Personnel System - 83 FR 35376 (Jul. 

2, 2021) and Treasury .020 – Health Screening and Contact Tracing Records - 86 FR 11381 

(Feb. 24. 2021) (for vaccination status records). Most non-Treasury HR connect users

participating in vaccination status collection using HRConnect (for example the Department 

of Housing and Urban Development (HUD)) rely on Office of Personnel 

Management/Government-wide -10, Employee Medical File System Records, as the SORN 

covering collection of their vaccination status records. Employees/onboarding employees

working for non-Treasury HR connect usersthat are participating in vaccination status 

collection using HRConnect should consult their agency’s privacy website or contact their 

privacy office for additional information.

6. ☐ Exemptions are claimed from the following Privacy Act provisions in the applicable

SORN(s): [List here all exemptions taken in the applicable SORN; Hint: it’s at the end of 

the SORN]: The citation to the applicable Notice of Proposed Rulemaking and/or Final 

Rule is[provide here the Federal Register Citation to the NPRM and Final Rule (if a Final 

Rule was required)]. 

Section 3: Information Collection

Section 3.1: Relevant and Necessary

The Privacy Act requires “each agency that maintains a system of records [to] maintain in its records

only such information about an individual as is relevant and necessary to accomplish a purpose of the 

agency required to be accomplished by statute or by executive order of the President.” 5 U.S.C. § 552a 

(e)(1). It allows federal agencies to exempt records from certain requirements (including the relevant 

and necessary requirement) under certain conditions. 5 U.S.C. §552a (k). The proposed exemption must 

be described in a Notice of Proposed Rulemaking (“NPRM”). In the context of the Privacy Act, the 

purpose of the NPRM is to give the public notice of a Privacy Act exemption claimed for a system of 

records and solicit public opinion on the proposed exemption. After addressing any public concerns 

raised in response to the NPRM, the agency must issue a Final Rule. It is possible for some, but not all, 

of the records maintained in the system or by the project to be exempted from the Privacy Act through 

the NPRM/Final Rule process.

Section 3.1(a) Exemption Claimed from this Requirement?

1. ☒ The PII maintained in this system or by this project is not exempt from 5 U.S.C. 

§ 552a(e)(1), the Privacy Act’s requirement that an agency “maintain in its records only

such information about an individual as is relevant and necessary to accomplish a purpose 

of the agency required to be accomplished by statute or by executive order of the 

President.”
7 

2. ☐ The PII maintained in this system or by this project is exempt from 5 U.S.C. 

§ 552a(e)(1), because [See Appendix B for a list of acceptable bases for claiming this 

exemption and cut and paste here all that apply].

Section 3.1(b) Continuously Assessing Relevance and Necessity 

1. ☐ The PII in the system is not maintained in a system of records. Therefore, the Privacy 

requirements do not apply. [Explain here what you do to ensure relevance and necessity 

despite the fact that the Privacy Act does not apply]. 

2. ☐ The PII in the system is maintained in a system of records, but the agency exempted 

these records from the relevance and necessity requirement. [Explain here what you do to 

ensure relevance and necessity to the extent possible despite the fact the records are exempt 

from this requirement]. 

3. ☒ The system owner conducted an assessment prior to collecting PII for use in the system 

or project to determine which PII data elements and types (see Section 3.2 below) were 

relevant and necessary to meet the system’s or project’s mission requirements. During this 

analysis, in conducting the “relevance and necessity” analysis that is documented in this 

PCLIA, the system owner reevaluated the necessity and relevance of all PII data elements 

and determined that they are still relevant and necessary. Every time this PCLIA is 

updated, this ongoing assessment will be revisited. If it is determined at any time that 

certain PII data elements are no longer relevant or necessary, the system owner will update

this PCLIA to discuss how the data element was removed from the system and is no longer 

collected.

4. ☒ With respect to PII currently maintained (as of the time this PCLIA is being done) in 

the system or by the project, the PII [choose one] ☒ is ☐ is not limited to only that which 

is relevant and necessary to meet the system’s or project’s mission requirements. During the 

PCLIA process, the system always undergoes a review to ensure the continuing relevance 

and necessity of the PII in the system.

5. ☒ With respect to PII maintained in the system or by the project, there [choose one] ☒ 

is ☐ is not a process in place to continuously reevaluate and ensure that the PII remains 

relevant and necessary. During the PCLIA process, the system always undergoes a review 

to ensure the continuing relevance and necessity of the PII on the system. If a 

determination is made that particular PII is no longer relevant and necessary in between 

PCLIA updates, this PCLIA will be updated at that time.

All data elements pertaining to human resources information are detailed within the 

HRConnect and PIV Data Synchronization (PDS) Data Model data dictionary and 

documented pursuant to the requirements imposed by Office of Management and Budget 

(OMB) Circular A-130. Additionally, all of the data elements are part of the functional 

requirements documentation and the configuration management procedures being adhered 

to by Treasury. Functional requirements documentation consists of data elements, valid 

values, business rules, workflow, and interfaces that define a given set of functionalities

within the system. Configuration management procedures are a set of processes, templates, 

guidelines, and frameworks used to create a snapshot of what the application configuration 

and code looks like at a given point in time and to plan what the application configuration 

and code will look like at a defined point in the future (i.e., release).

HRConnect also collects information using the forms listed in the table below (Section 3.2) 

which are subject to the Paperwork Reduction Act. Forms that are subject to the 

Paperwork Reduction Act (PRA) must be approved by the OMB Director before they are 
8 

used to collect information from the public. The OMB Director is required by law to 

determine whether a proposed collection of information by the agency is necessary for the 

proper performance of the functions of the agency, including whether the information will 

have practical utility to the agency. If the OMB Director determines that the collection of 

information (or a portion of the information proposed for collection) by an agency is 

unnecessary for any reason, the agency may not collect that information. All information 

that is collected in HRConnect using forms subject to the PRA have been approved by the

OMB Director and Treasury processes and, therefore, been assessed and determined to be 

relevant and necessary. 

HRConnect contains the following data fields that must be completed by employees of Treasury and 

non-Treasury users participating in vaccination status collection using HRConnect 

Vaccination Status:

Employees are required to select from one of the following options available in the dropdown 

screen:

• BOOSTER- I have received a booster vaccination. 

• FULLY- I am fully vaccinated. 

• GAODECLINE GAO USE ONLY - I decline to respond. 

• NOVACCINE - I am not vaccinated. 

• PARTIAL - I am not yet fully vaccinated. 

• REQUESTED RA - I am not vaccinated and have requested a Reasonable Accommodation

(RA statuses: Approved, Denied, Pending). 

Vaccination Type:

Employees are required to select from one of the following options available in the dropdown 

screen:

• ASTRABOOST AstraZeneca/Oxford Booster Vaccination 

• ASTRAZENECA AstraZeneca/Oxford 

• J&J Johnson & Johnson/Janssen 

• J&JBOOST Johnson & Johnson/Janssen Booster Vaccination 

• MODBOOST Moderna Booster Vaccination 

• MODERNA Moderna 

• NOVAVAX Novavax 

• PFIZER Pfizer-BioNTech 

• PFIZERBOOST Pfizer-BioNTech Booster Vaccination

Date of last vaccination (with calendar dropdown)

Attestation Statement: 

Employees must click an “attest” box to certify the following: “I understand that a knowing and 

willful false statement on this form can be punished by fine or imprisonment or both (18 U.S.C. 

1001). I understand that making a false statement on this form could result in additional 

administrative action including an adverse personnel action up to and including removal from my 

position.” 

Attachment:

Employees must attach one of the following documents to prove vaccination:
9 

• A record of immunization from a health care provider or pharmacy, 

• CDC COVID-19 Vaccination Record Card, 

• Medical records documenting the vaccination, 

• Immunization records from a public health or state immunization information system, or 

• Any other official documentation containing the required data points. 

Treasury determined that all of this information is both relevant and necessary to 

administer the authorities listed in section 2.2 of this PCLIA. Non-Treasury users 

participating in vaccination status collection using HRConnect may instruct their employees to 

collect some or all of the available data fields, depending on their authorities and 

requirements. At the top of the vaccination page in HRConnect, employees are invited to:

“Please enter vaccination information as required by your Agency.” (emphasis added). 

The HRConnect system permits the individual to update their data throughout their 

employment to keep it current as long as their agency continues to use HRConnect’s 

vaccination status. 

Section 3.2: PII and/or information types or groupings

The checked boxes below represent the types of information maintained in the system or by the project that 

are relevant and necessary for the information system or project to fulfill its mission. PII identified below is 

used by the system or project to fulfill the purpose stated in Section 2.2 above– Authority to Collect. 

Biographical/general information

☒ Name ☒ Nationality ☒ Country of Birth

☒ Age ☒ Citizenship ☐ Immigration Status

☒ Date of birth ☒ Ethnicity ☒ Alias (including nickname)

☒ Home physical/postal mailing 

address

☒ Gender ☒ City or County of Birth

☒ Zip Code ☒ Race ☒ Military Service Information

☒ Personal home phone, cell phone, 

or fax number

☒ Personal e-mail address ☒ Country or city of residence

☐ Other: (please describe) 

Other information

☐ Resume or curriculum vitae ☒ Cubical or office 

number

☒ Veteran’s preference

☒ Religion/Religious Preference ☒ Education Information ☒ Spouse Information

☐ Professional/personal references 

or other information about an 

individual’s friends, associates or 

acquaintances.

☒ Contact lists and directories 

(known to contain at least some 

personal information).

☒ Retirement eligibility information

☐ Sexual Orientation ☒ Marital Status ☒ Information about other relatives.

☒ Group/Organization Membership ☒ Information about children ☒ Other: Employment type (full or parttime), Eligibility for and coverage under 

Federal Employees Group Life Insurance

Program, Eligibility for and coverage 

under Federal Employee Retirement 

System (FERS) coverage, Occupational

series, Official Title Code, pay band, 

Whether the employee’s position is

temporary or permanent, Official title

associated with the position, Work

schedule type, Position Target Grade, 

Instant Message ID (IM) (table is under 

personal data CWR), Language 

proficiency (languages spoken)
10

Identifying numbers assigned to individuals 

☒ Full Social Security number ☒ Personal device identifiers or serial 

numbers

☐ Vehicle Identification Number

☒ Truncated Social Security Number 

(e.g., last 4 digits)

☐ Internet Protocol (IP) Address ☐ Driver’s License Number

☒ Employee Identification Number ☒ Personal Bank Account Number ☐ License Plate Number

☐ Taxpayer Identification Number ☐ Health Plan Beneficiary Number ☒ Professional License Number

☐ File/Case ID Number ☐ Credit Card Number ☐ Passport Number and information 

(nationality, date and place of issuance, 

and expiration date)

☐ Alien Registration Number ☐ Patient ID Number ☒ Other: Number randomly assigned to 

personnel files and maintained by Office 

of Human Resources (OHR) and provided 

to external vendors and internally within 

Treasury as a unique identifier to allow 

the development of aggregate/ statistical 

data to measure internal performance of 

Treasury programs. These numbers are 

deleted at the end of each project/study. 

New numbers are randomly created for 

each study.

Specific Information/File Types

☐ Taxpayer Information/Tax Return 

Information

☐ Law Enforcement Information ☐ Security Clearance/Background Check 

Information

☐ Civil/Criminal History 

Information/Police Records (obtained 

from government source)

☐ Civil/Criminal History 

Information/Police Records (obtained 

from commercial source)

☐ Credit History Information 

(government source) 

☐ Protected Information (as defined 

in Treasury Directive 25-10)

☐ Credit History Information 

(commercial source)

☐ Bank Secrecy Act Information

☐ Information provided under a 

confidentiality agreement

☐ Case files ☐ Personnel Files

☐ Business Financial Information 

(including loan information)

☐ Personal Financial Information (e.g., 

loan information)

☐ Information subject to the terms of an 

international or other agreement

☐ Passport information (state which 

passport data elements are collected if 

not all)

☐ Other: (please describe)

Audit Log and Security Monitoring Information

☒ User ID assigned to or generated 

by a user of Treasury IT

☐ Files and folders accessed by a user 

of Treasury IT

☐ Biometric information used to access 

Treasury facilities or IT

☒ Passwords generated by or 

assigned to a user of Treasury IT

☐ Internet or other queries run by a 

user of Treasury IT

☐ Contents of files accessed by a user of 

Treasury IT

☐ Files accessed by a user of 

Treasury IT (e.g., web navigation 

habits)

☒ Date and time an individual accesses 

a facility, system, or other IT

☐ Information revealing an individual’s 

presence in a particular location as 

derived from security token/key fob, 

employee identification card scanners or 

other IT.

☐ Public Key Information (PKI). ☐ Still photos of individuals derived 

from security cameras. 

☐ Purchasing habits or preferences

☐ Internet Protocol (IP) Address ☐ Video of individuals derived from 

security cameras

☐ Commercially obtained internet 

navigation/purchasing habits of 

individuals

☐ Global Positioning System 

(GPS)/Location Data 

☐ Secure Digital (SD) Card or Other 

Data stored on a card or other 

technology 

☐ Device settings or preferences (e.g., 

security level, sharing options, ringtones).

☐ Network communications data ☐ Cell tower records (e.g., logs. user 

location, time etc.)

☐ Other: (please describe)
11

Medical/Emergency Information Regarding Individuals

☐ Medical/Health Information ☐ Worker’s Compensation Act 

Information

☒ Emergency Contact Information (e.g., 

a third party to contact in case of 

emergency

☐ Mental Health Information ☒ Information regarding a disability ☐ Patient ID Number)

☐ Sick leave information ☐ Request for an accommodation 

under the Americans with Disabilities 

Act

☐ Patient ID Number 

☒ Other: (please describe) COVID 

19 vaccination Status (original 

vaccination and booster), Date of 

Last Vaccination required for full 

dose. See Section 3.1(b) of this 

PCLIA for a detailed description.

☒ Other (please describe): 

COVID 19 vaccination type

(original vaccination and booster, if 

different) and date of last shot 

required for full vaccination 

(including booster). See Section 

3.1(b) of this PCLIA for a detailed 

description.

☒ Other (please describe): 

Attestationregarding truth of 

information provided.See Section 

3.1(b) of this PCLIA for a detailed 

description.

Biometrics/Distinguishing Features/Characteristics of Individuals

☒ Physical description/ characteristics 

(e.g., hair, eye color, weight, height, 

sex, gender etc.) Identify which are 

collected: (Insert collected here)

☐ Signatures ☐ Palm prints

☐ Fingerprints ☐ Photos/Video: (identify which ☐ Voice audio recording

☐ Other: (please describe)

Identifying numbers for sole proprietors (including business information).

☐ Sole proprietor business credit card 

number

☐ Business Phone or Fax Number ☐ Business Physical/Postal Mailing 

Address

☐ Sole proprietor business 

professional license number

☐ Sole proprietor business file case 

number

☐ Sole proprietor business taxpayer 

identification number

☐ Sole proprietor business license 

plate number

☐ Sole proprietor business vehicle 

identification number

☐ Sole proprietor business bank account 

number

☐ Other (please describe): ☐ Other (please describe): ☐ Other (please describe):

Applicants who receive and accept job offersfor employment with a Federal agency that is serviced by HRC submit the 

information in Section 3.2 into the Treasury EBS HRLoB EODS (Entrance On Duty System) using the forms listed in 

the chart below. These forms are required to complete the hiring/onboarding process. For those agencies that use the 

EODS, these forms are completed within EODS and some of the information in these forms(not the form itself) and in 

USA Staffingis sent to HRC via a secure interface.

Form EODS HRC 

AD-349 USDA Employee Address Yes Yes 

I-9 Employment Eligibility Verification Data Yes No **

OF-306 Declaration of Federal Employment Yes No **

PIV Applicant Information Yes No **

SF-1199A Direct Deposit / Allotments Yes Yes 

TSP-19 Transfer Yes No

W4 Federal Withholding Yes Yes 

All State Taxes Yes Yes

D4 D.C. Tax Withholding Yes Yes 

D4A D.C. Tax Waiver Yes Yes 

MW507 Maryland Tax Withholding Yes Yes 

V4 Virginia Tax Withholding Yes Yes 

SF-144 Statement of Prior Federal Service Yes No

SF-181 Ethnicity and Race Identification Yes Yes 

SF-256 Self Identification of Disability Yes Yes 
12

Form EODS HRC 

SF-61 Appointment Affidavit /Oath of Office Yes No

SF-2809 Federal Employment Health Benefits (FEHB) Election Yes Yes 

DG 60 FEHB Premium Conversion Waiver Yes Yes 

SF-2817 Federal Employee Group Life Insurance (FFEGLI) Life Insurance Election Yes Yes 

SF-2823 FEGLI Designation of Beneficiary Yes No

SF-3109 Federal Employee Retire System (FERS) Election of Coverage Yes Yes 

FS-2808 Designation of Beneficiary – Civil Service Retirement System (CSRS) Yes No

SF3102 Designation of Beneficiary - Federal Employee Retire System (FERS) Yes No

OGE-278e Executive Branch Personnel Public Financial Disclosure Report Yes No

OGE-450 Confidential Financial Disclosure Yes No

SF-1152 Designation of Beneficiary Unpaid Compensation Yes No

TSP1 Thrift Savings Plan Election Yes Yes 

TSP3 Thrift Savings Plan Designation of Beneficiary Yes No

TSP1-C Thrift Savings Plan Catch Up Yes Yes 

24-Hr Personal Accident Insurance Enrollment Yes Yes (OCC Only)

OCC Group Life Insurance Enrollment Yes Yes (OCC Only)

OCC Short Term Disability Enrollment Yes Yes (OCC Only)

DS5002 State Department Designation of Beneficiary Yes No

SF52 Request for Personnel Action No Yes

SF50 Notification of Personnel Action No Yes

OF-8 Position Description No Yes

These forms require individuals to submit personally identifiable information (PII). The data derived from these 

forms is entered into HRConnect for purposes of performing activities related to individuals’ employment, such as 

compensation, benefits, and retirement. This includes the following types of information:

• Emergency Contact Data

• Citizenship, Race & Ethnicity Data

• Disability Data

• Banking & FinancialData

• Federal & State Tax Data

• Selective Service and Military ServiceData

• Criminal and Debt History Data related tosuitability for employment 

• Education Data

• Health Benefit Data

**CR 35355 provides new functionality where forms can be associated with attachment types. If the form 

can be associated with onboard/security attachments; data will not be stored in HRC tables.

*Form 

ID Description

1 Application for Access to Main Treasury Complex

10 Memorandum of Understanding/Agreement

11 New Hire Selection Notice

12 Request for Personnel Action (SF-52) 

13 Resume

14 

Supplemental Documentation for the Application to MTC or Security 

Processing

15 Position Description and Signed Position Description Form (OF-8) 

16 Visit Authorization Request or Letter

17 Visit Access Request (VAR)

2 Certificate of Birth

3 U.S. Citizen Born Aboard

4 U.S. Certificate of Naturalization
13

*Form 

ID Description

5 Permanent Alien Registration Card

6 Contracts and Modifications

7 Contractor Suitability Form (CSF)

8 Declaration of Federal Employment Form (OF-306) 

9 Intergovernmental Personnel Act (IPA) Agreement Form

HRConnect does not maintain actual Federal forms. Federal agencies that use HRC and EODs only maintain data 

extracted from the federal/agency forms listed below which are entered into HRC from the EODS data feed. The

table below is a complete list of SF forms and all data elements containing PII associated with each form. 

Document attachments are allowed in HRC. 

Form ID Form Name Data Elements

General Onboarding Forms

Declaration for Federal Employment

OF-306 Declaration for Federal

Employment

All Data Elements in OF-306

pertain to the Applicant

Applicant Full name (if only have 

initials in name provide and indicate 

“initials only”; if no middle name 

indicate “NoMiddle Name”

Phone Number Selective Service Registration 

SocialSecurity number Date of birth Branch of Service

Place of Birth Other Names used Dates of Military Service

Citizenship Military Service Type of Discharge 

Other Names used

Appointment Affidavit

SF-61 Appointment Affidavit All Data Elements in SF-61

pertain to the Applicant

Applicant Name Notary Public Commission Seal

information 

Statement of Prior Federal Service

SF-144 Statement of Prior Federal Service All Data Elements in SF-144

pertain to the Applicant

Applicant Name Last,First, Middle Date of Birth Year, month and day of service 

SocialSecurity Number Branch of Uniformed service Type of Discharge 

Ethnicity and Race Identification

SF-181 Ethnicity and Race Identification All Data Elements in SF181 pertain to the Applicant

Applicant Name SocialSecurity Number Date of Birth

Ethnicity/Race 

Self-Identification of Disability

SF-256 Self-Identification of Disability All Data Elements in SF-256 

pertain to the Applicant

Applicant Last Name,First Name,

and Middle initial

Date of Birth SocialSecurity Number

Direct Deposit Sign-up

SF-1199A DirectDepositSign-Up Data Elementsin SF-1199A

pertain to the Applicant and 

Joint Payee andJoinAccount 

holder information

Applicant Name of Payee Last, First,

Middle Name 

Name of person entitledto payment Depositor account number

Applicant Address Applicant Claim or Payroll ID 

number

Joint Account holders Certification 

required Signature 
14

Form ID Form Name Data Elements

Applicant Telephone number Payee/Joint Payee Certification 

require Signature 

Type of Depositor Account 

Checking or Savings 

FERS Election of Coverage

SF-3109 FERS Election of Coverage Data Elementsin SF-3109

pertain to the Applicant and

Former Spouse Information

Applicant Name Last,First Middle Applicant SocialSecurity Number Applicant Date of Birth

Applicant MaritalStatus Applicant Former Spouse’s Full

Name if OPM form 1556 is included as

an attachment 

Designation of Beneficiary (CSRS)

SF-2808 Designation of Beneficiary (CSRS) Data Elementsin SF-2808

pertain to Applicant and 

Designation for beneficiary or 

beneficiaries

Applicant Name Last,First, Middle Applicant Retirement Claim Number Address of each beneficiary 

Applicant Date of Birth Applicant Address Relationshipto applicant 

Applicant SocialSecurity Number Applicants Designation for 

beneficiary or beneficiaries First 

name, middle initial, and last name of 

each beneficiary 

Designation of Beneficiary (FEGLI)

SF-2823 Designation of Beneficiary

(FEGLI)

Data Elementsin SF-2823

pertain to the Applicant and

Beneficiaryfor the applicant

Applicant Name, Last, first, middle Applicant Home address Beneficiary SocialSecurity 

Number

Applicant Date of Birth Applicant CivilService Annuity 

(CSA), CSI, or Office of Worker 

Compensation Program (OWCP) 

claim number

Applicants Beneficiary Address 

Applicant SocialSecurity Number Beneficiary First name, middle 

initial, and last name of each 

beneficiary for the applicant 

Beneficiary Relationshipto

applicant 

Designation of Beneficiary (FERS)

SF-3102 Designation of Beneficiary (FERS) Data Elementsin SF-3102 

pertain to the Applicant and 

Beneficiary

Applicant Name, Last, First,Middle Applicant SocialSecurity Number Applicant Home address

Applicant Date of Birth Applicant If retired claim number Applicant Beneficiary First name,

initial, and last name of each 

beneficiary 

Designation of Beneficiary UnpaidCompensation of Deceased Fed Employee

SF-1152 Designation of Beneficiary Unpaid

Compensation of DeceasedFed

Employee

Data Elementsin SF-1152

pertain to the Applicant and

Beneficiaryfor the applicant

Applicant Name Last,First, Middle Applicant Address Address of each Applicants 

beneficiary 

Applicant Date of birth Applicants Beneficiary First name,

middle initial, and last name of each 

beneficiary 

Beneficiary Relationshipto

Applicant 

Applicant Social Security Number

Thrift Savings Plan Designation of Beneficiary

TSP-3 Thrift SavingsPlan Designation of

Beneficiary

Data Elementsin TSP-3 pertain

to the Applicant and Beneficiary
15

Form ID Form Name Data Elements

Applicant Name Last,First, Middle Applicant Foreign address Applicant Beneficiary Social

security Number or Tax ID 

Applicant TSP Account Number Applicant BenefitsInformation 

(including optional benefits selected) 

Applicant Beneficiary Date of 

Birth

Applicant Date of Birth Applicant Relationshipto Beneficiary 

information: Name of Spouse, Trust, 

Estate, Legal Entity/Corporation 

Applicant Beneficiary Foreign 

address

Applicant Day time Phone number Applicant Beneficiary Name of 

Individual Last, first Middle/Legal

Entity or corporation 

Applicant Beneficiary Home 

address

Applicant Home address

Applicant Name Last,First, Middle Applicant Foreign address Applicant Beneficiary Social

security Number or Tax ID 

Employee Election Form

TSP-1 Thrift SavingsPlan Enrollment All Data Elements in TSP-1

pertain to the Applicant

Applicant Name Last,First Middle Address SocialSecurity Number

Home Phone Number

TSP Catch-Up Contribution Form

TSP-1-C TSP Catch-Up Contribution All Data Elements in TSP-1-C

pertain to the Applicant

Applicant Name Last,First, Middle SocialSecurity Number Phone Number

Address

Premium Conversion Waiver/Election

DG-60 Premium Conversion

Waiver/Election Form

All Data Elements in DG-60 

pertain to the Applicant

Applicant Last Name,First Name,

Middle Initial

SocialSecurity Number Applicant Last Name,First Name,

Middle Initial

Life/Health Insurance/Benefits

SF-2809 Employee Health Benefit Election

(FEHB)

Data Elements in SF-2809

pertain to the Applicant and

Eligible family member/s

Applicant/Enrollee name last, first,

middle initial

Applicant Policy number Eligible family member/s Gender

Applicant SocialSecurity Number Applicant Email address Eligible family member/s Address

Applicant Date of Birth Applicant Phone number Eligible family member/s Name of 

other insurance

Applicant Gender Eligible family member/s Name Last,

First, Middle initial 

Eligible family member Name of 

other insurance and Policy Number

Applicant MaritalStatus Eligible family member/s Social

Security Number

Eligible family member/s 

Medicare Claim Number

Applicant Home address Eligible family member/s Date of 

Birth

Eligible family member/s Email

address

Applicant Name of other insurance

and Policy Number

Life Insurance Election (FEGLI)

SF-2817 Life Insurance Election (FEGLI) All Data Elements in SF-2817

pertain to the Applicant

Name last, first, middle SocialSecurity Number Telephone number

Date of birth Office of Worker’s Compensation 

Programs (OWCP) 

Withholding Allowances/Exemption Certificate

W-4 Employee WithholdingAllowance All Data Elements in W4 pertain

to the Applicant

Name First,Middle initial, Last 

Name 

Home Address MaritalStatus 

Employee Address
16

Form ID Form Name Data Elements

AD-349 Employee address All Data Elements in W4 pertainto

the Applicant 

Name Last,First,Middle SocialSecurity Number Employee Home Address

Employee Mailing Address Signature of Employee

Employment Eligibility Verification

I-9 Employment Eligibility Verification Not All Data Elements inform 

Name Last,First,Middle initial Other Names Used Home A ddress 

Date of Birth SocialSecurity Number Email Address

Telephone Number Citizenship Status Signature of Employee

Signature of Preparer or Translator Name Last and First of Preparer Address of Preparer

Identifying Document number Signature of Employer or Authorized

Representative 

Title of Employer

Employer’s business Business Address Date of Rehire

Personal Identity Verification for Federal Employees and Contractors

Form 13760 Personal Identity Verification for

Federal Employees and

Contractors

Not All Data Elements inform

pertain to the Applicant

Employee status (Employee or 

Contractor) 

Contract Number Contractor’s Company Name 

Name Last,First,Middle Initial SocialSecurity Number Date of Birth

Home Mailing Address Signature Sponsor Name 

Sponsor Title Sponsor Phone Number Sponsor Signature 

ID Number Registrar Name Registrar Title

Registrar Phone Number RegistrarSignature Issuer Name 

Issuer Title Issuer Phone Number Issuer Signature 

Certificate of Non-residence in the District of Columbia

Form D-4A Certificate of Non-residence in the

District of Columbia

Not All Data Elements inform

pertain to the Applicant

Name First,Middle Initial, Last 

Name 

Temporary DC address SocialSecurity Number

Permanent Address Signature 

Notification of Personnel Action

SF-50 Notification of PersonnelAction Not All Data Elements inform

pertain to the Applicant

Name Last,First,Middle SocialSecurity Number Date of Birth

Position Title and Number Pay Plan Occ. Code 

Grade or Level Step or Rate TotalSalary 

Pay Basis Name and Location of Position’s 

Organization 

Veterans Preference

Tenure FEGLI Service Computation Date

Work Schedule Position Occupied FLSA Category 

Appropriation Code Bargaining Unit Status Duty Station 

Employing Department or Agency Signature and Title of Approving 

Official

Transfer of Information Between Agencies

TSP-19 Thrift SavingsPlan Not All Data Elements inform

pertain to the Applicant

Name Last,First,Middle SocialSecurity Number Date of Birth

Date of Transfer TSP Status Code TSP Service Compilation Date 

TSP Vesting Code Contribution Election Information Catch-up contribution information 

Loan information Loan Account Number and Payment 

Amount 

Employee Nonpay status 

Agency Name Name of Contact Person Telephone Number of Contact

Person 

Agency Location 

Personnel Public Financial Disclosure Report
17

Form ID Form Name Data Elements

OGE Form 278e Personnel PublicFinancial

Disclosure Report

Not All Data Elements inform

pertain to the Applicant

Name Last,First,Middle Initial Title of Position Department or Agency 

Location of Present Office Office Telephone Number Presidential Nomination 

Congressional Committee

Certifying Individual’s Signature Reviewer’s Signature Ethics Official’s Signature 

Assets and Income Amounts Transactions Exceeding $1,000 Gifts, Reimbursements, and Travel

Expenses 

Debts over $10,000 Other Employment Compensation Employment Held Outside of the 

U.S. Government 

Compensation in Excess of $5,000 

Paid by One Source

Confidential Financial Disclosure Report

OGE Form 450 Confidential Public Financial

Disclosure Report

Not All Data Elements inform

pertain to the Applicant

Name Last,First,Middle Initial Position/Title Agency 

Branch/Unit and Address Work Number E-mail address

Special Government Employee 

(SGE)

SGE Mailing Address Reporting Status 

Certifying Individual’s Signature Reviewer’s Signature Agency’s Final Reviewing 

Official’s Signature 

Assets and Income Amounts Transactions Exceeding $1,000 Gifts, Reimbursements, and Travel

Expenses 

Debts over $10,000 Other Employment Compensation Employment Held Outside of the 

U.S. Government 

US Department of State Foreign Service Designation of Beneficiary

DS-5002 Designation of Beneficiary Data Elementsin DS-5002

pertain to Applicant and 

Designation for beneficiary or 

beneficiaries

Applicant Name Last,First, Middle Applicant Post of Assignment Address of each beneficiary 

Applicant Date of Birth Applicant Address Relationshipto applicant 

Applicant SocialSecurity Number Applicants Designation for 

beneficiary or beneficiaries First 

name, middle initial, and last name of 

each beneficiary 

3.3 Sources from which PII is obtained

Focusing on the context in which the data was collected and used (i.e., why it is collected and how it is 

used), check ALL sources from which PII is collected/received and stored in the system or used in the 

project

1. Members of the Public

☒ Members of the Public (i.e., including individuals who are current federal employees who are 

providing the information in their “personal” capacity (unrelated to federal work/employment). All 

of the following are members of the public. Please check relevant boxes (based on the context of 

collection and use in this system) for members of the public whose information is maintained in the 

system (only check if relevant to the purpose for collecting and using the information): 

☐ Members of the general public (current association with the federal government, 

if any, is irrelevant to the collection and use of the information by the system or 

project). Discuss here how/why PII is collected from this source.

☐ Retired federal employees. Discuss here how/why PII is collected from this 

source.
18

☐ Former Treasury employees. Discuss here how/why PII is collected from this 

source.

☐ Federal contractors, grantees, interns, detailees etc. Discuss here how/why PII is 

collected from this source.

☒ Federal job applicants. Applicants who receive and accept job offers for 

employment (new employees) with a Federal agency that is serviced by HRC

submit information using the forms listed in Section 3.2, which are required 

to complete the hiring/onboarding process. For those agencies that use the

Entrance on Duty System (EODS), these forms are completed within EODS 

and the necessary information (not all information contained in the forms) is 

sent to HRConnect via an interface. 

☐ Other: [Discuss here how/why PII is collected from this source.

2. Current Federal Employees, Interns, and Detailees

☒ Current Federal employees providing information in their capacity as Federal employees 

(for example, PII collected using OPM or Treasury forms related to employment with the 

federal government)

☒ Interns (Federal Pathways interns only). Vaccination status information is collected from 

Federal Pathways interns in accordance with OPM requirements. 

☐ Detailees. Discuss here how/why PII is collected from this source.

☐ Other employment-related positions. [name the position here and discuss how/why PII is 

collected from this source.]. 

3. Treasury Bureaus (including Departmental Offices)

☐ Other Treasury Bureaus: (name the bureau(s) here and identify the bureau/office 

information system from which the PII originated)and (how/why PII is collected from this 

source.). 

4. Other Federal Agencies

☒ Other Federal agencies: Agencies listed above. 

5. State and Local Agencies

☐ State and local agencies: (Name the State and local agencies here and explain how/why PII is 

collected from this source). 

6. Private Sector

☐ Private sector organizations(for example, banks and financial organizations, data brokers 

or other commercial sources): (Name the State and local agencies here and explain how/why 

PII is collected from this source.). 

7. Other Sources 

☐ Other sources not covered above (for example, foreign governments).

(Name the other sources here and explain how/why PII is collected from this source). 

Section 3.3: Privacy and/or civil liberties risks related to collection

When Federal agencies request information from an individual that will be maintained in a system of 

records, they must inform the individual of the following: “(A) the authority (whether granted by statute, or 
19

by executive order of the President) which authorizes the solicitation of the information and whether 

disclosure of such information is mandatory or voluntary; (B) the principal purpose or purposes for which 

the information is intended to be used; (C) the routine uses which may be made of the information, as 

published pursuant to paragraph (4)(D) of this subsection; and (D) the effects on [the individual], if any, of 

not providing all or any part of the requested information.” 5 U.S.C § 522a(e)(3). This is commonly called 

a Privacy Act Statement. The OMB Guidelines also note that subsection (e)(3) is applicable to both written 

and oral (i.e., interview) solicitations of personal information. Therefore, even if a federal employee or 

contractor has a fixed list of questions that they orally ask the individual in order to collect their information, 

this requirement applies. 

Section 3.3(a) Collection Directly from the Individual to whom the PII pertains

1. ☐ None of the PII in the system was collected directly from an individual to whom it 

pertains. . [Explain if the third-party/agency from which you obtained the PII actually 

collected the PII directly from the individuals about whom it pertains. Be prepared to 

discuss below how you ensure the information received from the third-party is still 

accurate, complete and timely for the purposes for which you will use it)]. [Explanation 

here.]

2. ☐ Some or ☒ all of the information in this system was collected directly from an individual

to whom it pertains.

Section 3.3(b) Privacy Act Statements

1. ☐ None of the PII in the system was collected directly from the individuals to whom it 

pertains. Therefore, a Privacy Act Statement is not required. 

2. ☐ Some ☒ All of the PII in the system was collected directly from the individual to whom 

it pertains. Therefore, a Privacy Act Statement was posted at the point where the PII was 

collected directly from the individual. That Privacy Act Statement was provided to the 

individual ☒ on the form in which the PII was collected ☐ on a separate sheet of paper 

that the individual could retain; or ☐ in an audio recording or verbally at the point where 

the information was collected (e.g., on the phone) or ☐ other [please explain]. 

3. The Privacy Act Statement contained the following: 

a. ☒ The authority (whether granted by statute, or by Executive order of the 

President) which authorizes the solicitation of the information.

b. ☒ Whether disclosure of such information is mandatory or voluntary.

c. ☒ The principal purpose or purposes for which the information is intended to be

used.

d. ☒ The individuals or organizations outside of Treasury with whom the 

information may be/ will be shared.

e. ☒ The effects on the individual, if any, if they decide not to provide all or any part 

of the requested information.

Section 3.3(c) Use of Full Social Security Numbers 

Treasury is committed to eliminating unnecessary collection, use, and display of full Social Security 

numbers (“SSN”) and redacting, truncating, and anonymizing SSNs in systems and documents to limit their 

accessibility to individuals who do not have a need to access the full SSN in order to perform their official 

duties. Moreover, the Privacy Act provides that: “It shall be unlawful for any Federal, State or local 

government agency to deny to any individual any right, benefit, or privilege provided by law because of 

such individual’s refusal to disclose his social security account number.” Pub. L. No. 93–579, § 7. This 
20

provision does not apply to: (1) any disclosure which is required by federal statute; or (2) any disclosure of 

an SSN to any federal, state, or local agency maintaining a system of recordsin existence and operating 

before January 1, 1975, if such disclosure was required under statute or regulation adopted prior to such date 

to verify the identity of an individual. Id. at § 7(a)(2)(A)-(B).

Section 3.3(d) Justification of Social Security Numbers

1. ☐ N/A No full SSNs are maintained in the system or by the project. [Explain if any portion 

of the SSN short of the full 9 digits is used in the system: Explain]; if the full SSN is located 

anywhere in the system (even if it is redacted, truncated or anonymized when viewed by 

users, please check number 2 below)]. 

2. ☒ Full SSNs are maintained in the system or by the project and the following approved 

Treasury uses of SSNs apply: 

☐ security background investigations; 

☒ interfaces with external entities that require the SSN; 

☐ a legal/statutory basis (e.g. where collection is expressly required by statute); 

☐ when there is no reasonable, alternative means for meeting business requirements; 

☐ statistical and other research purposes; 

☒ delivery of government benefits, privileges, and services; 

☐ for law enforcement and intelligence purposes; 

☐ aging systems with technological limitations combined with funding limitations render 

impracticable system modifications or replacements to add privacy risk reduction tools 

(partial/truncated/redacted or masked SSNs); and

☒ as a unique identifier for identity verification purposes.

Section 3.3(e) Controls implemented to limit access to and or improper disclosure of full 

Social Security Numbers 

1. ☐ Full SSNs are not maintained in the system or by the project.

2. ☒ Full SSNs are maintained in the system or by the project and the following controls are 

put in place to reduce the risk that the SSN will be seen or used by someone who does not 

have a need to use the SSN in order to perform their official duties (check ALL that apply): 

a. ☒ The entire SSN data field is capable of suppression (i.e., being turned off) and 

the data field is suppressed when the SSN is not required for particular system 

users to perform their official duties.

b. ☐ The SSN field is visible, but the SSN itself is blurred or distorted in some way 

so it is not capable of being read by users who do not require the SSN to perform 

their official duties.

c. ☐ Within the system, an alternative number (e.g., an Employee ID) is displayed to 

all system users who do not require the SSN to perform their official duties. The 

SSN is only linked to the alternative number within the system and when reporting 

outside the system (to an agency that requires the full SSN). The SSN is not 

visible to system users (other than administrators).

d. ☐ The SSN is truncated (i.e., shortened to the last 4 digits of the SSN) when 

displayed to all system users for whom the last four digits (but not the full) SSN 

are necessary to perform their official duties.
21

e. ☐ Full or truncated SSNs are only downloaded to spreadsheets or other documents 

for sharing within the bureau or agency when disclosed to staff whose official 

duties require access to the full or truncated SSNs for the particular individuals to 

whom they pertain. No SSNs (full or truncated) are included in spreadsheets or 

documents unless required by each recipient to whom it is disclosed in order to 

perform their official duties (e.g., all recipients have a need to see the SSN for 

each employee in the spreadsheet). 

f. ☐ Other: [Please describe].

Section 3.3(f) Denial of rights, benefits, or privileges for refusing to disclose Social Security 

Number

1. ☐ N/A No SSNs are maintained in the system or by the project.

2. ☐ Full SSNs are collected, but no individual will be denied any right, benefit, or privilege 

provided by law if the individual refuses to disclose their SSN for use in the system or 

project. If the individual chooses not to provide their SSN [please describe here what will 

happen (something less than denial of a privilege etc.) if the individual chooses not to 

provide their SSN].

3. ☒ Full SSNs are collected, and the individual will be denied the following right, benefit, 

or privilege provided by law if they refuse to disclose their SSN: Applicants who refuse to 

provide their SSN are denied federal employment. The SSN is required by HRConnect’s 

payroll provider, the United States Department of Agriculture, National Finance Center 

(NFC). NFC has operated as a payroll system of records since 1973. Denial of this right, 

benefit or privilege does not violate the law because: [choose one of the two boxes below]:

a. ☐ SSN disclosure is required by the following Federal statute or Executive Order;

OR

b. ☒ The SSN is disclosed to a Federal, state, or local agency that maintains a 

system of records that was in existence and operating before January 1, 1975, and 

disclosure was required under statute or regulation adopted prior to such date to 

verify the identity of an individual. The SSN is required by HRConnect’s payroll 

provider, the United States Department of Agriculture, National Finance Center 

(NFC). NFC has operated as a payroll system of records since 1973. 

Section 3.3(g) Records describing how individuals exercise First Amendment rights 

The Privacy Act requires that Federal agencies “maintain no record describing how any individual 

exercises rights guaranteed by the First Amendment unless expressly authorized by statute or by the 

individual about whom the record is maintained or unless pertinent to and within the scope of an authorized 

law enforcement activity.” 5 U.S.C. § 552a(e)(7). 

1. ☒ N/A. The system or project does not maintain information describing how an individual 

exercises their rights guaranteed by the First Amendment. Information regarding the 

substance of a religious exemption (from vaccination requirements) sought by employees 

and onboarding personnel are not stored in HRConnect. That information is stored in the 

applicable EEO office or other appropriate location designated by non-Treasury users 

participating in vaccination status collection using HRConnect. For Treasury, the Office of 

Civil Rights and Diversity maintains this information in its Reasonable Accommodations 

Tracker. The PCLIA for this system can be found on the Treasury Departmental Offices 

Privacy and Civil Liberties Impact Assessments webpage at:
22

https://home.treasury.gov/footer/privacy-act/privacy-and-civil-liberties-impactassessments/do-pclia

2. ☐ The system or project does maintain information describing how an individual exercises 

their rights guaranteed by the First Amendment. If you checked this box, please check the 

box below that explains Treasury’s authorization for collecting this information: 

a. ☐ The individual about whom the information was collected or maintained 

expressly authorizes its collection/maintenance. The individual about whom the 

information was collected or maintained expressly authorized its collection by. (for 

example, individuals may expressly authorize collection by requesting in writing 

that Treasury share information with a third party, e.g., their Congressman];

b. ☐ The information maintained is pertinent to and within the scope of an authorized 

law enforcement activity because [generally discuss here the nature and purpose of 

the information collected and the law enforcement activity]; 

c. ☐ The following statute expressly authorizes its collection: [provide here the name 

of and citation to the statute and the language from that statute that expressly 

authorizes collection] [your response MUST contain all three if you use a statute as 

the basis for the collection]. 

Section 4: Maintenance, use, and sharing of the information

Section 4.1: Ensuring accuracy, completeness, and timeliness of information collected, 

maintained, and shared when it is used to make determinations about individuals

The Privacy Act and Treasury policy require that Treasury bureaus and offices take additional care when 

collecting and maintaining information about individuals when it will be used to make determinations about 

those individuals (e.g., whether they will receive a federal benefit). This includes collecting information 

directly from the individual where practicable and ensuring that the information is accurate, relevant, timely 

and complete to assure fairness to the individual when making a determination about them. This section 

addresses the controls/protections put in place to address these issues. 

The Privacy Act requires that Federal agencies “maintain all records which are used by the agency in 

making any determination about any individual with such accuracy, relevance, timeliness, and completeness 

as is reasonably necessary to assure fairness to the individual in the determination.” 5 U.S.C § 552a(e)(5). 

If a particular system of records meets certain requirements (including the NPRM process defined in Section 

3.1 above), an agency may exempt the system of records(or a portion of the records) from this requirement. 

Exemptions may be found at the bottom of the relevant SORN next to the heading: “Exemptions Claimed 

for this System.” 

Section 4.1(a). Exemption from the accuracy, relevance, timeliness, and completeness requirements in 

section (e)(5) of the Privacy Act

1. ☒ None of the information maintained in the system or by the project that is part of a system of 

recordsis exempt from the accuracy, relevance, timeliness, and completeness requirements in 

section (e)(5) of the Privacy Act. Each agency/customer that uses HRConnect is responsible for 

the integrity/quality of the data entered into the system, including accuracy, completeness, and 

timeliness of the information. The information in the system is also derived directly from the 

individual, thereby generally providing a higher assurance of its accuracy. Treasury and the 

agency/customers that use HRConnect do not, however, receive any guarantees about the quality 

of the information. If errors are discovered, they are corrected. System user are encouraged to 

keep their information accurate and up-to-date. 

2. ☐ All ☐ Some of the PII maintained in the system or by the project is part of a system of records 

and is exempt from the accuracy, relevance, timeliness, and completeness requirements in section 

(e)(5) of the Privacy Act. The exemption claimed for these records is appropriate because [please 
23

see Appendix B which contains sample justifications for this exemption and provide the 

appropriate bases here [more than one bases may apply]. 

3. ☐ The PII maintained in the system or by the project is not: (a) part of a system of records as 

defined in section (e)(5) of the Privacy Act; or (b) used to make adverse determinations about 

individuals (defined in the Privacy Act as U.S. Citizens and legal permanent residents). Instead, 

the information is used to [describe how the information is used and why this use does not involve 

adverse determinations]. hat you read the rest of the options before checking this box

4. ☐ None of the information maintained in the system or by the project is part of a system of records

as defined in section (e)(5) of the Privacy Act, but the information in the system is used to make 

adverse determinations about individuals (defined in the Privacy Act as U.S. Citizens and legal 

permanent residents). Despite the fact that the Privacy Act does not apply, the following 

protections are in place to ensure fairness to the individual: explain here .

Section 4.1(b) Protections in place despite exemption from the accuracy, relevance, timeliness, and 

completeness requirements 

1. ☒ None of the information maintained in the system or by the project that is part of a system of 

recordsis exempt from the accuracy, relevance, timeliness, and completeness requirements in 

section (e)(5) of the Privacy Act.

2. ☐ For all information maintained in the system or by the project that is part of a system of records 

that is exempt from the accuracy, relevance, timeliness, and completeness requirements in section 

(e)(5) of the Privacy Act, the following efforts are made to ensure accuracy, relevance, timeliness, 

and completeness to the extent possible without interfering with the (check one) ☐ law 

enforcement ☐ intelligence ☐ other [describe here] mission requirements for which the system or 

project was created [choose ALL that apply]: 

a. ☐ The exempt information is not actually used to make any adverse determinations about 

individuals.

b. ☐ The exempt information is not actually used to make any adverse determinations about 

individuals without additional research and investigation to ensure accuracy, relevance, 

timeliness, and completeness.

c. ☐ Individuals and organizations to whom PII from the system or project is disclosed (as 

authorized by the Privacy Act) determine its accuracy, relevance, timeliness, and 

completeness in a manner reasonable for their purposes before they use it to make adverse 

determinations about individuals. 

d. ☐ Individuals about whom adverse determinations are made using PII from this system or 

project are given an opportunity to explain or modify their information (check one) ☐ before 

☐ after the adverse determination is made. During this process, individuals are allowed to: 

[discuss here ] 

e. ☐ Other: (please describe):

3. ☐ No additional efforts are made to ensure accuracy, relevance, timeliness, and completeness to 

the extent possible because it would interfere with mission requirements.

Section 4.1(c) Collecting information directly from the individual when using it to make 

adverse determinations about them. 

Section 552a(e)(2) of the Privacy Act requires that Federal agencies that maintain records in a system of 

records are required to collect information to the greatest extent practicable directly from the individual 

when the information about them may result in adverse determinations about their rights, benefits, and 

privileges under Federal programs. Agencies may exempt a system of records from this requirement under 

certain circumstances and if certain conditions are met.
24

1. ☐ The records maintained by this system or project are not used to make any adverse 

determinations about individuals. 

2. ☒ The records maintained by this system or project are used to make adverse determinations about 

individuals and [check all that apply]:

a. ☐ These records were exempted from the Privacy Act provision that requires 

collection directly from the subject individual to the greatest extent practicable. 

Exemption of these records is proper because [explain here why the records were 

exempted; sample responses are provided in Appendix B of this template]. 

b. ☒ These records were not exempted from the requirement to collect information 

directly from the individual to the greatest extent practicable and [check the relevant 

box below and provide the information requested]. 

i. ☒ All records used to make an adverse determination are collected directly from 

the individual about whom the decision is made. The vast majority of information 

maintained in the system is collected directly from the employee. Such information 

could be used to make an adverse determination about an individual’s rights, 

benefits, and privileges under federal programs. Agencies with which HRConnect 

shares information pursuant to the routine uses in the applicable systems of records 

notices (see below) may also use information from the system during their 

performance evaluation processes. Information maintained in the system regarding 

employee performance may be based on input from both the employee and their 

manager. Performance information may be used to make an adverse determination 

about an individual’s ability to receive a performance award. For an employee to 

receive a performance award, they must have received an overall rating of at least 

fully successful on their performance evaluation. This is enforced by the payroll 

provider system, NFC. The overall rating is not determined by HRConnect; it is 

determined (offline) by the manager and reviewing manager during the 

performance evaluation process. During the performance evaluation process, 

employees are provided with an opportunity to articulate their performance 

achievements and may submit an official written statement on their performance 

evaluation. HRConnect maintains the overall rating and the performance award 

amount and electronically transmits both to the payroll provider, NFC. 

Determinations regarding performance awards, including the amount of individual 

awards, are made by supervisors and senior staff within each bureau or office, not 

by the Office of Human Resources (OHR). 

“Employees who fail to comply with a requirement to be fully vaccinated or provide proof 

of vaccination and have neither received an exception nor have an exception request under 

consideration, are in violation of a lawful order. Employees who violate this lawful order 

will be subject to discipline, up to and including removal.”

ii. ☐ A combination of records collected from third parties and directly from the 

individual about whom the determination is made are used to make the 

determination because [please explain here why third-party data is required to 

make this determination; e.g., third-party data is required to verify the accuracy of 

the information provided by the individual seeking a privilege or benefit].

iii. ☐ None of the records used to make adverse determinations are collected directly 

from the individual about whom determinations are made because seeking the 

information directly from the individual might [select ALL that apply]: 
25

☐ alert the individual to the fact that their conduct is being observed or investigated; 

☐ cause the individual to alter or modify their activities to avoid detection;

☐ create risks to witnesses or other third parties if the individual is alerted to the fact 

that their conduct is being observed or investigated;

☐ Other: (please describe here).

Section 4.1(d) Additional controls designed to ensure accuracy, completeness, timeliness and 

fairness to individuals in making adverse determinations

1. Administrative Controls. Individuals about whom information is collected are given the 

following opportunities to amend/correct/update their information to ensure it is accurate, 

timely and complete to the extent reasonably necessary to assure fairness when it is used to 

make a determination about them: 

a. ☐ The PII collected for use in the system or project is NOT used to make adverse 

determinations about an individual’s rights, benefits, and privileges under federal 

programs. 

b. ☒ The records maintained in the system or by the project are used to make adverse 

determinations and (select one) ☐ are ☒ are not exempt from the access provisions in 

the Privacy Act, 5 U.S.C. 552a(d). 

c. ☒ Treasury has published regulations in place describing how individuals may seek access to 

and amendment of their records under the Privacy Act. The Treasury/bureaus FOIA and 

Privacy Act disclosure regulations can be found at 31 C.F.R. Part 1, Subtitle A, Subparts A and 

C. Corrections and amendments made to the record of a Federal employee are done via HR 

transactions in accordance with the U.S. Office of Personnel Management’s Guide to 

Processing Personnel Actions (GPPA). Individuals are notified via the Standard Form 50 (SF50), Notification of Personnel Action. For agencies that elect to maintain limited contractor 

PII in HRConnect, functionality can be enabled for contractors to update/correct their own 

information directly in HRConnect. For example, employees can update their vaccination 

status at any time.

d. ☐ Individuals who provide their information directly to Treasury for use in the system or by the 

project are provided notice of the adverse determination and an opportunity to amend/correct/ 

update their information [choose one] ☐ before ☐ after it is used to make a final, adverse 

determination about them. This is accomplished by [describe here how this process works and 

the protections in place, including redress/appeals processes; if notice is provided after an 

adverse determination is made, explain here why notice could not be provided before a 

determination was made, and the protections in place]: Descriptions. 

e. ☐ Individuals who provide their information directly to Treasury for use in the system or by 

the project are expressly told at the point where the information is collected that they need to 

keep their information accurate, current and complete because it could be used to make adverse 

determinations about them. This is accomplished by:... 

f. ☐ All manual PII data entry by federal employees/contractors is verified by a supervisor or 

other data entry personnel before it is uploaded to the system (e.g., PII entered into the system 

from paper records is double-checked by someone else before it’s uploaded to the system). 

This is accomplished by: [describe here how this process works].

g. ☐ Other: 

2. Technical controls. The system or project also includes additional technical controls to 

ensure that PII is maintained with such accuracy, relevance, timeliness and completeness as 

is reasonably necessary to assure fairness to the individual when it is used to make a 

determination about them. The following additional protections are relevant to this system 

or project 
26

a. ☐ No additional technical controls are available to ensure accuracy, relevance, timeliness and 

completeness. 

b. ☐ Automated data feeds are used to refresh/update the information in the system (where the 

system is reliant on updates from another system). These automated data feeds occur: [state 

here the frequency of updates] and [state here what happens when the data is updated and why 

the system is reliant on another system for its data]. 

c. ☐ Technical and/or administrative controls put are in place to ensure that when information 

about an individual is acquired from multiple sources for maintenance in a single file about a 

particular individual, it all relates to the same individual . This is accomplished by: [describe 

here the method or process used to ensure that information merged about an individual from 

multiple sources for inclusion in a single file, all relates to the same person]. 

d. ☐ Address verification and correction software (software that validates, updates and 

standardizes the postal addresses in a database).

e. ☒ Other: The data collected is verified for accuracy, relevancy, and completeness by the 

employees who submit their information to Treasury and other Federal agencies that use 

HRConnect (and in some cases EODs). The information is also reviewed by participating 

agencies’ HR Specialists and undergoes the quality assurance process put in place by each

agency. Treasury employees may also update their information in HRConnect upon request at 

any time. 

Section 4.2 Data-Mining

As required by Section 804 of the Implementing Recommendation of the 9/11 Commission Act of 2007 (“9-

11 Commission Act”), Treasury reports annually to Congress on its data mining activities. For a 

comprehensive overview of Treasury’s data mining activities, please review the Department’s Annual 

Privacy Act and Data Mining reports available at: http://www.treasury.gov/privacy/annual-reports. 

Section 4.2(a) Is the PII maintained in the system used to conduct data-mining?

1. ☒ The information maintained in this system or by this project is not used to conduct 

“data-mining” activities as that term is defined in the 9-11 Commission Act. Therefore, no 

privacy or civil liberties issues were identified in responding to this question.

2. ☐ The information maintained in this system or by this project is used to conduct “datamining” activities as that term is defined in the 9-11 Commission Act. This system is 

included in Treasury’s annual report to Congress which can be found on the external 

Treasury privacy website.

3. ☐ The information maintained in this system or by this project is used to conduct “datamining” activities as that term is defined in the 9-11 Commission Act, but this system is not 

included in Treasury’s annual report to Congress which can be found on the external

Treasury privacy website. This system will be added to the next Treasury Data-mining 

report to Congress.

Section 4.3 Computer Matching

The Computer Matching and Privacy Protection Act (CMPPA) of 1988 amended the 

Privacy Act by imposing additional requirements when Privacy Act systems of records are 

used in computer matching programs. 

Pursuant to the CMPPA, there are two distinct types of matching programs. The first type 

of matching program involves the computerized comparison of two or more automated 

federal personnel or payroll systems of records or a system of federal personnel or payroll 

records with non-federal records. This type of matching program may be conducted for any 

purpose. The second type of matching program involves the computerized comparison of 

two or more automated systems of records or a system of records with non-federal records. 
27

The purpose of this type of matching program must be for the purpose of eligibility 

determinations or compliance requirements for applicants, recipients, beneficiaries, 

participants, or providers of services for payments or in-kind assistance under federal 

benefit programs, or recouping payments or delinquent debts under such federal benefit 

programs. See 5 U.S.C. § 522a(a)(8). Matching programs must be conducted pursuant to a 

matching agreement between the source (the agency providing the records) and recipient 

agency (the agency that receives and uses the records to make determinations). The 

matching agreement describes the purpose and procedures of the matching and establishes 

protections for matching records.

Section 4.3(a) Records in the system used in a computer matching program

1. ☒ The PII maintained in the system or by the project is not part of a Privacy Act system 

of records. 

2. ☐ The information maintained in the system or by the project is part of a Privacy Act 

system of records, but is not used as part of a matching program.

3. ☐ The information maintained in the system or by the project is part of a Privacy Act 

system of records and is used as part of a matching program. [If whether a Matching 

Agreement was executed and published as required by the CMPPA/Privacy Act; if no 

Matching Agreement was executed, please explain here why]: Explain here. 

Section 4.3(b) Is there a matching agreement?

1. ☒ N/A

2. ☐ There is a matching agreement in place that contains the information required by 

Section (o) of the Privacy Act. 

3. ☐ There is a matching agreement in place, but it does not contain all of the information 

required by Section (o) of the Privacy Act. The following actions are underway to amend 

the agreement to ensure that it is compliant. 

Section 4.3(c) What procedures are followed before adverse action is taken against an 

individual who is the subject of a matching agreement search?

1. ☒ N/A

2. ☐ The bureau or office that owns the system or project conducted an assessment regarding 

the accuracy of the records that are used in the matching program and the following 

additional protections were put in place:

a. ☐ The results of that assessment were independently verified by [explain how and by 

whom accuracy is independently verified; include the general activities involved in the 

verification process]. 

b. ☐ Before any information subject to the matching agreement is used to suspend, 

terminate, reduce, or make a final denial of any financial assistance or payment under a 

Federal benefit program to an individual: 

i. ☐ The individual receives notice and an opportunity to contest the findings; OR 

ii. ☐ The Data Integrity Board approves the proposed action with respect to the 

financial assistance or payment in accordance with Section (p) of the Privacy Act

before taking adverse action against the individual. 

3. ☐ No assessment was made regarding the accuracy of the records that are used in the 

matching program.
28

Section 4.4: Information sharing with external (i.e., outside Treasury) 

organizations and individuals

Section 4.4(a) PII shared with/disclosed to agencies, organizations or individuals outside 

Treasury

1. ☐ PII maintained in the system or by the project is notshared with agencies, organizations, 

or individuals external to Treasury. 

2. ☒ PII maintained in the system or by the project is shared with the following agencies, 

organizations, or individuals external to Treasury: 

Treasury is a cross-services provider to other Treasury bureaus and Federal agencies 

pursuant to the U.S. Office of Personnel Management Human Resources Line of Business 

(HRLOB). An Interconnection Security Agreement (ISA) is countersigned by the Servicing 

Agency (Treasury) and the Requesting Agency (customer). The ISA documents the limits, 

conditions, and proper usage of the application and the data within by both the Servicing 

Agency and the Requesting Agency. As the Servicing Agency, Treasury provides data to the 

third- party application administrators listed below. There are agreements signed between 

Treasury and these third-party application administrators. 

Contracts are also executed between Treasury offices and vendors who perform studies to 

allow the development of aggregate/ statistical data to measure internal performance of 

Treasury programs. These contractors receive raw data from the system for the limited 

purpose of conducting the study and developing aggregate statistical data. These contracts 

limit the vendor’s use and disclosure of the data provided, including PII. The vendors are 

required to safeguard all data and other information, including PII received from the 

system. Vendors are also prohibited from using or disseminating such data and 

information for any purpose other than providing the services referenced in the contracts. 

The contracts also contain confidentiality provisions which prohibit vendor disclosure of 

any information obtained or prepared in the course of performing services under the 

contract. At the termination of the contract vendors are required to return all data 

provided upon request by Treasury. All government furnished information provided in 

conjunction with required performance under these contracts must be immediately returned 

at the written request of the Government after the purpose of the contract is completed (or 

before if terminated). 

Internal and External HRC customers access their own information directly in HRConnect. 

When an HRC customer accesses their own information it is not, technically internal 

sharing; it is merely a use of their own information. HRC customers do, however, 

sometimes make their own arrangements with vendors outside their organization to share 

HRC data for the purpose of conducting organizational, workforce, and similar 

assessments and studies. In general, data is used to develop aggregate/statistical data to 

measure internal performance of programs and operations. OHR provides customer 

service with respect to these disclosures upon request, and in accordance with the specific 

needs of each disclosure. For example, OHR assigns and maintains randomly assigned 

unique identifiers to each personnel file that is shared internally or externally to allow the 

development of aggregate/statistical data. These numbers are deleted at the end of each 

project/study. New unique identifying numbers for personnel files are randomly created for 

each study.
29

• Department of Veterans Affairs Office of Inspector General Department of 

Agriculture 

• USDA Ofc Chief Info Ofcr – CTS (Client Technology Services)

• U. S. Agency for International Development (USAID)

• Architectural and Transportation Barriers Compliance Board (US Access Board) 

• Department of Commerce:

 Office of the Secretary 

 Economic Development Administration 

 Bureau of Economic Analysis 

 National Oceanic and Atmospheric Administration 

 International Trade Administration 

 U. S. Patent and Trademark Office 

 National Institute of Standards and Technology 

 Minority Business Development Agency 

 National Telecommunications and Information Administration 

 National Technical Information Service 

 Bureau of the Census

 Office of the Inspector General

 Office of Inspector General 

 Economics and Statistics Administration 

 Bureau of Industry and Security 

• Department of Justice Bureau of Alcohol, Tobacco, Firearms, and Explosives

• Department of Labor 

• Denali Commission 

• Federal Reserve Bureau of Consumer Financial Protection (BCFP)

• Gulf Coast Ecosystem Restoration Council (GCERC)

• Office of Government Ethics (OGE) 

• Federal Housing Finance Agency OIG (FHFA OIG)

• Department of Homeland Security U.S. Secret Service (USSS)

• Department of Housing and Urban Development (HUD)

• Department of Housing and Urban Development HUD Office Inspector General

• Government Accountability Office (GAO)

• United States Congress Commission on Security and Cooperation in Europe 

(CSCE) 

• Armed Services Retirement Home (AFRH)

• Federal Mine Safety and Health Fed Mine Safety Health Rev Com

• Commission on People's Republic of China (CECPRC)

• Veterans Affairs Office of Inspector General (VA OIG)

With respect to vaccination status information, Treasury may disclose that information externally for 

any of the purposes allowed by the Privacy Act, including the routine uses listed in the applicable 

SORN, Treasury .020, Health Screening and Contact Tracing Records, Fed. Reg. Vol. 86, No. 35, at 

11381. Non-Treasury users participating in vaccination status collection using HRConnect may 

disclose vaccination status as allowed by the Privacy Act, including the routine uses stated in 

OPM/GOVT-10, Employee Medical File System Records. Available at: 

https://www.govinfo.gov/content/pkg/FR-2010-06-21/pdf/2010-14838.pdf Some HRConnect users may 

rely on their own SORN and the applicable routine uses stated in that document. Employees of NonTreasury users participating in vaccination status collection using HRConnect should consult their 
30

agency’s online privacy page and/or consult with their privacy officer for specific/additional 

information. 

3. ☒ All external disclosures are authorized by the Privacy Act (including routine uses in the 

applicable SORN). Vaccination status information is Confidential Medical Information under the 

Rehabilitation Act. Treasury will, therefore, segregate it from other personnel records and 

access will be limited based on need to know.

Section 4.4(b) Accounting of Disclosures

An accounting of disclosures is a log of all external (outside Treasury) disclosures of records made from a 

system of records that has not been exempted from this accounting requirement. This log must either be 

maintained regularly or be capable of assembly in a reasonable amount of time after an individual makes a 

request. Certain system of records may be exempted from releasing an accounting of disclosures (e.g., in law 

enforcement investigations). 

Section 4.4(c) Making the Accounting of Disclosures Available 

1. ☐ The records are not maintained in a system of records subject to the Privacy Act so an 

accounting is not required. 

2. ☐ No external disclosures are made from the system. 

3. ☐ The Privacy Act system of records maintained in the system or by the project is

exempt from the requirement to make the accounting available to the individual 

named in the record. Exemption from this requirement was claimed because: 

[please state here why the records in this system of records were exempted from 

this requirement]. 

4. ☒ The Privacy Act system of records maintained in the system or by the project 

is not exempt from the requirement to make the accounting available to the 

individual named in the record and a log is maintained regularly. The log is 

maintained for at least five years and includes the date, nature, and purpose of 

each disclosure (not including intra-agency disclosures and FOIA disclosures) of a 

record to any person or to another agency (outside of Treasury) and the name and 

address of the person or agency to whom the disclosure is made. 

5. ☐ The Privacy Act system of records maintained in the system or by the project 

is not exempt from the requirement to make the accounting available to the 

individual named in the record and a log is not maintained regularly, but is 

capable of being constructed in a reasonable amount of time upon request. The 

information necessary to reconstruct the log (i.e., date, nature, and purpose of each 

disclosure) is maintained for at least five years.

Section 4.4(d) Obtaining Consent Prior to New Disclosures Not Authorized by the Privacy 

Act

Recordsin a system of records subject to the Privacy Act may not be disclosed by "any means of 

communication to any person or to another agency" without the prior written request or consent of 

the individuals to whom the records pertain. 5 U.S.C. Sec. 552a(b). However, the Act also sets 

forth twelve exceptions to this general restriction. These 12 exceptions may be viewed at: 

https://www.justice.gov/usam/eousa-resource-manual-139-routine-uses-and-exemptions. Unless 

one of these 12 exceptions applies, the individual to whom a record pertains must provide their 

consent, where feasible and appropriate, before their records may be disclosed to anyone who is 

not listed in one of the 12 exceptions. One of these 12 exceptions also allows agencies to include 
31

in a notice published in the Federal Register, a list of routine uses. Routines uses are disclosures 

outside the agency that are compatible with the purpose for which the records were collected. 

Section 4.4(e) Obtaining Prior Written Consent

1. ☒ The records maintained in the system of records are only shared in a manner 

consistent with one of the 12 exceptions in the Privacy Act, including the routine 

uses published in the Federal Register. 

2. ☒ If a situation arises where disclosure (written, oral, electronic, or mechanical)

must be made to anyone outside of Treasury who is not listed in one of the 12 

exceptions in the Privacy Act (including the published routine uses), the 

individual’s prior written consent will be obtained where feasible and appropriate.

Vaccination status information is Confidential Medical Information under the 

Rehabilitation Act. Treasury will, therefore, segregate it from other personnel 

records and access will be limited based on need to know. Employees of NonTreasury users participating in vaccination status collection using HRConnect 

should consult their agency’s online privacy page and/or consult with their 

privacy officer for specific/additional information.

Section 5: Compliance with federal information management requirements

Responses to the questions below address the practical, policy, and legal consequences of failing 

to comply with one or more of the following federal information management requirements (to 

the extent required) and how those risks were or are being mitigated: (1) the Privacy Act System 

of Records Notice Requirement; (2) the Paperwork Reduction Act; (3) the Federal Records Act; 

(4) the E-Gov Act security requirements; and (5) Section 508 of the Rehabilitation Act of 1973.

Section 5.1: The Paperwork Reduction Act

The PRA requires OMB approval before a Federal agency may collect standardized data from 10 or more 

respondents within a 12-month period. OMB also requires agencies to conduct a PIA (a Treasury PCLIA) 

when initiating, consistent with the PRA, a new electronic collection of PII for 10 or more persons 

(excluding agencies, instrumentalities, or employees of the federal government).

Section 5.1(a)

1. ☐ The system or project maintains information obtained from individuals and organizations 

who are not federal personnel or an agency of the federal government (i.e., outside the 

federal government)

2. ☐The project or system involves a new collection of information in identifiable form for 10 

or more persons from outside the federal government. 

3. ☐ The project or system completed an Information Collection Request (“ICR”) and 

received OMB approval.

4. ☒ The project or system did not complete an Information Collection Request (“ICR”) and 

receive OMB approval because the information contained in this system is being gathered 

from individuals who have been offered employment with the Federal government, in their 

capacity as Federal employees, and from current Federal employees. Following an offer of 

employment, they are no longer considered members of the public, and as such, the 

Paperwork Reduction Act does not apply. 

Section 5.2: Records Management - NARA/Federal Records Act Requirements
32

Records retention schedules determine the maximum amount of time necessary to retain information in 

order to meet the needs of the project or system. Information is generally either disposed of or sent to the 

National Archives and Records Administration (NARA) for permanent retention upon expiration of this 

period. If the system has an applicable SORN(s), check the “Policies and Practices for Retention and 

Disposal of Records” section. 

Section 5.2(a) 

1. ☒ The records used in the system or by the project are covered by a NARA’s 

Treasury retains Human Resources records in this system in compliance with 

General Records Schedule (GRS) 2.0, approved by the National Archives and 

Records Administration (NARA). NARA is in the process of updating GRS 2.7 to 

include employee vaccine records. NARA has not yet approved that records 

schedule. Treasury will treat vaccination records as unscheduled records and 

retain permanently until GRS 2.7 is approved. After GRS 2.7 is approved, GRS 

2.7 will govern the disposal of Treasury vaccination records.

2. ☐ The records used in the system or by the project are covered by a NARA 

approved Treasury bureau Specific Records Schedule (SRS). The SRS [please

provide here the specific schedule name and identifying number]

3. ☐ On [please state the date on which NARA approval was sought] the system 

owner sought approval from NARA for an SRS and is awaiting a response from 

NARA. [State here the retention periods you proposed to NARA]. 

4. ☐ The system owner is still in the process of developing a new records schedule 

to submit to NARA.

Section 5.3: E-Government Act/NIST Compliance 

The completion of Federal Information Security Management Act (FISMA) Security 

Assessment & Authorization (SA&A) process is required before a federal information system 

may receive Authority to Operate (ATO). 

Section 5.3(a) 

1. ☒ The system is a federal information system subject to FISMA requirements.

2. ☒The system last completed an SA&A and received an ATO on: 01/31/2020. 

3. ☐This is a new system has not yet been authorized to operate. The expected to date for 

receiving ATO is [please state here the expected date on which you expect authorization 

will be granted]. 

4. ☒The system or project maintains access controls to ensure that access to PII maintained is 

limited to individuals who have a need to know the information in order to perform their 

official Treasury duties. Accessto the data by a useris determined based upon the roles assigned

to the user’s profile. Roles are assigned based on position. Specifically, users will only have 

access to the data that is inherently theirs, such as their own personally identifiable information 

(PII). In the case of managers, they will have access to their own PII as well as limited information 

of those employees assigned to them. Additional roles may be assigned using strict ‘need-to-know’ 

criteria. The criteria, procedures, controls, and responsibilities regarding access are documented.

5. ☒ All Treasury/bureau security requirements are met when disclosing and transferring 

information (e.g., bulk transfer, direct access by recipient, portable disk, paper) from the 

Treasury system or project to internal or external parties. The data in the system is shared 

with data owners (both internal and external to Treasury). These individuals must access 

the URL address via a secure and recognized connection to the Treasury network gateway 

and authenticate to the application using unique user credentials. Authorized third parties 
33

receive extracts of data in the system based on a ‘need-to-know’ basis and in accordance 

with a written agreement between themselves and the U.S. Department of Treasury, Office 

of the Chief Information Office, Enterprise Business Solutions, and HRConnect Program 

Office. The agencies must then adhere to the prescribed configuration management 

principles and procedures in conjunction with the HRConnect Program Office information 

systems protocols to set up a periodic file feed with the extracted information. In support of 

the HSPD-12 Initiative, HRConnect has implemented Web Services to provide data 

exchange services with Treasury Debt Management Services (DMS). 

6. ☒ This system or project maintains an audit log of system users to ensure they do not 

violate the system and/or Treasury/bureau rules of behavior.

7. ☐ This system or project has the capability to identify, locate, and monitor individuals or 

groups of people other than the monitoring of system users to ensure that they do not 

violate the system’s rules of behavior. [If checked, please describe this capability here, 

including safeguards put in place to ensure the protection of privacy and civil liberties.]

Section 5.4: Section 508 of the Rehabilitation Act of 1973

When Federal agencies develop, procure, maintain, or use Electronic and Information Technology (EIT), 

Section 508 of the Rehabilitation Act of 1973 (as amended in 1998) requires that individuals with 

disabilities (including federal employees) must have access and use (including privacy policies and 

directives as well as redress opportunities) that is comparable to that which is available to individuals who 

do not have disabilities.

Section 5.4(a) 

1. ☐ The project or system will not involve the development, procurement, maintenance or 

use of EIT as that term is defined in Section 508 of the Rehabilitation Act of 1973 (as 

amended in 1998)? 

2. ☐ The project or system will involve the development, procurement, maintenance or use 

of EIT as that term is defined in Section 508 of the Rehabilitation Act of 1973 (as amended 

in 1998)? If checked:

3. ☒ The system or project complies with all Section 508 requirements, thus ensuring that 

individuals with disabilities (including federal employees) have access and use (including 

access to privacy and civil liberties policies) that is comparable to that which is available to 

individuals who do not have disabilities. 

HRConnect is based on a COTS product (Oracle PeopleSoft). The COTS product platform 

for HRConnect has been evaluated by Oracle using the Voluntary Product Accessibility 

Template (VPAT). The Voluntary Product Accessibility Template (VPAT) was developed by 

ITI and GSA to assist Federal contracting officials and other buyers in making preliminary 

assessments regarding the availability of commercial Information and Communication 

Technology (ICT) products and services with features that support accessibility. 

4. ☐ The system or project is not in compliance with all Section 508 requirements. The 

following actions are in progress to ensure compliance: [please describe here the efforts 

underway to ensure compliance].
34

Responsible Officials

Timothy Skinner 

Director of Privacy and Civil Liberties 

Departmental Offices Privacy and Civil Liberties Officer 

U.S. Department of the Treasury 

Chakravarthy Susarla

Director - Enterprise Business Systems Development, HRConnect System Owner

Office of the Chief Information Officer, Enterprise Business Systems

Nicolaos Totten

Acting Associate Chief Information Officer Enterprise Business Solutions (EBS),

HRConnect Authorizing Official 

U.S. Department of the Treasury 

Approved by Reviewing Official:

_________________________________________________________

Ryan Law

Deputy Assistant Secretary for Privacy, Transparency, & Records

Departmental Offices

Department of the Treasury
35

Appendix A: Data Points and Descriptions

Personnel Action Data

Data Point(s) Description

Accession Codes Series of codes used by OPM and the hiring agency to identify the legal authority for

the action – initial hire, promotion, rehire, etc.

Action Code and Type Type of last personnel action code and description. This element provides a means of 

identifying, by code, and related description, the type of action being processed.

Age Age of employee (computed field), at the time the action was completed, and the age 

Age at time of Ac group of the employee. tion 

Age Range

Agency Years of Service (YOS) at 

Time of Action Number of years employee has been in federal service at time of action 

Annuitant Code and Description The status of an annuitant appointed to a position in the federal civilian service. This

code indicates whether an employee is receiving retired or retained pay from previous 

civilian or military service. 

Appointment Code(s) Series of codes used by OPM and the hiring agency to identify the legal authority for 

the appointment.

Action Code(s) and Description Nature of action code (and description of the code) under which the employee was 

converted. 

Awards Received Code used by OPM and the hiring agency to identify the type of award issued the 

employee. 

Bargaining Unit Status Indicates whether an employee is eligible for coverage by a bargaining unit, and if 

covered, the specific bargaining unit.

Base Contract Salary Amount of an employee’s salary – stated as annual, monthly, daily or hourly as 

indicated by salary rate code.

Authority Code(s) Series of codes used by OPM and the hiring agency to identify the legal authority for 

the action. 

Current Employment Status Employee’s current status.

Date of Accession Date employee separated from agency or agency terminated employee.

Enter on Duty Date for Agency Employee’s “Enter on Duty” date, more commonly known as start date, at the agency. 

Appointment Effective Date Date employee was appointed to Federal service.

Personnel Action Effective Date Date the personnel action became effective 

Service Computation Date Service computation date (SCD) relative to specific personnel actions, including 

leave eligibility calculation, reduction in workforce, and within grade increase(s).

Department Name and Code Code used to identify (and name of) the department of government the employee 

serves in. 

Disability Description The description of the physical or mental impairment which substantially

limits one or more major life activities as identified by the employee; the 

record of such impairment; or the perception of such impairment by others.

Duty Station City, State, Name Codes and names of the city, state, county and other related information of the duty 

station where the employee is primarily/permanently located. 

Education Level Code and description of the academic level of education attained by the employee.

Employee Ethnicity and Race Ethnicity and Race Identification (ERI) code as identified by the employee.

Employment Type Indicates if an employee is full-time, part-time, etc.

Fair Labor Standards Code Indicates whether the employee is covered by the minimum pay and overtime 

provisions of the fair labor standards act.

Federal Service at Time of Action Indicates amount of time in federal service at time of action. 

FEGLI Eligibility Code and description of employee’s eligibility (or ineligibility) for participation in the 

Federal Employees Group Life Insurance Program and, if eligible, whether the 

employee waived overage, is participating, or has elected to be covered under the 

optional insurance plan as well as the regular plan.

FERS Coverage Code and description of employee’s participation in Federal Employee Retirement 

System (FERS) coverage.

Internal Transfer Information Codes used to identify where in the organization the employee came from or moved 

to in the event of an internal transfer.

Geographic Rate Adjustment Amount of money/salary adjusted for geographic location. 
36

Data Point(s) Description

Geographic Percent Adjustment The percent used to compute an employee’s pay adjustment due to specific geographic 

location. 

Headquarters Field Code Code indicating whether an established record describes headquarters or field positions.

Instructional Program A description of the employee’s major field of study. 

Targeted Disability Information Code of the disabilities (other than the nine listed under targeted disabilities) as 

identified by employees.

FEGLI Coverage Code and description of employee’s coverage or no coverage under FEGLI.

Master Record Number A number identifying a unique master position, linked to agency, position, and grade. 

Values are agency assigned standard job number and/or unique number.

Time Off Award Information Code and description for time off award awarded to employee (individual or group).

Occupational Series Code and description of the exact occupational group to which the employee’s 

position has been classified.

Official Title Code Code indicating the official or classification title of the employee’s position. 

Organizational Level(s) Agency assigned codes established for the various levels of an organization (2-8).

Organization Name Name of the organization

PATCO Code Code and description of one of the seven major categories base on occupational series.

Pay Band Pay band the employee’s position falls into.

Pay Period Number Pay period number in which the action took place (number of pay period that is 

currently being processed).

Pay Plan Information Code and description of the pay play to which the employee’s position has been 

assigned. 

Pay Rate Determinant Records whether the employee is receiving a rate of pay other than the regular rate 

for the position, and, if so, to identify the legal and/or regulatory basis therefore, the 

pay rate.

Permanent or Temporary Whether the employee’s position is temporary or permanent.

Physical Handicap Code A code to indicate whether or not an employee has a physical or mental handicap. 

This is used for statistical reporting and for placement of employees in positions that 

require special physical qualifications.

Person of Interest Code Person of Interest code which identifies employment type. 

Position Number Specifically identifies, by number, the position occupied by the employee. 

Position Official Title Official title associated with the position occupied by the employee. 

Position Sensitivity The designation of the level of risk associated with a position. 

Position Supervisory Code The nature of managerial, supervisory or non-supervisory responsibility assigned to an 

employees’ position. 

Position Target Grade The grade at which the employee’s position will be properly classified when full 

potential is reached. 

Remark Codes Codes used to record those items of information which relate to the action being taken 

and which are required for documentation purposes. 

Retirement Coverage Code and description for the type of retirement/social security coverage held by the 

employee pursuant to his employment.

Salary Rate Code and description outlining pay basis for which employee’s salary is stated. 

Scheduled Salary Total salary is adjusted pay (basic pay plus locality pay) plus other pay. (Also known as 

"Scheduled Salary" or "Annual Salary".).

Separation Code Code used to record personnel actions related to separation from an agency. 

Sex Code Indicates the sex of the employee.

Special Employment Programs Identifies the employee to a special employment program area.

Start Date Start date for tenure (as Federal employee). Presented as day, month, and year.

Tenure Group Code and description used as a means of identifying, by code the tenure group which 

the employee occupies for reduction in force purposes (permanent or career).

Tour Of Duty Hours Hours required by an employee, per pay period, for purposes of pay and benefits 

setting. 
37

Data Point(s) Description

Appointment Type Code Identify the type of appointment given to an employee. The code will indicate into 

which service the employee has been placed and his status with respect to the type of 

appointment he holds.

Veteran’s Status and Preference Codes and descriptions associated with certain preferences granted veterans regarding 

reduction in workforce, hiring, status, etc. 

Work Schedule Code and description of work schedule type of the employee – for instance, 

compressed, regular, etc.

Sequence Number (for multiple

records processed on the same 

effective date)

Number of action relative to other actions processed that day (for distinguishing order 

of actions processed on same day).

Applicant Data

Position/Requisition Data (details of the posting, per posting)

Data Point Description

Requisition number Unique number assigned to the job posting

Status of requisition Current status of job posting (open, closed)

Close date Date job posting closed (or is scheduled to close) 

Date withdrawn (if applicable) Date job posting withdrawn (retracted without being filled)

Fair Labor Standards Act (FLSA) Whether the job is exempt from requirements of the FLSA 

Open date Date job posting opened

Filled Whether job posting was filled – yes or no

Position pay grade/band Pay grade or pay band for job in posting

Number of positions Number of positions that may be filled from the job posting

Internal/external posting Whether the posting is open to internal candidates only or internal and external

candidates

Applicant Data (per position)

Applicant ID number Unique number assigned for each individual applicant for a job posting

Date of activity Date of activity by an individual applicant specific to a job posting 

Minimum qualifications Whether the individual applicant met the minimum qualifications for the job 

Date of application Date the individual applied to the position in the job posting (submitted application)

Veteran preference Whether the individual claimed a veteran’s preference when applying for the position 

Requisition number Unique number assigned to the job posting

Disposition status Whether the individual was selected for the position (hired)

Best qualified Whether the individual was deemed “best qualified” for the position 

Internal/external applicant Whether the individual was an internal or external applicant 

Applicant Demographic Data

(aggregated count per posting and separate from individual applicant data)

Race As identified by the applicant from a provided selection in the application

Veterans status As identified by the applicant from a provided selection in the application

Ethnicity As identified by the applicant from a provided selection in the application 
38

Gender As identified by the applicant from a provided selection in the application

Employee Viewpoint Survey (EVS) Data 2013 - 2016

Response Data

(aggregated at the agency, office and organizational level)

Count of respondents to question(s) found in EVS % of positive responses for each question found in EVS

% of neutral responses for each question found in EVS % of negative responses for each question found in EVS

% of non-responses for each question found in EVS 

Exit Interview Data (4/2016 – 9/2016)

Response Data (aggregated narrative themes)

Time period (date range) Total number of separations

Number of interviews held Number of interviews declined 

General narrative feedback, including: reason for leaving; leadership effectiveness; 

employee engagement and morale; contributions; culture; miss or strengths; work life 

programs; most attractive aspect of new opportunity; general suggestions.

Listening Session and Feedback Data

Contact Data (Facilitate Participation in Listening Sessions)

Name Business Email

Title Business Phone

Office location (NY/DC)

Feedback Data (Aggregated and/or de-identified)

Survey responses regarding structure of listening sessions General feedback and comments provided in listening 

sessions 

Survey responses regarding topics for listening sessions General feedback and comments provided on dedicated 

phone-line