Page 1 of 5 

Privacy Impact Assessment

for

Ensuring a Safe and Healthy Workplace in Response 

to COVID-19 

April 2022

System/Business Owner

Todd Remusat

Security and Emergency Management Unit Officer

Reviewing Official 

Charles Cutshall

Chief Privacy Officer
Page 2 of 5

I. What information will be collected? 

General Information/File Types

☒ Health Information

Biographical Information

☒ Name ☒ Location Data (e.g., CFTC facility)

☒ Employment Information (e.g., reasonable 

accommodations)

☒ Health-related information (e.g., symptoms, 

test status and results, possible COVID-19 

exposure)

☒ Vaccine information (e.g., proof of vaccination, 

vaccination attestation status)

Biometrics/Distinguishing Features/Characteristics

☒ Video Recording (e.g., Kastle system) ☒ Signatures

Medical/Emergency Information

☒ Medical/Health Information

II. Why is the information being collected? 

The Commodity Futures Trading Commission (CFTC) implemented processes and procedures to allow staff 

(including employees and contractors) and visitors to safely access CFTC facilities in accordance with 

Federal guidelines for reopening government facilities during the COVID-19 public health crisis. 

As the crisis unfolded, the CFTC’s processes and procedures for ensuring a safe workplace were adapted 

to comply with evolving mandates and to help ensure the ongoing safety of CFTC staff and visitors entering 

CFTC facilities. In October 2020, the CFTC published a privacy impact assessment (PIA) detailing the 

processes and procedures that it established at the start of the COVID-19 public health crisis. This 

assessment reflects the adapted processes and procedures and supplements the earlier assessment.

The CFTC collects, or has collected, the following information:

1. Vaccination status and proof of vaccination for all CFTC employees, as well as individuals applying 

for employment with the CFTC;

2. Requests for medical or religious accommodations from CFTC employees; and,

3. Symptom screening information from CFTC staff and visitors to CFTC facilities, such as whether an 

individual has certain symptoms or has come into contact with someone who tested positive for 

COVID-19. 

The following CFTC privacy notices describe the purposes for which personally identifiable information

(PII) is collected, used, maintained, and shared: 

• CFTC-54, Ensuring Workplace Health and Safety in Response to a Public Health Emergency (85 FR 

60981)
Page 3 of 5 

• CFTC-57, Reasonable Accommodation Records (86 FR 70116) 

• OPM-GOVT 10, Employee Medical Files System Records (75 FR 35099) 

The following authorities permit the collection, use, maintenance, and sharing of PII: 

• Americans with Disabilities Act of 1990, Pub. L. No. 101-336 (1990), as amended by the ADA 

Amendments Act of 2008 (ADAA), Pub. L. No. 110-325 (2009) 

• General Duty Clause, Section 5(a)(1) of the Occupational Safety and Health (OSH) Act of 1970 (29 

U.S.C. 654)

• Title VII of the Civil Rights Act of 1964, Pub. L. No. 88-352, as amended; 29 CFR 1605 (Guidelines 

on Discrimination Because of Religion)

• Executive Order 14043, Requiring Coronavirus Disease 2019 Vaccination for Federal Employees

(Sep. 14, 2021)

• Executive Order 14042, Executive Order on Ensuring Adequate COVID Safety Protocols for Federal 

Contractors (Sep. 9, 2021)

• Executive Order 13991, Protecting the Federal Workforce and Requiring Mask-Wearing (Jan. 20, 

2021)

• Executive Order 13548, Increasing Federal Employment of Individuals with Disabilities (Jul. 26, 

2010)

• Executive Order 13164, Establishing Procedures to Facilitate the Provision of Reasonable 

Accommodation (July 28, 2000)

• Executive Order 12196, Occupational Safety and Health Program for Federal Employees (Feb. 26, 

1980)

• OMB Memorandum M-20-23 Aligning Federal Agency Operations with the National Guidelines for 

Opening Up America Again (Apr. 20, 2020)

III. What is the intended use of the information? 

In accordance with Federal guidelines and to ensure the ongoing safety of CFTC staff and visitors entering 

CFTC facilities during the ongoing COVID-19 public health crisis, the CFTC collects vaccination status and 

proof of vaccination from all CFTC employees and individuals applying for employment with the CFTC. In 

addition, in accordance with Federal guidelines and to ensure the ongoing safety of CFTC staff and visitors, 

the CFTC conducts symptom screenings for individuals visiting CFTC facilities. 

The CFTC has also established a Coronavirus Contact Tracing (CVCT) group to follow-up with staff who 

develop flu like symptoms (or who have any other reason to believe that they may have contracted SARSCoV-2, the virus that causes COVID-19) after having visited a CFTC facility or interacted in-person with 

other CFTC staff outside the office for social or other reasons. The CVCT group is composed of staff from 

the Division of Administration (DA), the Security Emergency Management Unit (SEMU), Logistics, and 

Workforce Relations. 

The CFTC collects, receives, tracks, processes, and reports the processing of requests for reasonable

medical or religious accommodations from COVID-19 vaccination. This collected information helps the 

agency maintain records from qualified employees who request or receive accommodations.

Privacy Act statements and notices are provided on applicable forms. This assessment also serves as notice 

to CFTC staff and visitors.
Page 4 of 5

IV. With whom will the information be shared? 

This information system collects and maintains information necessary to ensure a safe and healthy work 

environment in response to COVID-19. Information is collected directly from CFTC staff and is shared with 

officers and employees of the CFTC who have a need for the information in the performance of their 

official duties. 

In the process of conducting contact tracing (as needed), SEMU staff and the CVCT group may collect 

information from CFTC staff, their emergency contacts, property management staff, and the CFTC’s 

security systems (e.g., CCTV, badge access data) operated by Kastle Systems. The Physical Security 

Management System PIA for the CFTC’s Kastle Systems security system is available at: 

https://www.cftc.gov/Privacy/cftcpia/index.htm. Contact tracing lists will be stored in Excel spreadsheets 

and saved to a separate, restricted folder on the CFTC network drive. The CVCT group and/or SEMU staff 

share information with the Chairman’s Office who will then share necessary information with other 

Federal and state public health authorities as required by law and in accordance with the routine uses 

described in CFTC-54, Ensuring Workplace Safety in Response to a Public Health (85 FR 60981). Division of 

Administration staff and the CVCT group may share information regarding access to CFTC facilities, 

potential incidents of exposure to COVID-19, and general contact tracing activities devoid of PII with the 

Chairman’s Office so that it may maintain situational awareness.

Information may be disclosed to a Federal, State, or local agency to the extent necessary to comply with 

laws governing reporting of infectious disease; to the CFTC staff member's emergency contact for 

purposes of locating a staff member during a public health emergency or to communicate that the CFTC 

staff member may have potentially been exposed to a virus as the result of a pandemic or epidemic while 

visiting a CFTC facility; to another Federal agency, to a court, or a party in litigation before a court or in an 

administrative proceeding being conducted by a Federal agency when the Commission is a party to the 

judicial or administrative proceeding where the information is relevant and necessary to the proceeding;

to contractors, performing or working on a contract for the Commission when necessary to accomplish 

an agency function; to the Department of Justice or in a proceeding before a court, adjudicative body, or 

other administrative body which the Commission is authorized to appear, and; to another Federal agency 

or Federal entity, when the Commission determines that information from this system of records is 

reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed 

breach or (2) preventing, minimizing, or remedying the risk of harm to Individuals, the recipient agency or 

entity (including its information systems, programs, and operations), the Federal Government, or national 

security, resulting from a suspected or confirmed breach. In the event a third-party contractor is engaged 

to conduct contact tracing, they may also receive access to the information.

V. How is information in the information system secured?

Information is protected from unauthorized access and improper use through administrative, technical, 

and physical security measures. Administrative safeguards include ensuring rules of behavior are easily 

accessible and followed at all times. Technical security safeguards include user identification; the required 

use of a virtual private network (VPN); the required use of strong passwords that are frequently changed; 

use of encryption for certain data types and transfers; de-identification for certain information types; and, 

aggregation when records are shared with the Chairman’s office. Physical safeguards include restrictions 

on building access to authorized individuals, 24-hour security guard service, cameras, and identification 

badges.
Page 5 of 5 

The Americans with Disabilities Act (ADA) also includes specific handling requirements associated with the 

collection and storage of health information. The ADA requires an employer to maintain the 

confidentiality of employee medical information, which means it must be maintained separately from 

other personnel files. The CFTC is protecting confidential employee health information in conformance 

with this requirement.

The handling requirements in OPM GOVT-10, Employee Medical Files System Records (75 FR 35099)

ensure that all relevant, necessary, accurate, and timely data are available to support any medicallyrelated employment decisions affecting the subject of the records, and to ensure that records required to 

be retained on a long-term basis meet the mandates of law. The CFTC is protecting confidential employee 

health information in conformance with these requirements.

VI. Are records maintained as part of a Privacy Act system of records? 

Information processed in this information system is subject to the Privacy Act and is maintained as part 

of CFTC-54, Ensuring Workplace Health and Safety in Response to a Public Health Emergency (85 FR 

60981), CFTC-57, Reasonable Accommodation Records (86 FR 70116), and OPM GOVT-10, Employee 

Medical File System Records (75 FR 35099). The SORNs were published in the Federal Register on 

September 29, 2020, December 9, 2021, and June 21, 2010 respectively.