Privacy Impact Assessment

MSPB Collection of COVID-19 Vaccination

Status and Records

Updated Employee Medical File System (EMFS)

October 15, 2021 

Contact 

D. Fon Muttamara

Chief Privacy Officer

Merit Systems Protection Board

1615 M Street, NW

Washington, D.C. 20419

privacy@mspb.gov
Privacy Impact Assessment

MSPB Documentation of 

COVID-19 Vaccination EMFS

Page 2

Abstract

Given that the health and safety of employees at the U.S. Merit Systems Protection Board (MSPB) 

is our highest priority, MSPB implemented a limited Employee Medical File System (EMFS) to 

collect the COVID-19 vaccination status of its employees to ensure that the appropriate safety 

protocols are followed depending on vaccination status and Federal health and safety guidelines, 

and published a Privacy Impact Assessment (PIA) on August 13, 2021, because personally 

identifiable information (PII) is collected, used, and maintained by the agency through its 

implementation of the limited EMFS. In response to Executive Order 14043, “Requiring 

Coronavirus Disease 2019 Vaccination for Federal Employees” (Sept. 9, 2021), MSPB has 

updated the PIA to assess the privacy impacts to include the collection of the vaccination 

documentation, as required by Executive Order 14043. This PIA replaces the PIA published on 

August 13, 2021.

Overview

MSPB is updating and expanding the EMFS in accordance with the Safer Federal Workforce Task 

Force COVID-19 Workplace Safety: Agency Model Safety Principles (July 29, 2021) and the 

Safer Federal Workforce Task Force’s Frequently Asked Questions on Vaccinations (October 4, 

2021).

To support this effort, MSPB employees will provide information and documentation regarding 

their COVID-19 vaccination status to MSPB’s Director of the Office of Equal Employment 

Opportunity (EEO) through a personal link to MSPB’s secure statistical collection platform

(Qualtrics). 

Other than a system administrator, only the EEO Director will have access to employee responses.

This updated EMFS should only contain the following PII: name, MSPB office, MSPB email 

address, and information about that individual’s COVID-19 vaccination status, including the type 

of vaccine administered, the date(s) of administration, and the name of the health care 

professional(s) or clinic site(s) administering the vaccine(s). The updated EMFS may contain 

other PII that may be submitted by the individual MSPB employee, however, MSPB is only 

requesting MSPB employees submit the above PII.

Section 1.0 Authorities and Other Requirements

1.1 What specific legal authorities and/or agreements permit 

and define the collection of information by the project in

question?

MSPB is updating the EMFS to include the collection of the COVID-19 vaccination status and 

vaccination documentation of its employees pursuant to Executive Order 14043, the Safer Federal 

Workforce Task Force COVID-19 Workplace Safety: Agency Model Safety Principles (July 29, 
Privacy Impact Assessment

MSPB Documentation of 

COVID-19 Vaccination EMFS

Page 3

2021) and the Task Force’s Frequently Asked Questions on Vaccinations (October 4, 2021).

1.2 What Privacy Act System of Records Notice(s) (SORN) applies

to the information?

MSPB maintains these employee disclosures under the Office of Personnel Management’s (OPM)

OPM/GOVT – 10, Employee Medical File System of Records, 75 Fed. Reg. 35099 (June 21, 

2010), amended 80 Fed. Reg. 74815 (Nov. 30, 2015) (OPM/GOVT – 10).

1.3 Has a system security plan been completed for the 

information system(s) supporting the project?

Authorized by the Federal Risk and Authorization Management Program (FedRAMP), the 

Qualtrics platform is secured in accordance with Federal Information Security Modernization Act 

(FISMA) requirements and last underwent Certification and Accreditation on June 29, 2018. 

Qualtrics has also completed an Assessment and Authorization as part of its FedRAMP 

authorization package. Qualtrics has a FedRAMP authorization at the Moderate Impact level. 

1.4 Does a records retention schedule approved by the 

National Archives and Records Administration exist?

The information collected is subject to the National Archives and Records Administration’s 

(NARA) General Records Schedule (GRS) GRS 2.7: Employee Health and Safety Records.

While OPM/GOVT – 10 states that NARA GRS 1 covers the retention of these records, NARA’s 

reorganization of the entire GRS in 2016 has realigned the appropriate retention item for these 

records under GRS 2.7.

1.5 If the information is covered by the Paperwork Reduction Act 

(PRA), provide the OMB Control number and the agency

number for the collection. If there are multiple forms, include a 

list in an appendix.

The PRA does not apply to the collection of information from MSPB employees. 

Section 2.0 Characterization of the Information

2.1 Identify the information the project collects, uses, disseminates, 

or maintains.

The information collected are: name, MSPB office, MSPB email address, and information about 

that individual’s COVID-19 vaccination status, including the type of vaccine administered, the 

date(s) of administration, and the name of the health care professional(s) or clinic site(s) 

administering the vaccine(s).
Privacy Impact Assessment

MSPB Documentation of 

COVID-19 Vaccination EMFS

Page 4

2.2 What are the sources of the information and how is

the information collected for the project?

MSPB employees are the only source of submitted information. Documentation submitted by the 

MSPB employee may be from a different source.

2.3 Does the project use information from commercial sources 

or publicly available data? If so, explain why and how this 

information is used.

No.

2.4 Discuss how accuracy of the data is ensured.

The data is provided by the MSPB employee. Therefore, the accuracy is ensured by collecting the 

information from the source, who must attest to the truthfulness of the information they provide, 

including any documentation.

2.5 Privacy Impact Analysis: Related to Characterization of 

the Information

Privacy Risk: There is a privacy risk that the system will collect and maintain more information 

than is relevant and necessary to accomplish the agency’s mission.

Mitigation: This risk is mitigated. MSPB will only collect information regarding vaccination 

status and the documentation required by the Safer Federal Workforce Task Force, which provides 

for a minimal collection of PII. Additionally, MSPB provides the statutory protections afforded 

under the Privacy Act, along with the privacy tenets in the Fair Information Practice Principles 

and strives to only collect personal information that is necessary to accomplish the agency’s

mission.

Section 3.0 Uses of the Information

3.1 Describe how and why the project uses the information.

MSPB will use the information to determine whether MSPB employees are in compliance with 

Executive Order 14043, requiring agencies to implement a program to require COVID-19 

vaccination for all of MSPB’s Federal employees. To meet this requirement, MSPB has 

implemented this EMFS and the collection of vaccination information and records.
Privacy Impact Assessment

MSPB Documentation of 

COVID-19 Vaccination EMFS

Page 5

3.2 Does the project use technology to conduct electronic searches, 

queries, or analyses in an electronic database to discover or 

locate a predictive pattern or an anomaly? If so, state how 

MSPB plans to use such results.

No.

3.3 Are there other offices with assigned roles and 

responsibilities within the system?

No.

3.4 Privacy Impact Analysis: Related to the Uses ofInformation

Privacy Risk: There is a risk that information collected will be used inappropriately.

Mitigation: This risk is mitigated. MSPB has implemented several measures to ensure that the 

information is protected and handled in accordance with the uses described above. Authorized 

access to the information collected is restricted to the EEO Director. Any internal disclosures 

within MSPB will be on a need-to-know basis in accordance with the Privacy Act.

Section 4.0 Notice

4.1 How does the project provide individuals notice prior to the 

collection of information? If notice is not provided, explain 

why not.

The collection instrument provides a Privacy Act Statement (5 U.S.C. § 552a(e)(3)) providing 

information regarding the purpose of the collection, the routine uses of the disclosure of 

information, and the consequences for a failure to provide the information.

4.2 What opportunities are available for individuals to consent 

to uses, decline to provide information, or opt out of the

project?

Pursuant to Executive Order 14043, MSPB employees are required to provide the information 

requested. MSPB employees who seek an exception to the vaccination requirement must follow 

procedures outside of this information collection.

4.3 Privacy Impact Analysis: Related to Notice

Privacy Risk: There is a risk that MSPB employees will not be given appropriate notice prior to 

the collection of their information.
Privacy Impact Assessment

MSPB Documentation of 

COVID-19 Vaccination EMFS

Page 6

Mitigation: This risk is mitigated. The instrument provides notice at the outset of the collection 

process regarding the purpose of the collection, the routine uses of the disclosure of information, 

and the consequences for a failure to provide the information. 

Section 5.0 Data Retention by the project

The following questions are intended to outline how long the project retains the 

information after the initial collection.

5.1 Explain how long and for what reason the information isretained.

The information is subject to NARA GRS 2.7: Employee Health and Safety Records and will be 

retained to determine the appropriate implementation of safety measures, including with respect 

to mask wearing, physical distancing, regular testing, and adhering to appliable travel restrictions.

5.2 Privacy Impact Analysis: Related to Retention

Privacy Risk: There is a risk that information collected by the system may be retained longer 

than necessary.

Mitigation: This risk is mitigated. MSPB applies NARA-approved records retention schedules to 

the information collected. Once the records meet the destruction date designated in GRS 2.7, 

MSPB will destroy the records by fiscal year unless there is a business need for the record.

Section 6.0 Information Sharing

6.1 Is information shared outside of MSPB as part of the normal 

agency operations? If so, identify the organization(s) and how 

the information is accessed and how it is to be used.

OPM/GOVT – 10 governs the collection of information and provides the circumstances for the 

sharing of the information under normal agency operations. It is not anticipated that this 

information will be shared outside of MSPB as part of normal agency operations. 

6.2 Describe how the external sharing noted in 6.1 is compatible 

with the SORN noted in 1.2.

It is not anticipated that this information will be shared outside of MSPB as part of normal agency 

operations.
Privacy Impact Assessment

MSPB Documentation of 

COVID-19 Vaccination EMFS

Page 7

6.3 Does the project place limitations on re-dissemination?

The location of the information collected is access restricted. The EEO Director will inform 

MSPB’s Chief Privacy Officer (CPO) of any requests for disclosure of the information other than 

to supervisors on a “need to know” basis. Once the CPO, or designated disclosure staff, determines

that disclosure is appropriate under OPM/GOVT – 10, the provisions of the Privacy Act, or the 

Freedom of Information Act (FOIA), the EEO Director will provide the requested information to 

the CPO, or designated disclosure staff, to process the disclosure request. This includes releases 

under the routine uses of OPM/GOVT – 10, and MSPB only authorizes the disclosure of this 

information if the stated use is compatible with the purpose of the collection, as outlined in the 

applicable SORN. Records released pursuant to a FOIA request constitute public information and 

MSPB has no authority to limit its re-dissemination.

6.4 Describe how the project maintains a record of any

disclosures outside of the Agency.

MSPB utilizes FOIAonline to track requests for all information disclosure pursuant to FOIA, the 

Privacy Act, the routine uses in applicable SORNs, and statutes and regulations. FOIAonline is a 

web-based application and assists MSPB in tracking and recording requests received for the 

disclosure of information. This includes requests subject to the accounting provisions of the 

Privacy Act. The information retained as part of this accounting requirement includes the agency 

or individual requesting the information, a description of the requested information, the reason for 

the request, the date of the request, the date of the release, the authority for the release, and the 

limitations and obligations on the requesting agency or individual regarding use and further 

dissemination.

6.5 Privacy Impact Analysis: Related to InformationSharing

Privacy Risk: There is a risk that the information will be shared outside the scope of the 

applicable SORN or without the proper authority or accounting.

Mitigation: This risk is mitigated. All MSPB employees are required to complete annual privacy 

awareness training, which informs users on their Federal information privacy requirements, 

including the proper handling of PII. Additionally, the Qualtrics instrument that contains the 

information is access restricted, thus limiting the amount of personnel able to access and share the 

records.

External parties who are provided PII under a routine use are subject to Privacy Act limitations on 

disclosures. Any use of the records must be compatible with the purpose of the collection, as 

outlined in the applicable SORN. Records released pursuant to a FOIA request constitute public 

information and MSPB has no authority to limit its re-dissemination.
Privacy Impact Assessment

MSPB Documentation of 

COVID-19 Vaccination EMFS

Page 8

Section 7.0 Redress

7.1 What are the procedures that allow individuals to access 

their information?

Individuals seeking notification of and access to their records in this system of records may submit 

a request in writing to the Merit Systems Protection Board, Office of the Clerk of the Board, 1615 

M Street, NW, Washington, DC 20419. This request may also be sent to the agency by email at

privacy@mspb.gov. Individuals requesting access must comply with MSPB’s Privacy Act 

regulations regarding verification of identity and access to records (5 C.F.R. Part 1205).

7.2 What procedures are in place to allow the subject individual 

to correct inaccurate or erroneousinformation?

Individuals seeking to amend their attestation to their COVID-19 vaccination status or their 

vaccination documentation may request a new link from the EEO Director to update their COVID19 vaccination status or documentation. Individuals seeking amendment of their records in this

system of records for reasons other than to update their COVID-19 vaccination status or 

documentation may submit a request in writing to the Merit Systems Protection Board, Office of 

the Clerk of the Board, 1615 M Street, NW, Washington, DC 20419. This request may also be 

sent to the agency by email at privacy@mspb.gov. Individuals requesting amendment must follow 

MSPB’s Privacy Act regulations regarding verification of identity and amendment to records (5 

C.F.R. Part 1205).

7.3 How does the project notify individuals about the procedures 

for correcting their information?

This PIA provides notice to individuals on how to correct their information. Additionally, MSPB’s 

Privacy Act regulations and OPM/GOVT – 10 provide notice to the individual.

7.4 Privacy Impact Analysis: Related to Redress

Privacy Risk: There is a risk that individuals will not be able to correct inaccurate or erroneous 

information collected about them.

Mitigation: This risk is mitigated. The information is collected from the source, i.e., the 

individual. Should an individual need to update their COVID-19 vaccination status or 

documentation, they may request a new link to update their COVID-19 vaccination status or 

documentation. Should an individual seek amendment of any records they assert is not accurate, 

relevant, timely, or complete for any reason other than a change to their COVID-19 vaccination 

status or documentation, information on how to submit an amendment request is outlined in

MSPB’s Privacy Act regulations at 5 C.F.R. Part 1205.
Privacy Impact Assessment

MSPB Documentation of 

COVID-19 Vaccination EMFS

Page 9

Section 8.0 Auditing and Accountability

The following questions are intended to describe technical and policy-based safeguards 

and security measures.

8.1 How does the project ensure that the information is used 

in accordance with stated practices in this PIA?

MSPB ensures that the practices stated in this PIA are followed by leveraging employee training, 

Information Technology (IT) Rules of Behavior (RoB), role-based access, and other standard 

operating procures and policies. See Section 1.3 for additional security and privacy safeguards.

8.2 Describe what privacy training is provided to users 

either generally or specifically relevant to the project.

All MSPB users must complete privacy awareness training and information security awareness 

training annually or when they begin work on an MSPB contract, respectively, as well as read and 

agree to comply with MSPB’s IT RoB and annually thereafter.

8.3 What procedures are in place to determine which users may 

access the information and how does the project determine

who has access?

MSPB deploys role-based access controls and enforces a separation of duties throughout all MSPB

operations to limit access to records and ensures that only MSPB employees who have an official 

need to know will have access to the information. The need to know is determined by the 

respective responsibilities of the employee and the needs of the office. MSPB employees who do 

not have a need to know do not have access to the EMFS. Implementing instructions for this 

EMFS designate that the EEO Director will have primary responsibility for the management of 

this system and may only share information with designated personnel on a need-to-know basis. 

This ensures that access to the information is restricted to a limited number of MSPB personnel. 

8.4 How does the project review and approve information sharing 

agreements, Memoranda of Understanding (MOUs), new uses of 

the information, new access tothe system by organizations within 

MSPB and outside?

This EMFS does not require information sharing agreements or MOUs. New uses of information

are not permissible without review and authorization by MSPB stakeholders, including MSPB’s 

Chief Privacy Officer and Chief Information Officer, and OPM. If new uses of the information 

are approved, they will only be utilized once appropriate notice has been provided, including 

updating the PIA and, if applicable, revising applicable SORNs. Within MSPB, access to records 

in this EMFS is determined at the agency level.
Privacy Impact Assessment

MSPB Documentation of 

COVID-19 Vaccination EMFS

Page 10

Responsible Officials

D. Fon Muttamara

Chief Privacy Officer

U.S. Merit Systems Protection Board

Approval Signature & Date

William D. Spencer

Acting Executive Director

& Senior Agency Official for Privacy

U.S. Merit Systems Protection Board