Type of Information Collected or Maintained by the System: SSN Social Security number Medical & Health Information e.g. blood test results Financial Information e.g. credit card number Clearance Information e.g. "Q" Biometric Information e.g. finger print, retinal scan Mother’s Maiden Name DoB, Place of Birth Employment Information Criminal History Name, Phone, Address Other – Please Specify Has there been any attempt to verify PII does not exist on the system? DOE Order 206.1, Department of Energy Privacy Program, defines PII as any information collected or maintained by the Department about an individual, including but not limited to, education, financial transactions, medical history and criminal or employment history, and information that can be used to distinguish or trace an individual’s identity, such as his/her name, Social Security number, date and place of birth, mother’s maiden name, biometric data, and including any other personal information that is linked or linkable to a specific individual. YES or NO Some systems employ software tools to scan content (information or data) to search for types of data such as Social Security numbers. If “Yes,” what method was used to verify the system did not contain PII? (e.g. system scan) Tools, processes, types of information is scanned for, and frequency of the scanning. Threshold Questions Does system contain (collect and/or maintain), or plan to contain any information about individuals? YES or NO Is the information in identifiable form? YES or NO Is the information about individual Members of the Public? YES or NO
If the information system is operated in more than one site, how will consistent use of the information be ensured at all sites? System Owners and information owners are responsible for ensuring information is used and managed consistently for its stated purpose in support of the organization. Please describe processes, procedures, software tools, etc. that are used to support this goal. Records Management Identify the record(s). Enter the record item(s) and the corresponding record description(s) and disposition(s) for the retention and disposal. Identify the specific disposition authority(ies) that correspond to the record(s) noted in no. 22. Check appropriately and cite as required. □ Unscheduled □ Scheduled (cite NARA authority(ies) below) Records Contact Provide name, contact e-mail and phone number for the records contact who assisted with questions 22 and 23 ACCESS, SAFEGUARDS & SECURITY What controls are in place to protect the data from unauthorized access, modification or use? Please refer to your organization’s implementation of DOE Cyber Security Directives and Senior DOE Management Program Cyber Security Plans (PCSP). For example: "The System Owner has implemented and tested all baseline security controls appropriate to its FIPS categorization in accordance with the Senior DOE Management PCSP and DOE Directives. The system was certified and accredited (provide date(s)) and found to have mitigated risk to an acceptable level." Who will have access to PII data? List Roles Only of individuals who will have access to the PII data. Point to current access control list(s) (with version), but Please Do Not List Names Here. How is access to PII data determined? For example, will users have access to all data on the information system or will the user’s access be restricted? Do other information systems share data or have access to the data in the system? If yes, explain. Many information systems interconnect and share data. Please identify all systems that connect to and access information on this system.
(Signature) Ken Hunt Chief Privacy Officer __________________________________ (Print Name) __________________________________ (Signature) ________________