U.S. Department of Health & Human Services |
|
Improving the health, safety, and well-being of America |
Font Size
Print
Download Reader
HHS Home|HHS News|About HHS
Centers for Disease Control & Prevention Privacy Impact Assessments06.3 HHS PIA Summary for Posting (Form) / CDC African American Men who have Sex with Men (AAMSM) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC African American Men who have Sex with Men (AAMSM) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: NO 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): African American Men who have Sex with Men (AAMSM) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: David Purcell 10. Provide an overview of the system: The purpose of AAMSM data collection system is to permit funded sites to perform the following activities: · Manage venue information and venue testing activities for alternate venue testing and targeted outreach strategies · Manage interview data and other information about at-risk individuals who are nominated via the social networks and PCRS strategies · Manage clients’ demographic, HIV risk, HIV CTR, and strategy-specific information · Manage time and cost information collected for each strategy · Manage project staff details (e.g., time spent on a specific strategy activity, hourly rate) · Generate custom reports that summarize project data (by and across strategies) and facilitate effective program monitoring and evaluation The desired impact of this project is to improve the public's health by reducing the number of new HIV infections occurring each year in the United States. The goals of this project are to increase the proportion of HIV-infected African American MSM in the U.S. who are aware of their status and linked to appropriate prevention, care and treatment services. To accomplish these goals, project staff and grantees will evaluate the relative effectiveness of testing strategies based on existing models (e.g., mobile testing and alternative venue testing to make testing more accessible, using social networks of HIV-infected persons to refer at-risk peers for testing, and partner counseling and referral services). This project supports the following CDC Health Protection goal: Healthy People in Every Stage of Life. Although this project can potentially impact people in all life stages, the focus of the project is on improving the health of adults. The target population is 18 – 24 year old African American MSM. AAMSM will continue from 6/2008 until 10/2010. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): AAMSM does not contain IIF 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: The funded grantees will collect and maintain the following information · Venue information and venue testing activities for alternate venue testing strategy · Interview data and other information about at-risk individuals who are nominated via the social networks and PCRS strategies · Clients’ demographic, HIV risk, HIV CTR, and strategy-specific information · Manage time and cost information collected for each strategy · Project staff details for the staff who are involved in various activities of the project (e.g., time spent on a specific strategy activity, hourly rate) The information collected at the sites will be sent to the CDC via secure data network (SDN) for analyzing the data collected. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) AAMSM does not contain IIF 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: AAMSM does not contain IIF. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Michael W. Harris Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jul 28, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC ATSDR DHAC Identifying Exposure Pathways (IEP) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC ATSDR DHAC Identifying Exposure Pathways (IEP) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC ATSDR DHAC Identifying Exposure Pathways (IEP) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Robert L. Kay 10. Provide an overview of the system: Identifying Exposure Pathways (IEP) is a web-based training that has been on the Agency for Toxic Substances and Disease Registry (ATSDR)/CDC web since 2003. The online learning program provides information on the basic concepts used by ATSDR staff and agents of ATSDR in conducting public health assessments, specifically how to identify pathways of exposure. The program is intended to assist environmental public health professionals to understand the basic steps and coordination necessary to identify exposure pathways. The program provides learn-by-doing steps on how ATSDR's cooperative agreement partners (agents of ATSDR), ATSDR staff, and other environmental and public health professionals can identify how persons come into contact with hazardous and toxic substances. This program is an interactive simulation involving internal and external communications, site document review, mock site review, video clip review, community involvement activities, and completion of an exposure pathway table. The program does not collect/store any Personable Identifiable Information (PII) regarding any of its participants. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): No, does not contain PII 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: The information collected does not contain PII. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No, does not contain PII 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: No, does not contain PII PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P.Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC ATSDR Triage Tracking System (TTS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? No If this is an existing PIA, please provide a reason for revision: PIA Validation 1. Date of this Submission: CDC ATSDR Triage Tracking System (TTS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-03-02-9221-00 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): Triage Tracking System (TTS) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Richard Gillig 10. Provide an overview of the system: The Triage Tracking Database (TTS) is an MS Access database that is used to track the progress of documents (health consultations, public health assessments, etc) through the review process, as well as record ancillary data associated with said documents. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): No 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: (1) TTS records ancillary data associated with health education/ environmental activities. (2) TTS tracks the current status of documents and health education/ environmental activities. The system also tracks the status of known issues containing environmental and contamination through the review process. Reports are generated and used for internal purposes only and are not shared with any other Divisions/ Offices/ Centers within CDC. (3) TTS does not contain any PII. (4) N/A. No PII collected. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) The system does not contain PII. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: The system does not contain PII. No IIF Collected. E-Authentication Assurance Level = N/A Risk Analysis Date = 7/23/2009 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Michael W. Harris Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Aug 14, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC Auto Decal PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC Auto Decal 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-06-02-0984-00 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): DOT/ALL8 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): Auto Decal 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Tracy Hollis 10. Provide an overview of the system: Mainframe application used by the Office of Security and Emergency Preparedness to issue car decals for any vehicles parked on CDC premises or leased property by CDC workforce. The only system users are OSEP personnel, who enter information regarding a vehicle and the associated decal number and the owner’s User ID. The information is manually typed from a signed form by the vehicle owner usually submitted to security personnel assigned to the user’s workplace. The security staff issues the decal, and then submits the form to the security office in charge of entering the information from the form. This may take several days from the time the user is issued a decal until the information is entered into the Auto Decal system. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): Yes 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): N/A 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: Mainframe application used by the Office of Security and Emergency Preparedness to issue car decals for any vehicles parked on CDC premises or leased property by CDC workforce. The information collected is User ID and Vehicle Identifiers. The only system users are OSEP personnel, who enter information regarding a vehicle and the associated decal number and the owner’s User ID. The information is manually typed from a signed form by the vehicle owner usually submitted to security personnel assigned to the user’s workplace. The security staff issues the decal, and then submits the form to the security office in charge of entering the information from the form. This may take several days from the time the user is issued a decal until the information is entered into the Auto Decal system. The information is voluntary but mandatory for an Auto Decal. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): Yes 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Need to Know policy is enforced in the application. Only designated OSEP personnel can see the record. User Id’s, Passwords (expire after a set period of time), Accounts are locked after a set period of inactivity, Minimum length of passwords is eight characters, Accounts are locked after a set number of incorrect attempts. Firewall protected. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Michael W. Harris Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Aug 19, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCCHIS NCPHI DEOC Requests System (DRS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCCHIS NCPHI DEOC Requests System (DRS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-03-02-1255-00 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): 09-20-0055 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): DEOC Request System (DRS) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Clarence Bloomfield 10. Provide an overview of the system: This system is used by the CDC Emergency Operations Center to manage and track tasks that come into the Operations Center. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): Yes 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): The system does not share or disclose IIF. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: Name and phone numbers are collected. They are used to assign a point of contact for the tasks. A person may be contacted if there are any questions about a given task. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) Employees’ (new hires) are informed and have given consent during the employee orientation process that their PII information will be used in order to support the CDC Director’s Emergency Operations Center. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): Yes 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: CDC EMSSP security controls are adequate to protect the IIF contained within this system. The controls ensure a common baseline level of protection is met for all CDC information systems. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Michael Harris Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jul 28, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCEHIP ATSDR Centralized Information Management System - (SEQUOIA) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCEHIP ATSDR Centralized Information Management System - (SEQUOIA) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-02-1411-00 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): 09-90-0018 5. OMB Information Collection Approval Number: No 6. Other Identifying Number(s): No 7. System Name (Align with system Item name): Centralized Information Management System (CIMS) aka Sequoia 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Keith West 10. Provide an overview of the system: Sequoia is the result of reengineering ATSDR’s HazDat system. HazDat, initiated in 1988, is ATSDR’s scientific and administrative database developed to provide rapid access to information on the release of hazardous substance from Superfund sites and other events. It provides information on the effects of hazardous substances on the health of human populations. ATSDR’s business requirements have changed dramatically over the last few years, during which major development on HazDat was frozen. As a result, HazDat has become increasingly less useful to ATSDR staff, and Sequoia has been created to update the functionality of HazDat. Phase I of Sequoia includes functionality provided by the Site & Event, Cost Recovery, and ASA (Activities) modules of HazDat. Taken together, these modules provide users with the ability to track environmentally damaging events and cleanup activities, plus the recording of supporting information on the activities performed during those events to support efforts to recover cleanup costs for the federal government. 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): Yes 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Sequoia does not share or disclose any IIF data. The SSN data that is used for in a query with the UFMS payroll data is stored in a Sequoia data table in encrypted format & is only unencrypted via a SQL function whose access is limited. The SSN is unencrypted in order to match data contained in several related tables from the MISO database. SSN is not printed on any reports or displayed on any screens. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: Information on environmentally damaging events and cleanup activities, plus the recording of supporting information on the activities performed during those events to support efforts to recover cleanup costs for the federal government. ATSDR uses this system to identify patterns of release of hazardous substances, facilitate the development and creation of health studies, and expand the capacity for information sharing between divisions and offices. ATSDR’s products include health assessments, health consultations, supporting documentation for more than 5,000 sites, and toxicological profiles. Sequoia can be used to identify similarities in sites and events, such as populations, contaminants, and media; obtain site histories; rapidly access toxicology information; and analyze comprehensive site, substance, and health effects data. No IIF from users is collected. Sequoia has a time sheet entry that is used with the Cost Recovery module to correlate payroll data. CDC employee names are visible. CDC employees social security numbers are encrypted in the system, but are not displayed in the system. This information is housed on the Sequoia intranet server. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Administrative Controls: In order to ensure least privilege and accountability, read-only access is given by default. Additional access must be requested by the user’s manager/supervisor and granted by the system administrator. Technical Controls: integrated with AD for login, SQL server security including encryption. Physical Controls: Guards, ID badges, key cards, locked offices, locked server rooms. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Alice M. Brown Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Apr 23, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCEHIP ATSDR Hazardous Substances Emergency Event System - (HSEES) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCEHIP ATSDR Hazardous Substances Emergency Event System - (HSEES) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-02-9221-00 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): No 5. OMB Information Collection Approval Number: No 6. Other Identifying Number(s): No 7. System Name (Align with system Item name): HSEES (Hazardous Substances Emergency Events Surveillance) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Maureen Orr 10. Provide an overview of the system: The Hazardous Substances Emergency Events Surveillance (HSEES) system was established by ATSDR to collect and analyze information about acute releases of hazardous substances, as well as threatened releases that result in a public health action such as an evacuation. The goal of HSEES is to reduce the morbidity (injury) and mortality (death) that result from hazardous substances events, which are experienced by first responders, employees, and the general public. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): The Hazardous Substances Emergency Event Surveillance application collects company name and address information on the event location and the parties responsible for hazardous chemical events. Addresses of individuals (private households) are also collected, but not their names. The application also collects name (government employee), agency, address, and phone information on the party who notified the state department of the event. The address information is used to determine the latitude/ longitude values, and demographics/ proximity information of hazardous events to aid in prevention and outreach. The name of the event location is used to determine the type of industry that was involved with the hazardous release. The notification information is used for contact purposes in case data received is incomplete. User names, states, and email addresses are stored for user roles and privileges. IIF is only shared or disclosed to HSEES users who are State and International Partners (State Health Departments). Each state can only access their data. DHS users can access data from all states but name, address, and phone fields are encrypted. NOTE: IIF is NOT retrieved by Privacy data. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: The Hazardous Substances Emergency Event Surveillance application collects company name and address information on the event location and the parties responsible for hazardous chemical events. Addresses of individuals (private households) are also collected, but not their names. The application also collects name (government employee), agency, address, and phone information on the party who notified the state department of the event. The address information is used to determine the latitude/ longitude values, and demographics/ proximity information of hazardous events to aid in prevention and outreach. The name of the event location is used to determine the type of industry that was involved with the hazardous release. The notification information is used for contact purposes in case data received is incomplete. User names, states, and email addresses are stored for user roles and privileges. The IIF collected in this system is not mandatory. Data are entered by participating state health departments into a web-based application that enables ATSDR to instantly access data for analysis. Data collected include the following: • Name, address, and phone # of the source that notified the state health department of the event and the date of the notification. • Time, date, and day of the event. • Geographic location (street, city, county, state, zip, country, latitude, longitude) • Name of the event location, and the party responsible for the release. • The type of industry involved • The proximity and demographic (land use and nearby population information to estimate the number of persons potentially exposed) • Place within the facility where the event occurred • Event type (fixed-facility or transportation related event) • Factors contributing to the release • The substances released • Environmental sampling and follow-up health activities • Specific information on injured persons: age, sex, type and extent of injuries, distance from spill, population group (employee, general public, responders, student), and type of protective equipment used • Information about decontaminations, orders to evacuate or shelter-in-place Data are used to: • Provide presentations of data from HSEES to industries that account for a significant number of spills to help plan prevention strategies • Provide data for Hazardous Material training courses, including data on the risk of injury from methamphetamine labs • Provide data to establish and maintain protection areas for municipal water systems • Provide data by county on spills to assist with the proper placement of Hazardous Material teams and equipment • Distribute fact sheets on frequently spilled chemicals or chemicals that cause a disproportionate number of injuries, such as chlorine and ammonia • Distribute newsletters or fact sheets to industry, responder, and environmental groups • Provide presentations for state and local emergency planners 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): Yes 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Administrative: Users are assigned unique roles and privileges depending on their titles. The HSEES system administrator is responsible for assigning these roles. Technical: Depending on the user’s role certain fields containing IIF data are encrypted. Company name, address, and telephone information are entered by and visible to State users, but are encrypted to the Division of Health Studies (DHS) representatives. User access and authentication is provided through a Secure Data Network (SDN) issued digital certificate which is valid for one year from the date of receipt. Each user will be assigned a unique numeric token which will be used to access the SDN Web Server and assign user roles and privileges. SDN also requires a passphrase to access the SDN Web Server. Physical Controls: Production and test servers are stored in a server room secured by the CDC. Access tools are in place to secure entry into CDC buildings (Guards, ID Badges, Key Card, Cipher Locks, Closed Circuit TV). PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Michael Harris Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jul 11, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCEHIP ATSDR OCScheduler PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCEHIP ATSDR OCScheduler 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CCEHIP ATSDR OCScheduler 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Marianne Hartin 10. Provide an overview of the system: Office of Communication Conference Scheduler (OCScheduler) is a web based conference scheduling application that allows CDC/National Center for Environmental Health (NCEH)/Agency for Toxic Substance and Disease Registry (ATSDR) employees to sign up and volunteer to help support conferences, forums and other activities the division in involved in and attends. OCScheduler allows personnel to go online and visually see times and dates available to volunteer for and support NCEH/ATSDR conference activities. The application reduces the work required in organizing and ensuring coverage for necessary support of activities with varied days and times required for NCEH/ATSDR support. The application allows the user to view a primary page that lists the event to support, the dates and times needed for support and to volunteer by clicking on an available date and time and entering their contact information (name, business phone number and business email address). 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): n 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: The system does not contain PII. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) The system does not contain PII. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: The system does not contain PII. No IIF collected E-Authentication Assurance Level = N/A Risk Analysis Date = 12/19/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCEHIP ATSDR RssReader PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCEHIP ATSDR RssReader 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-03-02-9623-00 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): No 5. OMB Information Collection Approval Number: No 6. Other Identifying Number(s): No 7. System Name (Align with system Item name): RssReader (ATSDR News Room) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Wilma Lopez 10. Provide an overview of the system: ATSDR News Room (RSSReader) is a application to disseminate environmental health news stories to visitors of the webpage and the Agency for Toxic Substances and Disease Registry (ATSDR) web site. The news stories is to be used as informational sources for the general public to read and use for private use. The content is not generated by the National Center for Environmental Health (NCEH)/ATSDR Office of Communication. The content is just organized and available for public users of the website to find information on environmental health news storiesole to have add/edit/delete permissions 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): No 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: The system does not contain PII. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) The system does not contain PII. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: The system does not contain PII. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Michael W. Harris Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jun 11, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCEHIP NCEH ATSDR Spotlight Content System (ATSDR Spotlight) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCEHIP NCEH ATSDR Spotlight Content System (ATSDR Spotlight) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): No 5. OMB Information Collection Approval Number: No 6. Other Identifying Number(s): No 7. System Name (Align with system Item name): ATSDR Spotlight Content System (ATSDR Spotlight) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Marianne Hartin 10. Provide an overview of the system: Agency Toxic Substance and Disease Registry (ATSDR) Spotlight content system (ATSDR Spotlight) is a web-based content management application that provides CDC/NCEH/ATSDR Health Communication Science Office (HCSO) with the ability to organize information and allow information to be displayed as a date driven or event driven web page for the NCEH and ATSDR Internet website. ATSDR Spotlight will consist of content that will reference information NCEH/ATSDR wants to highlight (or spotlight) on the internet. 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): No 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: The system does not contain PII. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) The system does not contain PII. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: The system does not contain PII. E-Auth Level: N/A Risk Analysis Date: 3/2/09 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Apr 13, 2009 Approved for Web Publishing: - Date Published: - _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCEHIP NCEH Consolidated Data Request Tracking System (CDRTS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCEHIP NCEH Consolidated Data Request Tracking System (CDRTS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CCEHIP NCEH Consolidated Data Request Tracking System (CDRTS) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Carol Waller 10. Provide an overview of the system: Consolidated Data Request Tracking System (CDRTS) is a Resource Management System used to track work and requests being performed by staff and viewed in reports. CDRTS uses a framework for modular work request interfaces for internal Coordinating Center for Environmental Health and Injury Prevention (CCEHIP) use. Users access the system via a website where they fill out the work request. The request is then emailed to the team responsible for completing the request as well as to the requestor. The online request form connects to a database to populate various drop-down lists which provide the user with request options. 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): N/A 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: N/A 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) N/A 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: N/A PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Dec 18, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCEHIP NCEH DLS Frontends (DLSFE) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCEHIP NCEH DLS Frontends (DLSFE) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CCEHIP NCEH DLS Frontends (DLSFE) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Kathleen Caldwell 10. Provide an overview of the system: DLS FrontEnds (DLSFE) is an internally non-web based application designed to provide the quality control staff and supervising scientists with the ability to manage the receipt, analysis, and reporting of data associated with the specimen analysis work done in the Inorganic Radiological and Analytical Toxicology (IRAT) and Nutritional Biochemistry Branch (NBB) branches of the Division of Laboratory Sciences (DLS). The quality control staff and supervising scientists review the data using various DLSFE forms for consistency and accuracy and add comments and edit parameters as deemed necessary. The unexpected or out-of-range results may require additional specimen analysis, which would require a repeat of the previous steps minus initial login. If the quality control staff deems the data ready for reporting, then the data is flagged ‘ready to report’. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): The information collected does not contain PII. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: The information collected does not contain PII. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) The information collected does not contain PII. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: The information collected does not contain PII. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCEHIP NCEH Emergency Response & Air Toxicants Laboratory Information Systems (ERATLIS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCEHIP NCEH Emergency Response & Air Toxicants Laboratory Information Systems (ERATLIS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CCEHIP NCEH Emergency Response & Air Toxicants Laboratory Information Systems (ERATLIS) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Rudy Johnson 10. Provide an overview of the system: Emergency Response And Air Toxicants Laboratory Information Systems (ERATLIS) is a multi function Information Management System and a relational LIMS that collects stores, retrieves, processes and analyses information primarily gathered within the specimen life cycle of the Chemical Terrorism Response Laboratory (as well as the capacity to service laboratories outside of our branch for emergency response purposes). The system was designed to provide and assist in the development and validation of clinical assays. 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): The system does not contain PII. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: The system does not contain PII. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) The system does not contain PII. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: The system does not contain PII. No IIF collected E-Authentication Assurance Level = N/A Risk Analysis Date = 12/11/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCEHIP NCEH Inorganic and Radiological Analytic Toxicology Data Submission (IRATDS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCEHIP NCEH Inorganic and Radiological Analytic Toxicology Data Submission (IRATDS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CCEHIP NCEH Inorganic and Radiological Analytic Toxicology Data Submission (IRATDS) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Kathleen Caldwell 10. Provide an overview of the system: Inorganic and Radiological Analytic Toxicology Data Submission (IRATDS) is a custom web-based application designed to collect Quality Assurance (QA)/Quality Control (QC) analysis results from external laboratories for internal analysis by the Division of Laboratory Science’s Inorganic and Radiological Analytical Toxicology branch (IRAT), as well as to provide a means by which those laboratories can access performance reports created from previously submitted data. During each quarterly round the IRAT laboratory provides vials of blood and urine containing quantities of specific chemical compounds (lead, for example) to participating domestic and international laboratories for sample analysis. These quality control sample vials are processed by scientists, researchers or technicians from each external laboratory who then access the IRATDS online system to report their results using an online web-based form. The result data, which consists almost entirely of numeric values contains no Personally Identifiable Information (PII), is stored in a SQL Server database for later retrieval and internal analysis by the IRAT laboratory at the end of each quarter, resulting in the performance reports. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): N/A 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: The information collected does not contain PII. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) The information collected does not contain PII. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: The information collected does not contain PII. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCEHIP NCEH Lipid and Clinical Chemistry Databases (LCCDB) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCEHIP NCEH Lipid and Clinical Chemistry Databases (LCCDB) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): No 5. OMB Information Collection Approval Number: No 6. Other Identifying Number(s): No 7. System Name (Align with system Item name): Lipid and Clinical Chemistry Databases (LCCDB) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Mary Kimberly 10. Provide an overview of the system: The Lipid and Clinical Chemistry Databases (LCCDB) is a non-web based modular Lab Information Management System (LIMS) and Data Analysis System. LCCDB is designed to provide different functional analysis and data entry points based on role related duties. Lab data is from sources and direct import from lab equipment in the form of text files. 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): The system does not contain PII. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: The system does not contain PII. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) The system does not contain PII. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: E-Authentication Assurance Level = N/A Risk Analysis Date = 11/19/2008 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Dec 11, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCEHIP NCEH Lipid Standardization Program Data Submission (LSPDS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCEHIP NCEH Lipid Standardization Program Data Submission (LSPDS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CCEHIP NCEH Lipid Standardization Program Data Submission (LSPDS) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Mary Kimberly 10. Provide an overview of the system: Lipid Standardization Program, aka LSP, Data Submission (LSPDS) is a custom web-based application designed to collect Quality Assurance (QA)/Quality Control (QC) analysis results from external laboratories for internal analysis by the Division of Laboratory Science’s Clinical Chemistry branch (CCB), as well as to provide a means by which those laboratories can access performance reports created from previously submitted data. During each quarterly round the LSP laboratory provides vials of serum to participating domestic and international laboratories for sample analysis to measure levels of cholesterol. These quality control sample vials are processed by scientists, researchers or technicians from each external health laboratory who then access the LSPDS online system to report their results using a web-based form. The results from the data, which consists almost entirely of numeric values and contains no Personally Identifiable Information (PII), is stored in a SQL Server database for later retrieval and internal analysis by the LSP laboratory at the end of each quarter, resulting in the performance reports. 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): N/A 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: The information collected does not contain PII. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) The information collected does not contain PII. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: The information collected does not contain PII. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 12, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCEHIP NCEH Molecular Risk Assessment Data Management System (MRADMS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCEHIP NCEH Molecular Risk Assessment Data Management System (MRADMS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CCEHIP NCEH Molecular Risk Assessment Data Management System (MRADMS) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Patricia Mueller 10. Provide an overview of the system: Molecular Risk Assessment Data Management System (MRADMS) is a non web-based custom-designed MS Access application designed to manage, process, and analyze laboratory data from a wide array of assays generated by different laboratory instruments that each have varied data formats. MRADMS serves the Molecular Risk Assessment Laboratories (MRAL) as a Lab Information Management System (LIMS). The information contained within MRADMS includes laboratory management data, inventory data, and laboratory material data that is generated and entered by the staff of MRAL, which is part of the Coordinating Center for Environmental Health and Injury Prevention (CCEHIP) National Center for Environmental Health (NCEH)/Division of Laboratory Sciences/Newborn Screening and Molecular Biology Branch. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): The system does not collect PII. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: The system does not collect PII. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) The system does not collect PII. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: The system does not collect PII. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCEHIP NCEH NCIRD Environmental Health Specialists Network Information System - (EHSNIS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCEHIP NCEH NCIRD Environmental Health Specialists Network Information System - (EHSNIS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-02-02-9221-00 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CCEHIP NCEH NCIRD Environmental Health Specialists Network Information System- (EHSNIS) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Debbie Bankston 10. Provide an overview of the system: The Environmental Health Specialists Network (EHSNIS) is a survey analysis tool used by CDC staff to conduct studies for the purpose of identifying environmental causes of food borne illnesses and related outbreaks. Surveys are designed by the CDC personnel allowing for collaboration with Food and Drug Administration (FDA) and participating states. Once data is collected and entered into the system, specified users may edit or delete the data. Studies are then conducted to determine causes of various food borne illnesses and related outbreaks, for research purposes. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): The system does not contain PII. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: The system does not contain PII. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) The system does not contain PII. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: The system does not contain PII. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Dec 18, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCEHIP NCEH Pesticide Sample Tracking Analysis and Reporting System - (PSTARS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCEHIP NCEH Pesticide Sample Tracking Analysis and Reporting System - (PSTARS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-03-02-9623-00 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): No 5. OMB Information Collection Approval Number: No 6. Other Identifying Number(s): No 7. System Name (Align with system Item name): Pesticide Sample Tracking, Analysis, and Reporting System (PSTARS) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Charles Chambers 10. Provide an overview of the system: Pesticide Sample Tracking, Analysis, and Reporting System (PSTARS) is a form of a Lab Information Management System (LIMS). The system is non-web based and is designed to track samples from receipt through reporting. The samples are received from the National Center for Environment Health (NCEH)/Division of Laboratory Sciences (DLS) Sample Logistics section along with a printout of sample IDs. The sample IDs are then transferred to an Excel spreadsheet for importing to PSTARS. Sample IDs are associated with a Study, Lab Method, and Matrix upon import. Samples are tracked through the laboratory process in PSTARS for creating Runsheets, cleanup, creating an Excel Sequence for importing to the lab instruments, importing Excel spreadsheet result data from lab instruments, and exporting formatted results to a spreadsheet. 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): No 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: PSTARS does not contain IIF information. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) PSTARS does not contain IIF information. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: PSTARS does not contain IIF information. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Michael W. Harris Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: May 22, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCEHIP NCEH Radiation Studies Bibliographic Database (RSBD) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCEHIP NCEH Radiation Studies Bibliographic Database (RSBD) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CCEHIP NCEH Radiation Studies Bibliographic Database (RSBD) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Robert (Bob) Whitcomb 10. Provide an overview of the system: Radiation Studies Bibliographic Database (RSBD) is a web-based system designed to identify potentially harmful environmental exposures (such as radiation effects from nuclear weapons exposures) and examine all health risks that are associated with the identified exposures. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): RSBD does not contain IIF information. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: Radiation Studies Bibliographic Database (RSBD) is a web-based system designed to identify potentially harmful environmental exposures (such as radiation effects from nuclear weapons exposures) and examine all health risks that are associated with the identified exposures. The system information is considered to be open in nature, and therefore, does not contain any sort of Personable Identifiable Information (PII). 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) RSBD does not contain IIF information. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: The system does not contain IIF. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Michael W. Harris Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Nov 3, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCEHIP NCEH Rapid Data Collector (RDC) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCEHIP NCEH Rapid Data Collector (RDC) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N\A 5. OMB Information Collection Approval Number: N\A 6. Other Identifying Number(s): N\A 7. System Name (Align with system Item name): Research Data Center (RDC) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Peter Meyer 10. Provide an overview of the system: Provide a comprehensive description of the system’s function. Attach system concept of operations, vision statements, and/or project justification documents if available. The National Center for Health Statistics (NCHS) Research Data Center (RDC) is a research program through which approved data users are provided access to data that are not available through NCHS public use releases. The restricted data files contain information such as lower levels of geography (state, county, or lower), but do not contain direct identifiers (name or social security number). These data elements carry no disclosure risk in isolation but can increase disclosure risk when compiled together. An example would be adding together data elements for race/ethnicity, family structure, occupation, state of residence, and sex. Using these data elements together could add to the make a Black female dentist with five children in South Dakota identifiable. On the other hand a researcher may have a legitimate question that requires the use of these elements together. An example would be estimating the prevalence of hepatitis in dentist by state and race/ethnicity. In order to reduce the risk of disclosure, access to these data is controlled through a formal proposal review committee that includes RDC staff, representatives from the program that produces the data, and the NCHS Confidentiality Officer. The committee may grant three types of access to these data: 1) Onsite, 2) Remote, and 3) Census RDC. Each of these access methods uses different types of information technology to control what data elements user can access. The term access is very specific to the operations of the RDC. Researchers may work with the data but they are not permitted remove it from the controlled environment. When the proposed research and analysis are complete, they may take the results of their analysis away from the RDC after it undergoes a disclosure risk avoidance examination by RDC staff. No micro data or data sets are permitted to leave the RDC. Descriptions of the RDC’s three access methods follow: · On-site Access: Researchers may be provided access to sensitive data through the RDC secure laboratory on-site at NCHS. There are two labs that house stand alone computers that are not part of the CDC network and have had all of their media ports disabled. These computers are not part of any internal or external network and do not have access to Internet, email, printers or any other communication devise. When researchers arrive at the RDC they surrender cell phones, PDA’s and any other devise that could be used to copy or transmit data. When researchers have completed their analysis the results and output are subject to disclosure review by the RDC analyst assigned to the project. All approved output are then sent via email to the researcher or provided via some other form of electronic media. Printers are not used to create paper copies of analytic results created in the RDC. · Remote Access: ANDRE (Analytical Data Research by Email) is the RDC Remote Access system that supports statistical analytical requests of researchers from academic institutions and other government agencies (Federal, State, and local), etc. via Microsoft Outlook email. It authenticates users, runs a pre-analysis disclosure risk algorithms, executes analytical models, runs post-analysis disclosure risk algorithms, and provides the approved results to the researchers. Output from ANDRE is periodically flag for review by RDC staff analysts. The researchers never get to see the micro data and run their programs against a data set that they specify in their research proposal. The users only see output which is summary or aggregate measures that cannot be used to identify individuals. Email Server ANDRE Processing Computer · Census RDC Access: Researchers may access NCHS data through the Census RDC system. Data are tra 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): No IIF shared or disclosed 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: Data is unique to the individual project and is not maintained by the RDC beyond the duration of the project. Data in the RDC do not contain IIF. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) N/A 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: N/A PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Dec 12, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCEHIP NCEH Requisition and Purchase Information Database (RAPID) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCEHIP NCEH Requisition and Purchase Information Database (RAPID) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): No 5. OMB Information Collection Approval Number: No 6. Other Identifying Number(s): No 7. System Name (Align with system Item name): Requisition and Purchase Information Database (RAPID) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Kathleen Caldwell 10. Provide an overview of the system: Requisition And Purchase Information Database (RAPID) is a web-based purchase order management application that receives requests for purchases from users, presents the requests to authorized reviewers, and, if the purchase is approved, provides the purchasing staff with the information required to complete the purchases. The users designated for the RAPID systems includes laboratory scientists, administrative staff, team leaders, quality control staff, study managers, and the branch manager of the Inorganic Radiological and Analytical Toxicology (IRAT) Branch, Division of Laboratory Sciences (DLS). The RAPID application allows users to enter purchase requests by filling out online forms. 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): No 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: The information collected does not contain PII. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) The system does not contain PII. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: The system does not contain PII. No IIF Collected. E-Authentication Assurance Level = N/A Risk Analysis Date = 08/07/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Dec 18, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCEHIP NCEH Research Data Center (RDC) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCEHIP NCEH Research Data Center (RDC) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-05-02-9421-00 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N\A 5. OMB Information Collection Approval Number: N\A 6. Other Identifying Number(s): N\A 7. System Name (Align with system Item name): Research Data Center (RDC) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Peter Meyer 10. Provide an overview of the system: The National Center for Health Statistics (NCHS) Research Data Center (RDC) is a research program through which approved data users are provided access to data that are not available through NCHS public use releases. The restricted data files contain information such as lower levels of geography (state, county, or lower), but do not contain direct identifiers (name or social security number). These data elements carry no disclosure risk in isolation but can increase disclosure risk when compiled together. An example would be adding together data elements for race/ethnicity, family structure, occupation, state of residence, and sex. Using these data elements together could add to the make a Black female dentist with five children in South Dakota identifiable. On the other hand a researcher may have a legitimate question that requires the use of these elements together. An example would be estimating the prevalence of hepatitis in dentist by state and race/ethnicity. In order to reduce the risk of disclosure, access to these data is controlled through a formal proposal review committee that includes RDC staff, representatives from the program that produces the data, and the NCHS Confidentiality Officer. The committee may grant three types of access to these data: 1) Onsite, 2) Remote, and 3) Census RDC. Each of these access methods uses different types of information technology to control what data elements user can access. The term access is very specific to the operations of the RDC. Researchers may work with the data but they are not permitted remove it from the controlled environment. When the proposed research and analysis are complete, they may take the results of their analysis away from the RDC after it undergoes a disclosure risk avoidance examination by RDC staff. No micro data or data sets are permitted to leave the RDC. Descriptions of the RDC’s three access methods follow: · On-site Access: Researchers may be provided access to sensitive data through the RDC secure laboratory on-site at NCHS. There are two labs that house stand alone computers that are not part of the CDC network and have had all of their media ports disabled. These computers are not part of any internal or external network and do not have access to Internet, email, printers or any other communication devise. When researchers arrive at the RDC they surrender cell phones, PDA’s and any other devise that could be used to copy or transmit data. When researchers have completed their analysis the results and output are subject to disclosure review by the RDC analyst assigned to the project. All approved output are then sent via email to the researcher or provided via some other form of electronic media. Printers are not used to create paper copies of analytic results created in the RDC. · Remote Access: ANDRE (Analytical Data Research by Email) is the RDC Remote Access system that supports statistical analytical requests of researchers from academic institutions and other government agencies (Federal, State, and local), etc. via Microsoft Outlook email. It authenticates users, runs a pre-analysis disclosure risk algorithms, executes analytical models, runs post-analysis disclosure risk algorithms, and provides the approved results to the researchers. Output from ANDRE is periodically flag for review by RDC staff analysts. The researchers never get to see the micro data and run their programs against a data set that they specify in their research proposal. The users only see output which is summary or aggregate measures that cannot be used to identify individuals. Email Server ANDRE Processing Computer · Census RDC Access: Researchers may access NCHS data through the Census RDC system. Data are transferred through an approved CDC Secure Data Network (SDN) which is located in a secure environment in the NCHS RDC. This is a single purpose file server that is used exclusivel 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): No IIF shared or disclosed 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: Data is unique to the individual project and is not maintained by the RDC beyond the duration of the project. Data in the RDC do not contain IIF. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) N/A 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: N/A PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Michael Harris Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jul 28, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCEHIP NCEH/ATS ATSDR Geographical Information System (GIS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? No If this is an existing PIA, please provide a reason for revision: Initial PIA Migration to ProSight 1. Date of this Submission: CDC CCEHIP NCEH/ATS ATSDR Geographical Information System (GIS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-05-01-1011-02 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A - System does not constitute a "System of Records" under the Privacy Act. 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): ATSDR Geographic information System (GIS) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Andrew L. Dent 10. Provide an overview of the system: Geographic Information Systems (GIS) can provide a visual tool for identifying the location of events, the spatial relationship between incidents and the population they may impact. Mapping technology can also assist in the collection of information from exposed individuals to help identify the source of an unknown release. Proximity assessment, demographic characterization, and local resource identification (e.g., postal facilities, health care, fire, national guard) are also available through the use of spatial analysis techniques. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): The system does not collect, maintain (store), disseminate and/or pass through IIF within any database(s), record(s), file(s) or website(s) hosted by this system. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: This system maintains geospatial data such as basemap, emergency response, public health infrastructure, demographic, and environmental hazard data. The data will be used to generate cartographic products, support research, and analyze spatial relationships between features of interest in the public health domain. The system does not collect, maintain (store), disseminate and/or pass through IIF within any database(s), record(s), file(s) or website(s) hosted by this system. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) The system does not collect, maintain (store), disseminate and/or pass through IIF within any database(s), record(s), file(s) or website(s) hosted by this system. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: The system does not collect, maintain (store), disseminate and/or pass through IIF within any database(s), record(s), file(s) or website(s) hosted by this system. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Alice M. Brown Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden, OCISO Sign-off Date: Aug 15, 2007 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCEHIP NCEH/ATS Hazardous Substance Release/ Health Effects Database System (HazDat) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: Initial PIA Migration to ProSight 1. Date of this Submission: CDC CCEHIP NCEH/ATS Hazardous Substance Release/ Health Effects Database System (HazDat) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-23-01-1000-00 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): 09-19-0001 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): HazDat 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Lori Franklin 10. Provide an overview of the system: HazDat was initiated for tracking and analyses of ATSDR’s legislated responsibilities. HazDat is ATSDR’s scientific and administrative database developed to provide rapid access to information on the release of hazardous substance from Superfund sites or emergency events. The database provides information on the effects of hazardous substances on the health of human populations. This management information system allows ATSDR staff to locate information on the release of hazardous substances into the environment and ascertain the effects of hazardous substances on health with improved uniformity, efficiency, and precision. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): Yes 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): System does not share or disclose IIF. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: HazDat contains environmental and health data from ATSDR's documents, studies, and activities. The system currently contains data related to more than 4,000 hazardous waste sites and includes information from more than 1,900 public health assessments, 6,000 health consultations, 170 health studies, and 150 toxicological profiles, as well as almost 20,000 agency activity records and several hundred health education materials and training activities. The system is regularly used to obtain information about specific sites, documents, studies, substances, and activities. In addition, HazDat is indispensable for the timely generation of information provided in agency reports, testimony, and presentations, as well as responses to requests from Congress, other agencies, and the public. The IIF is collected to show who is requesting that work be done at sites. It is also used to track costs incurred by the agency at hazardous waste sites, so that those costs may be recovered from the responsible parties. Following enactment of CERCLA, EPA developed the Comprehensive Environmental Response, Compensation, and Liability Information System (CERCLIS) identifying Superfund sites and tracking EPA activities. Development of HazDat was initiated in 1989 for tracking and analyses of ATSDR’s legislated responsibilities. The HazDat system was carefully developed to assure compatibility of site-specific data between EPA and ATSDR (for common data elements) and to prevent the proliferation within ATSDR of limited-user, program-specific databases lacking consistent and compatible data elements. The goal is to provide high-quality scientific and administrative information that is readily accessible, accurate and consistent with source documents and agency activities, and responsive to the information needs of the agency. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) Data is collected from private citizens by the scientists and entered into the system at the site. Individuals are informed of data uses at the site. The consent form provides Privacy Act notification elements, including the identifiable information shar 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): Yes 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Administrative Controls: In order to ensure least privilege and accountability, read only access is given by default. Add/modify access must be requested by User's manager/supervisor. Requests must be made to system steward. Technical Controls: User ID, passwords, firewall, IDS, SDN certificates and roles. Physical Controls: Guards, ID badges, key cards, locked offices. Must have user id and password to access the system. The IIF can only be viewed by the user that enters it. The IIF is never contained in any output. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Betsey Dunaway Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden, OCISO Sign-off Date: Aug 18, 2006 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCEHIP NCIPC Extramural Tracking System - (NEXT) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCEHIP NCIPC Extramural Tracking System - (NEXT) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-04-00-02-0897-00-402-126 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): No 5. OMB Information Collection Approval Number: No 6. Other Identifying Number(s): No 7. System Name (Align with system Item name): NCIPC Extramural Tracking System (NEXT) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Robin Forbes 10. Provide an overview of the system: The NCIPC Extramural Tracking System (NEXT) is a workflow system for tracking the publishing of Funding Opportunity Announcements and the award process for the CDC’s National Center for Injury Prevention and Control (NCIPC). 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): No 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: The system maintains information related to Funding Opportunity Announcements and award processing. The information is used to streamline the publishing and awarding of Funding Opportunity Announcements. The information does not contain IIF. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: No PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Michael Harris Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jun 19, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCEHIP NCIPC National Violent Death Reporting System (NVDRS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCEHIP NCIPC National Violent Death Reporting System (NVDRS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): No 5. OMB Information Collection Approval Number: No 6. Other Identifying Number(s): No 7. System Name (Align with system Item name): National Violent Death Reporting System (NVDRS) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Joyce McCurdy 10. Provide an overview of the system: The National Violent Death Reporting System (NVDRS) is an incident-based system designed to capture data on violent deaths (suicides, homicides, and deaths of undetermined intent) in a relational database. Information on deaths are collected by state-level partner agencies (typically state health departments), and information is transmitted to the CDC after being stripped of all personally identifiable information. Cases are typically identified as death certificates are filed or by data abstractors reviewing cases reported to coroner/medical examiner (CME) offices. Accordingly, data within the NVDRS can be analyzed on the victim or suspect level (e.g. to determine details about victims or suspects) or the incident level (in which multiple homicides or linked homicide/suicides can be considered as single events). Each state’s own Violent Death Reporting System establishes the details of that state’s cases from primary and secondary data sources. Primary data sources are: death certificates (DC), CME records, police reports (PR), and crime laboratory data. Secondary, or optional data sources are: child fatality review team data (CFR), supplementary homicide reports (SHR), hospital (Hosp) data, emergency department (ED) data, and Alcohol Tobacco, Firearms and Explosives (ATF) trace information on firearms. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): No, does not contain IIF 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: The information collected does not contain IIF. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) The system does not contain IIF. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: The system does not contain IIF. E-Authentication Assurance Level = N/A Risk Analysis Date = 11/4/2008 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Nov 6, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCEHIP NCIPC Web-based Injury Statistics Query and Reporting System - (WISQARS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? No If this is an existing PIA, please provide a reason for revision: PIA Validation 1. Date of this Submission: CDC CCEHIP NCIPC Web-based Injury Statistics Query and Reporting System - (WISQARS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-04-00-0897-00 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): No 5. OMB Information Collection Approval Number: No 6. Other Identifying Number(s): No 7. System Name (Align with system Item name): Web-based Injury Statistics Query and Reporting System (WISQARS) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Kevin Webb 10. Provide an overview of the system: WISQARSTM (Web-based Injury Statistics Query and Reporting System, pronounced "whiskers"). WISQARS is an interactive web base system that utilizes non-IIF Public Use Data to provide violent and injury-related mortality and morbidity statistics useful for research and for making informed public health decisions. The system allows users to get basic counts and rates information on violent deaths, mortality deaths, and morbidity injuries. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): No 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: WISQARS is an interactive web base system that utilizes non-IIF Public Use Data to provide violent and injury-related mortality and morbidity statistics useful for research and for making informed public health decisions. The system allows users to get basic counts and rates information on violent deaths, mortality deaths, and morbidity injuries. This system contains no IIF. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: No PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Alice M. Brown Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Apr 23, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCHIS mobile.cdc.gov PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCHIS mobile.cdc.gov 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-02-02-9321-00 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CCHIS mobile.cdc.gov 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Scott Mullins 10. Provide an overview of the system: Mobile.cdc.gov is a Dot Net 2.0 application that refocuses publically available content for use and access on mobile devices. This application is hosted on the worldwide wireless network (WWWN) and converts existing CDC.Gov pages, via a WAP protocol, upon users entering the URL from a mobile browser. There is no active authentication protocol in place as all media and informational content is updated via CDC.Gov. 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): N/A 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: No 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: No PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Michael W. Harris Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Sep 10, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCHIS NCHM External Partners Networking Directory (EPND) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCHIS NCHM External Partners Networking Directory (EPND) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): The PII collected is exempt due to the business PII 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CCHIS NCHM External Partners Networking Directory (EPND) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Yolanda Jacobs 10. Provide an overview of the system: The system is comprised of the following interrelated functionality. External Organization Information Maintenance: The system enables users to maintain and/or manage information for the organization they represent. External Organization Networking Directory: The system also provides a means of generating and maintaining an organization contacts (networking) directory of organizations. Point of Contact (POC) Management – allows for current and future points of contact to register their specific relationship (Subject Matter Expert, Project Officer Facilitator, Detaille, Other) with each of the external organizations listed within. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): CDC Users and Invited Users (Registered external users who are members of organizations currently existing in the system. For the purpose of communicating with other organizations via the contact information retrieved through the system.) 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: Demographic and organizational contact information. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) N/A 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Administrative control is implemented by only allowing those approved by their division/group/organization within CDC needing read/write administrative access to the system with an administrator’s user-id & password. Technical security will be implemented via a valid Administrative user-id and password, to protect access to users’ and system data. Secure physical controls are implemented by locating the system where only authorized persons may enter the location, by means of ID badge and associated credentials. Technical security will be implemented via a valid Administrative user-id and password, to protect access to users’ and system data. Secure physical controls are implemented by locating the system where only authorized persons may enter the location, by means of ID badge and associated credentials. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 28, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCHIS NCHM XyVision PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? No If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCHIS NCHM XyVision 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): XyVision 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Tommy C. Seibert 10. Provide an overview of the system: This system takes existing documents and packages them for printing at GPO or publication on CDC's internet server. Original data and graphics are entered into the system by three users. These users use the system to edit and prepare a final form electronic document that is packaged into a pdf or other format document and then is manually sent by the user's email to its’ final destination. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): N/A 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: No IIF is collected, processed, stored or transmitted by the system. System is used strictly for Public document preparation and release. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) N/A 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: No IIF collected EAAL = N/A Risk Analysis Date = March 21, 2009 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Mar 26, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCHIS NCHS Q Bank PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCHIS NCHS Q Bank 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-05-02-9421-00 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): 09-20-0164 5. OMB Information Collection Approval Number: 0920-222 6. Other Identifying Number(s): N\A 7. System Name (Align with system Item name): Q-Bank 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Kristen Miller with Aaron Maitland as alternate. 10. Provide an overview of the system: Q-Bank was designed as a unique analytical and research tool for researchers and survey professionals. It contains no personal information or personal identifiable information (no IIF is stored in Q-Bank) other than Principal Investigator and Investigator/Interviewer Team Names, which are already published and released publicly by NCHS in the final report. While these names are IIF they do not need to have their confidentiality protected. Q-Bank is used by, and receives data and funding from, various government agencies including The Bureau of the Census, The National Institute of Science, The National Science Foundation, The National Cancer Institute, and The Bureau of Labor Statistics, as well as CDC/NCHS. Q-Bank’s development and management is under the direction of a Project Manager, an NCHS Project Officer, and an Inter-Agency Steering Committee. While Q-Bank is in an Operational/Maintenance Phase enhancements and modifications are being made to Q-Bank at the direction of the Inter-Agency Steering Committee and the Project Officer. The Q-Bank application stores survey questions which have been tested to determine the effectiveness of the question. It also contains the Researchers final report, including findings and recommendations based upon the analysis conducted. Questions are indexed and searchable by some 26 categories and endless combinations. Common terms and a common definition of terms and formats across participating agencies were developed to ensure the integrity, common understanding, and effective categorization of the data. No answers are contained in the data. Q-Bank consists of three modules (with a fourth notes module under development; see below); The Q-Bank database which is hosted by NCHS, the Q-Bank GUI which is hosted in the MTDC in Atlanta, and Q-Bank Admin which is hosted in NCHS. Q-Bank was originally developed using Sybase’s database and PowerBuilder products. It was then transitioned to Microsoft SQL Server and .net products at the request of NCHS OIT. Data elements include: Survey Title Survey Year Evaluation Type Test Date Sponsor Testing Agency Universe Mode Field Mode Documentation Global Instructions Separate Instructions Target Population Question Topic Question Type Information Type Index Status Flash Card Introductory Text Sequence Number Core Question Response Text Response Category Response Error Where Error Occurs The new fourth module supports standardized collection of QDRL project investigators and interviewers notes. This module contains the Principal Investigator and Investigator/Interviewer names which are already released publicly by NCHS in project reports. These individuals are limited to a known and defined researcher/interviewer population as determined or required by each QDRL project. Confidentially of these names do not need to be protected in this application. A second URL in support of this data collection will be utilized, in addition to sign on and password controls. Data elements for this notes module (Q-Notes) are: Date Project Name Principal Investigator Respondent ID (random numeric identifier) Interviewer Name Narrative Notes Meta Notes 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): Yes 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): NO PII Stored in Q-Bank with the exception of the Principal Investigator and Investigator Team names, which are already publicly released in the Final Report. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: Q-Bank was designed as a unique analytical and research tool for researchers and survey professionals. Q-Bank is used by, and receives data and funding from, various government agencies including The Bureau of the Census, The National Institute of Science, The National Science Foundation, The National Cancer Institute, and The Bureau of Labor Statistics, as well as CDC/NCHS. Q-Bank’s development and management is under the direction of a Project Manager, an NCHS Project Officer, and an Inter-Agency Steering Committee. While Q-Bank is in an Operational/Maintenance Phase enhancements and modifications are being made to Q-Bank at the direction of the Inter-Agency Steering Committee and the Project Officer. The Q-Bank application stores survey questions which have been tested to determine the effectiveness of the question. It also contains the Researchers final report, including findings and recommendations based upon the analysis conducted. Questions are indexed and searchable by some 26 categories and endless combinations. Common terms and a common definition of terms and formats across participating agencies were developed to ensure the integrity, common understanding, and effective categorization of the data. No answers are contained in the data. Q-Bank consists of three modules (with a fourth notes module under development; see below); The Q-Bank database which is hosted by NCHS, the Q-Bank GUI which is hosted in the MTDC in Atlanta, and Q-Bank Admin which is hosted in NCHS. Q-Bank was originally developed using Sybase’s database and PowerBuilder products. It was then transitioned to Microsoft SQL Server and .net products at the request of NCHS OIT. Data elements include: Survey Title Survey Year Evaluation Type Test Date Sponsor Testing Agency Universe Mode Field Mode Documentation Global Instructions Separate Instructions Target Population Question Topic Question Type Information Type Index Status Flash Card Introductory Text Sequence Number Core Question Response Text Response Category Response Error Where Error Occurs The new fourth module supports standardized collection of QDRL project investigators and interviewers notes. This module contains the Principal Investigator and Investigator/Interviewer names which are already released publicly by NCHS in project reports. These individuals are limited to a known and defined researcher/interviewer population as determined or required by each QDRL project. Confidentially of these names do not need to be protected in this application. A second URL in support of this data collection will be utilized, in addition to sign on and password controls. Data elements for this notes module (Q-Notes) are: Date Project Name Principal Investigator Respondent ID (random numeric identifier) Interviewer Name Narrative Notes Meta Notes 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) The Project Investigation Team including Principal Investigator and Investigator (Interviewer) names are included in publically released reports supporting the findings of the Project or Investigation. They provide points of contact and reference, as we 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: While data in Q-Bank is used by a targeted audience of researchers and investigators it is not restricted from the public. The only PII being the names of the Project Investigation Team, which are included in publicly released reports, there is no requirement or intent to secure this PII. The fourth module (Q-Notes) does have a unique URL (separate from the first three modules of Q-Bank), and sign-on and password controls, however this is not intended to protect PII as much as facilitate the Investigation Team members, collection, grouping, accessing, and dissemination of notes. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Michael Harris Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jun 26, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCHIS NCHS National Health And Nutrition Examination Survey (NHANES) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: Initial PIA Migration to ProSight 1. Date of this Submission: CDC CCHIS NCHS National Health And Nutrition Examination Survey (NHANES) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 9.200121011e+020 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): 09-20-0164 5. OMB Information Collection Approval Number: 0920-0237 6. Other Identifying Number(s): Protocol # 2005-006 7. System Name (Align with system Item name): National Health and Nutrition Examination Survey (NHANES) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Jerry Del Rosso 10. Provide an overview of the system: The National Health Examination Survey (NHES) is forerunner to the NHANES and was operational in the years 1959 – 1962, 1962 – 1965, 1966 – 1967. The NHANES 1 from 1971 – 1976, NHANES 2 from 1976 – 1980, NHANES 3 from 1988 – 1994. The current NHANES has been operational since 1999 to the present day. The NHANES system consists of multiple computing and functional components at various locations. Primary components of NHANES include: · Collection: Fully encrypted Fujitsu Lifebook T2020 Convertible Laptop computers are used for collecting interview data in the field. Survey data are maintained on the Fujitsu T2020 computer until uploaded to the Field Office (FO) server. The Fujitsu T2020 computer can operate in two modes -- as a traditional laptop computer and as a tablet computer. The Fujitsu T2020 is connected to the FO network for uploading survey data. · Analysis: Workstations and servers are located at all field offices and MEC trailers, the Westat offices in Rockville, Maryland, and the NCHS in Hyattsville, Maryland. Windows XP workstations are used for database access, data manipulation and review, and numerous other administrative duties. Microsoft Windows 2003 servers provide file and print server functionality on each network. The Microsoft Windows 2003 server does not maintain the database records from medical exams or surveys. Sun Microsystems Sybase database servers reside at all MEC trailers, the Westat office in Rockville, Maryland, and the NCHS office in Hyattsville, Maryland. Identifying details are removed from data every two years or as necessary in support of the creation of public release datasets. · Reporting: This data is cleaned and edited after a two year data collection period to insure high quality and to remove data that could identify a survey participant. Before releasing the data to the public, the data is reviewed by the NCHS Disclosure Review Board (DRB). Based on the DRB’s recommendations, the data is further processed, if necessary, to remove any other identifiable information. Once the records are de-identified, the data is released to the public. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): Yes 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): PII can be used by collaborators or researchers under a very strict control in the NCHS Research Data Center (RDC). At the RDC, survey data is used in a controlled environment allowing only aggregated information to be disseminated from the RDC. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: 1. The NHANES system collects, analyzes and disseminates data on the health of Americans. All major diseases, risk factors and behaviors, environmental exposures, and relationship between diet/health/nutrition are assessed. The system collects and processes health and nutritional information annually from about 5,000 adults and children in the United States. 2. NHANES data are used to measure the prevalence of numerous chronic diseases and risk factors, to measure exposure to hundreds of environmental chemicals, and to measure the nutritional intake of U.S. population. 3. PII is collected to allow future contact of a survey participant to report results of medical tests and for future longitudinal research both passive and active. Collection of PII is voluntary. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) 1. Major changes have not occurred and disclosure is not permitted therefore a system is not in place. Should major changes occur in the future each individual would be re-contacted for consent to the changes. 2. Written informed consent 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): Yes 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Administrative controls: · The system maintains SSP as a part of C&A CDC process. · The system maintains BCP with annual testing. The system maintains the backup and failover procedures. · Regular scheduled backups of data. · User manuals. · Role based access to data ensures least privilege and accountability. · Monthly system security reviews and analysis. · Data containing PII are strictly protected according with o Section 308(d) of the Public Health Service Act (42 U.S.C. 242m). o Chapter 45-13, “Safeguarding Record Contained in Systems of Records”, of the HHS General Administration Manual. o HHS Automated Information Systems Security Manual o NCHS Staff Manual on Confidentiality. o OMB Circular A-130, Appendix III. · All employees of NCHS and contractor personnel with access to HNANES records are required, as a condition of employment, to sign an affidavit binding them to nondisclosure of PII. · System has undertaken security evaluation risk assessments with the CDC and NCHS ISSOs, staff. These groups in part or whole have conducted thorough reviews of the NHANES network architecture, system architecture, and system/network security in March 2005. This review was in the form of the table top test. Technical controls: The system maintains in place following technical controls: · User identification · Passwords · Firewalls · Virtual private network (VPN) · Data encryption · Intrusion detection system (IDS) · Equipment failure monitoring and replacement/duplication Physical controls: · Security guards at the entrance point · ID badges · Key cards · Closed circuit TV (CCTV) · Servers with PII data are locked in caged area inside access protected room. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Alice M. Brown Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden, OCISO Sign-off Date: Aug 15, 2007 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCHIS NCHS National Health Interview Survey (NHIS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: Initial PIA Migration to ProSight 1. Date of this Submission: CDC CCHIS NCHS National Health Interview Survey (NHIS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-06-01-1020-02 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): 09-20-0164 5. OMB Information Collection Approval Number: 0920-0214 6. Other Identifying Number(s): N\A 7. System Name (Align with system Item name): National Health Interview Survey 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Anne Stratton 10. Provide an overview of the system: The National Health Interview Survey (NHIS) is a multi-purpose health survey of the civilian non-military population conducted by the National Center for Health Statistics (NCHS), which has produced annual data since 1957. NHIS data are used to describe the health of the US population, monitor trends in national health objectives, set and evaluate health policies, and perform methodological and epidemiological research on important health issues. Findings are generalizable to the US household population but have also been used to explore issues at the regional and state level. Since 1960, the NCHS has had the objective of producing vital and health statistics for the United States. NCHS has legislative authority under 42 U.S.C. 242k, Section 306(b) of the Public Health Service Act to collect statistics on the extent and nature of illness and disability of the population; environmental, social and other health hazards; determinants of health; health resources; and utilization of health care. The NHIS is a multi-purpose health survey conducted by NCHS in support of this legislative charge. It is the principal source of information on the health of the civilian, non-institutionalized population of the United States. Data from NHIS are used to assess agency and NCHS objectives, and initiatives such as Healthy People. Other strategic goals of NCHS are to increase the quality of the data collected and to make it more timely. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): Yes 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): NCHS/OAEHP for National Death Index Matching & AHRQ for MEPS sample. The customers of the NHIS are government agencies (federal, state, and local level), international, national, state and community organizations, private researchers, academia, consumer groups, companies, and health care providers. Examples of federal agencies who are recent customers include: the Centers for Medicare and Medicaid Services, the Environmental Pollution Agency, the Food and Drug Administration, General Accounting Office, National Cancer Institute, the National Institute on Aging, the National Institute for Mental Health, and the Veterans Administration. Many organizations have a vested interest in assuring the success and continuity of the NHIS. These organizations include; the Department of Health and Human Services (DHHS), the Agency for Healthcare Research and Quality (AHRQ), and others such as the Bureau of Census(BoC) and policy makers. Through partnerships with NCHS, other agencies within DHHS are able to piggyback on the NHIS infrastructure, expressing the NHIS as a significant DHHS asset. One example is the collaborative efforts between NCHS/DHIS and other DHHS agencies to collect data on topical public health subjects by fielding NHIS Supplements. The AHRQ follows up with half of the NHIS sample on its Medical Expenditure Panel Survey (MEPS). By NHIS providing the MEPS sample, AHRQ was able to save an estimated eight million dollars on its 1996 reengineering project and continues to save budget by forgoing annual listing and other sampling costs. Sharing a sample also allows for a NHIS/MEPS linkage file which enables users to link persons in the MEPS public use file to the records of the same person in the NHIS data file. This adds the broad array of NHIS information to the more specific MEPS data and allows for broad multivariate analyses. The agency shares the information with the public by posing all cleaned, edited, and de-identified data on the CDC website for public access. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: As the Nation's principal health statistics agency, NCHS is responsible for providing accurate, relevant, and timely data. The NHIS collects information along many different domains including health status, health conditions, health behaviors and risk factors, utilization of and access to healthcare, socio-demographic, and economic data. The data collected contains IIF. Participation in the survey is voluntary. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) NHIS policy does not permit disclosure rule changes and/or data use changes after the time of data collection and consent. The consent procedures in place for a given year continue to guide the use of the data in subsequent years. Any desired changes in d 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): Yes 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Administrative Controls: In order to ensure least privilege and accountability, each user name is assigned limited access rights to files and directories at varying levels. The CD's and hard copy printouts of records are stored in locked files or offices when not in use. Technical Controls: User ID, passwords, firewall, encryption. Physical Controls: Guards, Identification badges. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Betsey Dunaway Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden, OCISO Sign-off Date: Aug 18, 2006 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCHIS NCHS National Vital Statistics System (NVSS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: Initial PIA Migration to ProSight 1. Date of this Submission: CDC CCHIS NCHS National Vital Statistics System (NVSS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-06-01-1030-02 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): 09-20-0166 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): National Vital Statistics System (NVSS) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: James A. Weed 10. Provide an overview of the system: The National Vital Statistics System (NVSS) is one component of NCHS's health data collection program and is operated by NCHS to fulfill its legislatively mandated mission to produce national vital statistics based on data from the nation's birth and death records. The NVSS is a cooperative, decentralized system in which data from over 6 million vital event records are collected each year by all States and U.S. territories and transmitted to the NCHS for processing and dissemination. NCHS is responsible for administering the NVSS, which produces the nation's official vital statistics. These data are provided through State owned and operated registration systems, which collect the data on birth and death records submitted to State Registrars by physicians, medical examiners, coroners, hospitals, and funeral homes. The data are used only for statistical purposes in issues or activities relating to public health and population. Uses within the Department include the preparation of aggregated data in the form of statistical tables for publication, analysis, and interpretation to meet the legislative mandates of 42 U.S.C. 242k, i.e., to determine the extent and nature of illness and disability of the population of the U.S., including life expectancy and levels of infant and maternal mortality, environmental and other health hazards, trends in family formation and population change, to expand the scope of data that NCHS can collect from the national registration system, to make the registration system more responsive to changing needs for data, and to evaluate the quality of data collected on the birth and death records. Authority for maintenance of the system: Public Health Service Act, Section 306(h) (42 U.S.C. 242k). Most States submit vital statistics data on computer tape or PC-to-PC via modem, showing the State file number for each case but no names or addresses. A few States submit microfilm copies of certificates of death, and statistics are extracted from them. These microfilms contain individual identifiers; they are the only individually identified records in the system. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): Yes 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Special data releases approved by State vital registration officials Census Bureau for Population projections and estimates. Published reports prepared by NCHS staff or contractors are available to the public generally. Electronic microdata files containing no personally identifiable information are provided to the public as well. With the permission of the data provider (e.g. State Registrars) in a restricted data access program, electronic files containing additional detail is provided to qualified researchers who have signed a Restrictive Confidentiality Agreement. The Department occasionally contracts with a private firm for the purpose of collecting, analyzing, aggregating, or otherwise refining records in this system. Relevant records are disclosed to such a contractor. The contractor is required to maintain Privacy Act safeguards and to strictly follow Section 308(d) of the Public Health Service Act. NCHS may disclose selected identifiable information to authorized recipients such as the Social Security Administration for statistical analysis purposes only, consistent with the requirements of Section 308(d) of the Public Health Service Act and the Privacy Act. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: The NCHS receives either machine-readable data or microfilm of records prepared by States from records collected under the laws of each State for births, deaths, and fetal deaths. The records contain the demographic characteristics of individuals associated with each event. In addition, the birth records include information on the characteristics of each live birth, the health status of the infant, and socioeconomic characteristics of the parents. The death records contain socioeconomic characteristics of the deceased and medical information relating to cause of death; the fetal death record contains socioeconomic characteristics of the parents and medical information relating to cause of death. Through the NVSS, national data on vital events (births, deaths, and fetal deaths) are produced in both published and electronic form, including the annual report Vital Statistics of the United States, National Vital Statistics Reports (formerly the Monthly Vital Statistics Report), and other reports on selected topics. Standard forms for the collection of the data referred to as the U.S. Standard Certificates of Birth and Death and Fetal Death--and model procedures for the uniform registration of vital events throughout the U.S. are developed and recommended for State use through cooperative activities of the States and the NCHS. These standard certificates have been revised every decade since 1900 with the goal of updating the content of these records to reflect current public health issues as well as medical practice and knowledge. Collaboration in these decennial review processes is provided by representatives from professional organizations, including the American Medical Association, the College of American Pathologists, the American College of Obstetricians and Gynecologists, the American Hospital Association, the National Association of Medical Examiners, and the National Association of Funeral Directors. The information provided on the standard certificates is regarded by the public health community as the minimum data that should be collected with respect to all births, deaths, and fetal deaths occurring in the U.S. Content of the standard certificates is approved by the Secretary, DHHS. The data are used only for statistical purposes in issues or activities relating to public health and population. Uses within the Department include the preparation of aggregated data in the form of statistical tables for publication, analysis, and interpretation to meet the legislative mandates of 42 U.S.C. 242k, i.e., to determine the extent and nature of illness and disability of the population of the U.S., including life expectancy and levels of infant and maternal mortality, environmental and other health hazards, trends in family formation and population change, to expand the scope of data that NCHS can collect from the national registration system, to make the registration system more responsive to changing needs for data, and to evaluate the quality of data collected on the birth and death records. Data are collected on birth and death certificates according to State laws that regulate and mandate the content of these legal administrative records. Under State laws, hospitals and funeral directors are required to report the information contained in these certificates for vital registration purposes. IIF received by NCHS includes only date of birth and the State certificate number. Content of these certificates is regulated by State legislatures, which determine what IIF is to be collected and how it will be used. State Legislation and Regulations are available to the public describing the birth and death registration process, as well as the content of IIF required by the State. NCHS has no control over these legal administrative procedures. A few States submit microfilm copies of certificates of death, and statistics are extracted from them. These microfilms contain individual identifiers; they are the only 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) State laws and regulations dictate how and by whom vital events are registered and what data are to be collected. To implement these laws, the State Vital Registration offices work directly with hospital, physicians, and funeral homes. Submission of p 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): Yes 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Administrative Controls: The manual portions of the records are stored in locked files or offices when not in use. Building security in Hyattsville, MD includes the use of identification badges by employees and a card key system used to enter NCHS occupied space. In the Research Triangle Park, North Carolina facility access is controlled by a security guard, a card key system, and the use of identification badges by employees. Protection for computerized records both on the mainframe and the CIO Local Area Network (LAN) includes programmed verification of valid user identification code and password prior to logging on to the system, mandatory password changes, limited log-ins, virus protection, and user rights/file attribute restrictions. Password protection imposes user name and password log-in requirements to prevent unauthorized access. Each user name is assigned limited access rights to files and directories at varying levels to control file sharing. There are routine daily backup procedures and Vault Management System for secure off-site storage is available for backup tapes. Technical Controls: User ID, passwords, firewall, encryption, controls on read/write access to mainframe files. Physical Controls: Guards, ID badges, key card, cipher locks. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Betsey Dunaway Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden, OCISO Sign-off Date: Aug 18, 2006 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCHIS NCPHI Biosense PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: Initial PIA Migration to ProSight 1. Date of this Submission: CDC CCHIS NCPHI Biosense 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-21-01-1163-00-110-030 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A - System does not constitute a "System of Records" under the Privacy Act. 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): BioSense 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Lynn Steele 10. Provide an overview of the system: BioSense is a national program intended to improve the nation’s capabilities for conducting near real-time biosurveillance and health situational awareness through access to existing data from healthcare organizations across the country and national data sources. BioSense is developing and implementing enhanced capabilities for early event detection and real-time health situational awareness. The primary objective is to expedite event recognition and response coordination among federal, state, and local public health and healthcare organizations by providing each level of public health access to the same data, at the same time. BioSense receives, analyzes, and evaluates health data from numerous data sources. National data sources include Department of Defense and Veterans Affairs hospitals and ambulatory care clinics, and a large commercial clinical laboratory. In addition, local hospitals and healthcare systems transmit real-time data to BioSense. The data transmitted to BioSense includes anonymized demographic information, diagnoses, chief complaint, microbiology orders/results, radiology orders/results, and medication orders. The data are used for public health purposes to help identify and characterize naturally occurring disease outbreaks or bioterrorism events using electronic biosurveillance techniques. The information transmitted to BioSense does not contain IIF. Participation by data sources is voluntary. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): System does not contain IIF. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: BioSense receives, analyzes, and evaluates health data from numerous data sources. National data sources include Department of Defense and Veterans Affairs hospitals and ambulatory care clinics, and a large commercial clinical laboratory. In addition, local hospitals and healthcare systems transmit real-time data to BioSense. The data transmitted to BioSense includes anonymized demographic information, diagnoses, chief complaint, microbiology orders/results, radiology orders/results, and medication orders. The data are used for public health purposes to help identify and characterize naturally occurring disease outbreaks or bioterrorism events using electronic biosurveillance techniques. The information transmitted to BioSense does not contain IIF. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) System does not contain IIF. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: System does not contain IIF. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Alice M. Brown Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden, OCISO Sign-off Date: Aug 15, 2007 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCHIS NCPHI Data Message Brokering (DMB) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: Initial PIA Migration to ProSight 1. Date of this Submission: CDC CCHIS NCPHI Data Message Brokering (DMB) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-00-01-0908-00 (009-20-01-00-01-0909-00) 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A - System does not constitute a "System of Records" under the Privacy Act. 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): Public Health Information Network (PHIN) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Lynn Gibbs-Scharf 10. Provide an overview of the system: The Public Health Information Network (PHIN) is a set of guidelines, standards, specifications, and collaborative relationships that will enable the consistent and reliable exchange of response, health, and disease tracking data between public health partners. Currently there are multiple systems in place that support communications for public health labs, the clinical community, and state and local health departments. Each has demonstrated the importance of being able to exchange health information. However, many of these systems operate in isolation, not capitalizing on the potential for a cross-fertilization of data exchange. A crosscutting and unifying framework is needed to better monitor these data streams for early detection of public health issues and emergencies. The Public Health Information Network (PHIN) is this framework. Through defined data and vocabulary standards and strong collaborative relationships, the Public Health Information Network will enable consistent exchange of response, health, and disease tracking data between public health partners. 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): This system does not collect, maintain (store), disseminate and/or pass through IIF within any database(s), record(s), file(s) or website(s) hosted by this system 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: This initiative does not collect personally identifiable information. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) This system does not collect, maintain (store), disseminate and/or pass through IIF within any database(s), record(s), file(s) or website(s) hosted by this system 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: This system does not host a website. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Betsey Dunaway Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden, OCISO Sign-off Date: Aug 18, 2006 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCHIS NCPHI Document Organization and Clearance System (DOCS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCHIS NCPHI Document Organization and Clearance System (DOCS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): Document Organization and Clearance System (DOCS) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Robert Swain 10. Provide an overview of the system: The purpose of DOCS is to provide a secure, enterprise wide system of record, for creating, clearing, and storing CDC content. Components that make up the DOCS system have been in use for more than six years and supports clearance and document storage in all centers, and web content management of a number of intranet sites including CDC Connects. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Author and co-author information collected within DOCS will be shared with the CDC Public Access Project (CPAP). Author and co-author information can include names, email addresses, phone numbers, and associated organizations. The PII that would be shared with CPAP will not include the phone numbers and it is not known yet whether the CPAP application will display author and co-author email addresses to the general public. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: 1. DOCS collects, maintains, and disseminates CDC content ranging from posters, articles, and books to web content supporting intranet sites. In the clearance portion of the system POC and reviewers names are collected along with author and co-author information that extends beyond just names. 2. This content is stored in DOCS as a system of record or it is stored there to be cleared so it is approved to be shared inside and/or outside of the CDC. Specific information such as POC, reviewers, author, and co-author are collected to enable routing of the content through clearance and give deserved credit to authors. 3 PII in the system includes names or the POC, reviewers, author and co-authors. The co-author information also includes email addresses, organization, and options fro entering phone numbers. 4. POC is an automatically captured field for any document. Author, POC, and reviewer names are mandatory for any documents being cleared. Co-author information is voluntary, but encouraged. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) 1. Authors are trained to receive and capture approval from co-authors prior to submitting content into the clearance system. Authors are trained that their name will be associated with the content as well. 2. Co-authors are aware that their names and e 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: The PII in the system is protected by role based access to content and metadata. The metadata is stored in the SQL Server database associated with the repository, and access to the SQL Server data is secured as well by role-based security. IIF Collected. E-Authentication Assurance Level = N/A Risk Analysis Date =04/16/09 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: May 11, 2009 Approved for Web Publishing: - Date Published: - _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCHIS NCPHI Health Alert Network (HAN) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: Initial PIA Migration to ProSight 1. Date of this Submission: CDC CCHIS NCPHI Health Alert Network (HAN) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-23-01-1020-00 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A - System does not constitute a "System of Records" under the Privacy Act. Information collected is on officials for emergency notification, and data are retrieved by role (position). See additional comments in Question 30. 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): Health Alert Network (HAN) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Calvin Hightower 10. Provide an overview of the system: In the event of Bioterrorism or other public health emergent event or response, the HAN Messaging System is utilized to broadcast information about the event, public health guidelines and recommendations, precautions, interventions, and other guidance. The Health Alert Network (HAN) Messaging System is a Microsoft Outlook-based email and broadcast fax system designed to rapidly distribute official CDC Health Alerts, Advisories, and Updates regarding Bioterrorism and other emergent threats to Public Health, operated and updated by Public Health Advisors (PHAs) in the Informatics and Knowledge Systems Branch, Division of Public Health Systems Development and Research, Public Health Practice Program Office, Centers for Disease Control, DHHS. Data contained within the system include email and fax distribution lists of Public Health officials at the state and local levels, specific CDC and HHS personnel, and contacts within 139 public health and private provider partner organizations, utilized to address and rapidly distribute HAN messages developed by subject matter experts (SME) throughout CDC. Since September 11, 2001, 165 Health Alert Network messages have been distributed on a Special, Regional or National basis. Information collected is on officials for emergency notification, and data are retrieved by role (position). 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): EPO, for use with Epi-X . To date, the CDC has not shared, and has no intention of sharing, the collected information outside the agency. The intent is to maintain the contact information of these Public Health officials within the HAN system, as part of the overall PHIN initiative. Within the agency, the information has only been shared with the Director's Emergency Operations Center, Epi-X, and the PHIN initiative. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: The HAN PHAs contact their assigned states to collect contact information, including Name, Title, Position, Email Address(s), Phone Number(s), Fax Number(s), Mobile/Wireless Contact, and Mailing Address for State Public Health Officials. The officials at the State level include the State Health Officer, State Epidemiologist, State Lab Director, State Weapons of Mass Destruction Coordinator, State Public Health Information Officer, and State Health Alert Network Coordinator, and in most cases, backups for each position. In addition, HAN PHAs also utilize a listing of local health officials provided by the National Association of City and County Health Officials (NACCHO) to distribute HAN messages to Local Health Departments, when recommended by the SME, the Office of the Director, or the Office of Communications. The collected information is input into the appropriate distribution lists within the Outlook-based system. The distribution lists are accessed and maintained ONLY by authorized personnel within the CDC HAN program, and is only shared with similar systems in CDC, specifically the Epidemiology Exchange (Epi-X) system and the Public Health Information Network (PHIN), for use in similar notifications of emergent health events. The distribution lists are not shared outside of CDC, or outside the auspices of the overall PHIN initiative. The data collected are required to meet the strategic and mission-critical goal of rapidly disseminating urgent CDC guidance and information to the Public Health officials responsible for the response to an emergent health event. In order to meet this goal, all of the data collected are necessary, yet minimal. The information is being collected to ensure that vital CDC information reach front-line Public Health officials during an emergency response or other emergent health event. In order to meet this goal, the HAN staff collects only the information needed to contact these officials as quickly as possible. The intent of the HAN Messaging System is to reach the primary recipients, listed above, within one hour of the moment a HAN message is initiated. It has been officially determined that the Privacy Act does not apply. Individual is in the system only because she/he is a health officer / health department director, etc. Information collected is on officials for emergency notification, and data are retrieved by role (position). No SORN is necessary, and there is no PIA weakness. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) There is no written process for notifying individuals or obtaining consent. The distribution lists are populated by the HAN PHAs, who obtain the information on State officials through their regular contacts within the State Health Departments assigned to 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): Yes 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Administrative Controls: To ensure least privilege and accountability, only trained/certified HAN staff are authorized to utilize the system. Technical Controls: User ID, passwords, firewall, smart cards. Physical Controls: Guards, ID badges, key cards, metal detectors, restricted messaging. The Health Alert Network Messaging system utilizes Microsoft Outlook which is part of the CDC enterprise infrastructure and therefore adheres to same security provisions for data & information contained in these systems. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Alice M. Brown Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Aug 15, 2007 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCHIS NCPHI National Electronic Disease Surveillance System (NEDSS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: Initial PIA Migration to ProSight 1. Date of this Submission: CDC CCHIS NCPHI National Electronic Disease Surveillance System (NEDSS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-21-01-1010-00 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A - System does not constitute a "System of Records" under the Privacy Act. 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): NEDSS - National Electronic Disease Surveillance System - Base System (NBS) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Wayne Brathwaite 10. Provide an overview of the system: NEDSS is designed as the next iteration of CDC's disease surveillance systems. The system will allow many of the current silo electronic surveillance systems to become part of an integrated, standards-based whole, an initiative strongly supported by OMB and Congress. NEDSS is part of the Public Health Information Network (PHIN). The specific system addressed in this summary is the CDC-developed iteration of NEDSS, called the NEDSS Base System (NBS). Most states have elected to utilize the NBS while some states have decided to develop their own system using the same data models and standards. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): n/a 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: CDC asks participating state health departments to collect a standardized set of variables for surveillance activities. The agency uses the information so that more meaningful conclusions can be drawn from the information because the variables represent the same items of information. This system does not collect personally identifiable Information. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) This system does not collect IIF 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: This system does not collect IIF. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Betsey Dunaway Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden, OCISO Sign-off Date: Aug 18, 2006 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCHIS NCPHI Outbreak Management System (OMS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: Initial PIA Migration to ProSight 1. Date of this Submission: CDC CCHIS NCPHI Outbreak Management System (OMS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-03-02-1088-00-110-218 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): 09-20-0136; 09-20-0113 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): Outbreak Management System 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Scott McNabb 10. Provide an overview of the system: During a public health investigation, the Outbreak Management System (OMS) will be utilized by field staff in order to accumulate, analyze, and report, data related to diseases outbreaks and emergency response in a consistent manner. Field staff will accumulate possible case, contacts, possible threats, facility, geospatial, specimen, prophylaxis, vaccination and other emergency response data. They will securely connect to corresponding systems developed at the CDC to store and present these data to public health emergency response decision makers. They will also facilitate field access to communication tools and CDC polices, protocols and other support information. 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): Yes 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): During a public health investigation, information in the system is shared with state/local partners in the jurisdiction where the persons reside or become ill. This information is only shared for the purposes of outbreak investigation and containment and only in conjunction with activities supporting the state/local partners. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: Personally identifiable information collected is used only for purposes of outbreak investigation and containment. Some follow up studies may be done on data in the system but these studies are done using de-identified data unless specific IRB approvals are attained. The Outbreak Management System is only used during a public health investigation. Personally identifiable information is collected to track cases and contacts during a disease outbreak investigation and follow-up to an outbreak. Information in the system is cleared from the database when investigation is completed. Field staff will accumulate possible case, contacts, possible threats, facility, geospatial, specimen, prophylaxis, vaccination and other emergency response data. Submission of personal information is voluntary at the time of the outbreak. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) The information will only be obtained in a public health investigation by public health investigators. Information collection and notification of persons will vary based on state and local laws and the circumstances of the outbreak investigation. If foll 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): Yes 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Administrative Controls: To ensure least privilege and accountability, user name and password and access control views on data tables. Technical Controls: User ID, passwords, firewall, encryption. Physical Controls: Guards, ID badges, key cards. System information is stored in a Microsoft SQL server database with user level authentication and authorization constraints in place. This database is self-contained on remote hardware without a persistent connection to the Internet. Since the system is field deployed, file level encryption protects the database files from unauthorized access. Information exchanged is secured via encrypted transmissions using public/private key encryption. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Betsey Dunaway Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Deborah Holtzman Sign-off Date: Aug 18, 2006 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCHIS NCPHI Public Interactive Communication System (PICS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCHIS NCPHI Public Interactive Communication System (PICS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): None 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): None 7. System Name (Align with system Item name): Public Interactive Communication System (PICS) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Robert Swain 10. Provide an overview of the system: The Public Interactive Communication System (PICS) is being created to host collaborative open source applications to interact with partners and the general public. The initial application on PICS will be blogging software, which will create another communication channel for the CDC. 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): N/A 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: Collect: IP addresses of external contributers – Applications like blogs will allow users to submit comments. IP addresses will be captured with the comments. Collect: User supplied data – Comments captured by the system will contain any information that the user chooses to submit, however comments will be moderated and the ROB will instruct moderators to reject any comments that contain PIA. Disseminate: Comments – Once approved, comments will be shown to the public. None of the above information contains IIF. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) N/A 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: N/A No IIF Collected. E-Authentication Assurance Level = N/A Risk Analysis Date =05/01/2009 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: May 25, 2009 Approved for Web Publishing: - Date Published: - _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCHIS NCPHI Secure Data Network (SDN) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: Initial PIA Migration to ProSight 1. Date of this Submission: CDC CCHIS NCPHI Secure Data Network (SDN) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-02-02-0581-00-404-140 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): 09-70-0538 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): Secure Data Network (SDN) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Toby Slusher 10. Provide an overview of the system: SDN provides secure data exchange infrastructure for CDC. The SDN is a set of tools implementing the policy requirements for authentication using industry standard X.509 certificates, secure tokens, and other applicable means as identified; an encryption engine; and access control through the firewall by data routing to programs using an application server. This network is intended to allow field staff, researchers, and public health partners to securely exchange confidential, Privacy Act, proprietary and other sensitive or critical data with Center/Institute/Office (CIO) programs. The SDN also provides secure access to critical CDC/ATSDR Internet tools, program applications software and sensitive or critical data resources that can be conveniently implemented by CIO programs. SDN is the online or web hosting system that provides secure access to the CDC Extranet and other secure applications. This system does not constitute a "System of Records" under the Privacy Act because only business information is contained within the CDC system. Although information is retrievable by name, consideration is given to the role the individual will play, i.e., user of sensitive information. 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): Yes 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): The data will be shared with VeriSign to issue Digital Certificates for user enrollment, after which it is deleted. At CDC the information is kept in an encrypted SQL database accessible to only 4 staff. No IIF information is shared between SDN client programs. The SDN Agency Certificate Administrator sends the appropriate CDC SDN Program Administrator notification of applicants approved for digital certificates for the respective programs. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: System collects IIF: the name, business contact information, employer & type, and unique digital user key for users enrolled with an SDN account. The agency will collect minimum PII sufficient to perform identity verification and binding to identity devices of SDN enrollees, and establish uniqueness of SDN users for authentication and authorization. The information is voluntarily submitted, but required for system access to be authorized. It has been officially determined that the Privacy Act does not apply, and there is no SORN needed. System contains IIF, but it is business contact information. While information is retrievable by name, primary consideration is given to the role the individual will play as a user of sensitive information. Thiere is no potential weakness. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) The data being collected will be obtained from the SDN enrollee (self-identification). During the enrollment process, SDN enrollees are informed of the required and non-required information, and the use of that information (for identity binding). An agree 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): Yes 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Administrative Controls: Security controls manage access to data at system and application level. Technical Controls: Firewall, IDS, PKI; The data collected is secured via application, database, network, and server control mechanisms including user ID and password, digital certificates, encryption during transport and storage, and physical restrictions for access to infrastructure components. Physical Controls: Guards, ID badges, key cards. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Alice M. Brown Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden, OCISO Sign-off Date: Aug 15, 2007 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCHIS NCPHI Specimen Tracking and Results Reporting System (STARRS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? No If this is an existing PIA, please provide a reason for revision: PIA Validation 1. Date of this Submission: CDC CCHIS NCPHI Specimen Tracking and Results Reporting System (STARRS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-02-02-1081-00-110-218 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A - System does not constitute a "System of Records" under the Privacy Act. 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): Specimen Tracking and Results Reporting System (STARRS) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Emory Meeks 10. Provide an overview of the system: STARRS tracks specimens, exchange specimen data, and reports test results. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): N/A 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: N/A 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) N/A 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: N/A No IIF Collected. E-Authentication Assurance Level = 2 Risk Analysis Date = 5/28/2008 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Mike Harris Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden, OCISO Sign-off Date: Oct 27, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCHIS NCPHI Web Public Web Portal PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? No If this is an existing PIA, please provide a reason for revision: PIA Validation 1. Date of this Submission: CDC CCHIS NCPHI Web Public Web Portal 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-23-01-1015-00 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): None 5. OMB Information Collection Approval Number: None 6. Other Identifying Number(s): None 7. System Name (Align with system Item name): Public Web Portal (PWP) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Robert Swain 10. Provide an overview of the system: PWP is a general support system (GSS) which hosts CDC static web sites and externally facing Java-based applications. The PWP also provides functionality such as search, printer friendly version, and content syndication. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): N/A 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: The public web portal collects no information directly from the user except for terms used to search within the content. Search terms are not IIF. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) N/A 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: The public web portal collects no information directly from the user except for terms used to search within the content. Search terms are not IIF. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden, OCISO Sign-off Date: Mar 23, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCHIS NCPHI Wide-ranging Online Data for Epidemiological Reseach System (Wonder) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? No If this is an existing PIA, please provide a reason for revision: PIA Validation 1. Date of this Submission: CDC CCHIS NCPHI Wide-ranging Online Data for Epidemiological Reseach System (Wonder) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-02-02-1010-00-110-246 (009-20-01-21-01-1010-00) 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A - System does not constitute a "System of Records" under the Privacy Act. 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): WONDER 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Sigrid Economou 10. Provide an overview of the system: The CDC WONDER system provides data dissemination and web-based analysis, visualization and reporting for scientific datasets (collections) produced by CDC programs and partners. Access to information, summary statistics and micro-data is provided to the general public, public health policy makers and analysts, epidemiologists and researchers. The data collections on the public web site are public use data. No user accounts or registrations are required to access the public use data or public web site. The web site and data collections are relied on by state, local and community health programs, and CDC programs and partners for publication of these data collections, data sharing and analysis. An average of 20,000 persons, measured as "distinct hosts" or unique computer addresses, access the web site each week. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): N/A 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: The CDC WONDER system does not collect data. CDC WONDER does maintain and disseminate public use data collections. CDC WONDER maintains these data collections at the direction of the data steward for each collection. The data stewards for each data collection ensure privacy issues are met before release, that all information in identifiable form (IIF) or personal identifiers such as names, health record numbers, locations below the county level, birth or death dates are removed from the data before the data are submitted for inclusion in the CDC WONDER system. CDC WONDER receives regular updates to the data collections, some datasets are updated weekly, some annually. Previous data releases are available as “archive” data. The data are disseminated on a public web site. The CDC WONDER web-based software provides data query access, summary statistics, micro-data extracts and visual analysis tools. The data are used for analysis and evidence-based public health practice, by CDC programs and partners, public health analysts, epidemiologists and researchers. The CDC WONDER system is used to facilitate data sharing and data dissemination. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) N/A 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: N/A PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: David Knowles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden, OCISO Sign-off Date: May 6, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCHP NCCDPHP ExPOSE PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: Conversions 1. Date of this Submission: CDC CCHP NCCDPHP ExPOSE 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): ExPOSE 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Robert Swain 10. Provide an overview of the system: ExPOSE is an environment for external facing, public, web-based applications and has been set up specifically to support open source collaborative tools 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): N/A 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: The ExPOSE system is a GSS and has no client facing pieces. It will not collect, maintain, or disseminate any information. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) N/A 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: There is no IIF information Collected or maintained. No IIF collected EAAL = N/A Risk Analysis Date = April 10, 2009 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Mike Harris Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Aug 19, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCCDPHP Pediatric Nutrition Surveillance System - (PEDNSS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCCDPHP Pediatric Nutrition Surveillance System - (PEDNSS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 09-20-01-03-02-9121-00 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): ‘The PII collected is exempt due to It being N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): Pediatric Nutrition Surveillance System (PedNSS) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Karen Dalenius 10. Provide an overview of the system: The PedNSS collects clinic data for children <20 years of age, primarily for children age <5 years, from state, territorial and Indian Tribal Organizations WIC program around the country; logs incoming files and performs extensive editing on the file records; produces data quality reports detailing the results of the edits and transmits those reports back to the contributors; merges the edited data into master files in a SQL Server data warehouse; and produces and publishes statistical reports, graphics/maps based on aggregated data from the data warehouse. Locate a system overview on our website at http://www.cdc.gov/pednss. We use the term “contributor” to refer to the state and territorial health departments and Indian Tribal Organizations (ITS’s) that submit data to the PedNSS. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): The system shares IIF only with an original PedNSS contributor when that contributor requests copies of their cleaned and edited files. If non-contributors request PedNSS records, the following fields are stripped from the files: State and Substate, Clinic code, Date of Visit, Date of Birth and ID. If a non-contributor needs one or more of these fields on the PedNSS files, they must obtain written permission from the contributor(s) whose records they are requesting. Identifiers are almost always stripped at the request of contributors. Under FOIA requests, we cannot make sharing of data contingent upon obtaining permission from the contributor. However, FOIA does protect personal privacy interests. Data that are identifiable to a specific individual are protected from disclosure. In the event of a FOIA request for data, we strip the following identifying information from the records prior to distribution to a requesting non-contributor: Clinic Code and Identifier. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: The following critical and core fields are currently populated on most PedNSS records and/or have been populated on PedNSS records in the past: State Code, Substate Code, Clinic/School Code, County Code, Source of Data, Record Type, Date of Visit, Child’s Alphanumeric Identifier, Date of Birth, Sex, Race/Ethnicity, Household Size, Household Income, Birthweight, Height, Weight, Date of Height/Weight Measure, Hemoglobin, Hematocrit, Date of Hemoglobin/Hematocrit Measure, Currently Breastfed, Ever Breastfed, Length of Time Breastfed, and Date of Most Recent Breastfeeding Response. The following supplemental fields are currently populated on most PedNSS records and/or have been populated on PedNSS records in the past: Zip Code, Migrant Status, WIC/Food Stamp/Medicaid/TANF Participation, Introduction to Supplementary Feeding, TV Viewing, Household Smoking, Cholesterol, and FEP. CDC uses this information to monitor trends in the prevalence of growth and nutrition-related health problems in children, and to provide summary data to contributors to assess coverage, targeting, and effectiveness of pediatric health programs. State Code, Substate Code, Alphanumeric Identifier, and Date of Birth fields are referenced by CDC to create annual unique child files ensuring that only one record per child is included in annual PedNSS report analyses. DNPAO epidemiologists and statisticians also create and manage cohorts of children for PedNSS longitudinal analyses in reference to identifiers. DNPAO epidemiologists also create and manage cohorts of children for longitudinal analyses in reference to identifiers. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) PedNSS records are submitted by state, territorial, and Indian Tribal Organization WIC programs, Medicaid (EPSDT) programs, and state MCH programs, all of which require informed consents to be signed by participants upon program enrollment. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Access to the PedNSS database is governed through an assigned GP-DN-ro group managed by the NCCDPHP SQL database administrator, Terrine Mathews, with input from our team. This group is limited to Data Systems and Surveillance Team members and about eight DNPAO epidemiologists and statisticians. Data team members have the ability to add and backout files from the database. The epidemiologists and statisticians access the database to download files for their research purposes. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Michael W. Harris Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: May 8, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCHHSTP Capacity Building Assistance Reports (CBA Reports) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCHHSTP Capacity Building Assistance Reports (CBA Reports) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): The PII collected is exempt due to It being business PII 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): Capacity Building Assistance Reports (CBA Reports) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Rashad Burgess 10. Provide an overview of the system: CBA Reports provides user and administrative reports for both the CRIS and GEMS systems. CBA Reports does not store any data with the system, but rather pulls the data from CRIS and GEMS and compiles it into reports. It has a report wizard where the users can design their own reports and choose the criteria that will be included in the reports. CBA Reports has the capability to produce data for management level quarterly reports. 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Name and contact information will be shared with Capacity Building Assistance Providers who will be providing assistance. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: It displays reports that reflect the requests entered in the CRIS system. It reports info number of request for Focus Area 1, or number of request with status of Active, or number of requests for an organization. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) None 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Business IIF Collected. E-Authentication Assurance Level = N/A Risk Analysis Date = 12/01/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Dec 11, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCHHSTP Division of TB Elimination Image Library - (DTBE Image Library) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCHHSTP Division of TB Elimination Image Library - (DTBE Image Library) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: N/A 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): DTBE Image Library 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Maria Fraire 10. Provide an overview of the system: A central storage and retrieval system for current and historical TB –related digital images for DTBE. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): No IIF or any other information 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: No IIF or any other information 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No IIF or any other information 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): Yes 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: No IIF is collected. CDC approved User ID’s and passwords are used to access privileged areas of this system. E-Authentication Assurance Level = N/A Risk Analysis Date = 6/18/2008 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Michael Harris Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jul 15, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCHHSTP Grants Central Station System for Analysis of Intramural and Extramural Funds - (SAIEF) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCHHSTP Grants Central Station System for Analysis of Intramural and Extramural Funds - (SAIEF) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: (FY08) 009-20-01-01-02-1000-00 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): No 5. OMB Information Collection Approval Number: No 6. Other Identifying Number(s): No 7. System Name (Align with system Item name): GCS (Grants Central Station) Saief360 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Nancy Haban 10. Provide an overview of the system: Saief360 is used throughout the Agency by CIO’s and Divisions to effectively manage its financial resources. The system is used to provide a common system for tracking extramural funds. Saief360’s Extramural module tracks the funding of projects using the most commonly mechanisms i.e. contracts, announcements, memorandums of agreement etc. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): No 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: Saief360 will contain information pertaining to - CAN Code - Doc no - Admin code - Announcement Name - Announcement Number - Grantee Name (organization name) - Grant Year - Budget Year - Award number - Contract no - Contract Master title - Contractor Name (company name) - Option Date - Contract Year - contract mod number - MIM No [Memoranda of Understanding (MOU), Interagency Agreements (IAG), and Memoranda of Agreement (MOA)] - MIM title - Program - Transaction type - CAN - Cost Center - Allowance - Project code - Budget activity - Description This application does not contain IIF. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) This application does not contain IIF. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: This application does not contain IIF. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Michael W. Harris Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: May 19, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCHHSTP Group Event Management System - (GEMS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? No If this is an existing PIA, please provide a reason for revision: PIA Validation 1. Date of this Submission: CDC CCID NCHHSTP Group Event Management System - (GEMS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-02-00-02-9509-00 N/A 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): The PII collected is exempt due to the business PII 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): Group Event Management System (GEMS) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Rashad Burgess 10. Provide an overview of the system: The GEMS mission is to enable the Capacity Building Branch (CBB) to reduce the manual administration of training efforts that are aimed towards increasing the capacity of health departments and community based organizations to deliver HIV prevention intervention. The GEMS web-based application will be launched from the Capacity Building Assistance Portal (CBAP) bringing together CDC employees, Capacity Building Assistance (CBA) providers, directly funded Community Based Organizations (CBO) and Health Departments to a single online gateway to access CBA resources. CBAP is located at the following web site: http://wwwdev.cdc.gov/hiv/cba/default.htm. GEMS currently consists of two functional areas: a training calendar enabling registrants to register for events and coordinators to post and un-post events, and a profile management center enabling registrants to submit business contact information to create and modify their own profiles. GEMS Training Calendar events are posted to GEMS by the Calendar Coordinator. Training is offered by the CBB Training and Development (T&D) team. This team provides logistics, instructors, and technical assistance. GEMS registrants can complete event registration requests, which are received by the system and placed on the course roster or waitlist according to programmed business rules. The system sends an email confirmation of enrollment to the registrant. The system will also provide analytical and transactional reporting. A highlight of GEMS essential system functions are as follows: • Maintain training calendar • Register for events • Issue completion certificates • Submit events • Generate reports • Administer the system 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Name and contact information of organization employees will be shared with Capacity Building Assistance Providers who will be conducting the class for which the person is registered. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: System collects the business address of the organization the person is employed by and uses it to send course completion certificates after course completion. The system does not collect any personal information. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) N/A 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): Yes 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: There is no personal information collected therefore no special security is needed. Data is stored in a SQL database which is accessible only via the application. Only those with admin rights in GEMS can access the information. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Michael W. Harris Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: May 19, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCHHSTP Hepatitis Experimental Primate System (HEPS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCHHSTP Hepatitis Experimental Primate System (HEPS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-05-02-9122-00 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): Hepatitis Experimental Primate System (HEPS) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Kris Krawczynski, MD, PhD 10. Provide an overview of the system: HEPS is a CDC Intranet web application in Experimental Pathology Laboratory (EPL), Division of Virual Hepatitis (DVH), NCHHSTP, CDC. It helps EPL technologists and supervisors to collect, manage, analyze and report animal (mainly primate) hepatitis experimental data. The information includes when and from where the animal is received at CDC, its date of retirement, basic health information, physical and physiological measurements, clinical serologies, liver function assays, In-House PCR results and sample storage info. Study protocols are documented in the online system. All the information stored in the database can be retrieved in a number of ways. The HEPS system also interfaces with the DMS to allow orders for serological testing on an animal's serum, and the retrieval of test results 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): N/A 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: No (No sensitive info collected) 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No (No sensitive info collected) 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: N/A PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Michael Harris Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Aug 5, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCHHSTP HIV/AIDS Reporting - (HARS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCHHSTP HIV/AIDS Reporting - (HARS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-02-02-9122-00 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): HIV/AIDS Reporting System (HARS) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Sam Costa 10. Provide an overview of the system: HARS is a multipurpose surveillance system designed to monitor the total number of reported HIV/AIDS cases from public, private, and government reporting facilities. This surveillance system monitors the total number of AIDS cases reported in the 50 States, DC, six separately funded cities, US territories and possessions, and HIV cases in States that require reporting of persons with HIV (not AIDS) . The database is cumulative, containing all case reports since 1981 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): No 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: Public health data only. Case reports are received from providers who voluntarily report to the local surveillance program by phone with a surveillance representative completing the case report form and from surveillance representatives who abstract medical records in hospitals and private physicians’ offices to complete the case report form. Data is either manually entered or imported into HARS at the state or local level. Data is transferred to CDC monthly through the filtering of new and updated records. The transfer process removes identifying information (IIF) from the transfers, encrypts the file using SEAL and submits to CDC through the use of the Secure Data Network (SDN) file upload procedure. CDC produces national datasets quarterly, which are used to produce the annual national HIV/AIDS surveillance report, as well as numerous other epidemiological analyses. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) None 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: DOB only IIF within datasets. Access to the network is controlled with standard CDC IT security policies. Additionally, datasets are secured on a secure data store with limited user rights. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Michael W. Harris Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: May 27, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCHHSTP MDR/XDR PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCHHSTP MDR/XDR 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CCID NCHHSTP MDR/XDR 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Jose Becerra 10. Provide an overview of the system: The MDR/XDR application is an internal web-based application designed to provide for the current and upcoming needs for the MDR/XDR Taskforce to gather information and track all instances of MDR/XDR in the United States. This includes verification of known cases identified within the Tuberculosis Information Management System (TIMS), identification of unknown cases not reportable through TIMS, and ultimately a complete system to maintain these cases and the data associated with them. 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): The information is shared between State Health Agencies and the CDC for statistical analysis purposes. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: Case Information Date Reported Reporting State State Case Number Year Count status Date counted State Country Demographics Date of Birth Age at report Ethnicity Race Sex Origin of birth Country of origin Race (subgroup) Previous TB History Previous TB Previous TB year Patient Move History Did the patient move during therapy (y/n) Vital Status at diagnosis (dead/alive) If moved, state whether in state/out of state, out of US Transient referral active case when moved (y/n/) Risk Factors HIV Status Resident at correctional facility (y/n/) Correctional facility Resident of long-term care facility (y/n) Long term care facility Primary occupation Injecting drug use Non-injecting drug use Excess Alcohol use Drug Treatment Information Date therapy started Date therapy stopped Reason Initial drug regimen Select type of drug/regimen General comments Drug Susceptibility Testing (DST) Results Detail DST test results Sputum Culture Results Detail Sputum collection date Sputum Smear Results Sputum Culture results time to convert Tissue Culture Results Detail Collection date Anatomic code Chest Radiograph or Other Imaging Results Detail MDR/XDR Id Collection date Type Results This information contains IIF. Submission is mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No process in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: IIF Collected = yes E-Authentication Assurance Level = N/A Risk Analysis Date = 11/20/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Dec 18, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCHHSTP Public Health Advisor Staff Tracking (PHAST) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCHHSTP Public Health Advisor Staff Tracking (PHAST) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): 09-90-0018 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CCID NCHHSTP Public Health Advisor Staff Tracking (PHAST) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Audriene Bishop-Cline 10. Provide an overview of the system: This is NOT a web-based application. Internal Client-Server PHAST electronically stores personnel information of NCHHSTP public health field staff. Information collected includes current assignments, education credentials, demographics, training history, personnel action history and contact information. The Workforce Development Unit (WDU) uses the system as its primary source of emergency contact information. Divisions and NCHSTP/OD use it to plan training strategies, track personnel actions, answer questions that arise about assignments, generate personnel reports and create mass mailing lists. The Phast database includes names, date of birth, personal/work address, and phone. This data is only transmitted and used by designated CDC personnel. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): Yes 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): N/A 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: This applications contains the following data fields: - Name - Date of birth - Gender - Race - Position start date - Division - FTE number - Duty Date - Service comp date - Mailing address - Work Phone - Home Phone - Education - Training history - Emergency contact - International contact info Information contains PIF. Submission is voluntary 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Administrative Controls: The IIF will be secured by logical access controls. Technical controls: User ID, Passwords, firewall, encryption, IDS, CAC. Physical controls: Guards, ID badges, key cards. IIF= Collected E-Authentication Assurance Level = N/A Risk Analysis Date = 8/18/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Michael W. Harris Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Sep 10, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCHHSTP Sisters Empowered Sisters Aware - (SESA) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCHHSTP Sisters Empowered Sisters Aware - (SESA) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-01-02-1000-00 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): Sisters Empowered, Sisters Aware (SESA) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Lisa Kimbrough 10. Provide an overview of the system: Sisters Empowered, Sisters Aware (SESA) is a project designed to increase the number of African American women who know their HIV status (it is an HIV testing project). The project involves the evaluation of four HIV testing strategies designed to locate women with undiagnosed infection. The SESA data collection system is a client/server application developed in C#.NET with Microsoft SQL server 2005 as backend. The system contains client-level demographic, testing strategy, and counseling/ testing/referral (CTR) data. The system will also collect data pertaining to cost-effectiveness analysis and allow site managers to run queries and reports that summarize data associated with a specific time period. 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): No 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: HIV CTR, demographic, testing strategy, and cost-effectiveness data; does not contain any IIF. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: No PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Michael W. Harris Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: May 8, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCHHSTP STuberculosis Trials Consortium Client Server - (TBTC CS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCHHSTP STuberculosis Trials Consortium Client Server - (TBTC CS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-05-02-9122-00 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): No 5. OMB Information Collection Approval Number: No 6. Other Identifying Number(s): No 7. System Name (Align with system Item name): Tuberculosis Trials Consortium Client Server (TBTC CS) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Lorna Bozeman 10. Provide an overview of the system: The function of the application is to store study data for the clinical trials done by the TB Trials Consortium. The TB Trial consortium is a group of hospitals/research institutions/academic institutions funded by CDC to carry out trials for treating TB patients with new drugs. The applications also provide other modules which facilitate drug distribution, manage drug inventory levels and/or reorder drugs for the trial sites in a timely fashion. Some other reports like labels, patient visit schedules, patient enrollment count at different sites and reports for missing data are also generated 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): No 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: No 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: No PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Michael W. Harris Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: May 8, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCHHSTP Tuberculosis Epidemiologic Studies Consortium Data Management and Communications System - (DMACS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCHHSTP Tuberculosis Epidemiologic Studies Consortium Data Management and Communications System - (DMACS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-02-02-9122-00-110-246 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): DMACS 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Jose Becerra 10. Provide an overview of the system: The Division of Tuberculosis Elimination (DTBE) of the Centers for Disease Control and Prevention (CDC) established the Tuberculosis Epidemiologic Studies Consortium (TBESC) in order to strengthen, focus, and coordinate tuberculosis (TB) research. The TBESC is designed to build the scientific research capacities of state and metropolitan TB control programs, participating laboratories, academic institutions, hospitals, and both non- and for-profit organizations. It operates within an environment that fosters creative and open intellectual input. The research agenda is developed through a process of mutually negotiated scientific and programmatic peer review. It is guided by a national, comprehensive research agenda responsive to the Institute of Medicine’s (IOM) report, Ending Neglect: The Elimination of Tuberculosis in the United States (2000), (http://www.cdc.gov/nchstp/tb/pubs/iom/iomresponse/toc.htm), and DTBE’s priorities. The Data Management and Communications System (DMACS) is developed to support the TBESC mission and help data collection to the centralized database. 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): System does not have IIF 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: Tuberculosis Epidemiology Studies Consortium (TBESC) enter unidentifiable participant information into DMACS. IIF is not collected or contained in the DMACS. Submission is voluntary and is a means to collect research data. The data collected is analyzed by study principal investigators (PI) and for participating sites. The research entails extensive data collection that requires effective data management, communication, and analysis. A cost-benefit analysis (CBA) report recommended implementing a web-based data management and communications system using Java technology. DMACS will collect data based on the study objective identified by the protocol. For example, in one of the studies participants’ current demographics, background, country of origin, care seeking behavior for treating TB, symptoms, history of past TB testing and other variables related to a person’s susceptibility to TB and ability to navigate the medical care system will be collected. This information will be used to identify new opportunities to prevent transmission and improve TB testing and treatment among foreign born persons. DMACS users are required to enter user name and password in order to access the system. The entered information is authenticated. The user name and password are based on strict security guidelines as defined by CDC and other industry standards (the majority of end-users are not CDC employees). DMACS is a role based system, i.e., the system grants users access to information and data based on their role and not on their individual identity. Users are assigned a role or multiple roles e.g. Data Entry, Quality Assurance (QA), Principal Investigator (PI). Based on the role name, users may have access or may be restricted from viewing, using or altering specific data. For example, within DMACS, the Site QA role allows a user to review the patient record to identify data errors but not to modify it. Modification or corrections can only be made by the Data Entry role. Data collected is entered with a participant number, The data once entered into DMACS cannot be associated to any IIF as the face sheet (in the paper questionnaires) which collects personal information is destroyed by the site. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) NO IIF is Collected 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: No IIF is Collected PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Alice M. Brown Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas. P. Madden Sign-off Date: Oct 30, 2007 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCHSTP HIV Program Evaluation Management System Revision 3.0 - (PEMS R 3.0) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? No If this is an existing PIA, please provide a reason for revision: Initial PIA Migration to ProSight 1. Date of this Submission: CDC CCID NCHSTP HIV Program Evaluation Management System Revision 3.0 - (PEMS R 3.0) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-21-01-02-02-1260-00-110-246 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: 0920-0696 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC HIV Prevention Program Evaluation and Monitoring System Revision 3.0 (PEMS R3.0) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Tim Quinn 10. Provide an overview of the system: The primary purpose of PEMS is to provide a standardized data collection, analysis, and reporting tool for CDC HIV prevention program grantees. State and local governmental agencies, as well as the CDC, will use the data from PEMS for program monitoring and evaluation. Also community-based organizations (CBOs) and state and local health departments funded by CDC will use PEMS to report on HIV prevention activities they are funded to implement. PEMS will improve the ability of CDC-funded health departments and CBOs to collect and report HIV prevention program data. Data collected and reported via PEMS will be used to report on newly developed program performance indicators. These indicators will be used by CDC to monitor and report on the domestic HIV/AIDS prevention program. The use of PEMS and the data it will provide will be used to address deficiencies found using the Program Assessment Rating Tool (PART) by the Office of Management and Budget (OMB). The managers of these organizations and agencies along with federal project officers will use the data to improve programs and to monitor and assess the effects of the HIV prevention programs and any modifications. The focus of PEMS is to provide the data necessary to analyze and assess the processes and effects of HIV prevention programs. This data will help CDC to promulgate best practices, redesign interventions that are inefficient or not effective in reducing risky behaviors that could result in HIV infection, and to identify grantees that need assistance to better deliver effective prevention services. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): PEMS Does not share or disclose IIF 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: PEMS Collects both client information and partner information. The list of variables in PEMS includes: Encrypted Variables: Name, Date of Birth, Physical description, Address, Phone numbers, Occupation and Employer, Local Client Unique ID. Unencrypted Variables: Local Client ID, and Local PCRS IS. Although the system collects the Names of Individuals, ONLY: Year of Birth, Local Client ID and Local PCRS ID are accessible by the CDC, all other IIF is Encrypted. The Data that is being collected in PEMS will be used to evaluate HIV Prevention Programs that are funded by the CDC. The Data collected from Grantees is not mandatory, but if the required Data is not furnished there may be consequences to grantees in terms of future CDC funding availability. NO IIF data is required to be submitted by grantees to the CDC The IIF contained in this system is unavailable due to encryption. It has been officially decided that the Privacy Act is not Applicable and NO SORN is necessary. Therefore there is NO PIA WEEKNESS 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) The Owners of the Data (Grantees at the local level) will be notified if there are major changes to the system. Grantee agencies obtain informed consent from each individual before collecting data at the local level. It is their responsibility to inform i 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): Yes 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Administrative Controls: Digital Certificates (Only grantee sites owning data have the ability to un-encrypt), data confidentiality agreements. Technical Controls: User IDs, Passwords, Firewall, IDS, PKI, Digital Certificates, and SSL Encryption, Physical Controls: Guards, ID Badges, Key Cards, and CCTV. The PEMS Application will use Secure Socket Layer (SSL) between web-browser clients and the web server that accepts data from users. Additional SSL sessions secure data between the web server, the application server and the database server. Each of these sessions employs the same type of encryption used by all major financial services and electronic commerce sites today. PEMS R 3.0 also supports persistent encryption of specific data variables (identified as sensitive by the CDC) using 3DES algorithm. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Alice M. Brown Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Dec 19, 2007 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCID Electronic Disease Notification (EDN) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? No If this is an existing PIA, please provide a reason for revision: Conversions 1. Date of this Submission: CDC CCID NCID Electronic Disease Notification (EDN) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): 09- 20 - 0136 5. OMB Information Collection Approval Number: 1405-0113 6. Other Identifying Number(s): No 7. System Name (Align with system Item name): Electronic Disease Notification (EDN) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Michelle Weinberg 10. Provide an overview of the system: CDC assists state health departments and overall public health through an application called Electronic Disease Notification (EDN). Immigrants and refugees entering the United States are required by law to possess certain U.S. Department of State medical screening information and documentation as part of a visa request. Upon arriving at various U.S. points of entry, these immigrants and refugees provide medical information based on oversees examinations to customs and immigration officials on any of several health related conditions that may exist. The purpose of EDN is to document these health conditions and provide the case to the destination state health department for further follow up and tracking. The current EDN version replaces an earlier beta testing version and manual mail and entry process. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): Yes 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): No 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: Immigrants and refugees will provide medical information based on oversees examinations to customs and immigration officials on any of several health related conditions that may exist. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Role-based security, digital certificates, and passwords IIF Collected = Role-based security, digital certificates, and passwords E-Authentication Assurance Level = 2 Risk Analysis Date = 11/28/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Dec 12, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCID National Molecular Subtyping Network for Foodborne Disease Surveillance (PulseNet) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? No If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCID National Molecular Subtyping Network for Foodborne Disease Surveillance (PulseNet) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-02-02-0172-00-110-219 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): No 5. OMB Information Collection Approval Number: No 6. Other Identifying Number(s): No 7. System Name (Align with system Item name): CDC CCID NCZVED National Molecular Subtyping Network for Foodborne Disease Surveillance (PulseNet) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Peter Gerner-Smidt 10. Provide an overview of the system: PulseNet is a national network of public health and food regulatory agency laboratories coordinated by the Centers for Disease Control and Prevention (CDC). The network consists of: state health departments, local health departments, and federal agencies (CDC, USDA/FSIS, FDA). PulseNet participants perform standardized molecular subtyping (or “fingerprinting”) of foodborne disease-causing bacteria by pulsed-field gel electrophoresis (PFGE). PFGE can be used to distinguish strains of organisms such as Escherichia coli O157:H7, Salmonella, Shigella, Listeria, Campylobacter, Vparahaem, Vcholerae or Ypestis at the DNA level. DNA “fingerprints,” or patterns, are submitted electronically to a national database at CDC. These databases are available on-demand to participants—which allows for rapid comparison of the patterns. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): No 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: DNA fingerprint and associated demographic information. No IIF. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: No IIF Collected E-Authentication Assurance Level = 2 Risk Analysis Date = 11/14/2008 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Dec 2, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCID Public Health Laboratory Information System (PHLIS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: Initial PIA Migration to ProSight 1. Date of this Submission: CDC CCID NCID Public Health Laboratory Information System (PHLIS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-06-02-2045-00-110-246 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A - System does not constitute a "System of Records" under the Privacy Act. 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): PHLIS - Public Health Laboratory Information System 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: E. Kathleen Maloney 10. Provide an overview of the system: PHLIS collects public health laboratory surveillance data from approximately 100 sites in the U.S. Data screens (modules) can be created and updated then rapidly distributed to all reporting sites electronically without programmer involvement. Reporting sites can enter public health surveillance data and report it electronically. The system allows sites to set up and run imports which allow them to collect data from their LIMS systems. PHLIS provides the capacity for a hierarchical reporting scheme involving data transmission to multiple, successively higher reporting levels, and ultimately to a single central site. PHLIS allows sites to create their own questions and modules for their own independent disease surveillance activities. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): System does not contain IIF, so no IIF is shared or disclosed 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: System does not collect IIF. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) The system does not collect, maintain (store), disseminate and/or pass through IIF within any database(s), record(s), file(s) or website(s) hosted by this system 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: The system does not collect, maintain (store), disseminate and/or pass through IIF within any database(s), record(s), file(s) or website(s) hosted by this system PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Betsey Dunaway Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden, OCISO Sign-off Date: Aug 18, 2006 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCIRD Active Bacterial Core Surveillance (ABC) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? No If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCIRD Active Bacterial Core Surveillance (ABC) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-02-02-9721-00 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): System does not constitute a “system of records” under the Privacy Act. Data is not retrieved by name, SSN or other unique identifier. 5. OMB Information Collection Approval Number: 0920-0009 6. Other Identifying Number(s): No 7. System Name (Align with system Item name): Active Bacterial Core surveillance (ABCs) Active Bacterial Core surveillance (ABCs) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Carolyn Wright 10. Provide an overview of the system: ABCs is an active, population- and laboratory-based surveillance system conducted in ten Emerging Infections Program sites (EIPs): California, Colorado, Connecticut, Georgia, Maryland, Minnesota, New Mexico, New York, Oregon, and Tennessee. Surveillance is conducted for invasive bacterial diseases due to pathogens of public health importance. For each case of invasive disease in the study population, a case report with basic demographic information is completed and, in most cases, bacterial isolates from a normally sterile site from patients are sent for further laboratory characterization. ABCs data are used to determine the incidence and epidemiologic characteristics of invasive disease due to the pathogens under surveillance and to provide an infrastructure for further research, such as special studies aimed at identifying risk factors for disease, post-licensure evaluation of vaccine efficacy, and monitoring effectiveness of prevention policies. Data originates at the state level and aggregate, de-identified data is sent to CDC. Data are not retrieved by any unique identifier. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Aggregate data are shared in electronic form with other divisions within CDC for the purpose of generating reports and manuscripts. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: For each case of invasive disease in the surveillance population, a standard case report form with basic demographic and clinical information is completed. These data are used to determine the incidence and epidemiologic characteristics of invasive disease due to Haemophilus influenzae, Neisseria meningitidis, group A streptococcus, group B streptococcus, Streptococcus pneumoniae, and methicillin-resistant Staphylococcus aureus in several large populations; to determine molecular epidemiologic patterns and microbiologic characteristics of public health relevance for isolates causing invasive infections from select pathogens; to provide an infrastructure for further research, such as special studies aimed at identifying risk factors for disease, post-licensure evaluation of vaccine efficacy, and monitoring effectiveness of prevention policies. IIF collected is date of birth, race, ethnic origin, sex, age, weight, height, and whether individual is nursing home resident. System does not contain, name, SSN or other unique identifier. States voluntarily submit aggregate, de-identified data to CDC. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) Notification and consent takes place at the state level. CDC receives only de-identified, aggregate data. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): Yes 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Administrative controls: ABCs data are stored in aggregate form on the agency’s mainframe. Access to aggregate datasets is restricted to approved CDC users. Approved users are granted read only access through the agency’s mainframe system by the database administrator. Host system security and physical controls for IT infrastructure and services are established in the Service Level Agreement between the Information Technology Services Office (ITSO) and CDC. Technical controls: user ID, passwords, firewall, intrusion detection system, common access card and smart cards. Physical controls: guards, ID badges, key cards, and close circuit TV. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Michael Harris Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Aug 1, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCIRD CDC Federal Contract Vaccine Availability, Package and NDC (NDC) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCIRD CDC Federal Contract Vaccine Availability, Package and NDC (NDC) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): No 5. OMB Information Collection Approval Number: No 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC Federal Contract Vaccine Availability, Package and NDC (NDC) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cathy Hogan 10. Provide an overview of the system: An External application to display general information about Federal Contract Vaccines and National Drug Codes(NDC's) for the related vaccines. The application gathers data from the database table using a stored procedure and displays on an ASP page. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): No 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: No 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: No IIF Collected. E-Authentication Assurance Level = N/A Risk Analysis Date = 10/21/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Nov 14, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCIRD Conference Room Scheduling System - (CRSS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? No If this is an existing PIA, please provide a reason for revision: PIA Validation 1. Date of this Submission: CDC CCID NCIRD Conference Room Scheduling System - (CRSS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-02-00-02-9309-00 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): 09-20-0136 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): Conference Room Scheduling System 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Karron Singleton 10. Provide an overview of the system: The Conference Room Scheduling System is required by ITSO to schedule conference rooms and the services that are available in Conference Rooms. It is in use across the CDC enterprise. The administrators are geographically dispersed and operate autonomously with little necessary contact with ITSO, system stewards, or developers. The system communicates with users and administrators through many different types of emails. It also integrates with the ITSO Peregrine system to make requests for equipment such as computers and projectors without phone calls. The system is, by far, the largest system of its type at CDC. As of January 2008 (since the February 2005 launch), there are over 120,000 reservations across nearly 50 buildings and more than 230 rooms which were created by 5,000 distinct persons. Envision video conference scheduling and LiveMeeting web conference scheduling is partially integrated, saving the CDC 10s of thousands a month in telecommunications costs by matching real needs and usage to telecom requests. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): Yes 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Userid associated with a conference room reservation 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: Conference room scheduling information and voluntary userid for contact event coordinators 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Userid associated with a conference room reservation. Data secured via AD PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Michael Harris Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jul 10, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCIRD Division of Viral Diseases Surveillance Network (DVDSN) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCIRD Division of Viral Diseases Surveillance Network (DVDSN) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): None 7. System Name (Align with system Item name): Division of Viral Diseases Surveillance Network (DVDSN) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Wendi Kuhnert 10. Provide an overview of the system: The DVDSN is a web based collection tool to modernize viral surveillance. Current collection method is a non-web based email and telephones which is inefficient. 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): No PII data 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: Viral outbreaks for analysis. No personally identifiable information is collected. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) The information is submitted by public health agency and does not contain PII data. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: No PII data. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: May 20, 2009 Approved for Web Publishing: - Date Published: - _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCIRD Environmental Legionella Isolation Techniques Evaluation (ELITE) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCIRD Environmental Legionella Isolation Techniques Evaluation (ELITE) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): Environmental Legionella Isolation Techniques Evaluation (ELITE) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Dr. Claressa Lucas 10. Provide an overview of the system: ELITE is a voluntary proficiency testing program for commercial laboratories to encourage uniform standards in the industry and to provide the LLRDB with a database of regional commercial laboratories that can be recommended in the case of an outbreak. The ELITE website will be an avenue for the public to find general information about Legionella testing, test participants’ combined grades, a list of qualified testing facilities, and all other information pertaining to the program. The website will have its own URL but will also be linked from the CDC Legionellosis website under the quick links section. Online reporting shall be made available to Participants and the General public. Test sample results shall be entered through this site and enrollment into the program shall also take place on this site. 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): No, system does not share or disclose PII information 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: The website will be the main interface between the general public, participating laboratories, and the LLRDB. The website shall also be able to generate both public and private view reports by performing data analysis according to criteria provided by the LLRDB and the creation of digital graphics from the results and demographic information. Information gathered from industry may be used to refine policy and procedural recommendations for Legionella sampling and surveillance. Facility info including Business contact name, phone and email. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) Terms and Conditions Agreement 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Administrative controls: IIF data are backed up daily and copies stored in a separate facility. Technical controls: Access to the data is controlled by user ID and password, firewall, in addition to the user ID and password needed to access the network. Physical controls include security guards, ID badges, cardkeys and cipher locks. No IIF collected E-Authentication Assurance Level = 2 Risk Analysis Date = 11/14/2008 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Dec 18, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCIRD GID Travel and Consulting Web Application - (GID Travel) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCIRD GID Travel and Consulting Web Application - (GID Travel) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-02-00-02-9309-00 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): The PII collected is exempt due to It being business PII 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): GID TRAVEL 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Robert Avey 10. Provide an overview of the system: The GID Trav system collects data on prospective travel candidates for NCIRD/GID’s international travel programs including the STOP program. The site also allows GID staff to enter their travel itineraries to support the reporting requirements of CDC’s international partners 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): IIF is shared and accessible within GID for purposes of evaluating candidates for international travel. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: Information collected includes name, phone, address, limited employment history, email address. Submission of all data is voluntary. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No change policies exist. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Secured in SQL Server database accessible only to those with administrative access to view the data. CDC staff that enter their personal profile data may access their own data through the website. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Michael W. Harris Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: May 19, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCIRD Grants Application Tracking Information System - (eGRATIS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCIRD Grants Application Tracking Information System - (eGRATIS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-04-00-02-1036-00 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): System in development 5. OMB Information Collection Approval Number: System in development 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): eGrATIS 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Victor Negron 10. Provide an overview of the system: Track immunization grants awarded to State and Local Health Departments from application through award and budget changes. 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): N/A 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: eGrATIS’s will collect programmatic information from CDC grantees (state, cities and territories) through a common internet interface. eGrATIS operationalizes the entire life cycle of the grants application process from inception to completion. The system generates reports, supports queries, standardizes reporting practices, and consolidates program information. What IIF collected through eGrATIS is mandatory 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) N/A 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: eGrATIS is to be hosted on the Secure Data Network (SDN). The front-end of the application authenticates all users using X.509 digital certificates which are provided to the front-end server upon attempted login. Transport Layer Security (TLS) protects data in transit while users access data within the application. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Michael W.Harris Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: May 22, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCIRD Polio Entero Virus Database (EVDB) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCIRD Polio Entero Virus Database (EVDB) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): None 7. System Name (Align with system Item name): Polio Entero Virus Database (EVDB) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Steve Oberste 10. Provide an overview of the system: The system stores Polio Enterovirus lab results and specimen information. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): No PII information is shared. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: Collect basic clinical data and specimen identifiers pertaining to a patient whose clinical specimens are to be tested; info is submitted by physician/hospital/public health agency—submission of IIF is voluntary on their part; may contain surname, given name, DOB 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) IIF is obtained by submitter (see #30), not by CDC; IIF may be used to search for individual records, but never disclosed except by signed authorization. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: SQL Server is physically located in the central facility and is not accessible by general CDC users. Access to the database and modification must adhere to ITSO CM. E-Authentication Assurance Level = N/A Risk Analysis Date = 11/13/2008 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Dec 2, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCIRD Vaccine Tracking System (VTrckS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCIRD Vaccine Tracking System (VTrckS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): The PII collected is exempt due to the Business PII determination made in accordance with the HHS PIA SOP of February 2009” 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): Vaccine Tracking System (VTrckS) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Lance Rodewald, MD 10. Provide an overview of the system: VTrckS is an upgrade of the legacy Vaccine Ordering and Distribution system (VODS). VTrckS will provide the Grantee/projects a more advanced way to manage Vaccines for Children (VFC) while also allowing the immunization Providers (Public/Private Health Care providers) the ability to order and receive vaccines directly to the physicians office. VODS/VaX.NET manages $1.9 billion of pediatric vaccines purchased with Federal funding. VTrckS is on the CDC list of critical systems 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): N/A 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: VTrckS will be used by the CDC, Immunization Grantees and Providers to order, distribute, track and record information concerning publicly funded (VFC, 317 and state) vaccine purchases. The type of data includes Physicians first and last name, Physician number, Medicaid number, vaccine shipment address, type of vaccine, order quantity. No PII is used. Business IIF only. Submission of this information is voluntary 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) A system notice can be sent out. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: N/A – Business IIF only. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Apr 27, 2009 Approved for Web Publishing: - Date Published: - _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID AIDS Inventory PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID AIDS Inventory 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-02-02-9324-00 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): AIDS Inventory 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Dollene Hemmerlein 10. Provide an overview of the system: System inventories 30+ years of CDC specimens collected during investigations, outbreaks, congressionally mandated studies and CDC funded studies. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Testing labs and study investigators for results matching and use 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: Data collected is decided upon by investigator as relevant to study; mostly voluntary 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) All studies receive IRB approval and contain consent forms for collection and use of data and specimens 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): Yes 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: All IIF is blocked from view except by authorized users and released only after permission of investigator PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Michael Harris Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Jun 19, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID Arctic Investigations Program Information Management Project PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID Arctic Investigations Program Information Management Project 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): 09-20-0160 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): Arctic Investigations Program Information Management Project 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Lisa Bulkow 10. Provide an overview of the system: The application is used to collect, store, process, and report medical research data. The system provides the IT platform for laboratory and epidemiologic work done by the Arctic Investigations Program (AIP). It provides the integrated system for tracking of laboratory specimens and associated epidemiologic study data which are not associated with specimens received at AIP. Medical patient data is collected, processed, and stored for research purposes. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): Yes 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): N/A 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: The application is used to collect, store, process, and report medical research data. The system provides the IT platform for laboratory and epidemiologic work done by the Arctic Investigations Program (AIP). It provides the integrated system for tracking of laboratory specimens and associated epidemiologic study data which are not associated with specimens received at AIP. Medical patient data is collected, processed, and stored for research purposes. Medical Patient information is collected directly form patients, who are advised of the purpose of the information. Patients sign privacy waiver before releasing information to CDC staff. CDC staff sign on to application via user-ID and password across Local Area Network (intranet) and enter data into application. PII is collected. Personal information is provided voluntarily. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) Personal information is collected directly from patients. Patients voluntarily sign consent form agreeing to participate in research study. Information is used only for the conduct of research study and is not shared with other agencies or outside entitie 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Only authorized individuals have access to PII data, and only for authorized tasks. Individuals permitted access must submit proper user-ID/password to Operating System and then to application in order to access. Server housing the application is physically protected with locked doors and limited access. Operating system is hardened to limit exposure to unauthorized access. Application users receive annual security awareness training. IIF Collected = Yes E-Authentication Assurance Level = N/A Risk Analysis Date = 11/25/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Dec 18, 2008 Approved for Web Publishing: - Date Published: - _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID Biotechnology Core Facility Job Tracking Database PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID Biotechnology Core Facility Job Tracking Database 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): The PII collected is exempt due to It being business PII 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): Biotechnology Core Facility Job Tracking Database 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Elizabeth Neuhaus 10. Provide an overview of the system: The Biotechnology Core Facility Branch (BCFB) provides custom products, synthetic DNA oligonucleotides and synthetic peptides, as well as other services to CDC laboratory researchers. Since 1993 the BCFB has employed an electronic relational database for inventory control and tracking data related to these activities. Paradox was the database product selected after evaluation of commercial products available at that time and is the product currently used by the BCFB 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): N/A 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: Lab inventory and job tracking information. Maintain and track orders for lab items. Only Business – IIF data is collected. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes are in place, since only Business – IIF data is collected. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Business IIF Collected. E-Authentication Assurance Level = N/A Risk Analysis Date = 11/26/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Dec 11, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform DACH Alcohol Related Disease Indicators (Admin) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform DACH Alcohol Related Disease Indicators (Admin) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CoCHP Intranet Platform DACH Alcohol Related Disease Indicators (Admin) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform DACH Block Grant MIS PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform DACH Block Grant MIS 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CoCHP Intranet Platform DACH Block Grant MIS 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform DACH Block Grant MIS-Success Stories PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform DACH Block Grant MIS-Success Stories 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CoCHP Intranet Platform DACH Block Grant MIS-Success Stories 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform DACH BRFSS Survey Operations Support Admin PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform DACH BRFSS Survey Operations Support Admin 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CoCHP Intranet Platform DACH BRFSS Survey Operations Support Admin 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform DACH GA-Aging Work Group Voting PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform DACH GA-Aging Work Group Voting 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CoCHP Intranet Platform DACH GA-Aging Work Group Voting 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform DACH GA-BRFSS Abstract Submission Tool (Admin) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform DACH GA-BRFSS Abstract Submission Tool (Admin) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CoCHP Intranet Platform DACH GA-BRFSS Abstract Submission Tool (Admin) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform DACH GA-BRFSS Bibliography (Admin) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform DACH GA-BRFSS Bibliography (Admin) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CoCHP Intranet Platform DACH GA-BRFSS Bibliography (Admin) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform DACH GA-BRFSS Interview Training Guide PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform DACH GA-BRFSS Interview Training Guide 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CoCHP Intranet Platform DACH GA-BRFSS Training Guide 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform DACH GA-BRFSS Training Guide PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform DACH GA-BRFSS Training Guide 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CoCHP Intranet Platform DACH GA-BRFSS Interview Training Guide 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform DACH GA-CHAPS Toolkit Admin PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform DACH GA-CHAPS Toolkit Admin 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CoCHP Intranet Platform DACH GA-CHAPS Toolkit Admin 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform DACH GA-reQuest PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform DACH GA-reQuest 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CoCHP Intranet Platform DACH GA-reQuest 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform DACH GA-Steps Resource Center PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform DACH GA-Steps Resource Center 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CoCHP Intranet Platform DACH GA-Steps Resource Center 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform DACH GA-Steps Resource Center (Admin) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform DACH GA-Steps Resource Center (Admin) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CoCHP Intranet Platform DACH GA-Steps Resource Center (Admin) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform DACH GA-Syndemics (Admin) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform DACH GA-Syndemics (Admin) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CoCHP Intranet Platform DACH GA-Syndemics (Admin) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform DACH GIS-BRFSS Flu PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform DACH GIS-BRFSS Flu 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CoCHP Intranet Platform DACH GIS-BRFSS Flu 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform DACH PRC MIS PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform DACH PRC MIS 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CoCHP Intranet Platform DACH PRC MIS 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: Business Contact information is shared with internal staff. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform DASH GA-reQuest PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform DASH GA-reQuest 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CoCHP Intranet Platform DASH GA-reQuest 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform DASH GA-School Health Education Resources (Admin) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform DASH GA-School Health Education Resources (Admin) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CoCHP Intranet Platform DASH GA-School Health Education Resources (Admin) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform DASH GA-SHI (Admin) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform DASH GA-SHI (Admin) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CoCHP Intranet Platform DASH GA-SHI (Admin) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform DASH MIS PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform DASH MIS 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CoCHP Intranet Platform DASH MIS 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform DASH QADS-Questionaire Design Module PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform DASH QADS-Questionaire Design Module 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CoCHP Intranet Platform DASH QADS-Questionaire Design Module 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform DCPC Cancer QT PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform DCPC Cancer QT 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CoCHP Intranet Platform DCPC Cancer QT 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform DCPC Email Form PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform DCPC Email Form 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CoCHP Intranet Platform DCPC Email Form 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform DCPC GA-Issue Tracker PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform DCPC GA-Issue Tracker 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CoCHP Intranet Platform DCPC GA-Issue Tracker 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform DCPC GA-NPCR Annual Program Evaluation PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform DCPC GA-NPCR Annual Program Evaluation 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CoCHP Intranet Platform DCPC GA-Program Contacts (Admin) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform DDT MIS PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform DDT MIS 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CoCHP Intranet Platform DDT MIS 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform DHDSP HDSP MIS PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform DHDSP HDSP MIS 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CoCHP Intranet Platform DHDSP HDSP MIS 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform DHDSP Legislative Database (Admin) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform DHDSP Legislative Database (Admin) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CoCHP Intranet Platform DHDSP Legislative Database (Admin) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform DNPA GA-5-A-Day Recipes (Admin) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform DNPA GA-5-A-Day Recipes (Admin) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CoCHP Intranet Platform DNPA GA-5-A-Day Recipes (Admin) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform DNPA GA-DNPA Program Directory (Admin) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform DNPA GA-DNPA Program Directory (Admin) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CoCHP Intranet Platform DNPA GA-DNPA Program Directory (Admin) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform DNPA GA-DNPA Qualitative Research Inventory (Admin) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform DNPA GA-DNPA Qualitative Research Inventory (Admin) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CoCHP Intranet Platform DNPA GA-DNPA Qualitative Research Inventory (Admin) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform DNPA GA-Legislative Database (Admin) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform DNPA GA-Legislative Database (Admin) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CoCHP Intranet Platform DNPA GA-Legislative Database (Admin) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform DNPA MIS PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform DNPA MIS 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CoCHP Intranet Platform DNPA MIS 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform DOH ASTDD State Synopses (Admin) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform DOH ASTDD State Synopses (Admin) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CCID NCPDCID CoCHP Intranet Platform DOH ASTDD State Synopses (Admin) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform DOH GA - Documents PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform DOH GA - Documents 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CCID NCPDCID CoCHP Intranet Platform DOH GA - Documents 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform DOH MIS PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform DOH MIS 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CCID NCPDCID CoCHP Intranet Platform DOH MIS 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers. Tracks objectives and activities of state based oral health programs. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform DOH Oral Health Data Resource Center (Admin) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform DOH Oral Health Data Resource Center (Admin) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CCID NCPDCID CoCHP Intranet Platform DOH Oral Health Data Resource Center (Admin) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform DOH PTS (Admin) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform DOH PTS (Admin) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CCID NCPDCID CoCHP Intranet Platform DOH PTS (Admin) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers. Aids in the tracking and reporting of test data from participating water fluoride testing labs. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform NCHSTP GAP Request PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform NCHSTP GAP Request 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CCID NCPDCID CoCHP Intranet Platform NCHSTP GAP Request 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers. GAP Research Inquiries. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform NCIPC Injury ACE MIS PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform NCIPC Injury ACE MIS 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CCID NCPDCID CoCHP Intranet Platform NCIPC Injury ACE MIS 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers. Tracks objectives and activities of state based injury programs. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform OD Customer Satisfaction Ratings (CSR) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform OD Customer Satisfaction Ratings (CSR) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CCID NCPDCID CoCHP Intranet Platform OD Customer Satisfaction Ratings (CSR) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform OD EPMIS PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform OD EPMIS 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CCID NCPDCID CoCHP Intranet Platform OD EPMIS 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform OD EPMIS - POSSI PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform OD EPMIS - POSSI 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CCID NCPDCID CoCHP Intranet Platform OD EPMIS - POSSI 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform OD GA - BSU Report PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform OD GA - BSU Report 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CCID NCPDCID CoCHP Intranet Platform OD GA - BSU Report 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID CoCHP Intranet Platform OD GA - Change Tracking PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID CoCHP Intranet Platform OD GA - Change Tracking 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CCID NCPDCID CoCHP Intranet Platform OD GA - Change Tracking 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers. Application Update Change Tracking. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID Document Tracking System (DTS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID Document Tracking System (DTS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): Document Tracking System (DTS) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Dr. Elise Beltrami 10. Provide an overview of the system: The Document Tracking System (DTS) tracks documents (e.g. articles, publications, book chapters) that are being reviewed by DHQP. For example, the author of an article sends it to someone for review who then may pass it to someone else for review. The DTS keeps track of where the document is in the review process. The application is written in ASP (not ASP.NET). Both the application and SQL database are on server: acid-dhqp-dialy. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): N/A 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: N/A 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) N/A 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: No PII data is processed or stored.. No IIF Collected. E-Authentication Assurance Level = N/A Risk Analysis Date = 12/15/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Dec 18, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID Early Aberration Reporting System - (EARS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID Early Aberration Reporting System - (EARS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-02-02-9721-00-110-246 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): Early Aberration Reporting System (EARS) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Lori Hutwagner 10. Provide an overview of the system: The Early Aberration Reporting System (EARS) was pioneered as a method for monitoring bioterrorism during large-scale events. Various city, county, and state public health officials in the United States and abroad currently use EARS on syndromic data from emergency departments, 911 calls, physician office data, school and business absenteeism, and over-the-counter drug sales. The EARS program presents its analysis in a complete HTML Website containing tables and graphs linked through a home page. Viewing EARS output requires only a Web browser. 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): No 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: EARS will voluntarily collect daily counts of syndromic information. This information will be used to monitor for possible aberrations or spread of disease such as ILI. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: No PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Michael Harris Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: May 12, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID eManifest PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID eManifest 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): EmailForms 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Glenn Moore 10. Provide an overview of the system: Allows information submitted through web forms on designated CDC Internet sites to be sent via email to designated recipients. Examples include allowing web site users to submit questions or comments to the CDC via “Contact Us” web pages, or to submit requests to subscribe to CDC listservs to receive periodic notification of news or events. 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): N/A 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: Example uses of EmailForms include allowing web site users to submit questions or comments to the CDC via “Contact Us” web pages, and submitting requests to subscribe to CDC listservs to receive periodic notification of news or events. CDC web form authors define what information will be requested on those web forms and submitted through email via EmailForms. Such information typically includes the user’s email address and questions or comments the user may have. Email addresses and other contact information are used solely for the purpose of contacting the user in order to answer questions or comments. EmailForms does not store information submitted via web forms in most cases. EmailForms only generates email messages containing submitted form data and sends those messages via the CDC SMTP gateway. No form data is stored within the EmailForms application. In the event the SMTP gateway cannot be reached, EmailForms will temporarily store email messages on its local file system until the SMTP gateway is available again, at which time the emails will be sent and will be deleted from the EmailForms file system. Sent email may remain in the CDC email system subject to the CDC’s email retention policies. Submission of information through EmailForms is voluntary. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) N/A 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: N/A No IIF Collected. E-Authentication Assurance Level = N/A Risk Analysis Date = 02/09/2009 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Apr 24, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID Global Emerging Infections Sentinel Network (GeoSentinel) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID Global Emerging Infections Sentinel Network (GeoSentinel) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): The PII collected is exempt due to it being business PII 5. OMB Information Collection Approval Number: No 6. Other Identifying Number(s): No 7. System Name (Align with system Item name): Global Emerging Infections Sentinel Network (GeoSentinel) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Nina Marano 10. Provide an overview of the system: GeoSentinel is a provider-based sentinel network of the International Society of Travel Medicine (ISTM), through a cooperative agreement with CDC. GeoSentinel consists of 33 travel/tropical medicine clinics (Sites) around the world (including the U.S.) participating in active surveillance to monitor geographic and temporal trends in morbidity among travelers and other globally mobile populations. Passive surveillance and response capabilities are also extended to a broader network of GeoSentinel Network members. This is a surveillance system that collects information on significant health risks and alerts on important disease risks and outbreaks in collaboration with CDC and other international organizations that are channeled through these clinics. Most users of the system are nurses and physicians in the different sites that are non CDC personnel. The GeoSentinel is a web based system. There is one form (patient questionnaire) that is entered by the different sites into the system through a secured server. The main system functions include the following: Data entry of patient questionnaire, search capability, alerts, announcements and administrative tools. All information is stored in the central database. Users can also generate reports as well as download data and export it into external applications such as MS Excel or MS Access. There are three types of users: Site users that can only view their own information; global users that can view all site's information; and data managers that can view all site information and can also perform administrative functions such as managing sites, users and locations, customizing site specific fields, maintaining lists and creating announcements. Since this is a surveillance system, there are no personal identifiers that are entered into it and it is not affected by regulations. GeoSentinel is a standalone system that is not connected to any other system nor does it share any information with other systems. The system uses internal user-based application security. Database security includes role-based permission to system functions. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): No. System does not share or disclose information. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: This is a surveillance system that collects information on significant health risks and alerts on important disease risks and outbreaks in collaboration with CDC and other international organizations that are channeled through these clinics. Most users of the system are nurses and physicians in the different sites that are non CDC personnel. Information is used for analysis purposes and is collected from patients that voluntarily fill in the questionnaire when they visit one of the GeoSentinel clinics. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) Only IIF collected is business contact information (name, phone and email address) of the user who enters data for business purposes. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Administrative controls: IIF data are backed up daily and copies stored in a separate facility. Technical controls: Access to the data is controlled by user ID and password in addition to the user ID and password needed to access the network. Physical controls include security guards, ID badges, cardkeys and cipher locks. E-Authentication Assurance Level = 2 Risk Analysis Date = 9/25/2008 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Nov 14, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID Global Migration Database - (Global Migration) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID Global Migration Database - (Global Migration) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-02-02-9721-00 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): Global Migration Database (Global Migration) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Rob Murphy 10. Provide an overview of the system: The Global Migration project is an effort to gather air traffic data for modeling and analysis purposes. A data feed has been established with the Federal Aviation Administration’s (FAA) Enhanced Traffic Management System (ETMS). DGMQ receives a daily summary of flight information pulled from the archive process supported by the ETMS system. This feed is public data and available to and used by a number of commercial air traffic websites. The unique and powerful aspect of this project for CDC is the collection of the daily data feed into one large database (dataset) for statistical and situational analysis. At this point there is no user interface, the database servers as an air traffic warehouse to be accessed by statisticians, data analysts and queried for situation driven information. 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): N/A 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: The Global Migration project is an effort to gather air traffic data, from the Federal Aviation Administration (FAA), for modeling and analysis purposes. DGMQ receives a daily summary of flight information pulled from the archive process supported by the ETMS system. This feed is public data and available to and used by a number of commercial air traffic websites. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) N/A 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: N/A PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: - Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: May 8, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID Laboratory Response Network (LRN) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID Laboratory Response Network (LRN) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): No 5. OMB Information Collection Approval Number: No 6. Other Identifying Number(s): No 7. System Name (Align with system Item name): Laboratory Response Network (LRN) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Sherrie Bruce 10. Provide an overview of the system: The LRN web application allows users to view protocol documents, order inventory items, view communications and receive email broadcast announcements, and communicate to the LRN. The LRN web application contains data that users of facilities participating in response related activities will find useful in prevention preparedness and response activities. Such data includes laboratory referral information for locating your next nearest neighbor during an emergency, agent protocol information that instructs users in proper protocols and procedures during emergencies, communications sections that keeps the users current on preparedness and response needs, ordering systems that allow users to order items that will assist them in testing capacities. LRN data does not contain any personally identifying information. Access to the system is through role based security. Each user is assigned a role and their permissions within the system is based on their role. Users access the LRN system via a web-based interface using the FIPS-140-2 approved standard of Transport Layer Security (TLS) version 1.0. Users input a username and password into the system in order to gain access to their data. Users are only given usernames and passwords after signing a “rules of behavior” document. Details of the system interactions can be found in the technical description below. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): No 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: The LRN web application contains data that users of facilities participating in response related activities will find useful in prevention preparedness and response activities. Such data includes laboratory referral information for locating your next nearest neighbor during an emergency, agent protocol information that instructs users in proper protocols and procedures during emergencies, communications sections that keeps the users current on preparedness and response needs, ordering systems that allow users to order items that will assist them in testing capacities. There is no IIF collected and it is voluntary 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: No PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Nov 25, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID Memorandum of Agreements Tracking System (MOATS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID Memorandum of Agreements Tracking System (MOATS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CCID NCPDCID Memorandum of Agreements Tracking System (MOATS) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Janine Hines 10. Provide an overview of the system: The Division of Global Migration and Quarantine (DGMQ) commissioned the development of an intranet application to serve as a Memorandum of Agreement Tracking System (MOATS). MOATS will assist DGMQ personnel in the usage and upkeep of established Memorandums of Agreement between CDC and medical facilities enlisted to assist with implementation of isolation and quarantine measures. MOATS is a web-based system available to all Q-stations throughout the United States via CITGO and the CDC security framework and also to DGMQ authorized individuals at CDC headquarters via the DGMQ Intranet. The MOATS portion of the application allows Q station staff and authorized individuals at DGMQ headquarters to view hospital information as it pertains to hospitals that have entered into a Memorandum of Agreement (MOA) with the CDC to assist with implementation of isolation and quarantine measures. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): N/A 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: N/A 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) N/A 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: No PII data is processed or stored. E-Authentication Assurance Level = N/A Risk Analysis Date = December 15, 2008 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID NCID Informatics Portal (NCID Portal) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID NCID Informatics Portal (NCID Portal) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CCID NCPDCID NCID Informatics Portal (NCID Portal) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Charlie Miller 10. Provide an overview of the system: The NCID Informatics Portal is a web based system used to track projects and resources in the “old” NCID Office of Informatics when IT staff was rolled-up from branches and divisions into the center level servicing team. Initially it was designed as a place for team members to centrally save pertinent documentation and project information as well as a place for management to track ongoing project development. It was also used as a general resource leveling tool for managers. 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): N/A 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: All information that was collected in the NCID Portal was “project related” and was for internal use only. As the NCID Office of Informatics had many organizations and people that it needed to service, the NCID Portal was thought of as a way for our organization to have transparency to those groups who we were servicing. Anyone with access to the CDC intranet had “View” access to most of the information on the NCID Portal including project documentation and list of projects/resources. Members of the office of informatics were asked to “log in” to keep project information up to date as well as upload documentation/files. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) N/A 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: No PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 28, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID OD NCCDPHP Conference Planning System (Admin) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID OD NCCDPHP Conference Planning System (Admin) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CCID NCPDCID OD NCCDPHP Conference Planning System (Admin) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers. Allows coordinators for the Chronic Disease conference to plan agenda, speakers, travel, and other information. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID OD NCCDPHP Contracts Tracking PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID OD NCCDPHP Contracts Tracking 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CCID NCPDCID OD NCCDPHP Contracts Tracking 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID OSH GA - Cessation Resource Center (Admin) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID OSH GA - Cessation Resource Center (Admin) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CCID NCPDCID OSH GA - Cessation Resource Center (Admin) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers. Provides access to user-tested tobacco cessation materials. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCPDCID State Surveyor Information System v2.0 (SSIS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCPDCID State Surveyor Information System v2.0 (SSIS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): No 5. OMB Information Collection Approval Number: No 6. Other Identifying Number(s): No 7. System Name (Align with system Item name): CDC CCID NCPDCID State Surveyor Information System v2.0 (SSIS) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Jim Handsfield 10. Provide an overview of the system: The State Surveyor Information System (SSIS) v2.0 is a joint project under an inter-agency agreement between the Division of Laboratory Systems (DLS) at the Centers for Disease Control and Prevention (CDC) and the Division of Laboratory Services at the Centers for Medicare and Medicaid Services (CMS) to support the mandated laboratory evaluation functions of the Clinical Laboratory Improvement Amendment of 1988 (CLIA). 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): No 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: No 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: No PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Feb 24, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCZVED ADB Diagnostics Sample Database (ADBDSD) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCZVED ADB Diagnostics Sample Database (ADBDSD) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): 09-20-0160 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): ADB Diagnostics Sample Database (ADBDSD) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Robert S Lanciotti 10. Provide an overview of the system: The system tracks laboratory diagnostic samples & resulting test data & generates reports with patient information. The results are provided to State Laboratories. The system is an essential resource for clinicians who deal with diagnosing obscure Arboviral organisms, & supports the research of the Coordinating Center for Infectious Diseases, Division of Vector-Borne Infectious Diseases, Arbovirus Diseases Branch (CCID/DVBID/ADB). It also functions under the auspices of the World Health Organization (WHO) Reference Center for Arboviruses. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): Yes 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): State Health Departments. Date originates from State Health Department, and is tested, and after testing, reports of results are returned to Health Department providing the sample data. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: The system tracks laboratory diagnostic samples & resulting test data & generates reports with patient information. The results are provided to State Laboratories. The system is an essential resource for clinicians who deal with diagnosing obscure Arboviral organisms, & supports the research of the Coordinating Center for Infectious Diseases, Division of Vector-Borne Infectious Diseases, Arbovirus Diseases Branch (CCID/DVBID/ADB). It also functions under the auspices of the World Health Organization (WHO) Reference Center for Arboviruses. The information collected and processed includes PII data. CDC obtains information from State Health Departments, so CDC does not control or is aware of voluntary nature of data provided from patient participants. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) Only aggregate test results data is provided to State Health Departments. Exception is the State Health Department that originally provided the patient samples. For health departments that provided the sample data, the patient’s name, age, and sex is prov 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Access to application is limited to authorized individuals, and authentication of individual is achieved at two levels: Windows Active Directory authentication, and Microsoft Access authentication. Access to workstations and application server is physically restricted to CDC-badge employees and contractors. E-Authentication Assurance Level = N/A Risk Analysis Date = December 22, 2008 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Jan 12, 2009 Approved for Web Publishing: - Date Published: - _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCZVED Arbovirus Diseases Branch Inventory (ADBI) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCZVED Arbovirus Diseases Branch Inventory (ADBI) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-02-02-1481-00 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): Arbovirus Diseases Branch Inventory (ADBI) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Roger Nasci 10. Provide an overview of the system: This is an Access Program, totally. The front end is Access and the back end is Access. The system resides on a file server in Fort Collins (fcid-vbi-1). The system stores scientific data and tracks virus seeds, antibodies, and antigens of the ADB Virus collection along with their storage location. The system increments and decrements the supply of antigen as it is used by Branch Researchers in order to flag supply for restock. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): N/A 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: N/A 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) N/A 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: N/A PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Michael W. Harris Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jul 9, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCZVED Dengue Laboratory Samples Database (DLSDB) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCZVED Dengue Laboratory Samples Database (DLSDB) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): 09-20-0136 5. OMB Information Collection Approval Number: No 6. Other Identifying Number(s): No 7. System Name (Align with system Item name): Dengue Laboratory Samples Database (DLSDB) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Richard Peterson 10. Provide an overview of the system: The Dengue Laboratory Samples Database is an internal client server system located on San Juan Dengue Branch’s LAN. Dengue Laboratory Samples Database (DLSDB) is used for surveillance of dengue occurrences in Puerto Rico and other locations. The database contains patient information & laboratory results from the dengue diagnostic lab. It searches for previous samples from patients, stores data on the samples, & stores results of epidemiological evaluations. The data is used for epidemiologic analyses of disease activity in certain periods or locations by division scientists. Sample results are reported to the patients’ health care provider. 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): Yes 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): The data is used for epidemiologic analyses and is shared with the patients’ healthcare provider. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: The data is used for epidemiologic analyses of disease activity in certain periods or locations by division scientists. Sample results are reported to the patients’ health care provider. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) Individuals who have their blood tested for dengue know that their name, address, sex, age and birthday is being provided to the PRDH and CDC on the DCIF form as they assist in filling out the form by answering the doctors or healthcare providers’ questio 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: This is an internal facing system on the CDC network behind the firewall with no interconnections to any other outward facing system. CDC users go through yearly Computer Security training to address basic computer security issues. The DB is housed in a secure environment. IIF Collected. E-Authentication Assurance Level = N/A Risk Analysis Date =01/30/2009 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Mar 4, 2009 Approved for Web Publishing: - Date Published: - _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCZVED Division of Parasitic Diseases - (DPDx) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCZVED Division of Parasitic Diseases - (DPDx) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-02-02-9523-00-110-246 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): No 5. OMB Information Collection Approval Number: No 6. Other Identifying Number(s): No 7. System Name (Align with system Item name): Division of Parasitic Diseases (DPDx) Website 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Dr. Alexandre J. DaSilva 10. Provide an overview of the system: The purpose of DPDx website is to strengthen the level of laboratorians' expertise to diagnose foodborne and other parasitic diseases. The DPDx website allows users to obtain diagnostic assistance through telediagnosis. Laboratories can transmit images to CDC and obtain answers for their inquiries in minutes to hours. This allows laboratorians to more efficiently address difficult diagnositic cases in normal or outbreak situations and to disseminate information more rapidly. In addition, this method substantially increases the interaction between CDC and public health laboratories (PHLs) as well as among the participating PHLs. To date, 42 laboratories in 39 states and 1 territory have the capacity for telediagnosis, or are in the process of acquiring the hardware to perform telediagnosis. DPDx also provides training for laboratorians. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): No 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: NThe DPDx website allows users to obtain diagnostic assistance through telediagnosis. Laboratories can transmit images to CDC and obtain answers for their inquiries in minutes to hours. This allows laboratorians to more efficiently address difficult diagnositic cases in normal or outbreak situations and to disseminate information more rapidly.There is no IIF collected and it is voluntary. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: No PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Michael Harris Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jun 18, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCZVED DVBID Reagents Ordering System (DVBIDROS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCZVED DVBID Reagents Ordering System (DVBIDROS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): DVBID Reagents Ordering System (DVBIDROS) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Roger Nasci 10. Provide an overview of the system: The DVBIDROS information system consists of two components. The internal CDC component tracks reagents inventory and the external-facing web site is used by the Public Health Departments to process (ordering/requests) reagents. The requestor accesses the Internet site and requests a user name and password. Once the request for access is reviewed and approved by the divisions approving official, a user name and password is emailed to them. Once the requestor has their user name and password they can log into the Internet site and request reagents. Reagent requests are sent to Activity Chief’s for approval and the requestor receives an order confirmation. Once the approval is granted the DVBID Shipping Clerk prepares invoices and declaration of dangerous goods and ships the reagent. Users are Public health officials/researchers and Universities reagent ordering/requests. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): N/A 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: Only Business IIF is processed or stored on the application such as Institute name, address, email, phone number, and user name. Users are directed to appropriate forms based upon their user ID. User ID and password issued by Active Directory for network connection are made by CDC users. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) N/A 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: No IIF Collected. E-Authentication Assurance Level = 2 Risk Analysis Date = January 17, 2009 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Apr 13, 2009 Approved for Web Publishing: - Date Published: - _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCZVED DVBID Reservation System 2 - (RESSYS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCZVED DVBID Reservation System 2 - (RESSYS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-02-02-1479-00 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CCID NCZ DVBID Reservation System 2 (RESSYS) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Richard J. Peterson 10. Provide an overview of the system: The Reservation System 2 allows only Fort Collins users to reserve division assets (vehicles, laptops, peripherals) for checkout and use. System keeps historical records to track damage and/or loss. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): N/A 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: N/A 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) N/A 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: N/A No IIF collected. E-Authentication Assurance Level = N/A Risk Analysis Date = June 30, 2009 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Michael Harris Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Aug 5, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCZVED Early Detection Research Network-Cervical Cancer Clinical Epidemiology and Validation Center (EDRN-CCCEVC) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCZVED Early Detection Research Network-Cervical Cancer Clinical Epidemiology and Validation Center (EDRN-CCCEVC) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-02-02-9721-00-110-246 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): No 5. OMB Information Collection Approval Number: No 6. Other Identifying Number(s): No 7. System Name (Align with system Item name): Early Detection Research Network-Cervical Cancer Clinical Epidemiology and Validation Center (EDRN-CCCEVC) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Elizabeth R. Unger PhD, MD 10. Provide an overview of the system: The system is an integrated database designed to create, maintain and use a biorepository of samples to discover and validate biomarkers to improve cervical cancer screening. The system includes data on clinical, epidemiologic and laboratory values that are linked to the inventory of biologic samples. No personal identifiers of any kind are included. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): N/A 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: No IIF information is collected. System is completely anonymous and links biologic samples with patient demographics and disease status. Data will be shared with ERNE investigators seeking to develop or validate biomarkers for cervical cancer screening. It is voluntary. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) N/A 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: N/A PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Michael Harris Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jul 28, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCZVED National Outbreak Reporting System (NORS Public) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCZVED National Outbreak Reporting System (NORS Public) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): No 5. OMB Information Collection Approval Number: No 6. Other Identifying Number(s): No 7. System Name (Align with system Item name): National Outbreak Reporting System Public (NORS Public) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Richard Williams 10. Provide an overview of the system: National Outbreak Reporting System Public (NORS Public) is an ASP.Net web application with a SQL server backend. This system provides the ability for the public to look at a small subset of filtered foodborne outbreak data captured by the National Outbreak Reporting System (NORS). This is performed by filtering and transferring data from the NORS system to the NORS Public database. This is aggregate data that is extracted from the NORS system by using certain established parameters and then loaded to the NORS Public database. 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): No 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: This system provides the ability for the public to look at a small subset of filtered foodborne outbreak data captured by the National Outbreak Reporting System (NORS). This is merely a site, with no PII, that can be accessed by the public for general information. The public is able to choose from a few basic drop downs to filter the data that is available to them. Public users are allowed to download an XML file of the data. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: No IIF Collected. E-Authentication Assurance Level = N/A Risk Analysis Date = 4/3/2009 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Apr 27, 2009 Approved for Web Publishing: - Date Published: - _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCZVED National Outbreak Reporting System (NORS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCZVED National Outbreak Reporting System (NORS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): No 5. OMB Information Collection Approval Number: No 6. Other Identifying Number(s): No 7. System Name (Align with system Item name): National Outbreak Reporting System (NORS) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Ian Williams 10. Provide an overview of the system: The National Outbreak Reporting System (NORS) provides collection and storage of aggregate outbreak data from State Health Departments. The data is studied and analyzed as a part of national surveillance. Aggregate outbreak data is entered into the system as individual incident reports via client web interface for study as a passive surveillance tool. This surveillance analysis normally occurs after an actual outbreak has occurred. State administrators have the ability to finalize and approve individual incident reports. The data is collected at the CDC in a normalized relational database. Separate applications to work with the surveillance data. Administration and individual incident record viewing is done through the web interface. Currently aFORS (analytical FORS) is the only additional module that has been integrated. NORS has several system interconnections and dependencies. NORS will share functionality with PulseNet and NARMS by automatically sending requests and response for data between the systems. 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): No 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: The National Outbreak Reporting System (NORS) provides collection and storage of aggregate outbreak data from State Health Departments. The data is studied and analyzed as a part of national surveillance. Aggregate outbreak data is entered into the system as individual incident reports via client web interface for study as a passive surveillance tool. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: No PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Dec 12, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCZVED National West Nile Surveillance System - (ArboNet) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCZVED National West Nile Surveillance System - (ArboNet) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-02-02-1480-00 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): National West Nile Surveillance System (ArboNet) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Marc Fischer 10. Provide an overview of the system: National West Nile Surveillance System (Arbonet). Allows reporting of arboviral cases from the states. Can be reported through XML or through ArboNet front end. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): N/A 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: N/A 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) N/A 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: N/A PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Michael Harris Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jun 11, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCZVED OutbreakNet PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCZVED OutbreakNet 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CCID NCZVED OutbreakNet 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Richard Williams 10. Provide an overview of the system: OutbreakNet is an external facing web application. The application collects both line list and outbreak data that relates to cases but does not contain PII. The data is used to enable reporting and hypothesis generation during a foodborne outbreak. From this data the system will generate reports and allow direct connectivity for statisticians within the CDC. Allowing for greater analysis and easier reporting to allow more focus on the science behind the outbreak. 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): N/A 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: The application collects both line list and outbreak data that relates to cases but does not contain PII. The data is used to enable reporting and hypothesis generation during a foodborne outbreak. The data entered into the system is largely captured by state health departments and then shared voluntarily with the CDC. Once entered into OutbreakNet, states will not be able to download or read other states data. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) N/A 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: No PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Feb 3, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCZVED Pathology Report Information (IDPA Pathology) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCZVED Pathology Report Information (IDPA Pathology) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): 09-20-0106 5. OMB Information Collection Approval Number: No 6. Other Identifying Number(s): No 7. System Name (Align with system Item name): CDC Pathology Report Information (IDPA Pathology) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Mitesh Patel 10. Provide an overview of the system: The IDPB Lab Database application is used to support the operational activities of the laboratory covering the full specimen lifecycle. For all specimens, the system allows you to accession the specimen and case info, and contact information for the submitters; Pathologists can request tests to be performed, and setup & generate the final report that is sent to the submitters; Technologists can view the pending tests, setup the experiment, and enter the results. 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): Yes 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): The system does not share PII. The system, in the form of report, only discloses the decedent’s or patient’s name, if known, to the health official(s) that submitted the specimens to IDPB. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: The data is used internally by IDPB staff members and consists of, for the most part, PII text data related to cases submitted to IDPB for testing of infectious diseases. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place to address any of these situations listed; they do not seem to apply. The majority of our cases are people or animals that are dead. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: This is an internal facing system on the CDC network behind the firewall with no interconnections to any other outward facing system. CDC users go through yearly Computer Security training to address basic computer security issues. The DB is housed in a secure environment. IIF collected for identification purposes EAAL = N/A Risk Analysis Date = January 30, 2009 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Apr 13, 2009 Approved for Web Publishing: - Date Published: - _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCZVED Project Planning and Budget Integration Database (Vertical Planning) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCZVED Project Planning and Budget Integration Database (Vertical Planning) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CCID NCZVED Project Planning and Budget Integration Database (Vertical Planning) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Richard Williams 10. Provide an overview of the system: In order to provide consistency for planning and budget integration across the Center, NCZVED has chartered a working group, composed of representatives from each division, to develop a central NCZVED database to be used as a management tool for vertical and horizontal planning, budget and planning integration, mapping branch projects to division, center, coordinating center and CDC goals, and that serves as a building block for future CCID performance measurement processes. Use of this database enables a unified approach to expressing the public health priorities and impacts as measured by Center and CDC goals. This database may also serve as potential model for use by other CCID centers. 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): N/A 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: N/A 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) N/A 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: N/A PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Michael W. Harris Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Oct 21, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NCZVED Special Pathogens Diagnostics 1.0 (SPD) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NCZVED Special Pathogens Diagnostics 1.0 (SPD) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): 09-20-0106 5. OMB Information Collection Approval Number: No 6. Other Identifying Number(s): No 7. System Name (Align with system Item name): Special Pathogens Diagnostics 1.0 (SPD) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Dr. Pierre Rollin 10. Provide an overview of the system: Special Pathogens Diagnostic Laboratory System (SPD) is a specimen/result tracking and management system (data collection) used to manage all samples that come into the Special Pathogens branch. This includes any samples from humans or animals that arrive at CDC that are sick with an “unknown” virus, and all samples that are suspect for one of the viral or hemorrhagic fevers that the branch deals with. This includes but is not limited to the following: Hantavirus, Lassa Fever, Ebola, Marburg, Machupo, Junin, Guanarito, Yellow Fever, LCM (Lymphocytic Choriomeningitis Virus), CCHF (Crimean-Congo Hemorrhagic Fever), Sabia, Rift Valley Fever (RVF), Tick Bourne Encephalitis (TBE), UNK, White Water, Russian Spring Summer Encephalitis (RSE), Pichinde, Hendra, Sars, Al Khumrah Virus (ALK). SPD is a client server application whose data collection also includes some environmental samples. All samples arrive into the Diagnostic Laboratory and the specimen information is logged in there. The Elisa results for the samples are generated in this lab. All results are linked back to the originating sample information. Reports are then generated. 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): Yes 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Reports are generated for State and International Health Departments, Hospitals, and Universities for the unknown virus samples they submit to the SPD lab. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: Special Pathogens Diagnostic Laboratory System (SPD) is a specimen/result tracking and management system used to collect and manage all unknown virus samples that come into the Special Pathogens branch from State and International Health Departments, Hospitals, and Universities. SPD tests these samples and generate reports based on the results, then forwards the results back to the requesting organization. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) There is no notification since samples are received directly from Hospitals, Universities, and Physicians where the patients are being treated. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Access to the SPD database is restricted to authorized personnel only. The SPD lab is in building 15, which has restricted access. Access to the application is based on role based security using Active Directory. IIF Collected. E-Authentication Assurance Level = N/A Risk Analysis Date = 3/31/09 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Apr 13, 2009 Approved for Web Publishing: - Date Published: - _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NIP New Vaccine Surveillance Network (NVSN) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? No If this is an existing PIA, please provide a reason for revision: PIA Validation 1. Date of this Submission: CDC CCID NIP New Vaccine Surveillance Network (NVSN) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): No, System does not constitute a “system of records” under the Privacy Act. 5. OMB Information Collection Approval Number: No 6. Other Identifying Number(s): No 7. System Name (Align with system Item name): New Vaccine Surveillance Network (NVSN) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Marika Iwane 10. Provide an overview of the system: The system collects inpatient, outpatient, and well-child new vaccine surveillance data to evaluate the impact of new vaccines and vaccine policies. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): No, System does not share or disclose information. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: The surveillance data on symptoms, diagnosis, interview, lab results, and vaccine verification are used to evaluate the impact of new vaccines and vaccine policies. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) Yes, Date of Birth, Business Contact Information 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Administrative controls: IIF data are backed up daily and copies stored in a separate facility. The SQL Server database administration is maintained by ITSO. All modification to the database conforms to ITSO CM. Technical controls: Access to the data is controlled by user ID and password in addition to the user ID and password needed to access the network. Physical controls include security guards, ID badges, cardkeys and cipher locks. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Nov 6, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NIP Vaccine Adverse Event Reporting System (VAERS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: Initial PIA Migration to ProSight 1. Date of this Submission: CDC CCID NIP Vaccine Adverse Event Reporting System (VAERS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-02-01-1050-02 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): 09-20-0136 5. OMB Information Collection Approval Number: System is Exempt 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): Vaccine Adverse Event Reporting System (VAERS) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Scott Campbell 10. Provide an overview of the system: VAERS functions as the national passive surveillance system that allows CDC and FDA to monitor vaccine safety as mandated by the National Childhood Vaccine Injury Act of 1986. The goal of VAERS is to monitor vaccine safety by receiving reports of adverse events following vaccination. VAERS is the national passive surveillance vaccine safety monitoring system in the United States. VAERS is jointly operated by the Centers for Disease Control and Prevention, National Immunization Program and Food and Drug Administration, Center for Biologics Research and Evaluation to monitor the safety of vaccines licensed for use in the United States. It allows CDC and FDA to monitor vaccine safety as mandated by the National Childhood Vaccine Injury Act (NCVIA) of 1986 (P.L. 99-660), the Code of Federal Regulations Title 21, Part 600.80, and under statutory authority from the Public Health Service Act, section 301 (42 USC 241). VAERS receives reports of adverse events following vaccination from health care providers, vaccine manufacturers, state health departments, vaccine recipients and/or their parents/guardians, and other parties interested in vaccine safety. Health care providers by law, and manufacturers additionally by regulation, are required to report certain types of events that occur within specific time frames after vaccination. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): Yes 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): VAERS is jointly operated by the CDC/National Immunization Program and FDA/Center for Biologics Research and Evaluation to monitor vaccine safety IAW P.L. 99-660 and 21 CFR 600.80. Both agencies receive different versions of the VAERS database as well as access to the primary VAERS database and imagebase maintained by the contractor. CDC and FDA coordinate VAERS related research and surveillance activities. FDA has the authority to take regulatory action based on potential vaccine safety problems detected by VAERS and conducts reviews of the safety of individual vaccine lots using VAERS, and receives PII for VAERS reports to allow for specific follow-up of reports for this purpose. The Centers for Disease Control and Prevention, National Immunization Program jointly operates VAERS with the Food and Drug Administration, Center for Biologics Research and Evaluation to monitor vaccine safety in accordance with P.L. 99-660 and 21 CFR 600.80. Both agencies receive different versions of the VAERS database and have access to the primary VAERS database and imagebase maintained by the VAERS contractor. CDC and FDA coordinate VAERS related research and surveillance activities. FDA has the authority to take regulatory action based on potential vaccine safety problems detected by VAERS and conducts reviews of the safety of individual vaccine lots using VAERS. Pursuant to the Standards for Privacy of Individually Identifiable Health Information promulgated under the Health Insurance Portability and Accountability Act (HIPAA)(45 CFR Parts 160 and 164), covered entities including CDC may disclose protected health information to public health authorities "authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury, or disability, including, but not limited to, the reporting of disease, injury, vital events such as birth or death, and the conduct of public health surveillance, public health investigations, and public health interventions." The definition of a public health authority includes "a person or entity acting under a grant of authority from or a contract with such public agency" The VAERS Contractor will act under contract with the CDC to carry out the Vaccine Adverse Event Reporting System which is authorized by the statutory authority from the Public Health Service Act, section 301 (42 USC 241), the National Childhood Vaccine Injury Act (NVCIA), P.L. 99-660, and 21 CFR 600.80 and therefore may be considered a public health authority under the Privacy Rule for purposes of this project. Further, CDC considers this to be a disease/injury reporting system for which disclosure of protected health information by covered entities is authorized by section 164.512(b) of the Privacy Rule [45 CFR 164.512(b)]. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: VAERS collects information specific to the VAE on the Form VAERS-1, including information identifying the person who received the vaccine, the vaccine provider, and the reporter of the VAE, demographic information on the patient, a description of the VAE, information about the vaccine(s) being reported, information about vaccinations received during the previous month and any pre-existing illnesses, and information about previous VAEs experienced. The completed Form VAERS-1 can be submitted to the VAERS program by mail or fax; an electronic version of the Form VAERS-1 is also available on the Internet allowing secure web-based reporting. The information gathered is monitored and analyzed by Agency staff to ensure that vaccines are used appropriately and VAEs are recognized and appropriate measures taken. The information collected by VAERS is the minimum required for assessment and analysis of potential VAEs and for follow-up activities as required for evaluation of VAEs, for FDA's responsibilities for licensing and regulating vaccines, and for coordination with reporting entities to include local and state health authorities. The Department of Health and Human Services (DHHS) established VAERS to provide a single system for the collection and the analysis of reports on all VAEs associated with the administration of any U.S. licensed vaccine, in all age groups. To meet the needs for monitoring vaccine safety, the CDC and the FDA have worked together since 1989 to sponsor VAERS. These needs relate to CDC's responsibilities for the national control of vaccine-preventable diseases, ensuring vaccine safety, and for providing assistance to public sector vaccine programs, and FDA's responsibilities for licensing and regulating vaccines, and ensuring vaccine safety. The information collected by VAERS is required for assessment and analysis of potential VAEs, and for follow-up activities, for meeting FDA's responsibilities for licensing and regulating vaccines, and for coordination with reporting entities. Information being collected contains IIF. Health care providers and manufacturers are required by law to report reactions to vaccines listed in the Table of Reportable Events Following Immunization. Reports for reactions to other vaccines are voluntary except when required as a condition of immunization grant awards. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) VAERS collects information specific to the VAE using the Form VAERS-1; completed forms are submitted to the VAERS program by mail or fax; an electronic version of the Form VAERS-1 is also available on the Internet allowing secure web-based reporting. VAE 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): Yes 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Measures include but are not limited to maintaining the system and information contained in secured buildings with controlled access, using secured storage of all system data and forms, secure access to system operational and storage areas, using computer system protection with Technical controls (User ID, passwords, firewalls, VPN, encryption, IDS, virus protection, and password restriction of user access, employing routine system security audits and periodic risk and vulnerability assessments; Physical security controls (guards, ID badges, key cards & cipher locks), personnel security controls, and data backup and recovery, and transmission of information secured using encryption and Secure Socket Layer (SSL) technology, including data submitted using the web-based reporting form. Administrative controls: role based access. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: David Knowles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden, OCISO Sign-off Date: Apr 25, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NIP Vaccine Ordering and Distribution System (VODS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: Initial PIA Migration to ProSight 1. Date of this Submission: CDC CCID NIP Vaccine Ordering and Distribution System (VODS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-01-01-1030-02 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A - System does not constitute a "System of Records" under the Privacy Act. 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): Vaccine Ordering and Distribution System (VODS) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Terry Boyd 10. Provide an overview of the system: To allow grantees to order vaccine from the federal contract. VODS is a Database Management System (DBMS) used by 59 state, city, and territorial government Immunization Programs (called Projects). Only these Projects, designated by CDC, are eligible to use VODS (the application is not designed or accessible for any agency other than these 59 Projects). The Projects use VODS to order, and optionally to track and record information relating to vaccine purchases with public funds (e.g., Vaccines For Children program (VFC), Section 317 Grant funds, and State general funds). 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): This system does not collect, maintain (store), disseminate and/or pass through IIF within any database(s), record(s), file(s) or website(s) hosted by this system 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: This system does not collect Personal Identifiers; information is organizational data 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) This system does not collect, maintain (store), disseminate and/or pass through IIF within any database(s), record(s), file(s) or website(s) hosted by this system 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: This system does not collect, maintain (store), disseminate and/or pass through IIF within any database(s), record(s), file(s) or website(s) hosted by this system PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Alice M. Brown Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden, OCISO Sign-off Date: Aug 15, 2007 Approved for Web Publishing: - Date Published: - _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID NNCHHSTP FAO Applicant Approval System (FAAS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID NNCHHSTP FAO Applicant Approval System (FAAS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): FAO Applicant Approval System (FAAS) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Rashad Burgess 10. Provide an overview of the system: The Funding Applicant Approval System “FAAS” project is initiated to partner with the Strategic Science and Program Unit (SSPU) to automate the evaluation of applications for DHAP Funding. The major Business Functions of this project are CDC/Branch functions which will be conducted in collaboration with System Administrative functions as stipulated by DHAP. FAAS establishes an automated, best practices process for initiating and managing the evaluation of applications (SF 424) for Funding Opportunity Announcements including: Reviewer recruitment Letters of Intent “LOI” Establishing an automated, best practices process for conducting Special Emphasis Panel “SEP” activities Establishing an automated best practices process for conducting Pre-Decisional Site Visit “PDSV” activities FAAS will establish and maintain a list of potential and actual SEP reviewers to review, evaluate, and score SF 424 Grant applicants. Reviewers, who have been validated by CDC as qualified to participate in SEP activities, will be granted limited (time) access to the FAAS application during review process (less than 60 days), after which reviewer accounts are automatically deactivated. Reviewers will access the FAAS application via the Internet during SEP activities. CDC employees participating in SEP activities will also use a limited (time) FAAS account to access the application from the Internet. FAAS is a web-based application, developed using Microsoft .NET and SQL Server 2005 technology. The application is used to support the application, evaluation, and notification of Federal Grants for HIV prevention. Only Business IIF information is collected, processed, or stored within FAAS. 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): N/A 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: Business/organization applicant information for various federal grants. Information is collected to assist in evaluations of business/organization applicant qualifications. Only Business IIF information is collected, processed, or stored within application. No PII information is collected, processed, or stored within the application. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) N/A 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: No IIF Collected. E-Authentication Assurance Level = 1 Risk Analysis Date = 5 Jan 2009 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Apr 2, 2009 Approved for Web Publishing: - Date Published: - _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID OD Coordinating Center for Infectious Disease (CCID) Informatics Customer Support (c.Support) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID OD Coordinating Center for Infectious Disease (CCID) Informatics Customer Support (c.Support) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): 09-90-0001 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): Coordinating Center for Infectious Disease (CCID) Informatics Customer Support (c.Support) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Tonya Martin 10. Provide an overview of the system: c.Support® from GWI Software is a comprehensive help desk/customer support application that allows support organizations to coordinate and manage everyday support activities as well as track assets, build a knowledge base and provide customer self-help. Designed and developed using the Microsoft® .NET Framework, c.Support provides the best overall value by leveraging our existing investment in Microsoft® systems, servers, and infrastructure. c.Support will integrate with Microsoft Active Directory®, Domino Directory, a Microsoft SQL database, and/or Microsoft® CRM. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): Yes 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Other CDC and CDC Contracted Expert Resources for Incident Resolution. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: Records business email address, business phone, fax, and mailing address. Submission is mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) None 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Customer information is stored on a Microsoft SQL Server inside the firewall and protected by all CDC network protections. E-Authentication Assurance Level = N/A Risk Analysis Date = 10/31/2008 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Nov 24, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID OD Laboratory Information Tracking System (LITSPlus) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID OD Laboratory Information Tracking System (LITSPlus) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): 09-20-0106 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): Laboratory Information Tracking System (LITSPlus) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: James Tolson 10. Provide an overview of the system: The Laboratory Information Tracking System LITSPlus) is a laboratory information management system (LIMS) that provides a mechanism to enter, edit, analyze & report laboratory specimen and test results electronically. The specimen information collected within the system parallels individual laboratory samples that come into (or are generated by) the CDC. Once the information about the specimen is entered into the system users can examine all the data about the specimen they are working with; including data from other CDC laboratories that performed tests on the specimen. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): Yes 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): N/A, System does not share or disclose PII information 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: 1) to enter, edit, analyze & report laboratory specimen and test results 2) to track product requests and fulfillment 3) The product captures employee, business and patient PII information. 4) Employee and business PII is voluntary. Patient PII is captured at the state health labs, hospitals and private laboratories and submitted to CDC. The policy for submission of PII would be the responsibility of these centers. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) 1) Notices are sent to employees and business partners via email. Patients should be notified by the submitting agencies. 2) Employees are asked for their office location and phone number. Business partners submit name, address, phone number and email 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Administrative controls: The data will be secured by logical access controls. Technical controls: Access to the data is controlled by user ID and password, firewall. Internal physical controls include security guards, ID badges, and cardkeys. IIF collected for research purposes EAAL = N/A Risk Analysis Date = March 10, 2009 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Mar 24, 2009 Approved for Web Publishing: - Date Published: - _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CCID OD Space Management System (SMS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CCID OD Space Management System (SMS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): No 5. OMB Information Collection Approval Number: No 6. Other Identifying Number(s): No 7. System Name (Align with system Item name): Space Management System (SMS) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Marianne Simon 10. Provide an overview of the system: The Space Management System (SMS) is an internal client-server CDC application that tracks the Coordinating Center for Infectious Disease’s (CCID) assigned building space, office space, and laboratory space. SMS captures information regarding building space assigned to CCID. Space description consists of campus, buildings, floors, office numbers, office square footage, laboratory numbers and laboratory types. The system tracks which space allocations are assigned to centers and divisions. The system allows authorized users to enter space information and produce reports on space usage. There are 3 users and 1 developer who have access to the system. SMS is an old system developed and maintained as an ASP application with a SQL backend. 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): No 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: SMS captures information regarding building space assigned to CCID. No IIF information is collected. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: No IIF collected E-Authentication Assurance Level = N/A Risk Analysis Date = October 20, 2008 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomaas P Madden Sign-off Date: Dec 12, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC COCHIS NCPHI All Threat Agent Content System - ATACS PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC COCHIS NCPHI All Threat Agent Content System - ATACS 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-04-02-1196-00-110-028 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): All Threats Agent Content System (ATACS) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Sherrie Bruce 10. Provide an overview of the system: The All Threats Agent Content System (ATACS) is a web application that allows authorized users to retrieve content related to biological agents and pandemic/avian influenza. The vision for ATACS is to maintain a site where categories of preparedness- and response-related information can be provided for all bioterrorism threat agents (i.e., anthrax, botulism, etc.) and other critical infectious diseases that CDC responders may need to identify and contain. Examples of categories of information include "impact on wildlife" and "water-borne" information. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): System does not have IIF 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: The system collects only the documents that the users access within the system so that they can be presented with a list of their most accessed documents in the future. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No IIF is Collected 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: No IIF is collected by the system No IIF Collected. E-Authentication Assurance Level = N/A Risk Analysis Date = 08/11/2009 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Michael W. Harris Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Sep 10, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CoCHIS NCPHI Data Warehousing (DW) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? No If this is an existing PIA, please provide a reason for revision: PIA Validation 1. Date of this Submission: CDC CoCHIS NCPHI Data Warehousing (DW) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): 09-20-0136 5. OMB Information Collection Approval Number: No 6. Other Identifying Number(s): No 7. System Name (Align with system Item name): Data Warehousing (DW) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Michele Renshaw 10. Provide an overview of the system: DW collects data pertaining to diseases across states with disparate systems into a repository used for surveillance and analysis. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): Yes 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): DW is a non-major application that receives data, including IIF for its clients systems within CDC, CCID and DISSS. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: The system collects voluntary or involuntarily collected data about flu reports, nationally notifiable diseases, epidemics and routine public health events 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) None 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: DW is subject to certification and accreditation requirements of CDC "Moderate" security systems. It is subject to oversight from an assigned security professional, as well as OIG audit and OCISO requirements. IIF is collected and the proper controls are utilized to safeguard sensitive information. E-Authentication Assurance Level = N/A Risk Analysis Date = August 10, 2009 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: Nov 14, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CoCHIS NCPHI Division of Knowledge Management Services Decision Support Framework (DKMS-DSF) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CoCHIS NCPHI Division of Knowledge Management Services Decision Support Framework (DKMS-DSF) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-05-02-1414-00 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): DKMS-DSF 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Nedra Garrett 10. Provide an overview of the system: DKMS is developing a Decision Support Framework (DSF) of services to capture, aggregate and integrate highly relevant information into public health applications to support decision-making in various areas, such as biosurveillance. This framework will consist of a number of tools, processes and systems to support searching and filtering content using natural language processing techniques, weighting algorithms, probabilistic matching and others methods to gain the highest level of relevancy for the content areas 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): N/A 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: Collect: User preference data – Users of the system will be able to provide feedback on the information that they are receiving in order to improve the data received in the future. Collect: Web/Document content – The Thunderstone appliance indexes content and documents from specifically chosen sources. Disseminate: Search results – Search results returned by the web service will contain the text of the link, and potentially summary text of the content or document. Disseminate: Ontological information – A second web service will provide search term expansion by using ontological data stored in the database. None of the above information contains IIF. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) N/A 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: N/A PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Michael W. Harris Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jun 11, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC COCHP DCBDDD Metropolitan Atlanta Developmental Disabilities Surveillance Program - (MADDSP) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC COCHP DCBDDD Metropolitan Atlanta Developmental Disabilities Surveillance Program - (MADDSP) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: N/A 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): 09-20-0136 5. OMB Information Collection Approval Number: No 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): Metropolitan Atlanta Developmental Disabilities Surveillance Program (MADDSP) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Andrew R. Autry, PhD 10. Provide an overview of the system: The Metropolitan Atlanta Developmental Disabilities Surveillance Program (MADDSP) is an ongoing, multiple source ascertainment surveillance system that has been functioning since its inception in 1991. It is the model surveillance system by which states and localities collect surveillance data for developmental disabilities. The purposes of the MADDSP were to develop surveillance case definitions for five developmental disabilities (mental retardation, cerebral palsy, visual impairment, hearing impairment, and epilepsy) and provide prevalence estimates for the five disabilities in the metropolitan Atlanta area (counties of Clayton, Cobb, DeKalb, Fulton, and Gwinnett). 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): Yes 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): No 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: This is public health surveillance, not research. The participants do not know that their private data are being collected. The IIF allows for linkages of the abstracted data with birth and death certificates. It is also used to de duplicate the database. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) The participants do not know that their private data are being collected. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): Yes 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: This is public health surveillance, not research. The participants do not know that their private data are being collected. IIF is Collected by system E-Authentication Assurance Level = N/A Risk Analysis Date = 12/09/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia P. Kittles OCISO C&E PM Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P Madden Sign-off Date: May 27, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CoCHP Intranet Platform OD GA - Customer Satisfaction PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CoCHP Intranet Platform OD GA - Customer Satisfaction 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CoCHP Intranet Platform OD GA - Customer Satisfaction 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers. CoCHP Satisfaction Survey Tool. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CoCHP Intranet Platform OD GA - Data Release PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CoCHP Intranet Platform OD GA - Data Release 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CoCHP Intranet Platform OD GA - Data Release 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers. Data Relase Plans Sharing for Publication. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CoCHP Intranet Platform OD GA - Dataset Catalog PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CoCHP Intranet Platform OD GA - Dataset Catalog 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CoCHP Intranet Platform OD GA - Dataset Catalog 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers. Information about public health datasets and statistical code samples. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CoCHP Intranet Platform OD GA - Diversity Recruitment Contacts PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CoCHP Intranet Platform OD GA - Diversity Recruitment Contacts 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CoCHP Intranet Platform OD GA - Diversity Recruitment Contacts 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers. Personnel Recruitment Contacts Site. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CoCHP Intranet Platform OD GA - Issue Tracker PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CoCHP Intranet Platform OD GA - Issue Tracker 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CoCHP Intranet Platform OD GA - Issue Tracker 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers. Chronic Dev Team Issue Tracker Tool. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CoCHP Intranet Platform OD GA - Legislative Database PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CoCHP Intranet Platform OD GA - Legislative Database 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CoCHP Intranet Platform OD GA - Legislative Database 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers. OPEL Legislative Database. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CoCHP Intranet Platform OD GA - OPEL Tracking System PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CoCHP Intranet Platform OD GA - OPEL Tracking System 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CoCHP Intranet Platform OD GA - OPEL Tracking System 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers. Q&A tracking for OPEL. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CoCHP Intranet Platform OD GA - Portals Course Registration PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CoCHP Intranet Platform OD GA - Portals Course Registration 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CoCHP Intranet Platform OD GA - Portals Course Registration 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers. Project Officer of the Future Course Registration. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CoCHP Intranet Platform OD GA - Site Visits PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CoCHP Intranet Platform OD GA - Site Visits 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CoCHP Intranet Platform OD GA - Site Visits 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers. Project Officer of the Future tool to add site visits to the CDC events calendar. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CoCHP Intranet Platform OD GA - Upload Request Forms PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CoCHP Intranet Platform OD GA - Upload Request Forms 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CoCHP Intranet Platform OD GA-Upload Request Forms 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers. Forms used to request uploads for various stages of application development/deployment. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CoCHP Intranet Platform OD GA-Staff List PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CoCHP Intranet Platform OD GA-Staff List 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CoCHP Intranet Platform OD GA-Staff List 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers. Provides staff list for NCCDPHP employees. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CoCHP Intranet Platform OD HSR PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CoCHP Intranet Platform OD HSR 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CoCHP Intranet Platform OD HSR 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers. Human Subjects Review Tracking System. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CoCHP Intranet Platform OD HSR-CPS PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CoCHP Intranet Platform OD HSR-CPS 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CoCHP Intranet Platform OD HSR-CPS 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers. CoCHP Project Search. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CoCHP Intranet Platform OD NCCDPHP Intranet PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CoCHP Intranet Platform OD NCCDPHP Intranet 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CoCHP Intranet Platform OD NCCDPHP Intranet 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CoCHP Intranet Platform OD NCCDPHP Intranet - Events PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CoCHP Intranet Platform OD NCCDPHP Intranet - Events 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CoCHP Intranet Platform OD NCCDPHP Intranet - Events 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CoCHP Intranet Platform OD NCCDPHP Intranet - Events Service PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CoCHP Intranet Platform OD NCCDPHP Intranet - Events Service 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CoCHP Intranet Platform OD NCCDPHP Intranet - Events Service 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers. Read/write Events from CDC Events used by CDC Connects. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CoCHP Intranet Platform OD Personnel Reporting System (PRS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CoCHP Intranet Platform OD Personnel Reporting System (PRS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CoCHP Intranet Platform OD Personnel Reporting System (PRS) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): PII is shared with internal staff for a variety of administrative tasks. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There is only one application on the platform that maintains PII. There are several applications that maintain business contact data. The PII consists of personnel information, including grade level and DoB. The SSN is used to link records from MISO but is not visible to the end user. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CoCHP Intranet Platform OSH Clearinghouse PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CoCHP Intranet Platform OSH Clearinghouse 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CoCHP Intranet Platform OSH Clearinghouse 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CoCHP Intranet Platform OSH GA - Smoking and Health Resource Library PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CoCHP Intranet Platform OSH GA - Smoking and Health Resource Library 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CoCHP Intranet Platform OSH GA - Smoking and Health Resource Library 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers. Searchable abstracts of published tobacco-related articles; intranet version has access to full-text pdf files. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CoCHP Intranet Platform OSH MCRC (Admin) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CoCHP Intranet Platform OSH MCRC (Admin) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CoCHP Intranet Platform OSH MCRC (Admin) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers. Access to, and ordering support for, advertising campaigns for tobacco use prevention. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CoCHP Intranet Platform OSH NTCP Chronicle - Old PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CoCHP Intranet Platform OSH NTCP Chronicle - Old 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CoCHP Intranet Platform OSH NTCP Chronicle - Old 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers. Archived production internet version used to collect information on state tobacco control programs. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CoCHP Intranet Platform OSH STATE (Admin) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CoCHP Intranet Platform OSH STATE (Admin) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CoCHP Intranet Platform OSH STATE (Admin) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers. OSH State System Admin Tool. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 2, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC CoCHP Intranet Platform XSS Validate PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC CoCHP Intranet Platform XSS Validate 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC CoCHP Intranet Platform XSS Validate 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Cindy Allen 10. Provide an overview of the system: The CoCHP Internet Platform provides dynamic web content to internal CDC staff in support of the Coordinating Centers for Health Promotion. The platform also hosts several applications for other Coordinating Centers. Read/write Events from CDC Events used by CDC Connects. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Business Contact information is shared with internal staff. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: There are several applications that maintain business contact data. The data is used in routine administrative tasks. The PII is a requirement of employment at CDC and therefore mandatory. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) No processes in place. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Platform follows all NIST administrative, technical, and physical controls as required under the moderate EMSSP. IIF Collected = Yes E-Authentication Assurance Level = Risk Analysis Date = 12/10/08 PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Jan 5, 2009 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC COTPER Action Item Registry - (AIR) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC COTPER Action Item Registry - (AIR) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-03-02-8121-00 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): none 7. System Name (Align with system Item name): Action Item Registry - (AIR) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Joseph Dell 10. Provide an overview of the system: The COTPER Action Item Registry is an ASP web application hosted on the CDC Intranet with a SQL server database used as the backend. The application serves as a project planning and task tracking tool that allows users to provide current status and remarks on the progress towards the completion of various tasks and activities. In addition, the application generates real-time status reports based on specified criteria. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): No IIF or PII is collected 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: No information is collected, only disseminated. No PII is involved. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) None 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: N/A PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Alice M. Brown Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Mar 27, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC COTPER Center for Public Health Preparedness Program Activity Database - (CPHP) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC COTPER Center for Public Health Preparedness Program Activity Database - (CPHP) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-03-02-8121-00 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: No 6. Other Identifying Number(s): None 7. System Name (Align with system Item name): Center of Public Health Preparedeness Program Activity Database (CPHP) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Joseph Dell 10. Provide an overview of the system: The CPHP Activity Database is an intranet-based tool that allows CPHP Project Officers to electronically view and update required activity information collected from their CPHP centers as part of continuation applications and progress reports¿. The CPHP Activity Database includes program information for the respective budget periods. Activities are designated within the database as either Program Activities (education and training, partner-requested, or supportive) or Network Activities. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): The IIF contained in the system is made available to all program officers within the CPHP program. The application can also be accessed by anyone with access to the CDC intranet. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: The system displays names, phone numbers, email addresses, and/or mailing addresses for points of contact within schools that participate in the CPHP program. The information is first entered by the schools in a Word document, which is then emailed to the project officer. COTPER IT personal (the developers of the CPHP application) import the data to the SQL database which serves as the backend for all the CPHP applications data. It is visible to anyone with access to the CDC intranet via a web application (the CPHP application). The information can also be updated by anyone with access to the CDC intranet. The application users are aware that this information can be modified and accept the risk as this contact information store is used for convenience. Submission of this information is voluntary. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) The CPHP program officers that collect the original Word forms are responsible for notifying school contacts when changes occur. By submitting the Word document via email, participants accept any risks associated with the unsecured communication method ( 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Standard procedures to secure SQL databases within the shared hosting environment will be used to secure information. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Michael W. Harris Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: May 22, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC COTPER COTPER Calendar PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC COTPER COTPER Calendar 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-03-02-8121-00 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): NO 5. OMB Information Collection Approval Number: NO 6. Other Identifying Number(s): NO 7. System Name (Align with system Item name): COTPER Calendar 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Joseph Dell 10. Provide an overview of the system: The COTPER Calendar is an ASP application running on a SQL server database, developed to help identify and share key programmatic events and activities from across divisions and the agency. The COTPER Calendar allows anyone behind the CDC firewall to enter an event, but only events approved by the COTPER Calendar content approvers will appear. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): No IIF or PII is collected 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: No information is collected, only disseminated. No PII is involved. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) None 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: NO PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Alice M. Brown Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: - Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC COTPER COTPER Intranet PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC COTPER COTPER Intranet 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-03-02-8121-00 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): No 5. OMB Information Collection Approval Number: No 6. Other Identifying Number(s): No 7. System Name (Align with system Item name): COTPER Intranet 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Joseph Dell 10. Provide an overview of the system: The COTPER Intranet is an internally-facing web-based application designed with Microsoft classic ASP. The Intranet is used by COTPER to convey its vision and accomplishments across the agency. The intranet site hosts a variety of applications that have improved the efficiency of COTPER’s business operations. Staff can now visit the website to update site content dynamically, review policies and procedures, and fill-out and submit administrative forms. The system architecture contains a web front-end with a Microsoft SQL backend which is hosted in the Designated Server Site (DSS) and managed by ITSO. While the data on the intranet site may be viewed by anyone within CDC, the target audience is the ~500 users within COTPER. Users must be on the CDC network to access the Intranet. No non-CDC users can access the Intranet. No Personally Identifiable Information (PII) is contained within the COTPER Intranet system. There are no system dependencies beyond the ITSO server which the system is hosted on. The application does not generate any reports nor does it share any information across other federal agencies. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): No IIF or PII is collected 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: No information is collected, only disseminated. No PII is involved. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) None 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: No PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Alice M. Brown Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Mar 28, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC COTPER COTPER Stockpile Resource Plan - (SRP) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: PIA Validation 1. Date of this Submission: CDC COTPER COTPER Stockpile Resource Plan - (SRP) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-03-01-1352-00-110-246 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A - System does not constitute a "System of Records" under the Privacy Act. IIF is business related, and data are normally retrieved by product numbers and location. See additional comment in Question 30. 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): Stockpile Resource Plan (SRP) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Robert Phillips 10. Provide an overview of the system: The Division of the Strategic National Stockpile (DSNS) program provides pharmaceuticals, vaccines, medical supplies, and medical equipment to augment depleted state and local resources during response to terrorist attacks or other emergencies. System does not constitute a "System of Records" under the Privacy Act. All information collected on individuals is business related, and data are normally retrieved by product numbers and location. 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): The Veterans Administration/ National Acquisition Center (VA/NAC) receives ordering information for emergency response planning and deployments. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: The IIF the CDC will collect, maintain, or disseminate is work related and includes name, business address, business phone number and business e-mail address and user ID for system users on a voluntary basis. Vendor information is collected as part of ongoing contractual activities associated with procurement of goods and services for the CDC. This is the minimum necessary to accomplish system purposes. Submission is voluntary. All information collected on individuals is business related, and data are normally retrieved by product numbers and location. While names are collected, names are incidental to the system as points of contact. It has been officially determined that the Privacy Act does not apply. System does not constitute a "System of Records" under the Privacy Act. IIF is business related, and data are normally retrieved by product numbers and location. Therefore, no SORN is necessary and there is no PIA weakness. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) There is a process to notify individuals when approved rights have changed. The opportunity for consent is provided to individuals via the SRP Rules of Behavior, which they must sign before an account is created. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): Yes 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Technical controls: User ID, passwords, firewall, VPN, encryption, IDS, RSA Secuire IDs for CDC staff. Physical Controls: The information is stored in an Oracle Database which restricts access to authorized users only, and the servers are hosted in a locked and secure computer facility with controlled access. Guards, ID badges, key cards, cipher locks, closed circuit TV. Administrative: Role based access. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Betsey Dunaway Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Deborah Holtzman Sign-off Date: Aug 18, 2006 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC COTPER DEOC Decision Support System (DDSS) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC COTPER DEOC Decision Support System (DDSS) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: - 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A 5. OMB Information Collection Approval Number: N/A 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): CDC COTPER DEOC Decision Support System (DDSS) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Ron Abernathy 10. Provide an overview of the system: This system is used by the CDC Emergency Operations Center to provide protocols and procedures that the Watch Staff and Duty Officer should follow when receiving certain phone calls. The protocols exist on a shared file server and the system is merely link to those files. 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): N/A 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: N/A 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) N/A 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: - 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): - 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: N/A PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Felicia Kittles Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Dec 18, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC COTPER Etiological Agent Import Permit Program (EAIP) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: Initial PIA Migration to ProSight 1. Date of this Submission: CDC COTPER Etiological Agent Import Permit Program (EAIP) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-02-02-8121-00-110-218 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): N/A - System does not constitute a "System of Records" under the Privacy Act. IIF collected is not personal and data are not retrieved by personal identifiers. See Question 30 for additional comments. 5. OMB Information Collection Approval Number: 0920-0199 6. Other Identifying Number(s): N/A 7. System Name (Align with system Item name): Etiological Agent Importation Permit System 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Indira Srinivasan 10. Provide an overview of the system: EAIPS stores the minimum data required to support USPHS 42 CFR - Part 71 Foreign Quarantine, Part 71.54 Etiologic agents, hosts, and vectors which recognizes etiologic agents, vectors and material containing etiologic agents as hazardous materials which must be accompanied by a U.S. Public Health Service importation permit when imported into the United States of America. The system consists of a Microsoft Access database stored on a single, stand-alone Windows PC. No personal information is collected. Applicants provide their business related information. This does not constitute a "System of Records" under the Privacy Act. 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): The information stored in EAIPS is not shared. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: EAIPS stores the following information about the individuals who send materials covered by the regulation to the Applicant (Senders): last name, middle initial, first name, organization, address (street, city, state/province, postal code, country, telephone number, fax number, email address. EAIPS stores the following information about the materials being imported: detailed description of the material, country of origin, address where the pathogen will be used (street, city, state, zip), data about suspected etiologic agents contained in the material, type of material, how the material will be used, date work will be completed, data about the final disposition of the material. EAIPS stores the following information about material shipment and storage: number of shipments, port of entry, total volume, description of applicants laboratory facilities and equipment, description of the qualifications of the technical staff who will handle the material. Submission is mandatory for any person who wishes to obtain an import permit, but IIF is voluntarily supplied by the individual when applying. The Privacy Act is not applicable. System does not constitute a "System of Records" under the Privacy Act. IIF is business information, not personal data. Data are not retrieved by IIF but by organization. It has been officially determined that the Privacy Act does not apply. No SORN is necessary. There is no potential PIA weakness. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) The information collected by the EAIPS program will be submitted by Applicants (as identified in USPHS 42 CFR - Part 71 Foreign Quarantine. Part 71.54 Etiologic agents, hosts, and vectors) through submission of OMB form 0920-0199. This form includes guid 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): No 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): Yes 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: Administrative Controls: To ensure least privilege and accountability, user actions are audited by the system; audit logs are periodically reviewed by the system's Security Steward. Technical Controls: User ID, passwords, firewall, Secure Spaces compliant with Defense Security Services Standards. Physical Controls: ID badges, key cards, cipher locks, housing in a classified secure lab. EAIPS stores the data in a password protected database hosted on a single stand-alone Windows PC. The system and supporting paper documents are located within secure spaces compliant with Defense Security Services (DSS) standards. All personnel with access to the data will have current DoD Secret level clearances (or equivalent). PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Betsey Dunaway Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Deborah Holtzman Sign-off Date: Aug 18, 2006 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC COTPER NSAR (Select Agent II) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? No If this is an existing PIA, please provide a reason for revision: PIA Validation 1. Date of this Submission: CDC COTPER NSAR (Select Agent II) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-21-01-03-01-0547-00 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): 09-20-0170 5. OMB Information Collection Approval Number: n/a 6. Other Identifying Number(s): n/a 7. System Name (Align with system Item name): National Select Agent Registry (NSAR) 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Barry Copeland 10. Provide an overview of the system: The NSAR mission is to provide the regulated community with a secure public web interface for the submission of required registration and related forms. Separately, it provides the Select Agent (SA) Program with document and records management support in compliance with National Archives and Records Administration (NARA) standards. It also provides for a secure national database and processing environment, to include data entry and complex reporting capability in support of national incident response or appropriate law enforcement queries. NSAR stores the minimum data required to support 42 C.F.R Part 73, 7 C.F.R. Part 331, and 9 C.F.R. Part 121. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): Yes 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): Yes, APHIS, for compliance with federal mandates. 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: NSAR stores the following information about the individuals identified in the CDC-APHIS forms 1-5: First name, middle name, last name, organization, title, address (street, city, state, zip), telephone number, fax number, and email address. Submission is mandatory 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) The information collected by the EAIPS program will be submitted (as identified in 42 C.F.R. Part 74, 7 C.F.R. Part 331, and 0 C.F.R part 121) through the submission of CDC-APHIS forms 1-5. 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): Yes 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: NSAR stores data in a series of password protected databases hosted in secure environments. The system and supporting paper documents are located within secure spaces compliant with Defense Security Services (DSS) standards. All personnel with access to the data will have current DoD Secret level clearances (or equivalent). PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Michael W. Harris Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden, OCISO Sign-off Date: May 8, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC COTPER One Team PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC COTPER One Team 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-03-02-8121-00 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): 09-20-0169 5. OMB Information Collection Approval Number: No 6. Other Identifying Number(s): No 7. System Name (Align with system Item name): OneTeam 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Josh Giles 10. Provide an overview of the system: OneTeam is a web-based application to help the Coordinating Office for Terrorism Preparedness and Emergency Response (COTPER) Division of Business Services (DBS) track staff and vacancy information for all of COTPER. Developed as an expanded replacement for the COTPER Vacancy Action Tracking System (CVATS), OneTeam will combine the ability to track and report information related to vacancies with tracking and reporting of information related to staff members and positions throughout COTPER. 13. Indicate if the system is new or an existing one being modified: New 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): Yes 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): Yes 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): No 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: The application will collect information base on COTPER Positions (both vacant and occupied). Such data includes, but not limited to: Job Title, Division, Branch, Grade, Job Series, Employee Type (Contractor vs FTE), and General Remarks. Additional data collected about a vacancy will include: Assigned to (a pre-defined list), Date assigned, the vacancy action, and general comments. Occupied position will collect the person’s name, email and dated they were assigned to that position. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) notify and obtain consent from individuals regarding what PII is being collected from them; and (3) how the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]) None 32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII): Yes 37. Does the website have any information or pages directed at children under the age of thirteen?: No 50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN): No 54. Briefly describe in detail how the IIF will be secured on the system using administrative, technical, and physical controls.: All information will be stored on the CDC internal network. Access to OneTeam will be based on the CDC’s Windows Authentication, allowing only a pre-determined list of user access to the system via the CDC Intranet. Physical and additional technical controls are handled by ITSO and OSEP per appropriate C&A security controls. PIA Approval PIA Reviewer Approval: Promote PIA Reviewer Name: Michael W. Harris Sr. Official for Privacy Approval: Promote Sr. Official for Privacy Name: Thomas P. Madden Sign-off Date: Aug 20, 2008 Approved for Web Publishing: Yes Date Published: Jun 1, 2009 _____________________________________________________________________________
06.3 HHS PIA Summary for Posting (Form) / CDC COTPER PMET Terrorism Database - (PMET) PIA SUMMARY AND APPROVAL COMBINED PIA Summary Is this a new PIA? Yes If this is an existing PIA, please provide a reason for revision: - 1. Date of this Submission: CDC COTPER PMET Terrorism Database - (PMET) 2. OPDIV Name: CDC 3. Unique Project Identifier (UPI) Number: 009-20-01-03-02-8121-00 4. Privacy Act System of Records (SOR) Number (If response to Q.21 is Yes, a SORN number is required for Q.4): No 5. OMB Information Collection Approval Number: No 6. Other Identifying Number(s): No 7. System Name (Align with system Item name): PMET Terrorism Project Database 9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed: Joseph Dell 10. Provide an overview of the system: Provide a comprehensive description of the Low umbrella Minor Application’s function. Attach application concept of operations, vision statements, and/or project justification documents if available. Prior to each reporting period, project milestones and success factors from the Health Impact.net database are imported into the COTPER PMET webform for projects to enter their updates. At the conclusion of each reporting period, the PMET enters their project analysis via the working webform. At the conclusion of each reporting period, the PMET will publish an Operational Status Report for each project indicating project progress for the reporting period. For more information please refer to the Webform Submission Guidance: http://intra-apps.cdc.gov/od/otper/spendplan/FY2007/docs/FY2007%20Reporting%20Period%203%20Guidance.pdf The system architecture contains a web front-end with a Microsoft SQL backend which is hosted in the Designated Server Site (DSS) and managed by ITSO. While the data on the intranet site may be viewed by anyone within CDC, the target audience is the ~280 users within COTPER. Users must be on the CDC network to access the Intranet. No non-CDC users can access the Intranet. No Personally Identifiable Information (PII) is contained within the PMET system. There are no system dependencies beyond the ITSO server which the system is hosted on. The application does not generate any reports nor does it share any information across other federal agencies. 13. Indicate if the system is new or an existing one being modified: Existing 17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system? (Note: This question seeks to identify any, and all, personal information associated with the system. This includes any PII, whether or not it is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or other legislation. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?): No 21. Is the system subject to the Privacy Act? (If response to Q.19 is Yes, response to Q.21 must be Yes and a SORN number is required for Q.4): No 23. If the system shares or discloses IIF please specify with whom and for what purpose(s): No IIF or PII is collected 30. Please describe in detail: (1) the information the agency will collect, maintain, or disseminate; (2) why and for what purpose the agency will use the information; (3) in this description, explicitly indicate whether the information contains PII; and (4) whether submission of personal information is voluntary or mandatory: No information is collected, only disseminated. No PII is involved. 31. Please describe in detail any processes in place to: (1) notify and obtain consent from the individuals whose P |