HHS Privacy Impact Assessment (PIA) Summary

Question

Response

1

System:

CDC CCEHIP NCEH/ATS Hazardous Substance Release/ Health

Effects Database System (HazDat)

2

Is this a new PIA?

Yes

3

If this is an existing PIA, please provide a reason

for revision:

Initial PIA Migration to ProSight

4

Date of this Submission:

May 14, 2007

5

OPDIV Name:

CDC

6

Unique Project Identifier (UPI) Number:

009-20-01-23-01-1000-00

7

Privacy Act System of Records (SOR) Number:

09-19-0001

8

OMB Information Collection Approval Number:

NA

9

Other Identifying Number(s):

NA

10

System Name:

HazDat

11

System Point of Contact (POC). The System POC

is the person to whom questions about the system

and the responses to this PIA may be addressed:

Lori Franklin

12

Provide an overview of the system:

HazDat was initiated for tracking and analyses of ATSDR’s legislated

responsibilities. HazDat is ATSDR’s scientific and administrative

database developed to provide rapid access to information on the

release of hazardous substance from Superfund sites or

13

Indicate if the system is new or an existing one

being modified:

Existing

14

Does/Will the system collect, maintain (store),

disseminate and/or pass through IIF within any

database(s), record(s), file(s) or website(s) hosted

by this system?

Yes

15

Is the system subject to the Privacy Act?

Yes

16

If the system shares or discloses IIF please specify

with whom and for what purpose(s):

System does not share or disclose IIF.

17

Describe in detail the information the agency will

collect, maintain, or disseminate and why and for

what purpose the agency will use the information:

HazDat contains environmental and health data from ATSDR's

documents, studies, and activities. The system currently contains

data related to more than 4,000 hazardous waste sites and includes

information from more than 1,900 public health assessments, 6,

18

Describe the consent process:

Data is collected from private citizens by the scientists and entered

into the system at the site. Individuals are informed of data uses at

the site. The consent form provides Privacy Act notification

elements, including the identifiable information shar

19

Does the system host a website?

Yes

20

Does the website have any information or pages

directed at children under the age of thirteen?

No

21

Are there policies or guidelines in place with regard

to the retention and destruction of IIF?

Yes

22

Are there technical controls present?

Yes

23

Describe the IIF security controls:

Administrative Controls: In order to ensure least privilege and

accountability, read only access is given by default. Add/modify

access must be requested by User's manager/supervisor. Requests

must be made to system steward. Technical Controls: User ID

24

Sr Official of Privacy Signature:

Deborah Holtzman

25

Sr Official of Privacy Signoff Date:

August 18, 2006

PIA-HHS-Form

Report Date: 5/23/2007

Page: 1

Note on IIF: Any question about IIF seeks to identify any, and all, personal information associated with the system. This includes any IIF, whether or not it

is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily

or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or

other legislation. Note: If no IIF is contained in the system, please answer the remaining required questions, then promote the PIA to the Sr. Privacy

Official who will authorize the PIA. Note: If this system contains IIF, all remaining questions on the PIA Form Tabs must be completed prior to signature

and promotion.