HHS Privacy Impact Assessment (PIA) Summary

Question

Response

1

System:

CDC CCHIS NCHS National Health And Nutrition Examination

Survey (NHANES)

2

Is this a new PIA?

Yes

3

If this is an existing PIA, please provide a reason

for revision:

Initial PIA Migration to ProSight

4

Date of this Submission:

Mar 30, 2007

5

OPDIV Name:

CDC

6

Unique Project Identifier (UPI) Number:

9.20012E+20

7

Privacy Act System of Records (SOR) Number:

09-20-0164

8

OMB Information Collection Approval Number:

0920-0237

9

Other Identifying Number(s):

N/A

10

System Name:

National Health and Nutrition Examination Survey (NHANES)

11

System Point of Contact (POC). The System POC

is the person to whom questions about the system

and the responses to this PIA may be addressed:

Clifford L. Johnson

12

Provide an overview of the system:

The long-term goals and objectives of NHANES are as follows: 1. To

estimate the number and percent of persons in the U.S. population

and designated subgroups with selected diseases and risk factors; 2.

To monitor trends in the prevalence, awareness, treat

13

Indicate if the system is new or an existing one

being modified:

Existing

14

Does/Will the system collect, maintain (store),

disseminate and/or pass through IIF within any

database(s), record(s), file(s) or website(s) hosted

by this system?

Yes

15

Is the system subject to the Privacy Act?

Yes

16

If the system shares or discloses IIF please specify

with whom and for what purpose(s):

IIF is not disclosed or shared.

17

Describe in detail the information the agency will

collect, maintain, or disseminate and why and for

what purpose the agency will use the information:

NHANES does a multi-stage probability sample by selecting primary

sampling units, segments within a PSU, households within segments,

and finally individuals within households. Once individuals are

selected through a screening process household interviews

18

Describe the consent process:

Consent documents, informing the participants of what is being

collected and how it will be used, are signed voluntarily. If major

changes occur to the system that would require individuals being

notified, program staff and others involved in quality as

19

Does the system host a website?

Yes

20

Does the website have any information or pages

directed at children under the age of thirteen?

No

21

Are there policies or guidelines in place with regard

to the retention and destruction of IIF?

Yes

22

Are there technical controls present?

Yes

23

Describe the IIF security controls:

Administrative Controls: Role based access to data and requirements

for data sensitivity ensure least privilege and accountability.

Technical Controls: User ID, passwords, firewall, encryption, IDS,

routers used to restrict access by address and segment

24

Sr Official of Privacy Signature:

Deborah Holtzman

25

Sr Official of Privacy Signoff Date:

Aug 18, 2006

PIA-HHS-Form

Report Date: 5/23/2007

Page: 3

Note on IIF: Any question about IIF seeks to identify any, and all, personal information associated with the system. This includes any IIF, whether or not it

is subject to the Privacy Act, whether the individuals are employees, the public, research subjects, or business partners, and whether provided voluntarily

or collected by mandate. Later questions will try to understand the character of the data and its applicability to the requirements under the Privacy Act or

other legislation. Note: If no IIF is contained in the system, please answer the remaining required questions, then promote the PIA to the Sr. Privacy

Official who will authorize the PIA. Note: If this system contains IIF, all remaining questions on the PIA Form Tabs must be completed prior to signature

and promotion.