U.S. DEPARTMENT OF
HOUSING AND URBAN DEVELOPMENT
INITIAL PRIVACY ASSESSMENT (IPA)
Youth Homelessness Demonstration Program
Office of Special Needs Assistance Programs
Instruction & Template
April 04, 2016
INTRODUCTION
What is an Initial Privacy Assessment?
An Initial Privacy Assessment (IPA) is designed to assess whether a Privacy Impact Assessment (PIA), a Privacy Act system of records notice (SORN), and/or other related privacy documents are required. The responses to the IPA will provide a foundation for determining if either a PIA or SORN or both will be required, and will also help to identify any policy concerns.
The IPA incorporates the matters previously addressed in the Department’s Personally Identifiable Information (PII) Survey, and thus replaces the survey.
When should an IPA be completed?
An IPA should be completed for all information collection activities, whether the system is electronic or contains only records in paper form, and should be completed before commencement of any testing or pilot project of an information system or prior to implementing new information collections requests. Additionally, an IPA should be completed any time there is a change to the information system or collection to determine whether there are any privacy issues as a result of such a change.
Who should complete the IPA?
The IPA should be written and reviewed by a combination of the component’s (e.g., Privacy Act Officer, System Owner, Project Leaders, Paperwork Reduction Act Compliance Officers), and the program-specific office responsible for the system, project or information collections.
How is the IPA related to the Capital Planning, Certification and Accreditation, and the Paperwork Reduction Act process?
Upon completion and approval of the IPA by the Privacy Officer the official document may be uploaded into the C&A tool, and provided as part of the IT Capital Planning, and Paperwork Reduction Act package as validation of the completed evaluation. The completed IPA demonstrates that the program components have consciously considered privacy and related requirements as part of the overall information activities. For an IT system that does not require a C&A, such as a minor application that runs on a system that does require a C&A, an IPA still should be completed to determine if other related privacy documentation are required for that system or project.
Where should the completed IPA be sent?
A copy of the completed IPA should be sent to the Office of Privacy Project Leads for review. The Privacy Officer will review the IPA and determine what additional privacy documentation is required, and then will advise the Program component accordingly.
Initial Privacy Assessment
INFORMATION ABOUT THE SYSTEM OR PROJECT
Which of the following describes the type of records in the system:
|
|
Note: For this form purpose, there is no distinction made between technologies/systems managed by contractors. All technologies/systems should be initially reviewed for potential privacy impact.
Section I: The Entire IPA (Sections I and II) Should be Completed for New Systems or Projects. If this is an Existing System or Project Skip to Section II. Unless requested by the Office of Privacy, this section should not be completed for an existing System or Project.
Question 1: Provide a general description of the system of Project. The following questions are intended to define the scope of the information in the system, information collection, or project, specifically the nature of the information and the sources from which it is obtained.
Eligible applicants include local and state government entities, public housing authorities, and public and private nonprofit organizations. NOFA respondents applying for funding will provide information about their organization’s experience, staff’s experience, proposed program designs, system level needs, resources, and strategic planning goals and objectives.
Applications will be collected via email and through our online grants management system in three steps: through a site selection application, project applications, and the submission of a coordinated community plan. All steps will be reviewed by a panel consisting of HUD staff and other federal partners. The purpose of the site selection information collection is to accurately assess the eligibility of community applicants and to determine those communities that are most qualified to carry out grant activities. The purpose of the project application information collection is to assess the eligibility of project funding requests and whether they meet the quality standards established by the NOFA and the community plan. The purpose of collecting a coordinated community plan is to assess the preparedness of communities to effectively leverage federal funds to create an appropriate and effective coordinated community approach to end youth homelessness.
c. How is information transmitted to and from the system, information collection, or project?
Site selection applications and coordinated community plans will be emailed from the applicant to a HUD email account. Project applications will be submitted using e-snaps, the electronic grant management system used to manage the competition process for HUDs largest homelessness competition, the Continuum of Care (CoC) Program Competition (24 CFR part 578, OMB Control 2506-0112).
d. What are the interconnections with other systems or projects?
The appropriations act authorizing this program mandates an explicit connection to the CoC Program where all projects must be renewable under the CoC Program. To accommodate this requirement and ease the burden on applicants, the project applications will be submitted directly into e-snaps using the same forms that are required for application during the annual CoC Program competition.
|
If this is a new system, information collection, or project, specify the expected production date.
HUD expects to publish the NOFA by June, 2016. Applications will be accepted for the following 120 days. HUD may extend this deadline if necessary.
If an existing system, information collection, or project, specify the date of production.
Not applicable.
QUESTION 3: Does this system, information collection, or project collect personal identifiers/sensitive information
YES
|
NO
|
Does the system, information collection, or project collect personal/sensitive information? (e.g. name, address, personal email address, gender/sex, race/ethnicity, income/financial data, employment history, medical history, Social Security Number, Tax Identification Number, Employee Identification Number, FHA Case Number). Includes PII that may be part of a registration process?
|
If yes, specific data sets collected or provided, and the legal authorities, arrangement, and/or agreement authorize the collection of information (i.e. must include authorities that cover all information collection activities, including Social Security Numbers)?
Applicants will need to provide information contained in the SF-424, including applicant contact information, the name of the authorized representative and the Tax Identification number. The SF-424 is a required document for program NOFAs per HUD’s 2016 NOFA General Section.
QUESTION 4: Does the information about individuals identify particular individuals (i.e., is the information linked or linkable to specific individuals, often referred to as personally identifiable information?)
Yes, the applicant point of contact and authorized representative must be specific individuals for whom contact information (i.e., work telephone number and email address) is provided.
QUESTION 5: What type of Notice(s) are provided to the individual on the scope of information collected, the opportunity to consent to uses of said information, the opportunity to decline to provide information. (A notice may include a posted privacy policy, a Privacy Act notice on form(s), and/or a system of records notice published in the Federal Register.)
All requirements related to the collection of information is included in the YHDP NOFA, which HUD expects to publish this year. The only personal information collected is on the SF-424 which is a standard government form required to receive funding.
|
Yes, although by not providing this information in the SF-424, the application will be incomplete and not considered for funding.
|
Signing the SF-424 provides consent for HUD to contact the applicant point of contact and the authorized representative regarding developments on their application. |
QUESTION 6: Is there a Certification & Accreditation record for your system? (This question does not apply to Information Collection Requests) |
||||||||
Not applicable.
Specify below the systems categorization. If not available identify the FISMA-reported system whose Certification and Accreditation covers this system.
Not applicable.
|
||||||||
Confidentiality |
|
Low |
|
Moderate |
|
High |
|
Undefined |
Integrity |
|
Low |
|
Moderate |
|
High |
|
Undefined |
Availability |
|
Low |
|
Moderate |
|
High |
|
Undefined |
SECTION II - The Entire IPA should be completed for New Systems or Projects. If this is an Existing System or Project Complete Only This Section.
QUESTION 1: When was the system, information collection, or project developed?
This is a new program with no previous data collection. For two of the three steps there is no formal electronic system for the collection of applications; applications will be collected using the HUD email system. The e-snaps system has been in use since 2008 as the grants management system for the CoC Program.
QUESTION 2: If an existing system, information collection, or project, has the system or project undergone any changes since April 17, 2003?
As for the e-snaps component, the system was developed in 2008 and has undergone changes to improve the information collection (better information for HUD and a reduced burden for applicants) and to regularly update software as improvements in the technology have become available.
QUESTION 3: If an existing system, information collection, or project, has the system or project, explain the changes the system or project will be undergoing as part of this renewal/update process.
No changes are expected to e-snaps on account of the YHDP. Changes will occur as necessary in the future to improve question accuracy and user experience and as standard platform technology updates become available.
QUESTION 4: Do the changes to the system, information collection, or project involve a change in the type of records maintained, the individuals on whom records are maintained, or the use or dissemination of information from the system?
No.
QUESTION 5: Please indicate if any of the following changes to the system or project have occurred: (Mark all boxes that apply.)
No applicable changes.
|
A conversion from paper-based records to an electronic system.
|
|
A change from information in a format that is anonymous or non-identifiable to a format that is identifiable to particular individuals.
|
|
A new use of an IT system, including application of a new technology that changes how information in identifiable form is managed. (For example, a change that would create a more open environment and /or avenue for exposure of data that previously did not exist.)
|
|
A change that results in information in identifiable form being merged, centralized, or matched with other databases.
|
|
A new method of authenticating the use of an access to information in the identifiable form by members of the public.
|
|
A systematic incorporation of databases of information in identifiable form purchased or obtained from commercial or public sources.
|
|
A new interagency use of shared agency function that results in new uses or exchanges of information in identifiable form.
|
|
A change that results in a new use of disclosure of information in identifiable form.
|
|
A change that results in new items of information in identifiable form being added into the system. |
QUESTION 6: Does a PIA for the system or project already exist? If yes, please provide a copy of the notice as an appendix.
No, the information is organization and systems level. No personal/sensitive information is collected beyond the contact information collected for the point of contact and the authorized representative on the SF-424.
(To be completed by the Privacy Office)
|
This is NOT a privacy sensitive system, information collection or project – the system, information collection, or project contains no personal identifiers/sensitive information
|
|
This IS a Privacy Sensitive Project |
|
IPA sufficient at this time
|
|
A PIA is required |
|
The existing PIA requires an update/deletion |
|
A SORN is required |
|
The existing SORN requires an update or should be deleted |
|
Other |
COMMENTS:
|
|
DATE REVIEWED: |
PRIVACY REVIEWING OFFICIALS NAME: |
The IPA is “not” an official document until all signatures are obtained for this page.
By signing below the Program Office or Support Office attest that the content captured in this document is accurate and complete and meet the requirements of applicable federal regulations and HUD internal policies.
|
|
|
|
|
|
SYSTEM OR PROJECT OWNER<< INSERT NAME/TITLE>>
|
|
Date |
<<INSERT PROGRAM OFFICE>> |
|
|
|
|
|
|
|
|
|
|
|
PROGRAM AREA MANAGER<<INSERT NAME/TITLE>> |
|
Date |
<<INSERT PROGRAM OFFICE>> |
|
|
|
|
|
|
|
|
|
|
|
CHIEF PRIVACY OFFICER,<<INSERT NAME>> |
|
Date |
Office of the Chief Information Officer |
|
|
U. S. Department of Housing and Urban Development |
|
|
| File Type | application/msword |
| File Title | Attached for your immediate attention is the electronic copy of the SSN and PII memorandum distributed to Departmental Principle |
| Author | Nadine Craft |
| Last Modified By | Johnson, Urnell |
| File Modified | 2016-08-15 |
| File Created | 2016-08-15 |