Primavera ProSight ReportHummel, EricCopyright 1998-2008 Primavera Systems, inc. All Rights Reserved.lyubovitskym202014-02-26T14:24:00Z2014-02-26T14:24:00Z15424224185NIH\OD201562837114 7.5.7960 SP2 06.1 HHS Privacy Impact Assessment (Form) / NIH NCI Cancer Genetics Services Directory (CGSD) (Item) Primavera ProSightForm Report, printed by: Hummel, Eric, May 27, 2013PIA SUMMARY1The following required questions with an asterisk (*) represent the information necessary to complete the PIA Summary for transmission to the Office of Management and Budget (OMB) and public posting in accordance with OMB Memorandum (M) 03-22.Note: If a question or its response is not applicable, please answer “N/A” to that question where possible. If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of personally identifiable information (PII). If no PII is contained in the system, please answer questions in the PIA Summary Tab and then promote the PIA to the Senior Official for Privacy who will authorize the PIA. If this system contains PII, all remaining questions on the PIA Form Tabs must be completed prior to signature and promotion.2Summary of PIA Required Questions*Is this a new PIA?NoIf this is an existing PIA, please provide a reason for revision:PIA Validation*1. Date of this Submission:Jul 24, 2012*2. OPDIV Name:NIH*4. Privacy Act System of Records Notice (SORN) Number (If response to Q.21 is Yes, a SORN number is required for Q.4):N/A*5. OMB Information Collection Approval Number:0925-0639*6. Other Identifying Number(s):N/A*7. System Name (Align with system item name):NIH NCI Cancer Genetics Services Directory (CGSD)*9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed:Point of Contact InformationPOC NameMargaret Beckwith, Ph.D.*10. Provide an overview of the system:The National Cancer Institute Cancer Genetics Services Directory (CGSD) on the NCI's Website cancer.gov is a searchable collection of information about professionals who provide services related to cancer genetics. These services include cancer risk assessment, genetic counseling, and genetic susceptibility testing. The professionals have applied to be in the directory using an online application form and have met basic criteria outlined on the form. The CGSD is posting data such as investigator name, title, biography, and work contact information that is already publicly available on institutional websites and is not posting or collecting personally identifiable information.*13. Indicate if the system is new or an existing one being modified:New*17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?TIP: If the answer to Question 17 is “No” (indicating the system does not contain PII), only the remaining PIA Summary tab questions need to be completed and submitted. If the system does contain PII, the full PIA must be completed and submitted. (Although note that “Employee systems,” – i.e., systems that collect PII “permitting the physical or online contacting of a specific individual … employed [by] the Federal Government – only need to complete the PIA Summary tab.)Yes17a. Is this a GSS PIA included for C&A purposes only, with no ownership of underlying application data? If the response to Q.17a is Yes, the response to Q.17 should be No and only the PIA Summary must be completed.No*19. Are records on the system retrieved by 1 or more PII data elements?Yes*21. Is the system subject to the Privacy Act? (If the response to Q.19 is Yes, the response to Q.21 must be Yes and a SORN number is required for Q.4)Yes*23. If the system shares or discloses PII, please specify with whom and for what purpose(s):*30. Please describe in detail: (1) The information the agency will collect, maintain, or disseminate (clearly state if the information contained in the system ONLY represents federal contact data); (2) Why and for what purpose the agency will use the information; (3) Explicitly indicate whether the information contains PII; and (4) Whether submission of personal information is voluntary or mandatory:1. There are currently 567 genetics professionals listed in the directory. Approximately 30-60 new professionals are added to the directory each year. The applicants are nurses, physicians, genetic counselors, and other professionals who provide services related to cancer genetics. The information collected on the application includes name, professional qualifications, practice locations, and area of specialization. The information is updated annually using a web-based update mailer that mirrors the application form. 2. The information contained in the NCI Cancer Genetics Services Directory is published on the cancer.gov public website. It is a unique resource for cancer patients and their families who are looking for information about their family's risk of cancer and genetic counseling. Collecting applicant information such as name, title, area of expertise, biography, work contact information and verifying it annually by using the NCI CGSD web-based application form and update mailer is important for providing this information to the public and keeping it current. 3. There is no PII in the system. 4. All professionals listed in the directory voluntarily submit applications to be included.*31. Please describe in detail any processes in place to: (1) Notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) Notify and obtain consent from individuals regarding what PII is being collected from them; and (3) How the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]):There is no PII in the system.*32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII)Yes*37. Does the website have any information or pages directed at children under the age of thirteen?No*50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN)Yes*54. Briefly describe in detail how the PII will be secured on the system using administrative, technical, and physical controls:Information is secured using username/passwords, least privilege, separation of duties, an intrusion detection system, firewalls, locks, badge access, background investigations. A comprehensive IRT (Incident Response Team) capability is also maintained.PIA REQUIRED INFORMATION1HHS Privacy Impact Assessment (PIA)The PIA determines if Personally Identifiable Information (PII) is contained within a system, what kind of PII, what is done with that information, and how that information is protected. Systems with PII are subject to an extensive list of requirements based on privacy laws, regulations, and guidance. The HHS Privacy Act Officer may be contacted for issues related to Freedom of Information Act (FOIA) and the Privacy Act. Respective Operating Division (OPDIV) Privacy Contacts may be contacted for issues related to the Privacy Act. The Office of the Chief Information Officer (OCIO) can be used as a resource for questions related to the administrative, technical, and physical controls of the system. Please note that answers to questions with an asterisk (*) will be submitted to the Office of Management and Budget (OMB) and made publicly available in accordance with OMB Memorandum (M) 03-22.Note: If a question or its response is not applicable, please answer “N/A” to that question where possible.2General Information*Is this a new PIA?NoIf this is an existing PIA, please provide a reason for revision:PIA Validation*1. Date of this Submission:Jul 24, 2012*2. OPDIV Name:NIH3. Unique Project Identifier (UPI) Number for current fiscal year (Data is auto-populated from the System Inventory form, UPI table):N/A*4. Privacy Act System of Records Notice (SORN) Number (If response to Q.21 is Yes, a SORN number is required for Q.4):N/A*5. OMB Information Collection Approval Number:0925-06395a. OMB Collection Approval Number Expiration Date:Aug 31, 2014*6. Other Identifying Number(s):N/A*7. System Name: (Align with system item name)NIH NCI Cancer Genetics Services Directory (CGSD)8. System Location: (OPDIV or contractor office building, room, city, and state)System Location:OPDIV or contractor office building6116 Executive Blvd., Suite 300ARoomRoom 3094CityRockville StateMD*9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed:Point of Contact InformationPOC NameMargaret Beckwith, Ph.D.The following information will not be made publicly available:POC TitleActing Branch ChiefPOC OrganizationNCI/OCE/OCCMPOC Phone301-594-2718POC Emailmbeckwit@mail.nih.gov*10. Provide an overview of the system: (Note: The System Inventory form can provide additional information for child dependencies if the system is a GSS)The National Cancer Institute Cancer Genetics Services Directory (CGSD) on the NCI's Website cancer.gov is a searchable collection of information about professionals who provide services related to cancer genetics. These services include cancer risk assessment, genetic counseling, and genetic susceptibility testing. The professionals have applied to be in the directory using an online application form and have met basic criteria outlined on the form. The CGSD is posting data such as investigator name, title, biography, and work contact information that is already publicly available on institutional websites and is not posting or collecting personally identifiable information.SYSTEM CHARACTERIZATION AND DATA CATEGORIZATION1System Characterization and Data Configuration11. Does HHS own the system?Yes11a. If no, identify the system owner:12. Does HHS operate the system? (If the system is operated at a contractor site, the answer should be No)Yes12a. If no, identify the system operator:*13. Indicate if the system is new or an existing one being modified:New14. Identify the life-cycle phase of this system:Operations/Maintenance15. Have any of the following major changes occurred to the system since the PIA was last submitted?NoPlease indicate “Yes” or “No” for each category below: Yes/NoConversionsNoAnonymous to Non-AnonymousNoSignificant System Management ChangesNoSignificant MergingNoNew Public AccessNoCommercial SourcesNoNew Interagency UsesNoInternal Flow or CollectionNoAlteration in Character of DataNo16. Is the system a General Support System (GSS), Major Application (MA), Minor Application (child) or Minor Application (stand-alone)?Minor Application (child)*17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this system?YesTIP: If the answer to Question 17 is “No” (indicating the system does not contain PII), only the remaining PIA Summary tab questions need to be completed and submitted. If the system does contain PII, the full PIA must be completed and submitted. (Although note that “Employee systems,” – i.e., systems that collect PII “permitting the physical or online contacting of a specific individual … employed [by] the Federal Government – only need to complete the PIA Summary tab.)Please indicate "Yes" or "No" for each PII category. If the applicable PII category is not listed, please use the Other field to identify the appropriate category of PII.Categories: Yes/NoName (for purposes other than contacting federal employees)YesDate of BirthNoSocial Security Number (SSN)NoPhotographic IdentifiersNoDriver’s LicenseNoBiometric IdentifiersNoMother’s Maiden NameNoVehicle IdentifiersNoPersonal Mailing AddressNoPersonal Phone NumbersNoMedical Records NumbersNoMedical NotesNoFinancial Account InformationNoCertificatesNoLegal DocumentsNoDevice IdentifiersNoWeb Uniform Resource Locator(s) (URL)NoPersonal Email AddressNoEducation RecordsNoMilitary StatusNoEmployment StatusNoForeign ActivitiesNoOtherBusiness location and business contact information 17a. Is this a GSS PIA included for C&A purposes only, with no ownership of underlying application data? If the response to Q.17a is Yes, the response to Q.17 should be No and only the PIA Summary must be completed.No18. Please indicate the categories of individuals about whom PII is collected, maintained, disseminated and/or passed through. Note: If the applicable PII category is not listed, please use the Other field to identify the appropriate category of PII. Please answer "Yes" or "No" to each of these choices (NA in other is not applicable).Categories: Yes/NoEmployeesNoPublic CitizenYesPatientsNoBusiness partners/contacts (Federal, state, local agencies)NoVendors/Suppliers/ContractorsNoOtherN/A*19. Are records on the system retrieved by 1 or more PII data elements?YesPlease indicate "Yes" or "No" for each PII category. If the applicable PII category is not listed, please use the Other field to identify the appropriate category of PII.Categories: Yes/NoName (for purposes other than contacting federal employees)YesDate of BirthNoSSNNoPhotographic IdentifiersNoDriver’s LicenseNoBiometric IdentifiersNoMother’s Maiden NameNoVehicle IdentifiersNoPersonal Mailing AddressNoPersonal Phone NumbersNoMedical Records NumbersNoMedical NotesNoFinancial Account InformationNoCertificatesNoLegal DocumentsNoDevice IdentifiersNoWeb URLsNoPersonal Email AddressNoEducation RecordsNoMilitary StatusNoEmployment StatusNoForeign ActivitiesNoOtherBusiness location and business contact information20. Are 10 or more records containing PII maintained, stored or transmitted/passed through this system?Yes*21. Is the system subject to the Privacy Act? (If the response to Q.19 is Yes, the response to Q.21 must be Yes and a SORN number is required for Q.4)Yes21a. If yes but a SORN has not been created, please provide an explanation.INFORMATION SHARING PRACTICES1Information Sharing Practices22. Does the system share or disclose PII with other divisions within this agency, external agencies, or other people or organizations outside the agency?Yes Please indicate “Yes” or “No” for each category below:Yes/NoName (for purposes other than contacting federal employees)YesDate of BirthNoSSNNoPhotographic IdentifiersNoDriver’s LicenseNoBiometric IdentifiersNoMother’s Maiden NameNoVehicle IdentifiersNoPersonal Mailing AddressNoPersonal Phone NumbersNoMedical Records NumbersNoMedical NotesNoFinancial Account InformationNoCertificatesNoLegal DocumentsNoDevice IdentifiersNoWeb URLsNoPersonal Email AddressNoEducation RecordsNoMilitary StatusNoEmployment StatusNoForeign ActivitiesNoOtherBusiness location and contact information*23. If the system shares or discloses PII please specify with whom and for what purpose(s):24. If the PII in the system is matched against PII in one or more other computer systems, are computer data matching agreement(s) in place?Not Applicable25. Is there a process in place to notify organizations or systems that are dependent upon the PII contained in this system when major changes occur (i.e., revisions to PII, or when the system is replaced)?26. Are individuals notified how their PII is going to be used?26a. If yes, please describe the process for allowing individuals to have a choice. If no, please provide an explanation.27. Is there a complaint process in place for individuals who believe their PII has been inappropriately obtained, used, or disclosed, or that the PII is inaccurate?27a. If yes, please describe briefly the notification process. If no, please provide an explanation.28. Are there processes in place for periodic reviews of PII contained in the system to ensure the data’s integrity, availability, accuracy and relevancy?28a. If yes, please describe briefly the review process. If no, please provide an explanation.29. Are there rules of conduct in place for access to PII on the system?YesPlease indicate "Yes," "No," or "N/A" for each category. If yes, briefly state the purpose for each user to have access:Users with access to PIIYes/No/N/APurposeUserYesAccess information about genetics professionals on cancer.govAdministratorsYesSystem administrators have to set permissions to the system and make other system changesDevelopersYesDevelopers work on software that is used to maintain and publish the dataContractorsYesContractors enter new professionals and changes to records of others into the maintenance databaseOtherNot Applicable*30. Please describe in detail: (1) The information the agency will collect, maintain, or disseminate (clearly state if the information contained in the system ONLY represents federal contact data); (2) Why and for what purpose the agency will use the information; (3) Explicitly indicate whether the information contains PII; and (4) Whether submission of personal information is voluntary or mandatory:1. There are currently 567 genetics professionals listed in the directory. Approximately 30-60 new professionals are added to the directory each year. The applicants are nurses, physicians, genetic counselors, and other professionals who provide services related to cancer genetics. The information collected on the application includes name, professional qualifications, practice locations, and area of specialization. The information is updated annually using a web-based update mailer that mirrors the application form. 2. The information contained in the NCI Cancer Genetics Services Directory is published on the cancer.gov public website. It is a unique resource for cancer patients and their families who are looking for information about their family's risk of cancer and genetic counseling. Collecting applicant information such as name, title, area of expertise, biography, work contact information and verifying it annually by using the NCI CGSD web-based application form and update mailer is important for providing this information to the public and keeping it current. 3. There is no PII in the system. 4. All professionals listed in the directory voluntarily submit applications to be included.*31. Please describe in detail any processes in place to: (1) Notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) Notify and obtain consent from individuals regarding what PII is being collected from them; and (3) How the information will be used or shared. (Note: Please describe in what format individuals will be given notice of consent [e.g., written notice, electronic notice, etc.])There is no PII in the system.WEBSITE HOSTING PRACTICES1Website Hosting Practices*32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of the presence of PII)YesPlease indicate “Yes” or “No” for each type of site below. If the system hosts both Internet and Intranet sites, indicate “Yes” for “Both” only.Yes/ NoIf the system hosts an Internet site, please enter the site URL. Do not enter any URL(s) for Intranet sites.InternetYeswww.cancer.gov/cancertopics/genetics/directoryIntranetNoBothNo33. Does the system host a website that is accessible by the public and does not meet the exceptions listed in OMB M-03-22?Note: OMB M-03-22 Attachment A, Section III, Subsection C requires agencies to post a privacy policy for websites that are accessible to the public, but provides three exceptions: (1) Websites containing information other than "government information" as defined in OMB Circular A-130; (2) Agency intranet websites that are accessible only by authorized government users (employees, contractors, consultants, fellows, grantees); and (3) National security systems defined at 40 U.S.C. 11103 as exempt from the definition of information technology (see section 202(i) of the E-Government Act.).No34. If the website does not meet one or more of the exceptions described in Q. 33 (i.e., response to Q. 33 is "Yes"), a website privacy policy statement (consistent with OMB M-03-22 and Title II and III of the E-Government Act) is required. Has a website privacy policy been posted?Yes35. If a website privacy policy is required (i.e., response to Q. 34 is “Yes”), is the privacy policy in machine-readable format, such as Platform for Privacy Preferences (P3P)?Yes35a. If no, please indicate when the website will be P3P compliant:36. Does the website employ tracking technologies?YesPlease indicate “Yes”, “No”, or “N/A” for each type of cookie below:Yes/No/N/AWeb BugsYesWeb BeaconsYesSession CookiesYesPersistent CookiesNoOtherN/A*37. Does the website have any information or pages directed at children under the age of thirteen?No37a. If yes, is there a unique privacy policy for the site, and does the unique privacy policy address the process for obtaining parental consent if any information is collected?N/A38. Does the website collect PII from individuals?YesPlease indicate “Yes” or “No” for each category below:Yes/NoName (for purposes other than contacting federal employees)YesDate of BirthNoSSNNoPhotographic IdentifiersNoDriver's LicenseNoBiometric IdentifiersNoMother's Maiden NameNoVehicle IdentifiersNoPersonal Mailing AddressNoPersonal Phone NumbersNoMedical Records NumbersNoMedical NotesNoFinancial Account InformationNoCertificatesNoLegal DocumentsNoDevice IdentifiersNoWeb URLsNoPersonal Email AddressNoEducation RecordsNoMilitary StatusNoEmployment StatusNoForeign ActivitiesNoOtherbusiness location and contact information39. Are rules of conduct in place for access to PII on the website?Yes40. Does the website contain links to sites external to HHS that owns and/or operates the system?No40a. If yes, note whether the system provides a disclaimer notice for users that follow external links to websites not owned or operated by HHS.ADMINISTRATIVE CONTROLS1Administrative ControlsNote: This PIA uses the terms “Administrative,” “Technical” and “Physical” to refer to security control questions—terms that are used in several Federal laws when referencing security requirements.41. Has the system been certified and accredited (C&A)?No41a. If yes, please indicate when the C&A was completed:41b. If a system requires a C&A and no C&A was completed, is a C&A in progress?Yes42. Is there a system security plan for this system?Yes43. Is there a contingency (or backup) plan for the system?Yes44. Are files backed up regularly?Yes45. Are backup files stored offsite?Yes46. Are there user manuals for the system?No47. Have personnel (system owners, managers, operators, contractors and/or program managers) using the system been trained and made aware of their responsibilities for protecting the information being collected and maintained?Yes48. If contractors operate or use the system, do the contracts include clauses ensuring adherence to privacy provisions and practices?No49. Are methods in place to ensure least privilege (i.e., “need to know” and accountability)?Yes49a. If yes, please specify method(s):Access to information is restricted to administrative interface.*50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and Destruction section in SORN):Yes50a. If yes, please provide some detail about these policies/practices:TECHNICAL CONTROLS1Technical Controls51. Are technical controls in place to minimize the possibility of unauthorized access, use, or dissemination of the data in the system?YesPlease indicate “Yes” or “No” for each category below: Yes/NoUser IdentificationYesPasswordsYesFirewallYesVirtual Private Network (VPN)YesEncryptionNoIntrusion Detection System (IDS)YesCommon Access Cards (CAC)NoSmart CardsNoBiometricsNoPublic Key Infrastructure (PKI)No52. Is there a process in place to monitor and respond to privacy and/or security incidents?Yes52a. If yes, please briefly describe the process:NIH maintains a comprehensive Incident Response Team (IRT) capability.PHYSICAL ACCESS1Physical Access53. Are physical access controls in place?YesPlease indicate “Yes” or “No” for each category below:Yes/NoGuardsYesIdentification BadgesYesKey CardsYesCipher LocksYesBiometricsNoClosed Circuit TV (CCTV)No*54. Briefly describe in detail how the PII will be secured on the system using administrative, technical, and physical controls:Information is secured using username/passwords, least privilege, separation of duties, an intrusion detection system, firewalls, locks, badge access, background investigations. A comprehensive IRT (Incident Response Team) capability is also maintained.APPROVAL/DEMOTION1System InformationSystem Name:NIH NCI Cancer Genetics Services Directory (CGSD)2PIA Reviewer Approval/Promotion or DemotionPromotion/Demotion:PromoteComments:Approval/Demotion Point of Contact:Suzy MilliardDate:Jul 24, 20123Senior Official for Privacy Approval/Promotion or DemotionPromotion/Demotion:Comments:4OPDIV Senior Official for Privacy or Designee ApprovalPlease print the PIA and obtain the endorsement of the reviewing official below. Once the signature has been collected, retain a hard copy for the OPDIV's records. Submitting the PIA will indicate the reviewing official has endorsed itThis PIA has been reviewed and endorsed by the OPDIV Senior Official for Privacy or Designee (Name and Date):Name: __________________________________ Date: ________________________________________Name:Date:5Department Approval to Publish to the WebApproved for web publishingDate Published:Publicly posted PIA URL or no PIA URL explanation:PIA % COMPLETE1PIA CompletionPIA Percentage Complete:91.23PIA Missing Fields:Information Sharing Practices Tab, Question 23; Information Sharing Practices Tab, Question 25; Information Sharing Practices Tab, Question 26; Information Sharing Practices Tab, Question 27; Information Sharing Practices Tab, Question 28;