Pta

U.S. DEPARTMENT OF
HOUSING AND URBAN DEVELOPMENT

PRIVACY THRESHOLD ANALYSIS (PTA)
Continuum of Care Consolidated Program
Application Insert System
Office of Community Planning and
Development

30 August 2018

PRIVACY THRESHOLD ANALYSIS (PTA)

The PTA is a compliance form developed by the Privacy Branch to identify the use of Personally
Identifiable Information (PH) across the Department. The PTA is the first step in the Pit verification
process, which focuses on these areas of inquiry:
•

Purpose for the information,

•

Type of information,

•

Sensitivity of the information,

•

Use of the information,

•

And the risk to the information.

Please use the attached form to determine whether a Privacy Impact Assessment (PIA) is required under
the E-Govemment Act of 2002 or a System of Record Notice (SORN) is required under the Privacy Act
of 1974, as amended.
Please complete this form and send it to your program Privacy Liaison Officer (PLO). If you have no
program Privacy Liaison Officer, please send the PTA to the HUD Privacy Branch:
Marcus Smallwood, Acting, Chief Privacy Officer
Privacy Branch
U.S. Department of Housing and Urban Development

[email protected]

Upon receipt from your program PLO, the HUD Privacy Branch will review this form. If a PIA or SORN
is required, the HUD Privacy Branch will send you a copy of the PtA and SORN templates to complete
and return.

PRIVACY THRESHOLD ANALYSIS (PTA)
SUMMARY INFORMATION
Project or
Program Name:

CoC Consolidated Program Application

Program:

Community Planning and Development (CPD)

CSAM Name (it
applicable):

E-Snap

CSAM Number
(if applicable):

Click here to enter text.

Form or other Information
Collection

Project or
program
status:

Existing

August 30, 2018

Pilot launch
date:

Click here to enter a date.

Click here to enter a date.

Pilot end date:

Click here to enter a date.

ATO Status (it
applicable)

Choose an item,

ATO
expiration date
(if applicable):

Click here to enter a date.

Name:

Norm Suchar

Office:

SNAPs Office

Title:

Director

Phone:

202-402-4300

Email:

[email protected]

.

.

Type of Project or
Program:
Date first
developed:
Date of last PTA
update:

.

.

PROJECT OR PROGRAM MANAGER

INFORMATION SYSTEM SECURITY OFFICER (ISSO) (IF APPLICABLE)
Name:

Click here to enter text.

Phone:

Click here to enter text.

Email:

Click here to enter text.

Commented [NS1):

Ones this mean the date this
form was first developed or when the COC
was
first
developed?
LProgram

SPECIFIC PTA QUESTIONS
1. Reason for submitting the PTA Choose an item.
Please provide a general description of the project and its puipose so anon-technical person could
understand. If this is an updated PTA, please describe what changes and/or upgrades triggering the
update to this PTA. I/this is a renewal please state whether there were any changes to the project,
program, or system since tite lost version.

The regulatory authority to collect this information is contained in 24 CFR Part 578, and is authorized by
the McKinney-Vento Act, as amended by S. 896 The Homeless Emergency Assistance and Rapid
Transition to Housing (HEARTH) Act of 2009 (42 U.S.C. 11371 et seq.) which states that “The Secretary
shall award grants, on a competitive basis, and using the selection criteria described in section 427, to
carry out eligible activities under this subtitle for projects that meet the program requirements under
section 426, either by directly awarding funds to project sponsors or by awarding funds to unified funding
agencies. “(SEC.422(a))

The CoC Homeless Assistance Grant Application (0MB 2506-0112), also called the CoC Consolidated
Application, includes a CoC Application and CoC Priority Listing that collect information from the
statewide and local CoCs, and a Project Application that collects information from the individual project
applicants within those CoCs. The CoC Consolidated Application is necessary for the selection of
proposals submitted to HUD (by nonprofit organizations, states, local governments, instrumentalities of
states and local governments, and Public Housing Authorities) for the grant funds available through the
CoC Program.

The purpose of this information collection is to determine each CoC’s progress toward: 1) promoting
community-wide commitment to the goal of ending homelessness, including homelessness among the
specific subpopulations of the chronically homeless, families, youth and veterans; 2) provide funding for
efforts by nonprofit organizations, states, local governments, instrumentalities of States and local
govemments, and Public Housing Authorities to quickly re-house homeless individuals and families into
permanent housing while minimizing the trauma and dislocation caused to individuals, families, and
communities by homelessness; and 3) promote access to, and effective utilization of mainstream
programs and programs funded with State or local resources in order to increase self-sufficiency among
individuals and families experiencing homelessness. The information also allows HUD to assess project
quality according to the threshold criteria established annually by the CoC Program Competition Notice
of funding Availability (NOFA) and according to 24 CFR part 578.

2.

Does this system employ the following

technologies?

if you are using these technologies and want

Social Media
Web portal’ (e.g., SharePoint)

coverage under the respective PIA for that
Contact Lists
Informational and collaboration-based portals in operation at HUD and its programs that collect, use, maintain, and share limited
personally identifiable information (P11) about individuals who are ‘members’ of the portal or ‘potential members” svho seek to
gain access to the portal.

technology, please stov here and contact the HUD
Privacy Branch forfiirther guidance.

Public website (e.g. A website operated by
HUD, contractor, or other organization on behalf of
the HUD

E

None of these

This program collects no personally identifiable
information2
3.

From whom does the Project or
Program collect, maintain, use, or
disseminate information?
Please check alt that apply.

Members of the public
HUD employees/contractors (list programs):

E
E

Contractors working on behalf of HUD
Employees of other federal agencies
Other (e.g. business entity)

4.

What specific information about individuals is collected, generated or retained?

Please provide a specific description of inftrntation collected, ge,terated, or retained (such as full ,tcunes,
ntaide,t ndune, mother’s nutide,t ,tante, alias, social security ,tt,,nber, passport number, driver’,c license
niunber, taxpayer ide,ttification number, patient ideitt(flcation ,ttnnber, fiitcutcial account, credit card
ntunber, street internet protocol, ntedict access co,ttrot, telephone ,tuntber, ntobite ,ttunber, bu,si,te,c.c
,ttunber, p/to tograph image, x—ray.c, fin ge,print.c, biometric intcige, template date(e.g. retctin scent, well—
,

defined grotip of people),vehicle registration number, title mtwnber cutd i,zfrwntatio,t about an i,tduvial tltctt
i.r lbtked or li,tkable to one of the cibove (e.g. date of date, place of birth, race, religion, weight, activities,
geographical btdictors, employmeitt i,tforntatio,t, medial info rotation, edttc’cition utfo,7ttcttio,t, fi,tcutcial
btforntatio,t) and etc.
The Continuum of Care Program Applications are not designed to capture information about individuals.
information is only collected about nonprofit organizations, states, local governments, instrumentalities of
states and local governments, and Public Housing Authorities, Information about the projects that the
organizations are applying to fund is never collected on an individual level and is only ever collected in
aggregate.
The HUD and government-wide standard forms in eluded with the application do not collect information about
individuals and only collect information at the organization or aggregate level, These forms include the
HUD2880, HUDSOQ7Q, SFLLL, HUD96011, SF424, and SF424 (SUPP)

2

HUD defines personal information as ‘Personally Identifiable Information” or P11, which is any information that permits the
identity of an individual to be directly or indirectly inferred, including any information that is linked or linkable to that individual.
regardless of whether the individual is a U.S. citizen, lawful permanent resident, visitor to the U.S., or employee or contractor to
the Department. “Sensitive PIT’ is P11, which if lost, compromised, or disclosed without authorization, could result in substantial
harm, embarrassment, inconvenience, or unfairness to an individual. For the purposes of this PTA, SPll and P11 are treated the
same.

4(a) Does the project, program, or system
retrieve information from the system about

No. Please continue to next question.

a U.S. Citizen or lawfully admitted

Yes. If yes, please list all personal identifiers

permanent resident aliens by a personal

used:

identifier?
No. Please continue to next question.

4(b) Does the project, program, or system
have an existing System of Records Notice
(SORN) that has already been published in
the Federal Register that covers the

Yes. If yes, provide the system name and
number, and the Federal Register
citation(s) for the most recent complete notice and
any subsequent notices

information collected?

reflecting amendment to the system

4(c)Has the project, program, or s3’stem

No. Please continue to next question.
Yes. If yes, please describe.

undergone any significant changes since the

SORN?
4(d) Does the project, program, or system
use Social Security Numbers

No.
Yes.

(SSN)?

4(e) If yes, please provide the specific legal
authority and purpose for the collection of

Click here to enter text.

SSNs:
4(1) If yes, please describe the uses of the
Click here to enter text.

SSNs within the project, program, or
system:
4(g) If this project, program, or system

is

an information technology/system, does it
relate solely to infrastructure?

For example, is the system a Local Area Network
(IAN) or Wide Areci Network (WAN)?

No. Please continue to next question.
Yes. If a log kept of communication traffic,
please answer this question.

4(h) If header or payload data3 is stored in the communication traffic log, please detail the data
elements stored.

Click here to enter text.

5.

Does this project, program, or system
connect, receive, or share P11 with any
other HUD programs or systems?

No.

E

Yes.

If yes, please list:

Header: Information that is placed before the actual data. The header normally contains a small number of bytes of
control information, which is used to communicate important facts about the data that the message contains and how
it is to be interpreted and used, It serves as the communication and control link between protocol elements on different
devices.
Payload data: The actual data to be transmitted, often called the payload of the message (metaphorically borrowing a
term from the space industry!) Most messages contain some data of one form or another, but some actually contain
none: they are used only for control and communication purposes. For example, these may be used to set up or
terminate a logical connection before data is sent.

—

—

—

-Commented[NS2J:Idon’t know what this is.,

Click here to enter text.

6. Does this project, program, or system
connect, receive, or share P11 with any
external (non-HUB) partners or
systems?

No.

Yes. If yes, please list:
Click here to enter text.

6(a) Is this external sharing pursuant to
new or existing information sharing
access agreement (MOU, MOA, etc.)?

7. Does the project, program, or system
provide role-based training for
personnel who have access in addition
to annual privacy training required of
all HUB personnel?
8.

Per NIST SP 800-53 Rev. 4, Appendix

J, does the project, program, or system
maintain an accounting of disclosures
of P11 to individuals/agencies who have
requested access to their P11?
9. Is there a FIPS 199 determination?4

Choose an item.

Please describe applicable information sharing
governance in place:

No.

Yes.

If yes, please list:

No. What steps will be taken to develop and

maintain the accounting:
Yes. In what format is the accounting
maintained:

No.
Yes. Please indicate the determinations for each
of the following:
Confidentiality:
Low
Moderate

E High

Integrity:
E Low D Moderate

E High

Availability:
E Low E Moderate

D

High

PRIVACY THRESHOLD ANALYSIS REVIEW

FIPS 199 is the Fedil tstnwion Piu
nStandad Publication 199, Standards for Security Categorization of Federal
Information and Information Systems and is used to establish security categories of information systems.

(TO BE COMPLETED BY PROGRAM PLO)
Program Privacy Liaison Reviewer:

Click here to enter text.

Date submitted to Program Privacy
Office:

Click here to enter a date.

Date submitted to HTJD Privacy Branch:

Click here to enter a date.

Program Privacy Liaison Officer Reconunendation:
Please include recommendation below, including what new privacy compliance documentation is needed.
Click here to enter text.

(TO BE COMPLETED BY THE HUD PRIVACY BRANCH)
HUB Privacy Branch Reviewer:

Click here to enter text.

Date approved by HUD Privacy Branch:

Click here to enter a date.

PTA Expiration Date:

Click here to enter a date.
DESIGNATION

Privacy Sensitive System:

Choose an item.
Choose an item.

Category of System:
Determination:

If “no” PTA adjudication is complete.

If “other” is selected, please describe: Click here to enter text.

fl PTA sufficient at this time.
Privacy compliance documentation determination in progress.
New information sharing arrangement is required.

U HUD Policy for Computer-Readable Extracts Containing Sensitive P11
applies.

U Privacy Act Statement required.
Privacy Impact Assessment (P[A) required,

U System of Records Notice (SORN) required.
U Paperwork Reduction Act (PRA) Clearance may be required. Contact
your program PRA Officer.

U A Records Schedule may be required. Contact your program Records
Officer.
PIA
SORN:

Choose an item.
If covered by existing PIA, please list: Click here to enter text.
Choose an item.

If covered by existing SORN, please list: Click here to enter text.
HUB Privacy Branch Comments:

Please describe rationale fi’r privacy compliance determination above.
Click here to enter text.

DOCUMENT ENDORSMENT

DATE REVIEWED:
PRIVACY REVIEWING OFFICIALS NAME:

By signing below, you attest that the content captured in this document is accurate and complete
and meet the requirements of applicable federal regulations and HUD internal policies.

io)’t
Date
SYSTEM OWNER
NORM SUCHAR
SNAPS DIRECTOR

Date
CHIEF PRIVACY OFFICER
NEAL RACKLEFF
OFFICE OF ADMINISTRATION

1o

is