PIA Word

Save

^Privacy Impact Assessment Form

v 1.21

Status Form Number Form Date

Question Answer

1. ^OPDIV: CDC/DDNID/NCIPC/DIP

2. PIA Unique Identifier: _TBD

^{2a Name:} UNDERSTANDING VAPING PRACTICES IN THE UNITED STATES (U

3. The subject of this PIA is which of the following?

_3a Identify the Enterprise Performance Lifecycle Phase of the system.

3b Is this a FISMA-Reportable system?

Does the system include a Website or online

General Support System (GSS) Major Application

Minor Application (stand-alone) Minor Application (child) Electronic Information Collection Unknown

Implementation

Yes No

Yes

4. application available to and for the use of the general

public? ^No

5. Agency

   Contractor

   Identify the operator.

POC Title Business Steward

6. Point of Contact (POC):

POC Name Christopher Jones

POC Organization CDC/DDNID/NCIPC/DIP

POC Email [email protected]

POC Phone 404.498.0756

7	Is this a new or existing system?
8	Does the system have Security Authorization (SA)?
8b	Planned Date of Security Authorization

New Existing

Yes No

Not Applicable

8c Briefly explain why security authorization is not This is a new electronic data collection. required
10 Describe in further detail any changes to the system that have occurred since the last PIA.	N/A
11 Describe the purpose of the system.	The purposes of the Understanding Vaping Practices In The United States (UVPUS) study are to, (1) Collect data about product types, brands, devices, and frequency of use from a sample of individuals who report vaping Tetrahydrocannabinol (THC)-containing products but who have not developed e- cigarette, or vaping, product use associated lung injury (EVALI) and (2) Determine if the vaping characteristics/behaviors of non-cases (those who vape but have not developed EVALI) are different from the vaping characteristics of EVALI cases. The survey contains a series of up 34 questions that assess the respondents’: 1) substance(s) used in vaping products 2) product sources 3) specific “brands” used 4) devices/products used 5) other substances used or vaped and 6) frequency of use.
Understanding Vaping Practices In The United States (UVPUS) will be collecting and identify product types and frequency of use (collectively referred to as use characteristics) from a nationally diverse convenience sample of individuals who report vaping THC-containing products but have not Describe the type of information the system will developed EVALI. The sample is part of YouGov, an opt-in 12 collect, maintain (store), or share. (Subsequent online internet panel of registered individuals. YouGov questions will identify if this information is PII and ask specializes in market research and opinion polling through about the specific data elements.) online methods. YouGov maintains all respondent profile information and PII. There will be no PII collected in this study, preregistered participants will be emailed information about the survey and what is required for participation. PII, such as the name of the respondent and his/her contact information will not be stored in the data files at any time.
Participation in the survey will be voluntary for all respondents. Potential participants will be emailed information about the survey and what is required for participation. PII, such as the name of the respondent and his/her contact information will not be stored in the initial data files at any time. Unique identifiers will be assigned to each case in the data files as data are collected. Survey data will be stored by YouGov in secure Provide an overview of the system and describe the servers. YouGov maintains all respondent profile information 13 information it will collect, maintain (store), or share, on a separate server from survey responses/attitudinal data. either permanently or temporarily. Upon contract termination and per the terms of the agreement, YouGov will destroy all data related to this information collection at the completion of the project. Data files will be delivered to NCIPC using a secure file transfer protocol (SFTP) site. All data collected from the survey will be treated in a secure manner and will not be disclosed, unless otherwise compelled by law. CDC will retain and destroy records in accordance with the applicable CDC Records Control Schedule.
14 Does the system collect, maintain, use or share PII?	Yes No

	Reviewer Questions	Answer
REVIEWER QUESTIONS: The following section contains Reviewer Questions which are not to be filled out unless the user is an OPDIV Senior Officer for Privacy.
	Reviewer Questions	Answer
1	Are the questions on the PIA answered correctly, accurately, and completely?	Yes No
Reviewer Notes
2	Does the PIA appropriately communicate the purpose of PII in the system and is the purpose justified by appropriate legal authorities?	Yes No
Reviewer Notes
3	Do system owners demonstrate appropriate understanding of the impact of the PII in the system and provide sufficient oversight to employees and contractors?	Yes No
Reviewer Notes
4	Does the PIA appropriately describe the PII quality and integrity of the data?	Yes No
Reviewer Notes
5	Is this a candidate for PII minimization?	Yes No
Reviewer Notes
6	Does the PIA accurately identify data retention procedures and records retention schedules?	Yes No
Reviewer Notes
7	Are the individuals whose PII is in the system provided appropriate participation?	Yes No
Reviewer Notes
8	Does the PIA raise any concerns about the security of the PII?	Yes No
Reviewer Notes
9	Is applicability of the Privacy Act captured correctly and is a SORN published or does it need to be?	Yes No
Reviewer Notes
10	Is the PII appropriately limited for use internally and with third parties?	Yes No

	Reviewer Questions			Answer
Reviewer Notes
11	Does the PIA demonstrate compliance with all Web privacy requirements?			Yes No
Reviewer Notes
12	Were any changes made to the system because of the completion of this PIA?			Yes No
Reviewer Notes
General Comments
OPDIV Senior Official for Privacy Signature			HHS Senior Agency Official for Privacy

Page 2 of 4