Pia

PIA Historically Black Colleges and Universities HBCU tool 1-14-2020 (002).docx

Collection of grant and contract data that may be of interest to Historically Black Colleges and Universities (HBCUs) and small businesses (OD/OALM)

PIA

OMB: 0925-0767

⚠️ Notice: This form may be outdated. More recent filings and information on OMB 0925-0767 can be found here:

Document [zip]

Download: zip | pdf

Save


Privacy Impact Assessment Form v 1.47.4
Status Redraft Form Number F-41701 Form Date 1/14/2020 1:17:24 PM
Question Answer
1 OPDIV:	NIH
2 PIA Unique Identifier:	P-6278176-506881
2a Name:	Historically Black Colleges and Universities (HBCU) tool
General Support System (GSS) Major Application Minor Application (stand-alone) 3 The subject of this PIA is which of the following? Minor Application (child) Electronic Information Collection Unknown
_3aIdentify the Enterprise Performance Lifecycle Phase _{Implementation}of the system.
3b Is this a FISMA-Reportable system?		Yes No
Does the system include a Website or online _Yes 4 application available to and for the use of the general public? ^No
Agency 5 Identify the operator. Contractor
POC Title Program Analyst, OD/OALM POC Name Rachel Kenlaw _6 Point_of_Contact_(POC):POC Organization OD/OM/OALM POC Email [email protected] POC Phone 301.451.6827
New 7 Is this a new or existing system? Existing
Yes 8 Does the system have Security Authorization (SA)? No
8a Date of Security Authorization	8/8/2019 12:00:00 AM

Shape1 Shape2 Shape3 Shape4 Shape5 Shape6 Shape7 Shape8 Shape9 Shape10 Shape11 Shape12 Shape13


11 Describe the purpose of the system.	The system will allow those with access to see what grants and contracts are available through periodic data uploads from grants.nih.gov, NIH RePORTER, beta.sam.gov, and the Federal Procurement Data System (FPDS.gov). The data uploaded from these sites will reduce the user’s reporting effort by prepopulating about 75% of the data input fields. Consolidating the upcoming grants and contracts into this system will decrease the burden on the Historically Black Colleges and Universities HBCUs and businesses by giving them one site to access NIH funding opportunities. The information entered by an HBCU or a business is viewable only by that HBCU or business and the NIH Small Business Program Office (SBPO) staff.
Describe the type of information the system will ₁₂collect, maintain (store), or share. (Subsequent questions will identify if this information is PII and ask about the specific data elements.)	The HBCU pre-solicitation portal uses specific login information to assign permissions/user roles which is considered Personally Identifiable Information (PII). However, this is done by using the NIH Identity, Credential, and Access
Question 12 Comments	Please specify All "Other Identifiers" stored in the system within your answer.
Provide an overview of the system and describe the 13 information it will collect, maintain (store), or share, either permanently or temporarily.	The HBCU pre-solicitation portal uses specific login information to assign permissions/user roles which is considered Personally Identifiable Information (PII). However,
Question 13 Comments	Please Do Not be concerned if Q12 and Q13 overlap/cover information that should be included in the other response. List "All" Personal Identifiable Information collected, maintained or shared.
Yes 14 Does the system collect, maintain, use or share PII? No
Social Security Number Date of Birth Name Photographic Identifiers Driver's License Number Biometric Identifiers Mother's Maiden Name Vehicle Identifiers E-Mail Address Mailing Address Phone Numbers Medical Records Number Medical Notes Financial Account Info Certificates Legal Documents ₁₅Indicate the type of PII that the system will collect or _Education_Records_Device_Identifiers maintain. Military Status Employment Status Foreign Activities Passport Number Taxpayer ID

Shape15 Shape16 Shape17 Shape18 Shape19 Shape20


Question 15 Comments	Per Q12, please specify and list "Other Identifiers" in the free text.
Employees Public Citizens _Indicate_the_categories_of_individuals_about_whom_PIIBusiness Partners/Contacts (Federal, state, local agencies) ¹⁶is collected, maintained or shared. Vendors/Suppliers/Contractors Patients Other
Question 16 Comments	Per Q11, "System will decrease the burden on the Historically Black Colleges and Universities HBCUs and businesses by giving them one site to access NIH funding opportunities", whom are considered public citizens, please also select "Public Citizens" in your answer.
17 How many individuals' PII is in the system? _<100
₁₈_For_what_primary_purpose_is_the_PII_used?Users accessing the system will be shown specific features. Access based on their role.
₁₉Describe the secondary uses for which the PII will be used (e.g. testing, training or research)	n/a
20 Describe the function of the SSN. _n/a
20a Cite the legal authority to use the SSN. _n/a
₂₁Identify legal authorities governing information use _n/a and disclosure specific to the system and program.
Are records on the system retrieved by one or more ^Yes ²²PII data elements? _No

Shape26 Shape27 Shape28 Shape29 Shape21 Shape22 Shape23 Shape24 Shape25 Shape30

Directly from an individual about whom the information pertains

Identify the sources of PII in the system.

Government Sources

Non-Government Sources

In-Person Hard Copy: Mail/Fax

Email Online Other

Within the OPDIV Other HHS OPDIV State/Local/Tribal

Foreign Other Federal Entities

Other

Members of the Public

_23aIdentify the OMB information collection approval number and expiration date.

Commercial Data Broker Public Media/Internet

Private Sector

n/a

Other

Is the PII shared with other organizations?

Yes No

Within HHS

24a

Identify with whom the PII is shared or disclosed and for what purpose.

Other Federal Agency/Agencies

State or Local Agency/Agencies

Private Sector

24b

Describe any agreements in place that authorizes the information sharing or disclosure (e.g. Computer Matching Agreement, Memorandum of Understanding (MOU), or Information Sharing Agreement (ISA)).

To find the right partners to apply for the funding opportunities

n/a

_24cDescribe the procedures for accounting for disclosures

The application shows the 'Terms and Conditions' banner that informs the user that personal information is collected.

No Disclosures

Describe the process in place to notify individuals

that their personal information will be collected. If no prior notice is given, explain the reason.
Is the submission of PII by individuals voluntary or mandatory?

Voluntary Mandatory


Describe the method for individuals to opt-out of the ₂₇collection or use of their PII. If there is no option to object to the information collection, provide a reason.	There is no opt-out method for users since their email address is needed for authentication purposes. There is no collection of PII from the general public.
Describe the process to notify and obtain consent ^from^the^individuals^whose^PII^isⁱⁿ^the^system^whenNo major changes are expected to occur that would impact ^major^changes^occur^to^the^system^(e.g.,^disclosurethe use of the email address. However, if changes were to ²⁸^and/or^data^uses^have^changed^since^the^notice^atoccur, an email will be sent to the users to mention the the time of original collection). Alternatively, describe _changes_and_either_obtain_their_consent_or_let_them_opt_out_ofwhy they cannot be notified or have their consent _the_system. obtained.
Describe the process in place to resolve an ^individual's^concerns^when^they^believe^their^PII^hasIn the event if the user has any concern that their data is ²⁹^been^{inappropriately}^obtained,^used,^or^disclosed,^orinappropriately obtained, used, or disclosed, they have the^that^the^PII^is^inaccurate.^If^no^process^exists,^explainoption to use the 'Contact Us' page to contact the OALM Staff. why not.
^Describe^the^processⁱⁿ^place^for^periodic^reviews^ofThe Personally Identifiable Information (PII) data within OALM ₃₀^PII^containedⁱⁿ^the^system^to^ensure^the^data'sHBCU Tool will be backed up every day to ensure the data^integrity,^{availability,}^accuracy^and^relevancy.^If^noavailability and will be reviewed periodically to ensure the processes are in place, explain why not. _{integrity of the}_data.
₃₁Identify who will have access to the PII in the system and the reason why they require access.		Users	To find partnership opportunities
		Administrators	Administrators have access to the data and the main focus is to backup and restore data.
		Developers
		Contractors	Contractors maintaining the system
		Others
Question 31 Comments	Please select "Contractors" if any type of contractors will have access to the PII in the system. Please specify if the contractors are direct contractors. Direct contractors are contractors that operate on behalf of the agency and use the agency's credentials when doing so.
The System Administrators are required to read the NIH IT ^Describe^the^proceduresⁱⁿ^place^to^determine^whichGeneral Rules of Behavior (https://ocio.nih.gov/aboutus/ ³²^system^users^{(administrators,}^developers,publicinfosecurity/securitytraining/Pages/ ^contractors,^etc.)^may^access^PII.NIH_IT_GeneralRulesofBehavior.aspx) document that details General Security practices, data privacy and protection.
_Describe_the_methods_in_place_to_allow_those_withOALM HBCU Tool have role-based authorization to ensure least ₃₃_access_to_PII_to_only_access_the_minimum_amount_ofprivilege access to the data in the system. An individual user’s _information_necessary_to_perform_their_job.access in terms of read/write/review within OALM HBCU Tool is controlled by very strict role-based control.
Identify training and awareness provided to personnel (system owners, managers, operators, ₃₄contractors and/or program managers) using the system to make them aware of their responsibilities for protecting the information being collected and maintained.	The NIH Security Awareness Training course is used to satisfy this requirement. According to NIH policy, all personnel who use NIH applications must attend security awareness training every year. There are four categories of mandatory IT training (Information Security, Counterintelligence, Privacy Awareness, and Records Management). Training is completed on the http://irtsectraining.nih.gov site with valid NIH credentials.

Shape33 Shape34 Shape35 Shape43 Shape36 Shape37 Shape38 Shape39 Shape40 Shape41 Shape42


Describe training system users receive (above and 35 beyond general security and privacy awareness training).	n/a
Do contracts include Federal Acquisition Regulation _Yes 36 and other appropriate clauses ensuring adherence to privacy provisions and practices? ^No
Records are maintained within the HBCU pre-solicitation portal for a time of no less than six years after a password is altered or an user account is terminated in accordance with NARA record retention schedule: 3.2.031, System access records; Systems requiring special accountability for access; DAA- GRS-2013-0006-0004 Records are maintained within the pre-solicitation portal for one year after the system is superseded by a new iteration or when no longer needed for agency/Information Technology (IT) administrative purposes to ensure a continuity of security controls throughout the life of the system in accordance with Describe the process and guidelines in place with _NARA_record_retention_schedule: 37 regard to the retention and destruction of PII. Cite _3.2.010,_Systems_and_data_security_records:_DAA- specific records retention schedules. _{GRS-2013-0006-0001} General Records Schedule 3.2, Information Systems Security Records, Item 010, Systems and data security records. Disposition Authority DAA-GRS-2013-0006-0002. Disposition: Temporary: Destroy 3 year(s) after all necessary follow-up actions have been completed General Records Schedule 3.2, Information Systems Security Records, Item 030, System access records. Disposition Authority DAA-GRS-2013-0006-0003. Disposition: Temporary. Destroy when business use ceases.
Administrative Controls: & Technical Controls: Access to the system is controlled by NIH log-in which authenticates the user prior to granting access. Access level and permissions are controlled by the system and based on user, role, organizational unit, and status of the report. All servers have been configured to remove all unused applications and system files and all local account access except when necessary to manage the system and maintain Describe, briefly but with specificity, how the PII will ^{integrity of}^data. 38 be secured in the system using administrative, _technical,_and_physical_controls.Physical Controls: The servers reside in the Center for Information Technology (CIT) Computer Room where policies and procedures are in place to restrict access to the machines. This includes guards at the front door and entrance to the machine room. The System is hosted at NIH OIT within a secure Windows environment and can only be accessed by Administrators with authentication information. Technical controls such as firewall is in place to protect from unauthorized intrusions.
39 Identify the publicly-available URL: _{https://oamp.hbcu.od.nih.gov}
Yes 40 Does the website have a posted privacy notice? No

Shape45 Shape46 Shape47 Shape44 Shape48

Is the privacy policy available in a machine-readable ^Yes^40aformat? _No

Does the website use web measurement and ^Yes

⁴¹customization technology? _No

Does the website have any information or pages ^Yes

⁴²directed at children under the age of thirteen? _No

Does the website contain links to non- federal ^Yes

⁴³government websites external to HHS? _No

REVIEWER QUESTIONS: The following section contains Reviewer Questions which are not to be filled out unless the user is an OPDIV Senior Officer for Privacy.