Pta

U.S. DEPARTMENT OF

HOUSING AND URBAN DEVELOPMENT

PRIVACY THRESHOLD ANALYSIS (PTA)

CoC Recordkeeping

Office of Special Needs Assistance Programs

December 9, 2019

PRIVACY THRESHOLD ANALYSIS (PTA)

The PTA is a compliance form developed by the Privacy Branch to identify the use of Personally Identifiable Information (PII) across the Department. The PTA is the first step in the PII verification process, which focuses on these areas of inquiry:

• Purpose for the information,

• Type of information,

• Sensitivity of the information,

• Use of the information,

• And the risk to the information.

Please use the attached form to determine whether a Privacy and Civil Liberties Impact Assessment (PCLIA) is required under the E-Government Act of 2002 or a System of Record Notice (SORN) is required under the Privacy Act of 1974, as amended.

Please complete this form and send it to your program Privacy Liaison Officer (PLO). If you have no program Privacy Liaison Officer, please send the PTA to the HUD Privacy Branch:

John Bravacos, Senior Agency Official for Privacy

Privacy Branch

U.S. Department of Housing and Urban Development

[email protected]

Upon receipt from your program PLO, the HUD Privacy Branch will review this form. If a PCLIA or SORN is required, the HUD Privacy Branch will send you a copy of the PCLIA and SORN templates to complete and return.

PRIVACY THRESHOLD ANALYSIS (PTA)

Summary Information

Project or Program Name:	Continuum of Care Recordkeeping Requirements (CoC – Recordkeeping)
Program:
CSAM Name (if applicable):	Click here to enter text.	CSAM Number (if applicable):	Click here to enter text.
Type of Project or Program:		Project or program status:
Date first developed:	May 1, 2013	Pilot launch date:	Click here to enter a date.
Date of last PTA update:	January 3, 2017	Pilot end date:	Click here to enter a date.
ATO Status (if applicable)		ATO expiration date (if applicable):	Click here to enter a date.

PROJECT OR PROGRAM MANAGER

Name:	Ebony Rankin
Office:	SNAPS	Title:	Click here to enter text.
Phone:	(202) 402-2505	Email:	[email protected]

INFORMATION SYSTEM SECURITY OFFICER (ISSO) (if applicable)

Name:	Click here to enter text.
Phone:	Click here to enter text.	Email:	Click here to enter text.

Specific PTA Questions

1. Reason for submitting the PTA:

On May 20, 2009, the President signed into law ‘‘An Act to Prevent Mortgage Foreclosures and Enhance Mortgage Credit Availability,’’ which became Public Law 111–22. This law implements a variety of measures directed toward keeping individuals and families from losing their homes. Division B of this law is the HEARTH Act, which consolidates and amends three separate homeless assistance programs carried out under title IV of the McKinney-Vento Homeless Assistance Act (42 U.S.C. 11371 et seq.) (McKinney-Vento Act) into a single grant program that is designed to improve administrative efficiency and enhance response coordination and effectiveness in addressing the needs of homeless persons. The HEARTH Act codifies in law and enhances the Continuum of Care planning process, the coordinated response to addressing the needs of the homeless, which was established administratively by HUD in

1995. The single Continuum of Care Program established by the HEARTH Act consolidates the following programs: The Supportive Housing Program, the Shelter Plus Care Program, and the Moderate Rehabilitation/Single Room Occupancy Program.

Publication of the interim rule for the Continuum of Care Program continues HUD’s implementation of the HEARTH Act. This rule establishes the regulatory framework for the Continuum of Care Program and the Continuum of Care planning process, including requirements applicable to the establishment of a Continuum of Care. A Continuum of Care is designed to address the critical problem of homelessness through a coordinated community-based process of identifying needs and building a system of housing and services to address those needs. The approach is predicated on the understanding that homelessness is not caused merely by a lack of shelter, but involves a variety of underlying, unmet needs—physical, economic, and social.

As amended by the HEARTH Act, Subpart C of the McKinney-Vento Homeless Assistance Act establishes the Continuum of Care Program. The purpose of the program is to promote communitywide commitment to the goal of ending homelessness; provide funding for efforts by nonprofit providers, and State and local governments to quickly rehouse homeless individuals and families while minimizing the trauma and dislocation caused to homeless individuals, families, and communities by homelessness; promote access to and effective utilization of mainstream programs by homeless individuals and families; and optimize self-sufficiency among individuals and families experiencing homelessness.

The statutory provisions and implementing interim regulations found at 24 CFR 578 govern the Continuum of Care Program recordkeeping requirements for recipient and subrecipients and the standard operating procedures for ensuring that Continuum of Care Program funds are used in accordance with the program requirements.

Each collaborative applicant must keep the following documentation related to establishing and operating a Continuum of Care [24 CFR 578.103 (a)(1)(i-iii)]. 1. Evidence that the Board selected by the CoC meets the requirements, 2. Evidence that the Continuum has been established and operated according the subpart B of 24 CFR 578, and 3. Evidence that the Continuum has prepared the application for funds according to 24 CFR 578.9

Unified Funding Agencies (UFAs) that requested grant amendments from HUD must keep evidence that the grant amendment was approved by the Continuum [24 CFR 578.103 (a)(2)].

Recipients must maintain homeless and at risk of homeless status documentation of program participants [24 CFR 578.103 (a)(3-4)]. Recipients or subrecipients must document their compliance with the CoC’s homeless participation requirements [CFR 578.103(a)(12)]. Recipients are required to maintain documentation of reasonable belief of imminent threat of harm for victims of domestic violence, dating violence, sexual assault or stalking [24 CFR 578.103(a)(5)(i-ii)]. Recipients or subrecipients must also maintain records of supportive services provided, an annual assessment of services for program participants (as necessary), and as applicable, compliance with the termination of assistance [24 CFR 578.103(a)(7)(i-ii)]. Further, recipients or subrecipients must document the types of supportive services provided under a recipient’s program and the amounts spent on those services and adjust supportive service packages as necessary [CFR 578.103(a)(9)].

Program participants receiving housing assistance where rent or an occupancy charge is paid by the program participant, recipients or subrecipients must maintain documentation of the program participant’s annual income [24 CFR 578.103(a)(6)(i-iv)].

Recipients or subrecipients must retain documentation of compliance with the housing standards, including inspection reports [CFR 578.103(a)(8)].

Recipients must maintain documentation of the source and use of contributions made to satisfy the match requirement of the Continuum of Care Program. The records must indicate the grant and fiscal year for which each matching contribution is counted. Further, the records must show how the value placed on third party in-kind contributions was derived. To the extent feasible, volunteer services must be supported by the same methods that the organization uses to support the allocation of regular personnel costs [CFR 578.103(a)(10)].

Recipients and subrecipients must maintain documentation to demonstrate compliance with the organizational conflict-of-interest requirements, the Continuum of Care Board conflict-of interest requirements, and other conflict requirements as identified in the CoC Program [CFR 578.103(a)(11)].

Recipients and subrecipients must document compliance with the faith-based activities requirements of the Continuum of Care Program [CFR 578.103(a)(13)]. Moreover, recipients and subrecipients must maintain copies of their marketing, outreach, and other materials used to inform eligible persons of the program to document compliance with the CoC Program requirements [CFR 578.103(a)(14)].

Recipients and subrecipients must document their compliance with the other Federal requirements of the Continuum of Care Program, including but not limited to the following: environmental review, Solid Waste Disposal Act, Transparency Act Reporting, Coastal Barrier Resources Act, applicability to OMB Circulars, lead-based paint, audits, Davis-Bacon requirements, and Section 3 of the HUD Act [CFR 578.103(a)(15)].

The recipient must retain copies of all solicitations of and agreements with subrecipients, records of all payment requests by and dates of payments made to subrecipients, and documentation of all monitoring and sanctions of subrecipients, as applicable. Recipients must retain documentation of monitoring subrecipients, including any monitoring findings and corrective actions required. Recipient and subrecipients must retain copies of all procurement contracts and documentation of compliance with the procurement requirements in 24 CFR 84 and 85 [24 CFR 578.103(a)(16)].

Recipient and subrecipients must maintain other records specified by HUD and ensure that all records containing protected identifying information for individuals and families is kept secure and confidential Recipients and subrecipients must maintain all records pertaining to Continuum of Care funds. [24 CFR 578.103(a)(17)].

Does this system employ the following technologies? If you are using these technologies and want coverage under the respective PIA for that technology, please stop here and contact the HUD Privacy Branch for further guidance.

Social Media Web portal2 (e.g., SharePoint) Contact Lists Public website (e.g. A website operated by HUD, contractor, or other organization on behalf of the HUD None of these

From whom does the Project or Program collect, maintain, use, or disseminate information? Please check all that apply.

This program collects no personally identifiable information3 Members of the public HUD employees/contractors (list programs): Contractors working on behalf of HUD Employees of other federal agencies Other (e.g. business entity)

What specific information about individuals is collected, generated or retained?
This assessment concerns the recordkeeping requirements for participation in the Continuum of Care program operated by the Office of Special Needs Assistance Programs at the Department of Housing and Urban Development. Recordkeeping information is not centralized, nor is the data stored in systems that can be accessed by the program office or Department. Each grant recipient maintains its own records and must produce information only in the event of an monitoring request as appropriate to determine regulatory compliance. No personally identified information is captured in any federal system, nor is it shared in any way with the program office.
4(a) Does the project, program, or system retrieve information from the system about a U.S. Citizen or lawfully admitted permanent resident aliens by a personal identifier?	No. Please continue to next question. Yes. If yes, please list all personal identifiers used:
4(b) Does the project, program, or system have an existing System of Records Notice (SORN) that has already been published in the Federal Register that covers the information collected?	No. Please continue to next question. Yes. If yes, provide the system name and number, and the Federal Register citation(s) for the most recent complete notice and any subsequent notices reflecting amendment to the system
4(c)Has the project, program, or system undergone any significant changes since the SORN?	No. Please continue to next question. Yes. If yes, please describe.
4(d) Does the project, program, or system use Social Security Numbers (SSN)?	No. Yes.
4(e) If yes, please provide the specific legal authority and purpose for the collection of SSNs:	Click here to enter text.
4(f) If yes, please describe the uses of the SSNs within the project, program, or system:	Click here to enter text.
4(g) If this project, program, or system is an information technology/system, does it relate solely to infrastructure? For example, is the system a Local Area Network (LAN) or Wide Area Network (WAN)?	No. Please continue to next question. Yes. If a log kept of communication traffic, please answer this question.
4(h) If header or payload data4 is stored in the communication traffic log, please detail the data elements stored.
NA

Does this project, program, or system connect, receive, or share PII with any other HUD programs or systems?	No. Yes. If yes, please list: Click here to enter text.
Does this project, program, or system connect, receive, or share PII with any external (non-HUD) partners or systems?	No. Yes. If yes, please list: Click here to enter text.
6(a) Is this external sharing pursuant to new or existing information sharing access agreement (MOU, MOA, etc.)?	NA
7. Does the project, program, or system provide role-based training for personnel who have access in addition to annual privacy training required of all HUD personnel?	No. Yes. If yes, please list:
Per NIST SP 800-53 Rev. 4, Appendix J, does the project, program, or system maintain an accounting of disclosures of PII to individuals/agencies who have requested access to their PII?	No. What steps will be taken to develop and maintain the accounting: We collect no PII, so any procedure undertaken will state that no PII exists to collect. Yes. In what format is the accounting maintained:
Is there a FIPS 199 determination?5	Unknown. No. Yes. Please indicate the determinations for each of the following: Confidentiality: Low Moderate High Integrity: Low Moderate High Availability: Low Moderate High

PRIVACY THRESHOLD ANALYSIS REVIEW

(To be Completed by PROGRAM PLO)

Program Privacy Liaison Reviewer:	Click here to enter text.
Date submitted to Program Privacy Office:	Click here to enter a date.
Date submitted to HUD Privacy Branch:	Click here to enter a date.
Program Privacy Liaison Officer Recommendation: Please include recommendation below, including what new privacy compliance documentation is needed.
Click here to enter text.

(To be Completed by the HUD Privacy Branch)

HUD Privacy Branch Reviewer:	Click here to enter text.
Date approved by HUD Privacy Branch:	Click here to enter a date.
PTA Expiration Date:	Click here to enter a date.

DESIGNATION

Privacy Sensitive System:		If “no” PTA adjudication is complete.
Category of System:		If “other” is selected, please describe: Click here to enter text.
Determination: X PTA sufficient at this time. Privacy compliance documentation determination in progress. New information sharing arrangement is required. HUD Policy for Computer-Readable Extracts Containing Sensitive PII applies. Privacy Act Statement required. Privacy and Civil Liberties Impact Assessment (PCLIA) required. System of Records Notice (SORN) required. Paperwork Reduction Act (PRA) Clearance may be required. Contact your program PRA Officer. A Records Schedule may be required. Contact your program Records Officer.
PIA:	If covered by existing PCLIA, please list: Click here to enter text.
SORN:	If covered by existing SORN, please list: Click here to enter text.
HUD Privacy Branch Comments: This PTA will suffice at this time, however; if there are any changes, an update will be required. Please describe rationale for privacy compliance determination above.
Click here to enter text.

DOCUMENT ENDORSMENT

DATE REVIEWED:

PRIVACY REVIEWING OFFICIALS NAME:

By signing below, you attest that the content captured in this document is accurate and complete and meet the requirements of applicable federal regulations and HUD internal policies.

SYSTEM OWNER << INSERT NAME/TITLE>>		Date
<<INSERT PROGRAM OFFICE>>
John Bravacos Senior Agency Official for Privacy Privacy Branch		Date
OFFICE OF ADMINISTRATION

2 Informational and collaboration-based portals in operation at HUD and its programs that collect, use, maintain, and share limited personally identifiable information (PII) about individuals who are “members” of the portal or “potential members” who seek to gain access to the portal.

3 HUD defines personal information as “Personally Identifiable Information” or PII, which is any information that permits the identity of an individual to be directly or indirectly inferred, including any information that is linked or linkable to that individual, regardless of whether the individual is a U.S. citizen, lawful permanent resident, visitor to the U.S., or employee or contractor to the Department. “Sensitive PII” is PII, which if lost, compromised, or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. For the purposes of this PTA, SPII and PII are treated the same.

4 Header: Information that is placed before the actual data. The header normally contains a small number of bytes of control information, which is used to communicate important facts about the data that the message contains and how it is to be interpreted and used. It serves as the communication and control link between protocol elements on different devices.

Payload data: The actual data to be transmitted, often called the payload of the message (metaphorically borrowing a term from the space industry!) Most messages contain some data of one form or another, but some actually contain none: they are used only for control and communication purposes. For example, these may be used to set up or terminate a logical connection before data is sent.

5 FIPS 199 is the Federal Information Processing Standard Publication 199, Standards for Security Categorization of Federal Information and Information Systems and is used to establish security categories of information systems.

United States Department of Housing and Urban Development

January 14, 2021