Tpwa Pia

US Department of Health and Human Services
Third Party Websites and Applications Privacy Impact Assessment
Date Signed:
January 22, 2021

OPDIV:
OS

Name:
Survey Monkey
TPWA Unique Identifier:
T-5919681-488370
Is this a new TPWA?
Yes
Will the use of a third-party Website or application create a new or modify an existing HHS/OPDIV
System of Records Notice (SORN) under the Privacy Act?
No
If SORN is not yet published, identify plans to put one in place.
null
Will the use of a third-party Website or application create an information collection subject to
OMB clearance under the Paperwork Reduction Act (PRA)?
Yes
Indicate the OMB approval number and approval number expiration date (or describe the
plans to obtain OMB clearance).
OMB Approval
0990-0407
Indicate the OMB approval number expiration date (or describe the plans to obtain OMB
clearance).
6/30/22 12:00 AM
Expiration Date:
Describe the plans to obtain OMB clearance.
null
Explanation:
Does the third-party Website or application contain Federal Records?
No
Describe the specific purpose for the OPDIV use of the third-party Website or application:
SurveyMonkey will be used to maximize opportunities to engage and communicate with the subset
of registrants through distribution of questions regarding the usefulness of the Think Cultural Health
website content.
Have the third-party privacy policies been reviewed to evaluate any risks and to determine
whether the Website or application is appropriate for OPDIV use?
Yes

Describe alternative means by which the public can obtain comparable information or services if
they choose not to use the third-party Website or application:
There is no other alternative means if the public choose not to use SurveyMonkey to response the
survey. As stated, the survey is voluntary.
Does the third-party Website or application have appropriate branding to distinguish the OPDIV
activities from those of nongovernmental actors?
Yes
How does the public navigate to the third-party Website or application from the OPIDIV?
N/A
Please describe how the public navigate to the third-party website or application:
An unique URL link will be sent to each individual participants via email. The SurveyMonkey platform
creates custom links for survey participants.
If the public navigate to the third-party website or application via an external hyperlink, is there
an alert to notify the public that they are being directed to a nongovernmental Website?
No
Has the OPDIV Privacy Policy been updated to describe the use of a third-party Website or
application?
No
Provide a hyperlink to the OPDIV Privacy Policy:
https://thinkculturalhealth.hhs.gov/privacy-policy
Is an OPDIV Privacy Notice posted on the third-party website or application?
No
Is PII collected by the OPDIV from the third-party Website or application?
No
Will the third-party Website or application make PII available to the OPDIV?
No
Describe the PII that will be collected by the OPDIV from the third-party Website or application
and/or the PII which the public could make available to the OPDIV through the use of the thirdparty Website or application and the intended or expected use of the PII:
None. SurveyMonkey collects IP addresses from visitors. They are kept as meta data on the
responses & they do not do anything with them. They are collected to identify individuals and allow
the survey administrator to ensure 1 person isn't taking the survey multiple times. They are not
distributed to anyone and can be set to "anonymous," which will no longer collect IP when the survey
concludes.
Describe the type of PII from the third-party Website or application that will be shared, with
whom the PII will be shared, and the purpose of the information sharing:
PII is not shared
If PII is shared, how are the risks of sharing PII mitigated?
N/A
Will the PII from the third-party website or application be maintained by the OPDIV?
No

Describe how PII that is used or maintained will be secured:
The only PII data variable shared with Survey Monkey is the email address. The email address is
encrypted in the Survey Monkey database using cryptographic controls. Survey Monkey collects IP
addresses from its visitors.
What other privacy risks exist and how will they be mitigated?
None