DHS/USCIS/PIA-016(b)

Privacy Impact Assessment Update
for the

Computer Linked Application
Information Management System
(CLAIMS 3) and Associated Systems
DHS/USCIS/PIA-016(b)
May 7, 2019
Contact Point
Donald K. Hawkins
Privacy Officer
U.S. Citizenship and Immigration Services
(202) 272-8030
Reviewing Official
Jonathan R. Cantor
Acting Chief Privacy Officer
Department of Homeland Security
(202) 343-1717

Privacy Impact Assessment Update

DHS/USCIS/PIA-016(b), CLAIMS 3
Page 2

Abstract
U.S. Citizenship and Immigration Services (USCIS) oversees lawful immigration to the
United States and is responsible for processing petitions, applications, and other requests for
immigration benefits and requests. USCIS uses the Computer Linked Application Information
Management System (CLAIMS 3) and associated systems to manage the adjudication process for
most domestically-filed immigration benefit filings with the exception of naturalization,
intercountry adoption, and certain requests for asylum and refugee status. USCIS is now updating
this PIA to provide notice of system changes in support of the USCIS eProcessing initiative. Upon
publication of this PIA, CLAIMS 3 will (1) support the acceptance of certain electronically filed
immigration benefits; (2) include a new icon enabling users to retrieve and view immigration
content in support of the benefit adjudication; and, (3) communicate with RAILS (not an acronym)
to identify the location of the immigration file. This PIA update evaluates the privacy risks and
mitigations associated with these updates including the collection, use, and maintenance of
personally identifiable information (PII).

Overview
USCIS receives and adjudicates petitions, applications, and other requests (hereinafter
referred to as “immigration related requests”) for many United States immigration benefits and
requests. Historically, USCIS used CLAIMS 3 to process many paper-based, immigration benefit
filings with the exception of naturalization, intercountry adoption, and certain requests 1 for asylum
and refugee status. CLAIMS 3 is the case management system that supports the maintenance and
tracking of officer casework documentation for many immigration related requests. CLAIMS 3
functionalities include tracking the adjudication performed by USCIS personnel, archiving, card
production, case history, case transfer, on-demand reports, electronic file tracking, image capture,
production statistics, and status updates.
As described in the DHS/USCIS/PIA-061 Benefit Request Intake Process, 2 in order to
initiate the immigration related request process, a requestor may complete an immigration related
request form by paper or file the form electronically (if available); both methods collect the same
information and payment fee. At the time of publication of both DHS/USCIS/PIA-016(a) and
DHS/USCIS/PIA-061, CLAIMS 3 only supported the intake and processing of paper-filed

The “certain requests” for refugee and asylum benefits include the “follow to join” petition (Form I-730). “Follow
to join” is an option offered to family members of the principal beneficiaries of approved asylum and refugee status.
Immediate family members (spouses and children under the age of 21) may qualify for derivative status. An
individual who entered the United States and was granted asylum/refugee status within the past two years may
petition to have his or her spouse and/or unmarried children “follow-to-join” him or her in the United Sates and
obtain derivative status. The derivatives may be in the United States or outside the United States.
2 See DHS/PIA/USCIS-061 Benefit Request Intake Process, available at www.dhs.gov/privacy.
1

Privacy Impact Assessment Update

DHS/USCIS/PIA-016(b), CLAIMS 3
Page 3

immigration related requests. 3 To support the paper processing of an immigration related request
in CLAIMS 3, a requestor (or his or her legal representative) was instructed to a mail completed
paper-based form, supporting documents, and the applicable fee payment or fee waiver to a USCIS
Service Center, the National Benefits Center, or to a USCIS Lockbox.
Upon receipt, USCIS preliminarily reviewed the form for completeness, assigned the
benefit requestor an Alien Number (A-Number) or matched the request with an existing A-Number
(if applicable), assigned the application a Receipt Number, and forwarded the benefit request form,
to be consolidated in the Alien File (A-File) or Receipt File, to the appropriate USCIS office for
adjudication. After preliminary review, USCIS personnel manually entered relevant and necessary
information from the paper benefit request form into CLAIMS 3. As part of the adjudication
process, USCIS personnel reviewed all case-related information provided by the immigration
related requestor or his or her representative, including supplementary evidence and review the AFile (if available) to verify the identity and eligibility of the requestor, completed all necessary
screening, and conducted interviews (as necessary) to make a final determination on the
immigration related request (e.g., grant, deny, revoke).

Reason for the PIA Update
USCIS launched the eProcessing initiative to eliminate the creation of new paper
immigration records. 4 USCIS is moving from a traditional paper-based environment to a digital
environment in which the immigration related request filing, adjudication, and communication are
all electronic. As USCIS moves towards a digital environment, USCIS is fundamentally shifting
its immigration records management processes and technologies. USCIS has historically used
large systems with siloed operational functions to perform its case management needs. As part of
the eProcessing initiative, USCIS plans to leverage and integrate existing operational systems with
new services in an effort to enhance the processing of electronically filed immigration related
request forms. USCIS updated CLAIMS 3 to support the case management functions of certain
electronically filed applications. 5
USCIS has made several updates to CLAIMS 3 since the publication of DHS/USCIS/PIA016(a). Upon publication of this PIA, CLAIMS 3 will interface with the following systems:
(1) myUSCIS Account Experience to receive certain electronically filed immigration benefit
and request forms for adjudication; 6
See DHS/PIA/USCIS-016(a) Computer Linked Application Information System and Associated Systems
(CLAIMS 3), available at www.dhs.gov/privacy.
4 Immigration files currently in paper form will remain as such until an individual affirmatively requests an
additional benefit or until the record is otherwise used in an administrative context.
5 Please see the CLAIMS 3 PIA Appendix A for a list of forms.
6 See DHS/USCIS/PIA-071 myUSCIS Account Experience, available at www.dhs.gov/privacy.
3

Privacy Impact Assessment Update

DHS/USCIS/PIA-016(b), CLAIMS 3
Page 4

(2) STACKS to retrieve case-specific immigration-related content maintained in Content
Management System (CMS); 7 and
(3) RAILS to retrieve the immigration file location(s). 8
All USCIS systems exchange information through various data streaming services. 9 The data
streaming services are a combination of data delivery tools and connections to facilitate the
seamless communication between different USCIS systems. CLAIMS 3 does not directly connect
to any of these new systems, but relies on the data streaming services to share information. USCIS
uses data streaming services to integrate existing systems with new applications and support
services. The integration with these data streaming services allows CLAIMS 3 to share and receive
information from other systems without adversely impacting the availability of CLAIMS 3.
myUSCIS
USCIS offers individuals two options for filing immigration request forms with USCIS –
online and by mail (paper). USCIS established the myUSCIS Account Experience to offer
customers an authenticated online account to securely engage with USCIS. Individuals seeking
access to myUSCIS Account Experience are first required to create an account to access and use
the services offered by the online portal. Once an account is created, individuals are able to file
benefit and other immigration related requests electronically, check the status of pending cases,
store supplemental evidence, as well as receive notices from USCIS, and communicate casespecific inquiries with USCIS.
myUSCIS Account Experience allows certain benefit and other immigration related
request forms and service types to be electronically completed and filed by requestors and/or legal
representatives . 10 The electronic filing component of myUSCIS Account Experience offers an
interactive tool that assists individuals (immigration related requestors and/or legal
representatives) with completing certain immigration benefit and other request forms or certain
fee payments. The electronic benefit request forms collect the same information as the
corresponding paper forms. Once the request form is completed, myUSCIS prompts the individual
to review and sign the benefit request form, as well as pay the associated filing fees before final
submission.11

7
8

See DHS/USCIS/PIA-079 CMS, available at www.dhs.gov/privacy.
See DHS/USCIS/PIA-075 RAILS, available at www.dhs.gov/privacy.

9

See DHS/USCIS/PIA-008 Enterprise Service Bus (ESB) and the DHS/USCIS/PIA-078 Data Streaming Services

PIA, available at www.dhs.gov/privacy.
See Appendix B to DHS/USCIS/PIA-071 myUSCIS Account Experience to view the list of electronically
available forms.
11
Payment information is collected by the Department of Treasury’s Pay.gov system (see Financial Management
Service (FMS) PIA and Revenue Collection Records – Treasury/FMS.017 SORN, 68 FR 5691).
10

Privacy Impact Assessment Update

DHS/USCIS/PIA-016(b), CLAIMS 3
Page 5

Once the form is officially submitted to USCIS, myUSCIS sends the immigration related
request form to the appropriate case management system for receipt and adjudication. Initially,
myUSCIS sent electronically filed request forms to USCIS Electronic Immigration System
(USCIS ELIS) for adjudication. 12 However, instead of consolidating all electronic filings into one
system, USCIS has focused resources on enhancing previously used systems for various benefit
types (e.g., asylum, employment based, and naturalization filings) to support the electronic
processing of immigration benefit request forms.
Depending on the immigration related request form type, myUSCIS sends the filing to the
respective case management system. USCIS is establishing communication between myUSCIS
and CLAIMS 3 via Kafka for receipt and adjudication purposes. Certain key data elements from
the form are automatically transferred to and populated within CLAIMS 3, while the full online
submission, including the form and any supporting evidence, is retained in CMS. USCIS
adjudicators continue to use CLAIMS 3 as outlined in DHS/USCIS/PIA-016(a).
STACKS
As described above, CMS retains a copy of the full immigration related request filing
submitted by the requestor using myUSCIS. However, USCIS is also enhancing CLAIMS 3 by
creating an icon enabling direct access to STACKS. STACKS is the user interface that allows
users to view the immigration related request form, evidence, and other case content that is
received via myUSCIS and stored in CMS. Only cases that are submitted to USCIS via myUSCIS
Account Experience have the STACKS icon within CLAIMS 3. When users click this icon, the
relevant case-related information (including a copy of the request form in its entirety as well as all
associated supporting evidence and documentation) open in STACKS. This direct access provides
easy access to relevant content without the USCIS user needing to separately access another
system or file in support of the adjudication process.
RAILS
USCIS used legacy National File Tracking System (NFTS) to locate an immigration file
within an office and track the movement of files between offices. CLAIMS 3 previously connected
to NFTS via Enterprise Service Bus (ESB). USCIS replaced NFTS with a modernized version,
known as RAILS, which continues to serve as an automated file tracking system to maintain an
accurate file inventory and track the location of paper and electronic immigration files. CLAIMS
3 exchanges information with RAILS via the ESB 2. Through ESB 2, RAILS obtains limited
information from CLAIMS 3 pertaining to the subject of the record, the system user, and the
location of electronic and paper immigration files in order to track the current locations of
immigration files. RAILS shares the location and creation of paper and electronic immigration
files with CLAIMS 3.

12

See DHS/USCIS/PIA-056 USCIS ELIS, available at www.dhs.gov/privacy

Privacy Impact Assessment Update

DHS/USCIS/PIA-016(b), CLAIMS 3
Page 6

Privacy Impact Analysis
Authorities and Other Requirements
The legal authority to collect and use information, including Social Security number (SSN),
does not change with this update. Section 103 of the Immigration and Nationality Act (INA)
provides the legal authority for the administration and adjudication of immigration and nonimmigration benefits. 13
The collection, use, maintenance, and dissemination of information are covered under the
following system of records notices (SORN):
•

Alien File, Index, and National File Tracking System 14 covers the collection, use, and
maintenance of applications and supplemental evidence, in addition to other
information related to the individual as he or she passes through the immigration
process;

•

Immigration Biometric and Background Check 15 covers background checks and their
results; and

•

Benefits Information System 16 covers the collection and use of immigrant and nonimmigrant benefit applications, decisional data, and associated fees for adjudication.

This update does not change the Authority to Operate (ATO) for CLAIMS 3. USCIS issued the
ATO for CLAIMS 3 on September 3, 2015, and this system is part of an Ongoing Authorization
program. As such, CLAIMS 3 will have an ongoing ATO with no expiration date as long as
CLAIMS 3 continues to operate in compliance with security and privacy requirements.
The associated records schedule does not change with this update. USCIS continues to
retain data within CLAIMS 3 for 50 years from the date of the last completed action in accordance
with NARA Disposition Authority Number DAA-0566-2016-0013.
This update does not impact the Paperwork Reduction Act (PRA) requirements for
CLAIMS 3. The information stored within CLAIMS 3 is subject to the PRA and the burden is
accounted for under each information collection (i.e., applications and requests).

Immigration and Nationality Act (as amended), 8 U.S.C. ch. 12, available at
https://www.uscis.gov/ilink/docView/SLB/HTML/SLB/act.html.
14
DHS/USCIS/ICE/CBP-001 Alien File, Index, and National File Tracking System of Records, 82 FR 43556
(Oct.18, 2017).
15
DHS/USCIS-018 Immigration Biometric and Background Check (IBBC) System of Records, 83 FR 36950 (July
31, 2018). This SORN replaces the DHS/USCIS-002 Background Check Service, which previously provided
coverage for the background check results stored in CLAIMS 3.
16
DHS/USCIS-007 Benefits Information System, 81 FR 72069 (Oct. 19, 2016)
13

Privacy Impact Assessment Update

DHS/USCIS/PIA-016(b), CLAIMS 3
Page 7

Characterization of the Information
This update does not impact the collection of information in CLAIMS 3. USCIS continues
to collect and maintain the information outlined in Section 2.0 of the DHS/USCIS/PIA-016(a)
CLAIMS 3 and Associated Systems.
This update does not impact the sources of information collected. USCIS continues to
collect information directly from the immigration related requestor and/or legal representative and
internal and external systems. Instead of solely collecting information via paper forms, USCIS is
now also collecting information via the myUSCIS online portal. Information from myUSCIS is
transferred directly into CLAIMS 3 via Kafka.
This update does not impact the use of information from commercial sources or publicly
available data.
This update increases the accuracy of information received from the requestor and/or legal
representative. Previously, information was manually entered into the CLAIMS 3 system from the
immigration related request form. The automatic transfer of data from myUSCIS to CLAIMS 3
(via Kafka) reduces the potential of risk of inaccurate data due to manual data entry throughout
the adjudication process. Kafka is highly available and resilient to system failures and supports
automatic recovery, making Kafka a reliable choice to send accurate and complete data between
myUSCIS and CLAIMS 3.
Privacy Risk: There is a risk that inaccurate or incomplete data will be transferred from
myUSCIS to CLAIMS 3 via Kafka.
Mitigation: This risk is mitigated. Previously, information was manually entered into the
CLAIMS 3 system from the request form. With this practice, there was an increased risk of
inaccurate data within CLAIMS 3. USCIS mitigated this risk as best as possible through training,
supervisor reviews, and ongoing quality assurance reviews. With this update, data is entered into
myUSCIS directly from the benefit requestor and is then encrypted, transported, and delivered “as
is” to CLAIMS 3 via Kafka, with the exception of reformatting to standardize the representation
of the data. This process ensures the data integrity from the producer system to the consumer
system. Kafka continuously extracts, replicates, and loads myUSCIS information in real-time to
keep that system data consistent with the data in myUSCIS. Kafka continuously refreshes, which
allows the tool to identify changes and immediately send any updated or corrected information to
CLAIMS 3.
Uses of the Information
The uses of information do not change as a result of this update. USCIS continues to use
CLAIMS 3 and its associated systems to support and manage the administration and adjudication
of certain immigration related requests.

Privacy Impact Assessment Update

DHS/USCIS/PIA-016(b), CLAIMS 3
Page 8

CLAIMS 3 continues to not use technology to conduct electronic searches, queries, or
analyses to discover or locate a predictive pattern or anomaly.
DHS Components continue to have read-only access to CLAIMS 3 to perform mission
requirements, but will be unable to access STACKS using the STACKS icon in CLAIMS 3. DHS
Component access and use does not change as a result of this update.
There are no additional risks to the uses of information.
Notice
USCIS is providing general notice about the system changes through this PIA update.
USCIS also continues to provide notice through the associated SORNs listed in the “Authorities
and Other Requirements,” and through the Privacy Notices on the associated forms (both paper
and electronic). Furthermore, once electronic filing is mandated, USCIS will publish subsequent
notices stating that the paper form will no longer be accepted and the request must be submitted
online. There are no additional risks to notice.
Data Retention by the project
The records schedule does not change with this update. Data will be retained for 50 years
from the date of the last completed action in accordance with NARA Disposition Authority
Number DAA-0566-2016-0013. There are no additional risks to the retention of information.
Information Sharing
The external sharing of CLAIMS 3 does not change as a result of this PIA. Any external
sharing through myUSCIS and STACKS is discussed in the myUSCIS and CMS PIAs,
respectively. There are no additional risks to information sharing.
Redress
This update does not impact how access, redress, and correction may be sought through
USCIS. USCIS continues to provide individuals with access to their information through a Privacy
Act or Freedom of Information Act (FOIA) request. Individuals not covered by the Privacy Act or
Judicial Redress Act (JRA) still may obtain access to records consistent with FOIA unless
disclosure is prohibited by law or if the agency reasonably foresees that disclosure would harm an
interest protected by an exemption. U.S. Citizens and Lawful Permanent Residents may also file a
Privacy Act request to access their information. If an individual would like to file a Privacy Act or
FOIA request to view his or her USCIS record, the request can be mailed to the following address:
National Records Center
Freedom of Information Act/Privacy Act Program
P. O. Box 648010
Lee’s Summit, MO 64064-8010
Persons not covered by the Privacy Act or JRA are not able to amend their records through FOIA.
Should a non-U.S. person find inaccurate information in his or her record received through FOIA,

Privacy Impact Assessment Update

DHS/USCIS/PIA-016(b), CLAIMS 3
Page 9

he or she may visit a local USCIS Field Office to identify and amend inaccurate records with
evidence.
Auditing and Accountability
USCIS ensures that practices stated in this PIA comply with federal, DHS, and USCIS
standards, policies, and procedures, including standard operating procedures, rules of behavior,
and auditing and accountability procedures. CLAIMS 3 is maintained in the Amazon Web Services
(AWS), which is a public cloud designed to meet a wide range of security and privacy requirements
(e.g., administrative, operational, and technical controls) that are used by USCIS to protect data in
accordance with federal security guidelines. 17 AWS is Federal Risk and Authorization
Management Program (FedRAMP)-approved and authorized to host PII. 18 FedRAMP is a U.S.
government-wide program that delivers a standard approach to the security assessment,
authorization, and continuous monitoring for cloud services. USCIS employs technical and
security controls to preserve the confidentiality, integrity, and availability of the data, which are
validated during the security authorization process. These technical and security controls limit
access to USCIS users and mitigate privacy risks associated with unauthorized access and
disclosure to non-USCIS users. Further DHS security specifications also require auditing
capabilities that log the activity of each user in order to reduce the possibility of misuse and
inappropriate dissemination of information. All user actions are tracked via audit logs to identify
information by user identification, network terminal identification, date, time, and data accessed.
All USCIS systems employ auditing measures and technical safeguards to prevent the misuse of
data.
Privacy Risk: The data maintained by Amazon Web Services (AWS) for the purposes of
cloud hosting may be vulnerable to breach because security controls may not meet system security
levels required by DHS.
Mitigation: This risk is mitigated. USCIS is responsible for all PII associated with the
CLAIMS 3, whether on USCIS infrastructure or on a vendor’s infrastructure and it therefore
imposes strict requirements on vendors for safeguarding PII data. This includes adherence to the
DHS 4300A Sensitive Systems Handbook, which provides implementation criteria for the rigorous
requirements mandated by DHS’s Information Security Program. 19 USCIS cloud service providers
must be FedRAMP-certified. By using FedRAMP-certified providers, USCIS leverages cloud
services assessed and granted provisional security authorization through the FedRAMP process to
increase efficiency while ensuring security compliance. All contracted cloud service providers
must follow DHS privacy and security policy requirements. Before using AWS, USCIS verified
through a risk assessment that AWS met all DHS privacy and security policy requirements.
17 Public clouds are owned and operated by third-party service providers whereas private clouds are those that are
built exclusively for an individual enterprise.
18 https://marketplace.fedramp.gov/#/product/aws-us-eastwest?status=Compliant&sort=productName.
19 See https://www.dhs.gov/publication/dhs-4300a-sensitive-systems-handbook.

Privacy Impact Assessment Update

DHS/USCIS/PIA-016(b), CLAIMS 3
Page 10

Further, all cloud-based systems and service providers are added to the USCIS Federal Information
Security Modernization Act (FISMA) inventory and are required to undergo a complete security
authorization review to ensure security and privacy compliance. As part of this process, the DHS
Senior Agency Official for Privacy reviews all FedRAMP cloud service providers for privacy
compliance and privacy controls assessments as part of the privacy compliance review process.

Responsible Official
Donald K. Hawkins
Privacy Officer
U.S. Citizenship and Immigration Services
Department of Homeland Security

Approval Signature

Original signed copy on file with the DHS Privacy Office.
________________________________
Jonathan R. Cantor
Acting Chief Privacy Officer
Department of Homeland Security