Document

Privacy Act Assessment

ICR 202608-0925-001 · OMB 0925-0299 · Object 171705500.

Document Viewer [pdf]

Status: Original and derived artifacts are available for this document.

Download: pdf

Primary: pdfSource: application/pdf

Loading document viewer…

Document Metadata

Record metadata
File Type	application/pdf
File Title	Privacy Act Assessment
Last Modified By	Aspose.Words
File Modified	2026-03-23
File Created	2026-03-23
Conversion State	complete

Extracted Text

Limited Official Use - NIH Prod

PIA Form
v1.0

System Name
Research and Training Opportunities
Record
Research and Training Opportunities
Instance 1

3/23/2026
Limited Official Use - NIH Prod

Limited Official Use - NIH Prod
1 OPDIV: NIH
2 PIA Unique Identifier (This value is populated by the Privacy Office only)
P-1118564-913650
2a Name:
Research and Training Opportunities
3 The subject of this PIA is which of the following?
X Minor Application (child)
Electronic Information Collection
Major Application
Unknown
General Support System (GSS)
Minor Application (stand-alone)
3a Identify the Enterprise Performance Lifecycle Phase of the system.
X Operations and Maintenance
Requirements Analysis
Development
Implementation
Initiation
Disposition
Planning
Design
Test
Concept
3b Is this a FISMA-Reportable system?
X No
Yes
4 Does the system include a Website or online
application available to and for the use of the general
public?
X Yes
No
5 Identify the operator.
X Agency
Contractor

Limited Official Use - NIH Prod

Limited Official Use - NIH Prod
6 Point of Contact (POC):
POC Title
POC Name

POC Email

Program Analyst

POC Organization
Office of Intramural
Training & Education
Patricia Wagner

POC Phone
240-476-3619
[email protected]

7
Is this a new or existing system?
X Existing
New
8 Does the system have Security Authorization (SA)?
X Yes
No
8a/b Date of Security Authorization or the Planned Date
12/14/2023
9 Indicate the following reason(s) for updating this PIA.
Choose from the following options.
PIA Validation (PIA Refresh/Annual
New Interagency Uses
Review)
New Public Access
Anonymous to Non-Anonymous
Other
N/A
Commercial Sources
Conversion
Alteration in Character of Data
Internal Flow or Collection
Significant System Management Change

Limited Official Use - NIH Prod

Limited Official Use - NIH Prod
10 Describe in further detail any changes to the system
that have occurred since the last PIA.
The PIA has been updated to meet the
requirements of Executive Order Defending Women From Gender
Ideology Extremism And Restoring
Biological Truth To The Federal
Government.
X Select to describe details
N/A
11 Describe the purpose of the system.
TThe Office of Intramural Training & Education (OITE) administers programs and initiatives to
recruit and develop individuals who participate in research training activities on the NIH's main
campus in Bethesda, Maryland, as well as other NIH facilities around the country. To facilitate
its recruitment function, the OITE maintains the NIH Research and Training Opportunities
(RTO) system, https://www2.training.nih.gov/xfer/nihac, which includes applications and related
forms for intramural research training programs, including the Summer Internship Program
(SIP), the Postbaccalaureate Training Program (PBT), the Graduate Partnerships Program (GPP),
and the Undergraduate Scholarship Program (UGSP). The application system includes a backend database that functions as a centralized repository of information regarding program
applicants.
The RTO system also includes the Fellows Award for Research Excellence (FARE) application,
which is unique in that it is aimed, not at prospective trainees, but at current NIH trainees who
wish to participate in the annual FARE travel award competition. FARE is designed to foster
and reward scientific excellence in the NIH Intramural Research Program (IRP).

Limited Official Use - NIH Prod

Limited Official Use - NIH Prod
12 Describe the type of information the system will
collect, maintain (store), or share. (Subsequent
questions will identify if this information is PII and ask
about the specific data elements.)
The Research Training Opportunities (RTO) system collects information, including Personally
Identifiable Information (PII), necessary (1) to evaluate the qualifications of individuals who
seek intramural research training opportunities at the NIH, and (2) to contact these individuals to
discuss possible training opportunities.
The RTO application system collects the following types of information: Applicant's name,
email address, permanent and current address, telephone numbers, citizenship status, relative at
NIH (Y/N), relative's name and Institute-Center, academic information (institutional affiliations,
coursework and grades, enrollment status, grade point average, academic major, degrees earned,
dates of attendance), publications, resume/curriculum vitae, cover letter/personal statement,
scientific research interests, contact information for up to 3 references, letters of recommendation
and evaluation ratings (submitted online by the references), eligibility information, admission
preferences, standardized examination scores, reference information, mentor contact information,
and dissertation research description.
The Fellows Award for Research Excellence (FARE) application collects contact information for
the applicant and his/her mentor, fellowship information, an abstract of the applicant's current
NIH research, and optional sex information. Abstracts sometimes contain sensitive information,
including unpublished data, or novel experimental approaches.
NIH users log into the system using the NIH Identity, Credential, and Access Management
(IAM) Services which maintains its own unique privacy impact assessment (PIA) on record,
including all legal authorities documented. The purpose of IAM Services is to authenticate and
authorize all users and computers in a Windows domain type network; assigning and enforcing
information security policies for all computers and installing or updating software. The IAM
Services collect unique user credentials and stores them in an encrypted format. The IAM
Services are an essential service which facilitates and governs network access to various
resources.
For individuals external to NIH, such as business partners, collaborators, and researchers; the
system uses NIH Federated Services, a centralized authentication hub for web-based applications
at NIH, instead of storing a user’s login credentials. NIH Federated login enables users to use a
single authentication method via an individual’s parent organization. After the system owner
approves access to an individual and registers their parent organization’s identity provider,
individuals are redirected to their parent organization’s identity provider for credentials.

Limited Official Use - NIH Prod

Limited Official Use - NIH Prod
13 Provide an overview of the system and describe the
information it will collect, maintain (store), or share,
either permanently or temporarily.

Limited Official Use - NIH Prod

Limited Official Use - NIH Prod
The Office of Intramural Training & Education (OITE) administers programs and initiatives to
recruit and develop individuals who participate in research training activities on the NIH's main
campus in Bethesda, Maryland, as well as other NIH facilities around the country. To facilitate
its recruitment function, the OITE maintains the NIH Research and Training Opportunities
(RTO) system, https://www2.training.nih.gov/xfer/nihac, which includes applications and related
forms for intramural research training programs, including the Summer Internship Program
(SIP), the Postbaccalaureate Training Program (PBT), the Graduate Partnerships Program (GPP),
and the Undergraduate Scholarship Program (UGSP). The application system includes a backend database that functions as a centralized repository of information regarding program
applicants.
The RTO system also includes the Fellows Award for Research Excellence (FARE) application,
which is unique in that it is aimed, not at prospective trainees, but at current NIH trainees who
wish to participate in the annual FARE travel award competition. FARE is designed to foster
and reward scientific excellence in the NIH Intramural Research Program (IRP).

The Research Training Opportunities (RTO) system collects information, including Personally
Identifiable Information (PII), necessary (1) to evaluate the qualifications of individuals who
seek intramural research training opportunities at the NIH, and (2) to contact these individuals to
discuss possible training opportunities.
The RTO application system collects the following types of information: Applicant's name,
email address, permanent and current address, telephone numbers, citizenship status, relative at
NIH (Y/N), relative's name and Institute-Center, academic information (institutional affiliations,
coursework and grades, enrollment status, grade point average, academic major, degrees earned,
dates of attendance), publications, resume/curriculum vitae, cover letter/personal statement,
scientific research interests, contact information for up to 3 references, letters of recommendation
and evaluation ratings (submitted online by the references), eligibility information, admission
preferences, standardized examination scores, reference information, mentor contact information,
and dissertation research description.
The Fellows Award for Research Excellence (FARE) application collects contact information for
the applicant and his/her mentor, fellowship information, an abstract of the applicant's current
NIH research, and optional sex information. Abstracts sometimes contain sensitive information,
including unpublished data, or novel experimental approaches.
NIH users log into the system using the NIH Identity, Credential, and Access Management
(IAM) Services which maintains its own unique privacy impact assessment (PIA) on record,
including all legal authorities documented. The purpose of IAM Services is to authenticate and
authorize all users and computers in a Windows domain type network; assigning and enforcing
information security policies for all computers and installing or updating software. The IAM
Services collect unique user credentials and stores them in an encrypted format. The IAM
Services are an essential service which facilitates and governs network access to various
resources.
For individuals external to NIH, such as business partners, collaborators, and researchers; the
Limiteda Official
Useauthentication
- NIH Prod hub for web-based applications7
system uses NIH Federated Services,
centralized
at NIH, instead of storing a user’s login credentials. NIH Federated login enables users to use a
single authentication method via an individual’s parent organization. After the system owner
approves access to an individual and registers their parent organization’s identity provider,

Limited Official Use - NIH Prod

14 Does the system collect, maintain, use or share PII?
X Yes
No
15 Indicate the type of PII that the system will collect or
maintain.
Name
Certificates
E-Mail Address
Passport Number
Phone Numbers
Vehicle Identifiers
Education Records
Driver's License Number
Mailing Address
Military Status
Employment Status
Medical Records Number
Other
Legal Documents
Social Security Number
Taxpayer ID
y/n - age 18 by June 15 of
Medical Notes
the current year
Other
Date of Birth
Other
y/n - age 17 by June 15 of
Other

the current year

Financial Account Info
optional sex information
(FARE)
Other

Mother's Maiden Name
Foreign Activities

Biometric Identifiers
Photographic Identifiers
Device Identifiers
16 Indicate the categories of individuals about whom PII
is collected, maintained or shared.
Employees
Other
Public Citizens
Vendors/Suppliers/Contractors
Patients
Business Partners/Contacts (Federal, state,
local agencies)
NIH Trainees; NIH
fellows

Limited Official Use - NIH Prod

Limited Official Use - NIH Prod
17 How many individuals' PII is in the system?
X 100,000-999,999
50,000-99,999
<100
1,000,000 or more
500-4,999
10,000-49,999
100-499
5,000-9,999
18 For what primary purpose is the PII used?
The primary use of this information is to evaluate applicants' qualifications for research training
at the NIH, including periodic updates to their record status.
19 Describe the secondary uses for which the PII will be
used (e.g. testing, training or research)
OITE sometimes uses the email addresses provided by applicants to send them notices regarding
training opportunities of potential interest to them.
Other secondary uses for system PII include:
(a) Preparing appointment paperwork;
(b) Investigating possible cases of inappropriate use of the system (e.g., violations of the NIH
nepotism policy);
(c) Verifying the identity of users who contact us offline (e.g., by telephone) to report technical
problems involving the system;
(d) Administering the annual FARE competition.
20 Describe the function of the SSN.
n/a
20a Cite the legal authority to use the SSN.
n/a
21 Identify legal authorities governing information use
and disclosure specific to the system and program.
The legal authority granted to NIH to train future biomedical scientists comes from several
sources. Title 42 of the U.S. Code, Sections 241 and 282(b)(13) authorize the Director, NIH, to
conduct and support research training for which fellowship support is not provided under Part
487 of the Public Health Service (PHS) Act (i.e., National Research Service Awards), and that is
not residency training of physicians or other health professionals. Sections 405(b)(1)(C) of the
PHS Act and 42 U.S.C. Sections 284(b)(1)(C) and 285-287 grant this same authority to the
Director of each of the Institutes/Centers at NIH.

Limited Official Use - NIH Prod

Limited Official Use - NIH Prod
22 Are records on the system retrieved by one or more
PII data elements?
X Yes
No
22a Identify the number and title of the Privacy Act
System of Records Notice (SORN) that is being used
to cover the system or identify if a SORN is being
developed.
Published
Published
Published
09-25-0158 Administration Records of
Applicants and Awardees
of the Intramural Research
Training Awards Program
OPM/GOVT-1 - General
Personnel Records
OPM/GOVT-5 Recruiting, Examining,
and Placement Records

In Progress
09-25-0014 - Clinical
Research: Student
Records
09-25-0108 - Personnel:
Guest Researchers,
Special Volunteers, and
Scientists Emeriti
09-25-0140 - International
Scientific Researchers in
Intramural Laboratories at
the National Institutes of
Health

23 (1)
Identify the sources of PII in the system.
Directly from an individual about whom the information pertains
Email
Online
Other

Hard Copy: Mail/Fax
N/A
In-Person

23 (2)
Identify the sources of PII in the system.
Government Sources
Within the OPDIV
Other Federal Entities
Other
State/Local/Tribal

N/A
Other HHS OPDIV
Foreign

Limited Official Use - NIH Prod

Limited Official Use - NIH Prod
23 (3)
23 Identify the sources of PII in the system.
Non-Government Sources
Members of the Public
Private Sector
Other

Public Media/Internet
Commercial Data Broker
N/A

23a Identify the OMB information collection approval
number and expiration date.
0925-0299, expiration May 2024
Renewal Started November 2023 (60-day Federal Register published)
24 Is the PII shared with other organizations?
X Yes
No
24a (1)
Identify with whom the PII is shared or disclosed and
for what purpose.

X Within HHS
N/A

PII may be shared with NIH Investigators
and administrators for admissions and
appointment paperwork. Records may
also be disclosed to student volunteers,
individuals working under a personal
services contract, and other individuals
performing functions for HHS who do
not technically have the status of agency
employees, if they need the records in the
performance of their agency functions.

24a (2)
Identify with whom the PII is shared or disclosed and
for what purpose.

Limited Official Use - NIH Prod

X Other Federal Agency/Agencies
N/A

Disclosure may be made to the
Department of Justice or to a court or
other tribunal when (a) HHS, or any
component thereof; or (b) any HHS
employee in his or her official capacity;
or (c) any HHS employee in his or her
individual capacity where the
Department of Justice (or HHS, where it
is authorized to do so) has agreed to
represent the employee; or (d) the United
States or any agency thereof where HHS
determines that the litigation is likely to
affect HHS or any of its components, is a
party to litigation or has an interest in
such litigation, and HHS determines that
the use of such records by the
Department of Justice, court or other
tribunal is relevant and necessary to the
litigation and would help in the effective
representation of the governmental party,
provided, however, that in each case
HHS determines that such disclosure is
compatible with the purpose for which
the records were collected.

24a (3)
Identify with whom the PII is shared or disclosed and
for what purpose.

X State or Local Agency/Agencies
N/A

Disclosure may be made to a Federal,
State or local agency maintaining civil,
criminal or other pertinent records, such
as current licenses, if necessary to obtain
a record relevant to an agency decision
concerning the selection or retention of a
fellow.

24a (4)
Identify with whom the PII is shared or disclosed and
for what purpose.

Limited Official Use - NIH Prod

X Private Sector
N/A

Disclosure may be made to institutions
providing financial support.

24b
Is the PII shared with other organizations?
Describe any agreements in place that authorizes the
information sharing or disclosure (e.g. Computer
Matching Agreement, Memorandum of
Understanding (MOU), or Information Sharing
Agreement (ISA)).

X Click here to describe
N/A

Each GPP institutional and Individual
Partnership has its own Memorandum of
Understanding (MOU) between the NIH
and the university partner. The MOUs
vary in content, training duration, and
financial support arrangements. MOUs
are finalized by the NIH OITE and
managed by key NIH personnel.

24c
Is the PII shared with other organizations?
Describe the procedures for accounting for
disclosures

Limited Official Use - NIH Prod

Limited Official Use - NIH Prod
The OITE confers with the key NIH
administrators when information about a
trainee/fellow needs to be shared outside
the agency.
Disclosures from RTO are unlikely to be
made; however, if Privacy Act records
are disclosed, the disclosing office will
maintain an accounting, and the
disclosures will be made in accordance
with the applicable SORN.

X Click here to describe
N/A

The procedures by which GPP
administrators share information with
university partners and account for these
disclosures vary from program to
program.

25 Describe the process in place to notify individuals
that their personal information will be collected. If
no prior notice is given, explain the reason.
Each collection form used by the OITE has a Privacy Act
Statement notifying individuals that their PII is collected.
Inclusion of the text and/or links ensures those completing the
form are well informed prior to entering data voluntarily.
26 Is the submission of PII by individuals voluntary or
mandatory?
X Voluntary
Mandatory
27 Describe the method for individuals to opt-out of the
collection or use of their PII. If there is no option to
object to the information collection, provide a
reason.
There is no way for prospective applicants to opt out of the collection or use of their PII. The
applications and other forms collect information (including PII) that is needed to evaluate the
qualifications of the individual seeking intramural research training opportunities at the NIH.
28 Describe the process to notify and obtain consent
from the individuals whose PII is in the system when
major changes occur to the system (e.g., disclosure
and/or data uses have changed since the notice at
the time of original collection). Alternatively, describe
Limited Official Use - NIH Prod

Limited Official Use - NIH Prod
why they cannot be notified or have their consent
obtained.
The OITE will confer with NIH administrators and general counsel prior to making changes in
how PII is used. If there is a modification from the original intent, then a mail-merge message
to each affected individual will be sent from the OITE's email address.
29 Describe the process in place to resolve an
individual's concerns when they believe their PII has
been inappropriately obtained, used, or disclosed, or
that the PII is inaccurate. If no process exists, explain
why not.
The RTO system relies extensively on system-generated email messages, and applicants and
references can contact OITE by replying to these messages. Also, there is a link to OITE's
"Contact Us" page, https://www.training.nih.gov/contact, in the page footer of every RTO form.
Individuals who have concerns about their PII can use the information on this page to notify us.
The OITE will confer with key offices, including but not limited to NIH administrators, legal
counsel, and ethics office, to ensure the concerns of the individual are addressed in a timely
manner.
The RTO system also includes a transaction auditing module to track record changes and system
activity. This module can be used by RTO administrators to investigate/confirm inappropriate or
suspicious activity.
RTO system administrators have tools enabling them to modify system data (e.g., login
credentials) when a breach is suspected and to disable/lock individual RTO users' accounts in
cases where it is determined that the user has accessed, used, or disclosed applicant data
inappropriately. In such cases, OITE disables and locks the account immediately and notifies the
user, as well as his/her Information Systems Security Officer (ISS) or Scientific Director (SD),
who determines the appropriate next steps.
30 Describe the process in place for periodic reviews of
PII contained in the system to ensure the data's
integrity, availability, accuracy and relevancy. If no
processes are in place, explain why not.
RTO data are managed in accordance with the Federal record retention and disposal guidelines.
Typically, an application remains in the system for one year, after which time it is archived.
Archiving procedures vary from program to program; for some, archiving occurs once monthly,
while for others, archiving is handled manually by system administrators. Archived applications
cannot be accessed by internal RTO users, except for system developers and authorized OITE
staff. Archived applications are generally retained for two years after being archived (i.e., for
three years total).
System developers monitor the database and online application processes as a routine matter to
ensure the data's integrity and availability.

Limited Official Use - NIH Prod

Limited Official Use - NIH Prod
31 (1)
Identify who will have access to the PII in the system
and the reason why they require access.
Users

X Yes
N/A

NIH personnel who are involved in the
recruitment and selection of NIH
trainees. These individuals require viewonly access to applicant data to perform
their job duties. GPP university partners
require view-only access to NIHUniversity partnership applications to
identify the best candidates for the
program. Users have access to their own
PII within the system.

31 (2)
Identify who will have access to the PII in the system
and the reason why they require access.
Administrators

X Yes
N/A

OITE personnel that have view/edit
access to RTO accounts, applications,
reports, and administrative tools. These
users can grant limited view/edit access
to individual account-holders who have
been designated by their ICs to serve as
"Program Coordinators." Coordinators
can, in turn, create view-only accounts
for individuals at their respective ICs
who are involved in the recruitment and
selection of NIH trainees and require
access.

31 (3)
Identify who will have access to the PII in the system
and the reason why they require access.
Developers

Limited Official Use - NIH Prod

X Yes
N/A

System developers monitor the database
and online application processes as a
routine matter to ensure the data's
integrity and availability.

31 (4)
Identify who will have access to the PII in the system
and the reason why they require access.
Contractors

X Yes
N/A

Direct contractors and NIH IT staff who
are responsible for managing/maintaining
all aspects of the application system: web
and database servers, forms, databases,
system-generated email messages,
webpages, data downloads and system
reports, etc.

31 (5)
Identify who will have access to the PII in the system
and the reason why they require access.
Others

X N/A
Yes
32 Describe the procedures in place to determine which
system users (administrators, developers,
contractors, etc.) may access PII.
Determinations are made based on role-based access controls and least privilege. User rights are
provisioned based on controls within the system, allowing users only access to the minimum
amount of PII necessary to perform their job.

Limited Official Use - NIH Prod

Limited Official Use - NIH Prod
33 Describe the methods in place to allow those with
access to PII to only access the minimum amount of
information necessary to perform their job.
The only RTO users who can create new RTO accounts are Program Coordinators and
SuperAdmins. Decisions regarding who at an IC may have access to RTO are (within limits
established by OITE) left up to the Program Coordinator(s) at that IC. Occasionally OITE will
create the account after verifying from someone appropriately placed at the IC that the individual
requesting access has a legitimate business need to access system data.
Program Coordinators can create view-only "Investigator"
accounts; SuperAdmins can create any kind of account. As a
rule, OITE will give a user elevated access within the system
only when the user needs that access to do his/her job.
By default, an Investigator account gives one read-only access
to the SIP and Postbac IRTA application pools. In cases where
it is known that a user does not require access to both
subsystems, a SuperAdmin can remove the user's access to
one, or even both, subsystems. A SuperAdmin might remove a
user's access to both subsystems if the user has agreed to serve
as a mentor to an incoming summer intern and does not
require access to the entire SIP applicant database. Authorized
users can share individual applications with another
authorized user. In these cases, the user's access to the shared
applications expires after 60 days.
34 Identify training and awareness provided to
personnel (system owners, managers, operators,
contractors and/or program managers) using the
system to make them aware of their responsibilities
for protecting the information being collected and
maintained.
According to NIH policy, all personnel who manage or operate NIH applications must
successfully complete annual security awareness training. There are five categories of
mandatory information technolgoy (IT) training (Information Security, Counterintelligence,
Privacy Awareness, Records Management and Emergency Preparedness). Training is completed
on the http://irtsectraining.nih.gov site with valid NIH credentials.
35 Describe training system users receive (above and
beyond general security and privacy awareness
training).
Each RTO user has access to a role-specific RTO User's Guide. While the guides are primarily
focused on how to use the system tools, some touch on such RTO policies as who may access the
system, etc.

Limited Official Use - NIH Prod

Limited Official Use - NIH Prod
36 Do contracts include Federal Acquisition Regulation
and other appropriate clauses ensuring adherence to
privacy provisions and practices?
X Yes
No
37 Describe the process and guidelines in place with
regard to the retention and destruction of PII. Cite
specific records retention schedules.
Records are maintained in RTO in accordance with the following NIH Records Schedules:
06-901 – Non-Employee Fellowship Records – Destroy 3 years after completion of fellowship,
termination of agreement, or non-acceptance of application. Longer retention is authorized if
required for business use. - DAA-0443-2020-0002-0001
06-902 – Visiting Fellow and Visiting Fellow scientist Immigration and Work Authorization
Records – Destroy 3-years after completion of fellowship, termination of agreement, or nonacceptance of application. Longer retention is authorized if required for business use. - DAA0443-2020-0002-0001
38 Describe, briefly but with specificity, how the PII will
be secured in the system using administrative,
technical, and physical controls.
Administrative Controls: RTO applies role-based security to ensure access is restricted to the
appropriate user groups. All system users are required to accept the RTO Terms of Use every
time they sign in. The Terms of Use page notes that the system contains information that is
subject to the Privacy Act; describes the user's responsibilities regarding the safeguarding of
system data; and states that unauthorized access or use of this system may subject violators to
criminal, civil, and/or administrative action. At any time, Program Coordinators can disable
accounts of individuals at their respective Institutes and Centers (IC) who leave the NIH or
transfer to another IC. In addition, RTO administrators conduct a comprehensive review of all
system accounts once annually, disabling/locking those belonging to individuals who are no
longer at the NIH and purging all dormant accounts. Also, RTO administrators conduct periodic
and ongoing monitoring of system audits and system email traffic to identify cases of
inappropriate access to or use of the system.
Technical Controls: Access to the system is controlled by NIH Login, which authenticates the
user prior to granting access. Access level and permissions are controlled by the system and
based on user, role, and organizational unit.
Physical Controls: The servers reside in the Office of Information Technology (OIT) hosting
facility, where policies and procedures are in place to restrict access to the machines. This
includes guards at the front door and entrance to the machine room.

Limited Official Use - NIH Prod

Limited Official Use - NIH Prod
39 Identify the publicly-available URL:
Research and Training Opportunities Applicant CenterApplicants - https://www2.training.nih.gov/xfer/nihac
References - https://www2.training.nih.gov/apps/rto/ac/refforms/login.aspx
Fellows Award for Research Excellence (FARE) - NIH-Only
https://www2.training.nih.gov/apps/rto/fare/fareapp/fareApp.aspx (FARE)
40 Does the website have a posted privacy notice?
X Yes
No
40a Is the privacy policy available in a machine-readable
format?
X Yes
No
41
Does the website use web measurement and
customization technology?
X Yes
No
41a (1) Does the system use web beacons?
X
No. This technology is not used.

Yes, and it collects PII.

Yes, and it does not collect PII.

41a (2) Does the system use web bugs?
X
No. This technology is not used.

Yes, and it does not collect PII.

Limited Official Use - NIH Prod

Yes, and it collects PII.

41a (3) Does the system use session cookies?
X
Yes, and it does not collect PII.

No. This technology is not used.

Yes, and it collects PII.

41a (4) Does the system use persistent cookies?
X
No. This technology is not used.

Yes, and it collects PII.

Yes, and it does not collect PII.

41a (5) Does the system use another type of website measurement and customization
technology?
No. This technology is not used.
Click here to describe the technology.
Yes, and it does not collect PII
Yes, and it collects PII.
42 Does the website have any information or pages
directed at children under the age of thirteen?
X No
Yes
42a Is there a unique privacy policy for the website, and
does the unique privacy policy address the process
Limited Official Use - NIH Prod

Limited Official Use - NIH Prod
for obtaining parental consent if any information is
collected?
No
Yes
43 Does the website contain links to non- federal
government websites external to HHS?
X Yes
No
43a Is a disclaimer notice provided to users that follow
external links to websites not owned or operated by
HHS?
X Yes
No
General Comments (for minor applications, add parent boundary name and UUID)
To successfully submit the form for review/approval, each page of this form must be 100%
completed.

System is a child system of NIH OD GSS 9UUID:
2092B382-A4F2-4FD5-A93E-1857E18B771E)

Limited Official Use - NIH Prod

Workflow Steps
Created

Workflow Step

Date
Feb 4 2025 10:47AM

Submitted
Not Reviewed (Rejected)
Submitted
Reviewed
Approved

Feb 25 2025 2:37PM
Mar 6 2025 10:07AM
Mar 6 2025 10:10AM
Mar 6 2025 10:10AM
Mar 6 2025 10:10AM

By
Christopher Edward
Sowards
Cameron Pratt
Dustin Close
Dustin Close
Dustin Close
Dustin Close

Workflow Comments
Comment

Date

Limited Official Use - NIH Prod

Limited Official Use - NIH Prod
Process of Being Renamed
Office of Intramural Training & Education - Content Management System
OITE-CMS

PIA Form
v1.0

System Name
Research Training Programs Web Site
Record
Research Training Programs Web Site
Instance 1

3/23/2026
Limited Official Use - NIH Prod

Limited Official Use - NIH Prod
1 OPDIV: NIH
2 PIA Unique Identifier (This value is populated by the Privacy Office only)
P-8646487-112495
2a Name:
Research Training Programs Web Site
3 The subject of this PIA is which of the following?
X Minor Application (stand-alone)
Major Application
Minor Application (child)
Unknown
General Support System (GSS)
Electronic Information Collection
3a Identify the Enterprise Performance Lifecycle Phase of the system.
X Operations and Maintenance
Implementation
Initiation
Planning
Design
Disposition
Concept
Test
Requirements Analysis
Development
3b Is this a FISMA-Reportable system?
X No
Yes
4 Does the system include a Website or online
application available to and for the use of the general
public?
X Yes
No
5 Identify the operator.
X Contractor
Agency

Limited Official Use - NIH Prod

Limited Official Use - NIH Prod
6 Point of Contact (POC):
POC Title
POC Name

POC Email
POC Phone
240-476-3619
[email protected]

Director

POC Organization
Office of Intramural
Training & Education
Patricia Wagner

7
Is this a new or existing system?
X Existing
New
8 Does the system have Security Authorization (SA)?
X Yes
No
8a/b Date of Security Authorization or the Planned Date
12/14/2023
9 Indicate the following reason(s) for updating this PIA.
Choose from the following options.
PIA Validation (PIA Refresh/Annual
Commercial Sources
Review)
Anonymous to Non-Anonymous
Internal Flow or Collection
Alteration in Character of Data
Significant System Management Change
New Interagency Uses
N/A
New Public Access
Conversion
Other

10 Describe in further detail any changes to the system
that have occurred since the last PIA.
There have been no substantive changes
to the system since the last Privacy
Impact Assessment (PIA) was submitted.
X Select to describe details
N/A

Limited Official Use - NIH Prod

Limited Official Use - NIH Prod
11 Describe the purpose of the system.
The purpose of the NIH Research Training Programs (RTP)
website, https://www.training.nih.gov, is to provide access to the training opportunities and
support services provided by NIH.
12 Describe the type of information the system will
collect, maintain (store), or share. (Subsequent
questions will identify if this information is PII and ask
about the specific data elements.)
Account information: User's name, user credentials (email address and password), phone
numbers, mailing address (Campus and Institute/Center), education records, NIH Enterprise
Directory (NED) ID, and employment status.
NIH administrators log into the system using the NIH Identity, Credential, and Access
Management (IAM) Services which maintains its own unique privacy impact assessment (PIA)
on record, including all legal authorities documented. The purpose of IAM Services is to
authenticate and authorize all users and computers in a Windows domain type network;
assigning and enforcing information security policies for all computers and installing or updating
software. The IAM Services collect unique user credentials and stores them in an encrypted
format. The IAM Services are an essential service which facilitates and governs network access
to various resources.
13 Provide an overview of the system and describe the
information it will collect, maintain (store), or share,
either permanently or temporarily.
The purpose of the NIH Research Training Programs (RTP)
website, https://www.training.nih.gov, is to provide access to the training opportunities and
support services provided by NIH.
Account information: User's name, email address, password, phone numbers, mailing address
(Campus and Institute/Center), education records, NIH Enterprise Directory (NED) ID, and
employment status.
NIH administrators log into the system using the NIH Identity, Credential, and Access
Management (IAM) Services which maintains its own unique privacy impact assessment (PIA)
on record, including all legal authorities documented. The purpose of IAM Services is to
authenticate and authorize all users and computers in a Windows domain type network;
assigning and enforcing information security policies for all computers and installing or updating
software. The IAM Services collect unique user credentials and stores them in an encrypted
format. The IAM Services are an essential service which facilitates and governs network access
to various resources.

Limited Official Use - NIH Prod

Limited Official Use - NIH Prod
14 Does the system collect, maintain, use or share PII?
X Yes
No
15 Indicate the type of PII that the system will collect or
maintain.
Name
Taxpayer ID
E-Mail Address
Medical Notes
Phone Numbers
Legal Documents
Education Records
Other
Mailing Address
Social Security Number
Employment Status
Date of Birth
Other
Mother's Maiden Name
Certificates
Other
Vehicle Identifiers
Military Status
Foreign Activities
Passport Number
Other
Driver's License Number
Medical Records Number
Other

Financial Account Info
Photographic Identifiers
Device Identifiers
Biometric Identifiers

16 Indicate the categories of individuals about whom PII
is collected, maintained or shared.
Employees
Other
Public Citizens
Vendors/Suppliers/Contractors
Business Partners/Contacts (Federal, state,
local agencies)
Patients
NIH trainees; NIH fellows
17 How many individuals' PII is in the system?
X 5,000-9,999
1,000,000 or more
500-4,999
10,000-49,999
100,000-999,999
100-499
50,000-99,999
<100

Limited Official Use - NIH Prod

Limited Official Use - NIH Prod
18 For what primary purpose is the PII used?
To administer Office of Intramural Training and Education (OITE) events and services, limiting
access to restricted resources (e.g., NIH-only events, appointments with OITE career
counselors), as appropriate.
19 Describe the secondary uses for which the PII will be
used (e.g. testing, training or research)
Track where the NIH Intramural Research Program trainees go once they leave the NIH;
Provide networking opportunities for current trainees, NIH staff, and program alumni;
Identify individuals who are willing to serve as event speakers or contacts for OITE staff
organizing training events;
Collect applicant data, including letters of recommendation, to supplement information collected
via OITE's online application system (RTO);
Assess the diversity of various user groups (applicants and current trainees);
Enhance the experience of program participants (e.g., by creating personalized certificates for
children of NIH staff who participate in Take Your Child to Work Day events).
20 Describe the function of the SSN.
N/A
20a Cite the legal authority to use the SSN.
N/A
21 Identify legal authorities governing information use
and disclosure specific to the system and program.
The legal authority granted to NIH to train future biomedical scientists comes from several
sources. Title 42 of the U.S. Code, Sections 241 and 282(b)(13) authorize the Director, NIH, to
conduct and support research training for which fellowship support is not provided under Part
487 of the Public Health Service (PHS) Act (i.e., National Research Service Awards), and that is
not residency training of physicians or other health professionals. Sections 405(b)(1)(C) of the
PHS Act and 42 U.S.C. Sections 284(b)(1)(C) and 285-287 grant this same authority to the
Director of each of the Institutes/Centers at NIH.
22 Are records on the system retrieved by one or more
PII data elements?
X Yes
No
22a Identify the number and title of the Privacy Act
System of Records Notice (SORN) that is being used

Limited Official Use - NIH Prod

Limited Official Use - NIH Prod
to cover the system or identify if a SORN is being
developed.
Published
Published
09-90-0020 - Suitability
for Employment Records,
HHS/OS/ASPER; 09-250014 - Clinical Research:
Student Records,
HHS/NIH/OD/OIR/OE;
09-25-0108 - Personnel:
Guest Researchers,
Special Volunteers, and
Scientists Emeriti,
HHS/NIH/OHRM;
OPM/GOVT-1 - General
Personnel Records;
OPM/GOVT-5 Recruiting, Examining,
and Placement Records

Published
In Progress
09-25-0140 - International
Activities: International
Scientific Researchers in
Intramural Laboratories at
the National Institutes of
Health,
HHS/NIH/FIC/ORS/DIRS
; 09-25-0158 Administration: Records
of Applicants and
Awardees of the NIH
Intramural Research
Training Awards
Program,
HHS/NIH/OD/OIR/OE;
09-25-0165 - National
Institutes of Health Office
of Loan Repayment and
Scholarship (OLRS)
Records System,
HHS/NIH/OD

23 (1)
Identify the sources of PII in the system.
Directly from an individual about whom the information pertains
Online
N/A
In-Person

Email
Other
Hard Copy: Mail/Fax

23 (2)
Identify the sources of PII in the system.
Government Sources

Limited Official Use - NIH Prod

Limited Official Use - NIH Prod
Within the OPDIV
Other Federal Entities
N/A
Other HHS OPDIV

Foreign
Other
State/Local/Tribal

23 (3)
23 Identify the sources of PII in the system.
Non-Government Sources
Members of the Public
Public Media/Internet
Other

Commercial Data Broker
Private Sector
N/A

23a Identify the OMB information collection approval
number and expiration date.
0925-0299 (Expiration Date: May 2024)
Renewal in-progress
24 Is the PII shared with other organizations?
X Yes
No
24a (1)
Identify with whom the PII is shared or disclosed and
for what purpose.

X Within HHS
N/A

24a (2)
Identify with whom the PII is shared or disclosed and
for what purpose.

Limited Official Use - NIH Prod

X Other Federal Agency/Agencies
N/A

24a (3)
Identify with whom the PII is shared or disclosed and
for what purpose.

X State or Local Agency/Agencies
N/A

24a (4)
Identify with whom the PII is shared or disclosed and
for what purpose.

Limited Official Use - NIH Prod

X Private Sector
N/A

Disclosure may be made to institutions
providing financial support. Also,
responses to the "Amgen Scholars
Program at NIH - Supplemental
Application" survey are shared with the
corporate sponsor that provides financial
support for that program.

X Click here to describe
N/A

There are Memorandums of
Understanding between NIH and
graduate universities for the Institutional
Partnerships and Individual Partnerships.

24c
Is the PII shared with other organizations?
Describe the procedures for accounting for
disclosures

Limited Official Use - NIH Prod

X Click here to describe
N/A

Disclosures from RTP are unlikely to be
made; however, if Privacy Act records
are disclosed, the disclosing office will
maintain an accounting, and the
disclosures will be made in accordance
with the applicable System of Records
Notice (SORN). The OITE will confer
with the NIH Senior Official for Privacy
and other key NIH administrators if RTP
system data involving PII need to be
disclosed.

25 Describe the process in place to notify individuals
that their personal information will be collected. If
no prior notice is given, explain the reason.
The footer of every RTP page includes a link to our Privacy Notice, which says in part:
We maintain and dispose of electronically submitted information in accordance with the Federal
Records Act (44 U.S.C. Chapter 31) and records schedules of the National Archives and Records
Administration. Information may be subject to disclosure in certain cases (for example, if
authorized by a Privacy Act System of Records Notice).
If you apply to one of our training programs and your application becomes part of a record
system designed to retrieve PII about you by personal identifier (name, e-mail address, mailing
address, phone number, etc.), we will safeguard the information you provide to us in accordance
with the Privacy Act of 1974, as amended (5 U.S.C. Section 552a). We prominently display a
Privacy Act Notification Statement on any form which asks you to provide personally
identifiable information.
26 Is the submission of PII by individuals voluntary or
mandatory?
X Voluntary
Mandatory
27 Describe the method for individuals to opt-out of the
collection or use of their PII. If there is no option to
object to the information collection, provide a
reason.
Submission of personal information is voluntary; however, in order to access certain information
(e.g., the Alumni Database), services (e.g., making an appointment with a career counselor), and
admission consideration for certain training programs, users must complete all required fields.
28 Describe the process to notify and obtain consent
from the individuals whose PII is in the system when
major changes occur to the system (e.g., disclosure
Limited Official Use - NIH Prod

Limited Official Use - NIH Prod
and/or data uses have changed since the notice at
the time of original collection). Alternatively, describe
why they cannot be notified or have their consent
obtained.
At present, there is no process in place to notify and obtain consent from individuals whose PII is
in the system when major changes occur to the system (e.g., disclosure and/or data uses have
changed since the notice at the time of the original collection). If there were a modification
from the original intent, OITE would confer with key offices, including but not limited to the
NIH Senior Official for Privacy, to determine the appropriate course of action. If deemed
appropriate, OITE would notify each affected individual using the email address on record.
29 Describe the process in place to resolve an
individual's concerns when they believe their PII has
been inappropriately obtained, used, or disclosed, or
that the PII is inaccurate. If no process exists, explain
why not.
The RTP system relies extensively on system-generated email messages, and registered users can
in many cases contact OITE by replying to these messages. Also, the page footer of every RTP
page includes a link to OITE's "Contact Us" page, https://www.training.nih.gov/contact.
Individuals who have concerns about their PII can use the information on this page to notify us.
The OITE will confer with key offices, including but not limited to the NIH Senior Official for
Privacy, to ensure the concerns of the individual are addressed in a timely manner.
The RTP system also includes a transaction auditing module to track record changes and system
activity. This module can be used by RTP administrators to investigate/confirm inappropriate or
suspicious activity.
RTP system administrators have tools enabling them to monitor system activity when a breach is
suspected and to disable/archive individual RTP users' accounts in cases where it is determined
that an unauthorized person has accessed, used, or disclosed applicant data.
All system users have access to tools to manage their passwords if they suspect that someone has
accessed their data through this system.

Limited Official Use - NIH Prod

Limited Official Use - NIH Prod
30 Describe the process in place for periodic reviews of
PII contained in the system to ensure the data's
integrity, availability, accuracy and relevancy. If no
processes are in place, explain why not.
The contractor who maintains the RTP system, Symplicity Corp., monitors the database and
system processes as a routine matter to ensure the data's integrity and availability. Also, OITE
system staff informally monitor this in their day-to-day use of the system tools. There is no
general process in place to ensure the accuracy and relevancy of the data, as there is no feasible
way to do so. That said, the system does have business rules in place that ensure the email
address provided by a new user is accurate in the sense of being accessible by that individual.
The system sends an account activation link to the email address provided when a new user
registers for an account. The user cannot sign in until he/she activates the account.
31 (1)
Identify who will have access to the PII in the system
and the reason why they require access.
Users

X Yes
N/A

To modify/update their profile data and
change their account preferences.

31 (2)
Identify who will have access to the PII in the system
and the reason why they require access.
Administrators

X Yes
N/A

To (1) generate reports for program
evaluation purposes; (2) ensure data
integrity/accuracy/etc.; (3) maintain
career counselor appointment-related
records; and (4) assist users with
technical issues.

31 (3)
Identify who will have access to the PII in the system
and the reason why they require access.
Developers

Limited Official Use - NIH Prod

X Yes
N/A

To ensure proper functioning of the
system and assist OITE with technical
issues.

31 (4)
Identify who will have access to the PII in the system
and the reason why they require access.
Contractors

X Yes
N/A

Direct and Non-Direct contractors. To
support Administrators and Developers.

31 (5)
Identify who will have access to the PII in the system
and the reason why they require access.
Others

X Yes
N/A

Registered NIH Trainees, NIH Staff, and
Alumni have access to Alumni Database,
for career networking purposes.

32 Describe the procedures in place to determine which
system users (administrators, developers,
contractors, etc.) may access PII.
Determinations are made based on role-based access controls and least privilege. User rights are
provisioned based on controls within the system, allowing users only access to the minimum
amount of PII necessary to perform their job.

Limited Official Use - NIH Prod

Limited Official Use - NIH Prod
33 Describe the methods in place to allow those with
access to PII to only access the minimum amount of
information necessary to perform their job.
When creating and editing system staff accounts, OITE System Admins assign roles based on
each individual's job duties, using the principle of least privilege. The system allows System
Admins to assign multiple roles to users when necessary and appropriate, and to remove
individual rights in most cases. This gives OITE the ability to control staff members' access to
PII in a fine-grained way. OITE occasionally reviews system staff accounts and adds/removes
roles and rights, as appropriate.
34 Identify training and awareness provided to
personnel (system owners, managers, operators,
contractors and/or program managers) using the
system to make them aware of their responsibilities
for protecting the information being collected and
maintained.
According to NIH policy, all personnel who manage or operate NIH applications must
successfully complete annual security awareness training. There are five categories of
mandatory information technology (IT) training (Information Security, Counterintelligence,
Privacy Awareness, Records Management and Emergency Preparedness). Training is completed
on the http://irtsectraining.nih.gov site with valid NIH credentials.
35 Describe training system users receive (above and
beyond general security and privacy awareness
training).
N/A
36 Do contracts include Federal Acquisition Regulation
and other appropriate clauses ensuring adherence to
privacy provisions and practices?
X Yes
No

Limited Official Use - NIH Prod

Limited Official Use - NIH Prod
37 Describe the process and guidelines in place with
regard to the retention and destruction of PII. Cite
specific records retention schedules.
Records are maintained within RTP for a time accordance with NARA record retention
schedules:
2.1.060 - Job Application Packages
Destroy 1 year after date of submission
Applications
3.2.030 - System Access Records
Destroy when business use ceases
RTP Accounts - user profiles, login files, password files, audit trails, etc
3.2.031 - System Access Records
Records are maintained within RTP for a time based on the type or data
Destroy 6 years after password is altered or user account is terminated, but longer retention is
authorized if required for business use.
RTP Accounts - user profiles, login files, password files, audit trails, etc
3.2.041 - System Backups and Tape Library Records
Destroy when second subsequent backup is verified as successful or when no longer needed for
the system restoration, whichever is later.
RTP BackUps
5.1.030 - Records of Non-Mission Related Internal Agency Committees
Destroy when business use ceases
Alumni Database, Memberships, MyOITE

Limited Official Use - NIH Prod

Limited Official Use - NIH Prod
38 Describe, briefly but with specificity, how the PII will
be secured in the system using administrative,
technical, and physical controls.
Administrative Controls: OITE staff access system data via a password-protected Content
Management System. Other users can access their own account information or other restricted
resources (e.g., the Alumni Database) by providing valid system login credentials of the proper
type. RTP applies role-based security to ensure access is restricted to the appropriate user
groups. At any time, System Admins can manually disable accounts of individuals who have left
the NIH or no longer require access to the site.
Technical Controls: Access to the system is controlled by login name and password. Access level
and permissions are controlled by the system and based on user, role, and account status. The
OITE has implemented strong password requirements for OITE staff and NIH trainees (both
internal and external users) to access specific sections of the website."
Physical Controls: The RTP system is hosted in the cloud, through Amazon Web Services
(AWS). The contractor who maintains the RTP system, Symplicity Corp., uses Amazon Aurora
for its database needs. Amazon Aurora provides multiple levels of security at the database level.
These include network isolation using Amazon Virtual Private Cloud (VPC), encryption at rest
using keys created and controlled through AWS Key Management Service and encryption of
data in transit using Secure Sockets Layer. On an encrypted Amazon Aurora instance, data in the
underlying storage is encrypted, as are the automated backups, snapshots, and replicas in the
same cluster. Communications between application and database are limited to the OITE
network segment and are never exposed to a public network.
Connections to the database server are made using accounts with only the access level necessary
for that connection. Connections needing only read-access to data, such as users browsing
postings, are made using a database account with only read access to the specific database table
they'll be reading. Similarly, update connections are made through connections granted write
access only to those databases and tables they need access to.
39 Identify the publicly-available URL:
https://www.training.nih.gov/
40 Does the website have a posted privacy notice?
X Yes
No
40a Is the privacy policy available in a machine-readable
format?
X No
Yes
41
Does the website use web measurement and
customization technology?
Limited Official Use - NIH Prod

Limited Official Use - NIH Prod

X Yes
No
41a (1) Does the system use web beacons?
X
No. This technology is not used.

Yes, and it collects PII.

Yes, and it does not collect PII.

41a (2) Does the system use web bugs?
X
No. This technology is not used.

Yes, and it collects PII.

Yes, and it does not collect PII.

41a (3) Does the system use session cookies?
X
Yes, and it does not collect PII.

Yes, and it collects PII.

No. This technology is not used.

41a (4) Does the system use persistent cookies?
X
No. This technology is not used.

Limited Official Use - NIH Prod

Yes, and it collects PII.

Yes, and it does not collect PII.

41a (5) Does the system use another type of website measurement and customization
technology?
Yes, and it does not collect PII
Yes, and it collects PII.
Click here to describe the technology.
No. This technology is not used.
The 'awstats' open source
log file analyzer to parse
Apache access

42 Does the website have any information or pages
directed at children under the age of thirteen?
X No
Yes
42a Is there a unique privacy policy for the website, and
does the unique privacy policy address the process
for obtaining parental consent if any information is
collected?
No
Yes
43 Does the website contain links to non- federal
government websites external to HHS?
X Yes
No
43a Is a disclaimer notice provided to users that follow
external links to websites not owned or operated by
HHS?
X Yes
No
General Comments (for minor applications, add parent boundary name and UUID)

Limited Official Use - NIH Prod

Limited Official Use - NIH Prod
To successfully submit the form for review/approval, each page of this form must be 100%
completed.

This component is under the OD GSS, whose Universal Unique Identifier (UUID) is:
2092B382-A4F2-4FD5-A93E-1857E18B771E.

Limited Official Use - NIH Prod

Workflow Steps
Workflow Step
Created
Submitted
Approved

Date
Jun 24 2024 8:39AM
Jun 25 2024 2:25PM
Jun 25 2024 2:25PM

By
Olugbemiga Oluseye
Olugbemiga Oluseye
Olugbemiga Oluseye

Workflow Comments
Comment

Date

Limited Official Use - NIH Prod