Privacy Threshold Assessment

Status: Original and derived artifacts are available for this document.

Download: pdf

Archived Privacy Threshold Analysis (PTA): CDC - OCIO ISB INFR SVCS - Message Validation, Processing, and Provisioning System - QTR2 - 2024 CDC8304536
Created Date: 6/6/2024 7:27 PM Last Updated: 4/22/2025 2:45 PM

Copy Approved PTA (Privacy Threshold Analysis)
Do you want to copy this Privacy Threshold Analysis (PTA) ?
Please define who would be the Submitter of copied Privacy Threshold Analysis (PTA).

Instructions
Review the following steps to complete this questionnaire:

1) Answer questions. Select the appropriate answer to each question. Question specific help text may be available via the
answer dictates an explanation, a required text box will become available for you to add further information.

icon. If your

2) Add Comments. You may add question specific comments or attach supporting evidence for your answers by clicking on the
each question. Once you have saved the comment, the icon will change to the

icon next to

icon to show that a comment has been added.

3) Change the Status. You may keep the questionnaire in the "In Process" status until you are ready to submit it for review. When you have
completed the assessment, change the Submission Status to "Submitted". This will route the assessment to the proper reviewer. Please note that
all values list questions must be answered before submitting the questionnaire.
4) Save/Exit the Questionnaire. You may use any of the four buttons at the top and bottom of the screen to save or exit the questionnaire. The
button allows you to complete the questionnaire. The button allows you to save your work and close the questionnaire. The button allows you to
save your work and remain in the questionnaire. The button closes the questionnaire without saving your work.
Acronyms
ATO - Authorization to Operate
CAC - Common Access Card
FISMA - Federal Information Security Management Act
HHS - Department of Health and Human Services
NARA - National Archives and Record Administration
OMB - Office of Management and Budget
PIA - Privacy Impact Assessment
PII - Personally Identifiable Information
POC - Point of Contact
PTA - Privacy Threshold Analysis
URL - Uniform Resource Locator

General Information
PTA Name:

CDC - OCIO ISB INFR SVCS - Message Validation,
Processing, and Provisioning System - QTR2 - 2024 CDC8304536

PTA ID:

8304536

Name of
Component:

OCIO ISB Infrastructure Services

Name of ATO
Boundary:

OCIO ISB Infrastructure Services

Does this need
to migrate to a
SubComponent?:

No

Consolidated Parent Component

Component Name

No Records Found
Is this a SubComponent?:

Yes

Sub-Component
Software Name

Message Validation, Processing, and Provisioning System
Overall Status:

PTA Queue:

Submitter:

FINLAYSON, Douglas

# of Days Open: (289)

Submission
Status:

Submitted

Submit Date:

8/22/2023

Office:

OD

PIA Required:

Yes

OpDiv:

CDC

Legacy PTA ID:
1:

Identify the Enterprise Performance Lifecycle Phase of the system.

2:

Is this a FISMA-Reportable system?

3:

Does the system have or is it covered by a Security Authorization to
Operate (ATO)?

4:

ATO Date or Planned ATO Date.

10/23/2023

5:

Is the system or electronic information collection agency or contractor
operated?

Agency

History Log:

View History Log

PTA Questions
General
PTA - 1 Point of Contact (POC)
POC Title

POC Name

POC Organization

POC E-mail

Business Steward

Indira Srinivasan

CDC/OPHSS/CSELS

[email protected]

PTA - 2:

Indicate the following reason(s) for this PTA. Choose from the following
options.

PTA - 2A:

Describe in further detail any changes to the system that have occurred since the last PIA.

PTA - 3:

Is the data contained in the system owned by the agency or contractor?

Agency

PTA - 4:

Please give a brief overview and purpose of the system by describing
what the functions of the system are and how the system carries out
those functions.

MVPS system is a multifaceted public health disease
surveillance system that gives public health officials
powerful capabilities to monitor the occurrence and

PIA Validation (PIA Refresh)
N/A

spread of diseases. Facets of MVPS will be used by
numerous state, territorial, tribal, and local health
departments; and by partner organizations, such as
the Council of State and Territorial Epidemiologists
(CSTE).
The primary goal of the Message Validation,
Processing, and Provisioning System (MVPS) is to
develop a common infrastructure for public health
agencies that allows the Federal, state, and local
level public health agencies to store and exchange
data using a common set of business procedures,
metadata, and capabilities that can be defined from
the start.
PTA - 5:

List and/or describe all the types of information that are collected (into), MVPS contains the following patient (case) contact
maintained, and/or shared in the system regardless of whether that
data: Names, mailing address, email addresses,
information is PII and how long that information is stored.
phone numbers, medical notes, date of birth (DOB),
Sex/ Race, county, marital status and census tract.
The raw messages are stored in the databases to
maintain source and history and are kept
permanently.

PTA - 5A:

Are user credentials used to access the system?

PTA - 5B:

Please identify the type of user credentials used to access the system.

PTA - 6:

Describe why all types of information is collected (into), maintained,
The primary goal of the Message Validation,
and/or shared with another system. This description should specify what Processing, and Provisioning System (MVPS) is to
information is collected about each category of individual.
develop a common infrastructure for public health

Yes, but the user credentials are maintained in a
separate system (e.g., AD, AMS) and not collected or
maintained by this system. The system providing
credentials is - Internal CDC users authenticate via
CDC's Active Directory. Partners authenticate via
Secure Access Management System (SAMS)

agencies that allows the Federal, state, and local
level public health agencies to store and exchange
data using a common set of business procedures,
metadata, and capabilities that can be defined from
the start and not be introduced ad-hoc. The MVPS
system is a message processing system. Messages
are received and are then validated.
Names – MVPS only collects patient name for
Malaria cases. It is a requirement by the Malaria
program. Submitters names (state epidemiologist in
most cases) are collected in case someone needs to
contact them for questions or issues.
Mailing address – MVPS does not collect street
address, but does collect city/state/zip/county for
basic demographics on a case.
Email addresses, phone numbers, medical notes,
DOB, Sex/ Race, county, marital status and census
tract – email addresses and phone numbers are only
collected for the submitters (state epidemiologist in
most cases) in case of questions or issues. medical
notes, DOB, Sex/ Race, county, marital status and
census tract are collected for basic demographics on
a case.
PTA - 7:

Does the system collect, maintain, use of share PII?

Yes

PTA - 7A:

Does this include Sensitive PII as defined by HHS?

Yes

PTA - 8:

Does the system include a website or online application?

Yes

PTA - 8A:

Are any of the URLs listed accessible by the general public (to include
publicly accessible log in and internet websites/online applications)?

No

URL Details
Type of URL

List Of URL

No Records Found
PTA - 9:

Describe the purpose of the website, who has access to it, and how users The site serves as a dashboard for Admin users (all
access the web site (via public URL, log in, etc.). Please address each
Admins are internal CDC users) as as a reporting
element in your response.
platform for external partners.
Internal CDC users authenticate via CDC's Active
Directory. Partners authenticate via SAMS.

PTA - 10:

Does the website have a posted privacy notice?

Yes

PTA - 11:

Does the website contain links to non-federal government websites
external to HHS?

No

PTA - 11A:

Is a disclaimer notice provided to users that follow external links to
websites not owned or operated by HHS?

PTA - 12:

Does the website use web measurement and customization technology? Yes

PTA - 12A:

Select the type(s) of website measurement and customization
technologies in use and if it is used to collect PII.

Session Cookies - Does Not Collect PII

PTA - 13:

Does the website have any information or pages directed at children
under the age of thirteen?

No

PTA - 13A:

Does the website collect PII from children under the age thirteen?

PTA - 13B:

Is there a unique privacy policy for the website and does the unique
privacy policy address the process for obtaining parental consent if any
information is collected?

PTA - 14:

Does the system have a mobile application?

PTA - 14A:

Is the mobile application HHS developed and managed or a third-party
application?

PTA - 15:

Describe the purpose of the mobile application, who has access to it, and
how users access it. Please address each element in your response.

PTA - 16:

Does the mobile application/have a privacy notice?

PTA - 17:

Does the mobile application contain links to non-federal government
websites external to HHS?

PTA - 17A:

Is a disclaimer notice provided to users that follow external links to
resources not owned or operated by HHS?

PTA - 18:

Does the mobile application use measurement and customization
technology?

PTA - 18A:

Describe the type(s) of measurement and customization technologies or
techniques in use and what information is collected.

PTA - 19:

Does the mobile application have any information or pages directed at
children under the age of thirteen?

PTA - 19A:

Does the mobile application collect PII from children under the age
thirteen?

PTA - 19B:

Is there a unique privacy policy for the mobile application and does the
unique privacy policy address the process for obtaining parental consent
if any information is collected?

PTA - 20:

Is there a third-party website or application (TPWA) associated with the
system?

No

PTA - 21:

Does this system use artificial intelligence (AI) tools or technologies?

No

No

Review & Comments
Privacy Analyst Review
OpDiv Privacy
Analyst Review
Status:

Approved

Privacy Analyst In the PIA, "mailing address" is better described as
"geo location data" as it is described in PTA 6 as
Comment :
being general location and not a specific address.

Privacy Analyst
Review Date:

8/22/2023

Privacy Analyst
Days Open:

0

SOP Review
SOP Review
Status:
SOP Comments:

Approved

SOP Signature:
SOP Review
Date:

8/22/2023

SOP Days Open: 0

Supporting Document(s)
Name

Size

Type

Upload Date

Downloads

No Records Found

Comments
Question Name

Submitter

Date

Comment

PTA - 5A

MOSIOS, Joshua

8/14/2023

Please define all acronyms upon first
use (SAMS)

PTA - 6

MOSIOS, Joshua

8/14/2023

Please justify why all the data
elements in PTA 5 (both PII and nonPII) are processed by this system.

Miscellaneous Fields
SubComponent
ISSO:

BLACKBURN, Jason

Attachment