Privacy Impact Assessment - QARS

06.1 HHS Privacy Impact Assessment (Form) / Quarantine Activity
Reporting System (QARS)

Primavera
ProSight

CDC PIA (April 2011)
PIA SUMMARY
1
The following required questions with an asterisk (*) represent the information necessary to complete the PIA Summary for transmission to the Office of
Management and Budget (OMB) and public posting in accordance with OMB Memorandum (M) 03-22.
Note: If a question or its response is not applicable, please answer “N/A” to that question where possible. If the system hosts a website, the Website Hosting
Practices section is required to be completed regardless of the presence of personally identifiable information (PII). If no PII is contained in the system,
please answer questions in the PIA Summary Tab and then promote the PIA to the Senior Official for Privacy who will authorize the PIA. If this system
contains PII, all remaining questions on the PIA Form Tabs must be completed prior to signature and promotion.

2

Summary of PIA Required Questions

*Is this a new PIA?

No
If this is an existing PIA, please provide a reason for revision:

Recertification
*1. Date of this Submission:

11/26/2012
*2. OPDIV Name:

CDC
*3. Unique Project Identifier (UPI) Number for current fiscal year:

N/A
*4. Privacy Act System of Records Notice (SORN) Number (If response to Q.21 is Yes, a SORN number is required for Q.4):

N/A
*5. OMB Information Collection Approval Number:

No
*6. Other Identifying Number(s):

ESC# 1390
*7. System Name (Align with system item name):

Quarantine Activity Reporting System (QARS)
*9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed:

Point of Contact Information
POC Name

Todd Mercer

*10. Provide an overview of the system:
Note: If SSN’s(Social Security Numbers) will be collected, maintained (stored), disseminated and/or pass through within any database(s),

record(s), file(s) or website(s) hosted by this system you must complete and submit Attachment A – SSN Elimination or Usage
Approval Request located at http://intranet.cdc.gov/ociso/pandp/policy.html
Note: According to OMB 07-16M, All agencies MUST participate in government-wide effort to eliminate unnecessary use of and explore alternatives to
agency use of Social Security Numbers as a personal identifier for both Federal employees and in Federal programs.

Page 1 of 21

The Division of Global Migration and Quarantine (DGMQ) commissioned the development of
a Quarantine Activity Reporting System (QARS) as a subset of the DGMQ Intranet project,
as a way to boost internal communications within the division and enable the DGMQ to
track the activities recorded in this application.
Currently, each of the eight quarantine stations produces a daily activity report (DAR) of
the significant activities occurring at their stations. These reports are then sent to DQ
Headquarters, where DGMQ personnel review and consolidate all reports into a Quarantine
Activity Daily Report for distribution at the CDC center level and above.
The quarantine stations are involved on a daily basis in various activities, including
responding to reports of ill passengers, inspecting imported shipments of nonhuman
primates, and monitoring the arrival of immigrants and refugees. These activities are
recorded and summarized individually at each quarantine station. Monthly, counts of
activities are submitted by each station for a monthly activity report.
The QARS allows Quarantine Station personnel to enter their daily activities in an electronic
standardized format, using controlled vocabulary. The QARS allows both Quarantine Station
personnel and Headquarters personnel to enter follow-up reports to responses and
investigations, as well as information gathered after the creation of the initial report. QARS
will enable DGMQ personnel to generate the Quarantine Daily Activity Report in a timelier
and uniform manner. The information collected on a daily basis will be collated and stored
in a database that can be utilized to generate reports on a monthly, quarterly, and annual
basis. The system will facilitate the provision of required data for the Office of Management
and Budget. The QARS will allow for the assessment of the volume and type of activities
that the quarantine stations perform in order to better allocate resources and personnel.
The information gathered through the illness investigation reports will enable the
quantification and analysis of the information acquired during illness responses and
investigations.
*13. Indicate if the system is new or an existing one being modified:

Existing
*17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this
system?
TIP: If the answer to Question 17 is “No” (indicating the system does not contain PII), only the remaining PIA Summary tab questions need to be completed
and submitted. If the system does contain PII, the full PIA must be completed and submitted. (Although note that “Employee systems,” – i.e., systems that
collect PII “permitting the physical or online contacting of a specific individual … employed [by] the Federal Government – only need to complete the PIA
Summary tab.)

Yes
17a. Is this a GSS PIA included for C&A purposes only, with no ownership of underlying application data? If the response to Q.17a is Yes, the response to
Q.17 should be No and only the PIA Summary must be completed. NOTE: TO BE DETERMINED AND COMPLETED BY OCISO ONLY!!!

*19. Are records on the system retrieved by 1 or more PII data elements?

No
*21. Is the system subject to the Privacy Act? (If the response to Q.19 is Yes, the response to Q.21 must be Yes and a SORN number is required for Q.4)

No
Page 2 of 21

*23. If the system shares or discloses PII, please specify with whom and for what purpose(s):

DGMQ quarantine station public health officers, medical officers, head quarter staff to
perform duties as required by regulations.
*30. Please describe in detail: (1) The information the agency will collect, maintain, or disseminate (clearly state if the information contained in the system
ONLY represents federal contact data); (2) Why and for what purpose the agency will use the information; (3) Explicitly indicate whether the information
contains PII; and (4) Whether submission of personal information is voluntary or mandatory:

1) daily activity reports 2) Information is used to follow up with ill passengers, trace
contacts or inform exposed persons of possible exposure. 3) Data includes PII. 4)
Submission is mandatory.
*31. Please describe in detail any processes in place to: (1) Notify and obtain consent from the individuals whose PII is in the system when major changes
occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) Notify and obtain consent from
individuals regarding what PII is being collected from them; and (3) How the information will be used or shared. (Note: Please describe in what format
individuals will be given notice of consent [e.g., written notice, electronic notice, etc.]):

DGMQ has a legal mandate to collect data and perform illness and death investigations and
report on diseases that may be of public health interest. As part of the data collection,
quarantine staff is required to collect personal identifying information.
1) After DGMQ collects PII information, it is entered into the QARS system. PII is stored
only on ill travelers who are suspected of having a disease of public health interest.
2) For illnesses/deaths reported after travel is completed, case PII is obtained and provided
to DGMQ by the reporting agency (i.e. state/local health department). If the illness is of
public health interest, the PII is entered into QARS and used for confirming case travel
details and locating potentially exposed contacts of the case, if needed. If an illness/death
is reported during travel, quarantine station staff asks the individual to provide PII in order
to conduct follow-up and rule out an illness/death of public health interest.
3) If the disease is of public health interest, DGMQ will provide PII to the appropriate
health department of jurisdiction to allow them to conduct case follow-up and initiate a
community-based investigation, if necessary. PII on potential contacts of the case is stored
in QARS and sent to the health department with jurisdiction to conduct follow-up. DGMQ
does not routinely use the PII to communicate with the case or contacts. DGMQ does not
formally ask for consent but the individual can refuse to answer questions.
*32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of
the presence of PII)

Yes
*37. Does the website have any information or pages directed at children under the age of thirteen?

No
*50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention and
Destruction section in SORN)

Yes
*54. Briefly describe in detail how the PII will be secured on the system using administrative, technical, and physical controls:

QARS is managed by ITSO and inherits all the enterprise security controls of CDC. QARS
uses the HHS ROB for all users.

Page 3 of 21

If the response to Question 17 is “NO” and Question 32 is “YES”, you only
need to complete the PIA Summary and Website Hosting section (Questions
32 – 40).
If the response to Question 17 is “YES”, please complete ALL remaining
questions.

Page 4 of 21

PIA REQUIRE INFORMATION
1

HHS Privacy Impact Assessment (PIA)

The PIA determines if Personally Identifiable Information (PII) is contained within a system, what kind of PII, what is done with that information, and how that
information is protected. Systems with PII are subject to an extensive list of requirements based on privacy laws, regulations, and guidance. The HHS Privacy
Act Officer may be contacted for issues related to Freedom of Information Act (FOIA) and the Privacy Act. Respective Operating Division (OPDIV) Privacy
Contacts may be contacted for issues related to the Privacy Act. The Office of the Chief Information Officer (OCIO) can be used as a resource for questions
related to the administrative, technical, and physical controls of the system. Please note that answers to questions with an asterisk (*) will be submitted to the
Office of Management and Budget (OMB) and made publicly available in accordance with OMB Memorandum (M) 03-22.
Note: If a question or its response is not applicable, please answer “N/A” to that question where possible.

2

General Information

*Is this a new PIA?

No
If this is an existing PIA, please provide a reason for revision:

*1. Date of this Submission:

11/26/2012
*2. OPDIV Name:

CDC
3. Unique Project Identifier (UPI) Number for current fiscal year:

N/A
*4. Privacy Act System of Records Notice (SORN) Number (If response to Q.21 is Yes, a SORN number is required for Q.4):

N/A
*5. OMB Information Collection Approval Number:

N/A
5a. OMB Collection Approval Number Expiration Date:

N/A
*6. Other Identifying Number(s):

ESC# 1390
*7. System Name: (Align with system item name)

Quarantine Activity Reporting System (QARS)
8. System Location: (OPDIV or contractor office building, room, city, and state)

System Location:
OPDIV or contractor office building

Chamblee 106

Room

B0012

City

Atlanta

State

GA

Page 5 of 21

*9. System Point of Contact (POC). The System POC is the person to whom questions about the system and the responses to this PIA may be addressed:

Point of Contact Information
POC Name

Todd Mercer

The following information will not be made publicly available:

POC Title

Public Health Advisor

POC Organization

OID/NCEZID/DGMQ

POC Phone

404-639-4489

POC Email

Ztc9@cdc.gov

*10. Provide an overview of the system:
Note: If SSN’s(Social Security Numbers) will be collected, maintained (stored), disseminated and/or pass through within any database(s),

record(s), file(s) or website(s) hosted by this system you must complete and submit Attachment A – SSN Elimination or Usage
Approval Request located at http://intranet.cdc.gov/ociso/pandp/policy.html
Note: According to OMB 07-16M, All agencies MUST participate in government-wide effort to eliminate unnecessary use of and explore alternatives to
agency use of Social Security Numbers as a personal identifier for both Federal employees and in Federal programs.

Page 6 of 21

The Division of Global Migration and Quarantine (DGMQ) commissioned the development of
a Quarantine Activity Reporting System (QARS) as a subset of the DGMQ Intranet project,
as a way to boost internal communications within the division and enable the DGMQ to
track the activities recorded in this application.
Currently, each of the eight quarantine stations produces a daily activity report (DAR) of
the significant activities occurring at their stations. These reports are then sent to DQ
Headquarters, where DGMQ personnel review and consolidate all reports into a Quarantine
Activity Daily Report for distribution at the CDC center level and above.
The quarantine stations are involved on a daily basis in various activities, including
responding to reports of ill passengers, inspecting imported shipments of nonhuman
primates, and monitoring the arrival of immigrants and refugees. These activities are
recorded and summarized individually at each quarantine station. Monthly, counts of
activities are submitted by each station for a monthly activity report.
The QARS will allow the Quarantine Station personnel to enter their daily activities in an
electronic standardized format, using controlled vocabulary. The QARS allows both
Quarantine Station personnel and Headquarters personnel to enter follow-up reports to
responses and investigations, as well as information gathered after the creation of the
initial report. The QARS will enable DGMQ personnel to generate the Quarantine Daily
Activity Report in a timelier and uniform manner. The information collected on a daily basis
will be collated and stored in a database that can be utilized to generate reports on a
monthly, quarterly, and annual basis. The system will facilitate the provision of required
data for the Office of Management and Budget. The QARS will allow for the assessment of
the volume and type of activities that the quarantine stations perform in order to better
allocate resources and personnel. The information gathered through the illness
investigation reports will enable the quantification and analysis of the information acquired
during illness responses and investigations.

Page 7 of 21

SYSTEM CHARACTERIZATION AND DATA CATEGORIZATION
1

System Characterization and Data Configuration

11. Does HHS own the system?

Yes
11a. If no, identify the system owner:

N/A
12. Does HHS operate the system? (If the system is operated at a contractor site, the answer should be No)

Yes
12a. If no, identify the system operator:

N/A
*13. Indicate if the system is new or an existing one being modified:

Existing
14. Identify the life-cycle phase of this system:

Operations/Maintenance
15. Have any of the following major changes occurred to the system since the PIA was last submitted?

No
Please indicate “Yes” or “No” for each category below:

Yes/No

Conversions

No

Anonymous to Non-Anonymous

No

Significant System Management Changes

No

Significant Merging

No

New Public Access

No

Commercial Sources

No

New Interagency Uses

No

Internal Flow or Collection

No

Alteration in Character of Data

No

16. Is the system a General Support System (GSS), Major Application (MA), Minor Application (child) or Minor Application (stand-alone)?

MA
*17. Does/Will the system collect, maintain (store), disseminate and/or pass through PII within any database(s), record(s), file(s) or website(s) hosted by this
system?

Yes
TIP: If the answer to Question 17 is “No” (indicating the system does not contain PII), only the remaining PIA Summary tab questions need to be completed
and submitted. If the system does contain PII, the full PIA must be completed and submitted. (Although note that “Employee systems,” – i.e., systems that
collect PII “permitting the physical or online contacting of a specific individual … employed [by] the Federal Government – only need to complete the PIA
Summary tab.)

Page 8 of 21

Please indicate "Yes" or "No" for each PII category. If the applicable PII category is not listed, please use the Other field to identify the appropriate category
of PII.

Categories:

Yes/No

Name (for purposes other than contacting federal
employees)

Yes

Date of Birth

Yes

Social Security Number (SSN)

No

Note: According to OMB 07-16M, All agencies MUST participate in
government-wide effort to eliminate unnecessary use of and explore
alternatives to agency use of Social Security Numbers as a personal
identifier for both Federal employees and in Federal programs.

Photographic Identifiers

No

Driver’s License

Yes

Biometric Identifiers

No

Mother’s Maiden Name

No

Vehicle Identifiers

No

Personal Mailing Address

Yes

Personal Phone Numbers

Yes

Medical Records Numbers

Yes

Medical Notes

Yes

Financial Account Information

No

Certificates

No

Legal Documents

Yes

Device Identifiers

No

Web Uniform Resource Locator(s) (URL)

Yes

Personal Email Address

No

Education Records

No

Military Status

No

Employment Status

No

Foreign Activities

No

Other

ID Type (passport, drivers license, PR Card,
Military Card, etc.

17a. Is this a GSS PIA included for C&A purposes only, with no ownership of underlying application data? If the response to Q.17a is Yes, the response to
Q.17 should be No and only the PIA Summary must be completed. NOTE: TO BE DETERMINED AND COMPLETED BY OCISO ONLY!!!

18. Please indicate the categories of individuals about whom PII is collected, maintained, disseminated and/or passed through. Note: If the applicable PII
category is not listed, please use the Other field to identify the appropriate category of PII. Please answer "Yes" or "No" to each of these choices (NA in other
is not applicable).

Page 9 of 21

Categories:

Yes/No

Employees

No

Public Citizen

Yes

Patients

Yes

Business partners/contacts (Federal, state, local
agencies)

No

Vendors/Suppliers/Contractors

No

Other

No

*19. Are records on the system retrieved by 1 or more PII data elements?

No
Please indicate "Yes" or "No" for each PII category. If the applicable PII category is not listed, please use the Other field to identify the appropriate category
of PII.

Categories:

Yes/No

Name (for purposes other than contacting federal
employees)

No

Date of Birth

No

Social Security Number (SSN)

No

Note: According to OMB 07-16M, All agencies MUST participate in
government-wide effort to eliminate unnecessary use of and explore
alternatives to agency use of Social Security Numbers as a personal
identifier for both Federal employees and in Federal programs.

Photographic Identifiers

No

Driver’s License

No

Biometric Identifiers

No

Mother’s Maiden Name

No

Vehicle Identifiers

No

Personal Mailing Address

No

Personal Phone Numbers

No

Medical Records Numbers

No

Medical Notes

No

Financial Account Information

No

Certificates

No

Legal Documents

No

Device Identifiers

No

Web URLs

No

Personal Email Address

No

Education Records

No
Page 10 of 21

Military Status

No

Employment Status

No

Foreign Activities

No

Other

No

20. Are 10 or more records containing PII maintained, stored or transmitted/passed through this system?

Yes
*21. Is the system subject to the Privacy Act? (If the response to Q.19 is Yes, the response to Q.21 must be Yes and a SORN number is required for Q.4)

No
21a. If yes but a SORN has not been created, please provide an explanation.

N/A

Page 11 of 21

INFORMATION SHARING PRACTICES
1

Information Sharing Practices

22. Does the system share or disclose PII with other divisions within this agency, external agencies, or other people or organizations outside the agency?

Yes
Please indicate “Yes” or “No” for each category below:

Yes/No

Name (for purposes other than contacting federal
employees)

Yes

Date of Birth

Yes

Social Security Number (SSN)

No

Note: According to OMB 07-16M, All agencies MUST participate in
government-wide effort to eliminate unnecessary use of and explore
alternatives to agency use of Social Security Numbers as a personal
identifier for both Federal employees and in Federal programs.

Photographic Identifiers

No

Driver’s License

Yes

Biometric Identifiers

No

Mother’s Maiden Name

No

Vehicle Identifiers

No

Personal Mailing Address

Yes

Personal Phone Numbers

Yes

Medical Records Numbers

Yes

Medical Notes

Yes

Financial Account Information

No

Certificates

No

Legal Documents

Yes

Device Identifiers

No

Web URLs

Yes

Personal Email Address

No

Education Records

No

Military Status

No

Employment Status

No

Foreign Activities

No

Other

ID Type (passport, drivers license, PR Card,
Military Card, etc.

*23. If the system shares or discloses PII please specify with whom and for what purpose(s):

Page 12 of 21

DGMQ quarantine station public health officers, medical officers, head quarter staff to
perform duties as required by regulations.
24. If the PII in the system is matched against PII in one or more other computer systems, are computer data matching agreement(s) in place?

No
25. Is there a process in place to notify organizations or systems that are dependent upon the PII contained in this system when major changes occur (i.e.,
revisions to PII, or when the system is replaced)?

No
26. Are individuals notified how their PII is going to be used?

No
26a. If yes, please describe the process for allowing individuals to have a choice. If no, please provide an explanation.

DGMQ collects PII’s in QARS as part of its regulatory authority and permission from ill
travelers is not needed.
27. Is there a complaint process in place for individuals who believe their PII has been inappropriately obtained, used, or disclosed, or that the PII is
inaccurate?

Yes
27a. If yes, please describe briefly the notification process. If no, please provide an explanation.

There is no formal complaint process in place for this, however individuals can contact the
quarantine station and express their concerns, and will then be directed to the appropriate
person to handle the complaint.
28. Are there processes in place for periodic reviews of PII contained in the system to ensure the data’s integrity, availability, accuracy and relevancy?

No
28a. If yes, please describe briefly the review process. If no, please provide an explanation.

After an investigation is complete, the PII of the case is no longer needed, utilized or
updated. Some elements of stored PII (age, gender, state/country of residence, etc.) may
be used for data analysis purposes by DGMQ.
29. Are there rules of conduct in place for access to PII on the system?

Yes
Please indicate "Yes," "No," or "N/A" for each category. If yes, briefly state the purpose for each user to have access:

Users with access to PII

Yes/No/N/A

User

Purpose

Yes

Administrators

No

Developers

No

Contractors

Yes

Page 13 of 21

Contact ill passengers for
follow-up, contact tracing
because of possible
exposure to disease of
public health significance.

Assist public health officers
in follow-up or data entry of
follow up information, test
results, etc.

Other

No

*30. Please describe in detail: (1) The information the agency will collect, maintain, or disseminate (clearly state if the information contained in the system
ONLY represents federal contact data); (2) Why and for what purpose the agency will use the information; (3) Explicitly indicate whether the information
contains PII; and (4) Whether submission of personal information is voluntary or mandatory:

1)daily activity reports 2) Information is used to follow up with ill passengers,
trace contacts or inform exposed persons of possible exposure. 3) Data includes
PII. 4) Submission is mandatory.
*31. Please describe in detail any processes in place to: (1) Notify and obtain consent from the individuals whose PII is in the system when major changes
occur to the system (e.g., disclosure and/or data uses have changed since the notice at the time of the original collection); (2) Notify and obtain consent from
individuals regarding what PII is being collected from them; and (3) How the information will be used or shared. (Note: Please describe in what format
individuals will be given notice of consent [e.g., written notice, electronic notice, etc.])

DGMQ has a legal mandate to collect data and perform illness and death investigations and
report on diseases that may be of public health interest. As part of the data collection,
quarantine staff is required to collect personal identifying information.
1) After DGMQ collects PII information, it is entered into the QARS system. PII is stored
only on ill travelers who are suspected of having a disease of public health interest.
2) For illnesses/deaths reported after travel is completed, case PII is obtained and provided
to DGMQ by the reporting agency (i.e. state/local health department). If the illness is of
public health interest, the PII is entered into QARS and used for confirming case travel
details and locating potentially exposed contacts of the case, if needed. If an illness/death
is reported during travel, quarantine station staff asks the individual to provide PII in order
to conduct follow-up and rule out an illness/death of public health interest.
3) If the disease is of public health interest, DGMQ will provide PII to the appropriate
health department of jurisdiction to allow them to conduct case follow-up and initiate a
community-based investigation, if necessary. PII on potential contacts of the case is stored
in QARS and sent to the health department with jurisdiction to conduct follow-up. DGMQ
does not routinely use the PII to communicate with the case or contacts. DGMQ does not
formally ask for consent but the individual can refuse to answer questions.

Page 14 of 21

WEBSITE HOSTING PRACTICES
1

Website Hosting Practices

*32. Does the system host a website? (Note: If the system hosts a website, the Website Hosting Practices section is required to be completed regardless of
the presence of PII)

Yes
Please indicate “Yes” or “No” for each
type of site below. If the system hosts
both Internet and Intranet sites,
indicate “Yes” for “Both” only.

Yes/ No

If the system hosts an Internet site, please enter the site
URL. Do not enter any URL(s) for Intranet sites.

Internet

No

Intranet

Yes

Both

No

33. Does the system host a website that is accessible by the public and does not meet the exceptions listed in OMB M-03-22?
Note: OMB M-03-22 Attachment A, Section III, Subsection C requires agencies to post a privacy policy for websites that are accessible to the public, but
provides three exceptions: (1) Websites containing information other than "government information" as defined in OMB Circular A-130; (2) Agency intranet
websites that are accessible only by authorized government users (employees, contractors, consultants, fellows, grantees); and (3) National security systems
defined at 40 U.S.C. 11103 as exempt from the definition of information technology (see section 202(i) of the E-Government Act.).

No
34. If the website does not meet one or more of the exceptions described in Q. 33 (i.e., response to Q. 33 is "Yes"), a website privacy policy statement
(consistent with OMB M-03-22 and Title II and III of the E-Government Act) is required. Has a website privacy policy been posted?
(Note: A website privacy policy is required for Internet sites only.)

Yes
35. If a website privacy policy is required (i.e., response to Q. 34 is “Yes”), is the privacy policy in machine-readable format, such as Platform for Privacy
Preferences (P3P)?
(Note: Privacy policy in machine-readable format is required for Internet sites only.)

Yes
35a. If no, please indicate when the website will be P3P compliant:

N/A
36. Does the website employ tracking technologies?

Please indicate “Yes”, “No”, or “N/A” for each type of
cookie below:

Yes/No/N/A

Web Bugs

No

Web Beacons

No

Session Cookies

No

Persistent Cookies

No

Other

No

*37. Does the website have any information or pages directed at children under the age of thirteen?

No
Page 15 of 21

37a. If yes, is there a unique privacy policy for the site, and does the unique privacy policy address the process for obtaining parental consent if any
information is collected?

N/A
38. Does the website collect PII from individuals?

No
Please indicate “Yes” or “No” for each category below:

Yes/No

Name (for purposes other than contacting federal
employees)

No

Date of Birth

No

Social Security Number (SSN)

No

Note: According to OMB 07-16M, All agencies MUST participate in
government-wide effort to eliminate unnecessary use of and explore
alternatives to agency use of Social Security Numbers as a personal
identifier for both Federal employees and in Federal programs.

Photographic Identifiers

No

Driver's License

No

Biometric Identifiers

No

Mother's Maiden Name

No

Vehicle Identifiers

No

Personal Mailing Address

No

Personal Phone Numbers

No

Medical Records Numbers

No

Medical Notes

No

Financial Account Information

No

Certificates

No

Legal Documents

No

Device Identifiers

No

Web URLs

No

Personal Email Address

No

Education Records

No

Military Status

No

Employment Status

No

Foreign Activities

No

Other

No

39. Are rules of conduct in place for access to PII on the website?

Page 16 of 21

Yes
40. Does the website contain links to sites external to HHS that owns and/or operates the system?

Yes
40a. If yes, note whether the system provides a disclaimer notice for users that follow external links to websites not owned or operated by HHS.

Yes
ADMINISTRATIVE CONTROLS
1

Administrative Controls

Note: This PIA uses the terms “Administrative,” “Technical” and “Physical” to refer to security control questions—terms that are used in several Federal
laws when referencing security requirements.
41. Has the system been certified and accredited (C&A)?

Yes
41a. If yes, please indicate when the C&A was completed (Note: The C&A date is populated in the System Inventory form via the responsible Security
personnel):

41b. If a system requires a C&A and no C&A was completed, is a C&A in progress?

N/A
42. Is there a system security plan for this system?

Yes
43. Is there a contingency (or backup) plan for the system?

Yes
44. Are files backed up regularly?

Yes
45. Are backup files stored offsite?

Yes
46. Are there user manuals for the system?

Yes
47. Have personnel (system owners, managers, operators, contractors and/or program managers) using the system been trained and made aware of their
responsibilities for protecting the information being collected and maintained?

Yes
48. If contractors operate or use the system, do the contracts include clauses ensuring adherence to privacy provisions and practices?

Yes
49. Are methods in place to ensure least privilege (i.e., “need to know” and accountability)?

Yes
49a. If yes, please specify method(s):

Only those individuals that need to see information in order to perform duties have access
to the PII. All others see blanks or initials if that is required to prevent miscommunication.
*50. Are there policies or guidelines in place with regard to the retention and destruction of PII? (Refer to the C&A package and/or the Records Retention
and Destruction section in SORN):

Yes
50a. If yes, please provide some detail about these policies/practices:

Page 17 of 21

Records are maintained and disposed of in accordance with CDC’s Records Retention policy.

Page 18 of 21

1

Technical Controls

51. Are technical controls in place to minimize the possibility of unauthorized access, use, or dissemination of the data in the system?

Yes
Please indicate “Yes” or “No” for each category below:

Yes/No

User Identification

Yes

Passwords

Yes

Firewall

Yes

Virtual Private Network (VPN)

No

Encryption

No

Intrusion Detection System (IDS)

No

Common Access Cards (CAC)

No

Smart Cards

No

Biometrics

No

Public Key Infrastructure (PKI)

No

52. Is there a process in place to monitor and respond to privacy and/or security incidents?

Yes
52a. If yes, please briefly describe the process:

ITSO and OCISO monitor the network for security incidents. If any are detected, the ISSO
is notified and if necessary the incident is escalated to HHS and the proper authorities.
PHYSICAL ACCESS
1

Physical Access

53. Are physical access controls in place?

Yes
Please indicate “Yes” or “No” for each category below:

Yes/No

Guards

Yes

Identification Badges

Yes

Key Cards

Yes

Cipher Locks

No

Biometrics

No

Closed Circuit TV (CCTV)

No

*54. Briefly describe in detail how the PII will be secured on the system using administrative, technical, and physical controls:

Page 19 of 21

QARS is managed by ITSO and inherits all the enterprise security controls of CDC. QARS
uses the HHS ROB for all users.

Page 20 of 21

APPROVAL/DEMOTION
1

System Information

System Name:

2

Quarantine Activity Reporting System (QARS)

Senior Official for Privacy Approval/Promotion or Demotion

Promotion/Demotion:

PROMOTE

Comments:

3

OPDIV Senior Official for Privacy or Designee Approval

Please print the PIA and obtain the endorsement of the reviewing official below. Once the signature has been collected,
retain a hard copy for the OPDIV's records. Submitting the PIA will indicate the reviewing official has endorsed it
This PIA has been reviewed and endorsed by the OPDIV Senior Official for Privacy or Designee (Name and Date):

Name: _________________________________________________

Name:

Beverly E. Walker

Date:

4

Department Approval to Publish to the Web

Approved for web publishing
Date Published:
Publicly posted PIA URL or no PIA URL explanation:

Page 21 of 21

Date: ____________________
05 February 2013