Pia

Save

Privacy Impact Assessment Form
v 1.47.4
Status Post-Transition

Form Number

Form Date

Question

Answer

1

OPDIV:

NIH

2

PIA Unique Identifier:

P-1276680-859519

2a Name:

Commercialization Assistance Program (CAP) Program
Management System (PMS)
General Support System (GSS)
Major Application

3

Minor Application (stand-alone)

The subject of this PIA is which of the following?

Minor Application (child)
Electronic Information Collection
Unknown
3a

Identify the Enterprise Performance Lifecycle Phase
of the system.
Yes

3b Is this a FISMA-Reportable system?

4

Does the system include a Website or online
application available to and for the use of the general
public?

5

Identify the operator.

6

Point of Contact (POC):

7

Is this a new or existing system?

8

Does the system have Security Authorization (SA)?

No
Yes

Accept

No

Reject

Agency
Contractor
POC Title

SBIR/STTR Program Manager

POC Name

J.P. Kim, J.D., M.B.A.

POC Organization National Institutes of Health
POC Email

jpkim@nih.gov

POC Phone

301-435-0189

Accept
Reject

New
Existing
Yes

Accept

No

Reject

8b Planned Date of Security Authorization
Not Applicable

Page 1 of 10

Save

9

Indicate the following reason(s) for updating this PIA.
Choose from the following options.

PIA Validation (PIA
Refresh/Annual Review)
Anonymous to NonAnonymous
New Public Access
Internal Flow or Collection

Significant System
Management Change
Alteration in Character of
Data
New Interagency Uses
Conversion

Accept
Reject

Commercial Sources
PIA Officer Request
10

Accept

Describe in further detail any changes to the system
that have occurred since the last PIA.

11 Describe the purpose of the system.

Reject
Assists SBIR program office to track/communicate with
applicants in the NIH Commercialization Accelerator Program.

1) the system collects standard applicant information including
name and the web url so that we know which SBIR technology
is receiving the assistance in the CAP program, meaning all this
PII can be located in the NIH QVR system. Nothing in this
management system is disseminated to anyone; 2) The PMS is
Describe the type of information the system will
strictly used as a tool to help keep track of and have effective
collect, maintain (store), or share. (Subsequent
12
questions will identify if this information is PII and ask communication with selected companies and oversee their
progress and deliverables.; 3) I believe by definition this is PII.;
about the specific data elements.)
4) The information is not mandatory but encouraged as it is
generally needed to identify the applicant small business.
Information about the technology details are voluntary and we
discourage disclosure of any business confidential and
proprietary information.
Provide an overview of the system and describe the
13 information it will collect, maintain (store), or share,
either permanently or temporarily.
14 Does the system collect, maintain, use or share PII?

Accept
Reject

Accept
Reject

Accept
Reject
Yes

Accept

No

Reject

Page 2 of 10

Save

15

Indicate the type of PII that the system will collect or
maintain.

Social Security Number

Date of Birth

Name

Photographic Identifiers

Driver's License Number

Biometric Identifiers

Mother's Maiden Name

Vehicle Identifiers

E-Mail Address

Mailing Address

Phone Numbers

Medical Records Number

Medical Notes

Financial Account Info

Certificates

Legal Documents

Education Records

Device Identifiers

Military Status

Employment Status

Foreign Activities

Passport Number

Accept
Reject

Taxpayer ID

Employees
Public Citizens
16

Indicate the categories of individuals about whom PII
is collected, maintained or shared.

Business Partners/Contacts (Federal, state, local agencies)

Accept

Vendors/Suppliers/Contractors

Reject

Patients
Other
17 How many individuals' PII is in the system?

18 For what primary purpose is the PII used?
19

Accept
<100

Reject

This information used to enable communication with small
business applicants by NIH CAP-these are business contacts.

Accept
Reject
Accept

Describe the secondary uses for which the PII will be
used (e.g. testing, training or research)

Reject
Accept

20 Describe the function of the SSN.

Not applicable

20a Cite the legal authority to use the SSN.

Not applicable

21

Identify legal authorities governing information use
Not applicable
and disclosure specific to the system and program.

22

Are records on the system retrieved by one or more
PII data elements?

Reject

Accept
Reject
Yes

Accept

No

Reject

Page 3 of 10

Save
Directly from an individual about whom the
information pertains
In-Person
Hard Copy: Mail/Fax
Email
Online
Other
Government Sources

23

Within the OPDIV
Other HHS OPDIV
State/Local/Tribal
Foreign
Other Federal Entities
Other

Identify the sources of PII in the system.

Accept
Reject

Non-Government Sources
Members of the Public
Commercial Data Broker
Public Media/Internet
Private Sector
Other
23a

Identify the OMB information collection approval
number and expiration date.

24 Is the PII shared with other organizations?

Yes

Accept

No

Reject

Describe the process in place to notify individuals
25 that their personal information will be collected. If
no prior notice is given, explain the reason.
26

Is the submission of PII by individuals voluntary or
mandatory?

Accept
Reject
Voluntary

Accept

Mandatory

Reject

1) & 2) The contractor and administrator notify participants of
any system changes that would affect safety of the PII
collected about them. We explain to participants how the
Describe the method for individuals to opt-out of the system works, create log-in incredentials for them and disclose
collection or use of their PII. If there is no option to
who has access to the portal. We advise all companies to sign
27
object to the information collection, provide a
confidentiality non-disclosure agreements (CDAs) and also tell
reason.
them that all contractors and special advisors also have to sign
CDAs. 3) no information collected within the portal is shared or
disseminated to outside parties. That information is strictly for
NIH SBIR program use.
Describe the process to notify and obtain consent
from the individuals whose PII is in the system when
major changes occur to the system (e.g., disclosure
Individuals are aware of how their PII is going to be used at the
28 and/or data uses have changed since the notice at
time they provide the information as notification language is
the time of original collection). Alternatively, describe provided at the time of submission.
why they cannot be notified or have their consent
obtained.

Accept
Reject

Accept
Reject

Page 4 of 10

Save
Describe the process in place to resolve an
individual's concerns when they believe their PII has Any complaints regarding the potential misuse of PII is emailed
29 been inappropriately obtained, used, or disclosed, or to the system manager wo directs the response to the
that the PII is inaccurate. If no process exists, explain appropriate personnel (i.e. NIH security administrators).
why not.
Describe the process in place for periodic reviews of
PII contained in the system to ensure the data's
30
integrity, availability, accuracy and relevancy. If no
processes are in place, explain why not.

31

Identify who will have access to the PII in the system
and the reason why they require access.

Users

access information only about their
company

Administrators

i have access to all the information

Developers

have access in order to update and
provide suport

Contractors

have access in order to update and
provide support

Accept
Reject

Accept
Reject

Accept
Reject

Others
Describe the procedures in place to determine which
32 system users (administrators, developers,
contractors, etc.) may access PII.

Accept

Describe the methods in place to allow those with
33 access to PII to only access the minimum amount of
information necessary to perform their job.
Identify training and awareness provided to
personnel (system owners, managers, operators,
contractors and/or program managers) using the
34
system to make them aware of their responsibilities
for protecting the information being collected and
maintained.

Accept

Describe training system users receive (above and
35 beyond general security and privacy awareness
training).

Accept

Do contracts include Federal Acquisition Regulation
36 and other appropriate clauses ensuring adherence to
privacy provisions and practices?

Reject

Reject

Accept
Reject

Reject
Yes

Accept

No

Reject

Describe the process and guidelines in place with
37 regard to the retention and destruction of PII. Cite
specific records retention schedules.

Records are retained and disposed of under the authority of
the NIH Records Control Schedule contained in NIH Manual
Chapter 1743, Appendix 1 - "Keeping and Destroying
Records" (HHS Records Management Manual, Appendix B-361),
item 4000-A-2, which allows records to be destroyed when no
longer needed for administrative purposes. Refer to the NIH
Manual Chapter for specific disposition instructions

Describe, briefly but with specificity, how the PII will
38 be secured in the system using administrative,
technical, and physical controls.

We have password protected access in place that is set up for
the administrator, the contracted staff that run the database
(Larta Institute of 606 Olive Street, Suite 650, Los Angeles, CA),
the selected companies which can only access their own files,
and special advisors that mentor the company who also can
access technology related information abut the company they
were assigned to.

Accept
Reject

Accept
Reject

Page 5 of 10

Save
Reviewer Questions

Answer

REVIEWER QUESTIONS: The following section contains Reviewer Questions which are not to be filled out unless the user is an OPDIV
Senior Officer for Privacy.

Reviewer Questions
1

Answer
Yes

Accept

No

Reject

Does the PIA appropriately communicate the purpose of PII in the system and is the purpose
justified by appropriate legal authorities?

Yes

Accept

No

Reject

Do system owners demonstrate appropriate understanding of the impact of the PII in the
system and provide sufficient oversight to employees and contractors?

Yes

Accept

No

Reject

Yes

Accept

No

Reject

Yes

Accept

No

Reject

Yes

Accept

No

Reject

Yes

Accept

No

Reject

Yes

Accept

No

Reject

Yes

Accept

No

Reject

Yes

Accept

No

Reject

Are the questions on the PIA answered correctly, accurately, and completely?

Reviewer
Notes
2
Reviewer
Notes
3
Reviewer
Notes
4

Does the PIA appropriately describe the PII quality and integrity of the data?

Reviewer
Notes
5

Is this a candidate for PII minimization?

Reviewer
Notes
6

Does the PIA accurately identify data retention procedures and records retention schedules?

Reviewer
Notes
7

Are the individuals whose PII is in the system provided appropriate participation?

Reviewer
Notes
8

Does the PIA raise any concerns about the security of the PII?

Reviewer
Notes
9

Is applicability of the Privacy Act captured correctly and is a SORN published or does it need
to be?

Reviewer
Notes
10

Is the PII appropriately limited for use internally and with third parties?

Page 6 of 10

Save
Reviewer Questions

Answer

Reviewer
Notes
11

Does the PIA demonstrate compliance with all Web privacy requirements?

Yes

Accept

No

Reject

Yes

Accept

No

Reject

Reviewer
Notes
12

Were any changes made to the system because of the completion of this PIA?

Reviewer
Notes

General Comments

HHS Senior
Agency Official
for Privacy

OPDIV Senior Official
for Privacy Signature

Third-Party Website Assessment PIA Form
v 1.47.4
Status

Form Number

Read Only

Question

Form Date

Read Only

Answer

1

OPDIV:

Read Only - OPDIV

2

TPWA Unique Identifier (UID):

Read Only - TPWA UID

3

TPWA Name:

Read Only - TPWA Name

4

Is this a new TPWA?

Yes
No

4a Please provide the reason for revision

5

Will the use of a third-party Website or application
create a new or modify an existing HHS/OPDIV
System of Records Notice (SORN) under the Privacy
Act?

5a

Indicate the SORN number (or identify plans to put
one in place.)

Yes

Accept

No

Reject

SORN Number:
If not published:

Page 7 of 10

Save
6

Will the use of a third-party Website or application
create an information collection subject to OMB
clearance under the Paperwork Reduction Act (PRA)?

Yes

Accept

No

Reject

Yes

Accept

No

Reject

OMB Approval Number
Indicate the OMB approval number and approval
6a number expiration date (or describe the plans to
obtain OMB clearance.)

Expiration Date
Explanation

7

Does the third-party Website or application contain
Federal Records?
POC Title
POC Name

8

Point of Contact (POC):

Accept

POC Organization

Reject
POC Email
POC Phone

9

Accept

Describe the specific purpose for the OPDIV use of
the third-party Website or application:

Have the third-party privacy policies been reviewed
10 to evaluate any risks and to determine whether the
Website or application is appropriate for OPDIV use?
Describe alternative means by which the public can
obtain comparable information or services if they
11
choose not to use the third-party Website or
application:
Does the third-party Website or application have
12 appropriate branding to distinguish the OPDIV
activities from those of nongovernmental actors?
13

How does the public navigate to the third party
Website or application from the OPIDIV?

13a

Please describe how the public navigate to the thirdparty website or application:

If the public navigate to the third-party website or
application via an external hyperlink, is there an alert
13b
to notify the public that they are being directed to a
nongovernmental Website?
Has the OPDIV Privacy Policy been updated to
14 describe the use of a third-party Website or
application?

Reject
Yes

Accept

No

Reject
Accept
Reject

Yes

Accept

No

Reject
Accept
Reject

Yes
No
Yes

Accept

No

Reject

Yes

Accept

No

Reject

14a Provide a hyperlink to the OPDIV Privacy Policy:
15

Is an OPDIV Privacy Notice posted on the third-party
Website or application?

Page 8 of 10

Save
Confirm that the Privacy Notice contains all of the
following elements: (i) An explanation that the
Website or application is not government-owned or
government-operated; (ii) An indication of whether
and how the OPDIV will maintain, use, or share PII
15a that becomes available; (iii) An explanation that by
using the third-party Website or application to
communicate with the OPDIV, individuals may be
providing nongovernmental third-parties with access
to PII; (iv) A link to the official OPDIV Website; and (v)
A link to the OPDIV Privacy Policy
Is the OPDIV's Privacy Notice prominently displayed
at all locations on the third-party Website or
15b
application where the public might make PII
available?

Yes
No

Yes
No

16

Is PII collected by the OPDIV from the third-party
Website or application?

Yes

Accept

No

Reject

17

Will the third-party Website or application make PII
available to the OPDIV?

Yes

Accept

No

Reject

Describe the PII that will be collected by the OPDIV
from the third-party Website or application and/or
the PII which the public could make available to the
18
OPDIV through the use of the third-party Website or
application and the intended or expected use of the
PII:
Describe the type of PII from the third-party Website
or application that will be shared, with whom the PII
19
will be shared, and the purpose of the information
sharing:

Accept
Reject

Accept
Reject

19a

If PII is shared, how are the risks of sharing PII
mitigated?

20

Will the PII from the third-party Website or
application be maintained by the OPDIV?

20a

If PII will be maintained, indicate how long the PII will
be maintained:

21

Describe how PII that is used or maintained will be
secured:

Accept

22

What other privacy risks exist and how will they be
mitigated?

Accept

Yes

Accept

No

Reject

Reject

Reject

REVIEWER QUESTIONS: The following section contains Reviewer Questions which are not to be filled out unless the user is an OPDIV
Senior Officer for Privacy.

Reviewer Questions
1

Are the responses accurate and complete?

Answer
Yes

Accept

No

Reject

Page 9 of 10

Save
REVIEWER QUESTIONS: The following section contains Reviewer Questions which are not to be filled out unless the user is an OPDIV
Senior Officer for Privacy.

Reviewer
Notes
2

Is the TPWA compliant with all M-10-23 requirements, including appropriate branding and
alerts?

Yes

Accept

No

Reject

Has the OPDIV posted an updated privacy notice on the TPWA and does it contain the five
required elements?

Yes

Accept

No

Reject

Yes

Accept

No

Reject

Yes

Accept

No

Reject

Reviewer
Notes
3
Reviewer
Notes
4

Does the PIA clearly identify PII made available and/or collected by the TPWA?

Reviewer
Notes
5

Is the handling of PII appropriate?

Reviewer
Notes
General
Comments

OPDIV Senior Official
for Privacy Signature

HHS Senior
Agency Official
for Privacy

Page 10 of 10