Privacy Impact Assessment

Save

Privacy Impact Assessment Form
v 1.47.4
Status Draft

Form Number

F-47351

Form Date

Question

Answer

1

OPDIV:

CDC

2

PIA Unique Identifier:

P-8814776-813944

2a Name:

2/28/2018 8:22:11 AM

Data Coordinating Center (DCC)
General Support System (GSS)
Major Application

3

Minor Application (stand-alone)

The subject of this PIA is which of the following?

Minor Application (child)
Electronic Information Collection
Unknown

3a

Identify the Enterprise Performance Lifecycle Phase
of the system.

Operations and Maintenance
Yes

3b Is this a FISMA-Reportable system?

4

Does the system include a Website or online
application available to and for the use of the general
public?

5

Identify the operator.

6

Point of Contact (POC):

7

Is this a new or existing system?

8

Does the system have Security Authorization (SA)?

8a Date of Security Authorization

No
Yes
No
Agency
Contractor
POC Title

IT Specialist

POC Name

William Dolan

POC Organization NCHHSTP/OD
POC Email

wdolan@cdc.gov

POC Phone

404.639.6233
New
Existing
Yes
No

May 11, 2018

Page 1 of 3

Save
The Data Coordinating Center (DCC) supports two 2nd
generation HIV surveillance systems: The Morbidity Monitoring
Project (MMP) and the National HIV Behavioral Surveillance
System (NHBS). DCC serves as a centralized data hub
maintaining the information compiled from both of these
projects.

11 Describe the purpose of the system.

The primary objectives of the DCC are:
(1) To receive data from no more than 25 NHBS and 26 MMP
sites over a secure transport mechanism;
(2) To process data for quality assurance;
(3) To create and transfer cumulative and final data sets to CDC
and to project areas;
(4) To provide ad-hoc technical assistance to NHBS and MMP
project areas;
(5) To provide formal training sessions for NHBS and MMP
project areas; and
(6) To communicate and report to CDC.
The data compilation within DCC is composed of information
collected by both NHBS and MMP. Therefore, the information
stored by the system is as follows:
1- The following information is maintained within DCC as a
result of the NHBS data collection:
Information collected by NHBS: Month and Year of Birth; Age;
Census Tract (adjacent cross streets); Race; Ethnicity; and Sex.

Describe the type of information the system will
collect, maintain (store), or share. (Subsequent
12
questions will identify if this information is PII and ask
about the specific data elements.)

2- The following data is collected by MMP and is also
maintained within DCC:
The MMP collects both interview and medical record
abstraction data on approximately 9000 participants each year.
Information collected for MMP are: Month and Year of Birth;
Sex at birth; Gender; Race; Ethnicity; and Country of Birth.
DCC requires user names and business email addresses to
provide user access, provide system support, and send
reminders about data collection activities. User IDs and
passwords are required for identification and authentication to
the DCC and are stored permanently. Passwords are encrypted
with a one-way hash.

Page 2 of 3

Save
CDC has developed and initiated two major surveillance
systems: the National HIV Behavioral Surveillance (NHBS) and
the Medical Monitoring Project (MMP). These surveillance
systems are currently functioning in no more than 25 NHBS
and 26 MMP sites. In order to support these surveillance
systems, the Division of HIV/AIDS Prevention (DHAP)
contracted with a vendor for the DCC. DCC serves as the
“central data processing hub” receiving data collected by NHBS
and MMP grantees, applying validations to the data received,
merging the data from these different sources, and storing this
information to make it available for CDC/DHAP program users.

Provide an overview of the system and describe the
13 information it will collect, maintain (store), or share,
either permanently or temporarily.

The grantee sites are responsible for implementing the
projects, collecting and monitoring data and transmitting it to
CDC. CDC is responsible for technical assistance to project
areas; data management and data report-generation for
project areas; returning a 'clean' data set for project areas to
use for their local analysis; and compiling and documenting a
national database.
DCC receives de-identified data from the 25 NHBS and 26 MMP
project areas (states and grantees). NHBS grantees collect
Month and Year of Birth; Age; Census Tract (adjacent cross
streets); Race; Ethnicity; and Sex. MMP grantees collect Month
and Year of Birth; Sex at birth; Gender; Race; Ethnicity; and
Country of Birth. This data is compiled and maintained within
DCC. DCC encrypts all analyzed data and makes it available to
the CDC program via the system portal.
DCC also collects user names and business email addresses to
provide user access, provide system support, and send
reminders about data collection activities. User IDs and
passwords are required for identification and authentication to
the DCC and are stored permanently. Passwords are encrypted
with a one-way hash.

14 Does the system collect, maintain, use or share PII?

Yes
No

General Comments

OPDIV Senior Official
for Privacy Signature

Beverly E.
Walker -S

Digitally signed by
Beverly E. Walker -S
Date: 2018.05.10 12:32:02
-04'00'

Page 3 of 3