Pia

Save

Privacy Impact Assessment Form
v 1.47.4
Status

Form Number

Form Date

Question
1

OPDIV:

2

PIA Unique Identifier:

2a Name:

Answer

NIH Workplace Civility and Equity Survey
General Support System (GSS)
Major Application

3

Minor Application (stand-alone)

The subject of this PIA is which of the following?

Minor Application (child)
Electronic Information Collection
Unknown

3a

Identify the Enterprise Performance Lifecycle Phase
of the system.

Development
Yes

3b Is this a FISMA-Reportable system?

4

Does the system include a Website or online
application available to and for the use of the general
public?

5

Identify the operator.

6

Point of Contact (POC):

7

Is this a new or existing system?

8

Does the system have Security Authorization (SA)?

No
Yes

Accept

No

Reject

Agency
Contractor
POC Title

Chief, Strategic Workforce
Analytics and Engagement
Branch

POC Name

Jonathan Lappin

NIH/OD/OM/OHR/Workforce
POC Organization Support and Development
Division
POC Email

lappinjo@od.hih.gov

POC Phone

301-435-7562

Accept
Reject

New
Existing
Yes

Accept

No

Reject

Page 1 of 11

Save
8a Date of Security Authorization

01/03/2022

11 Describe the purpose of the system.

The system will use the Qualtrics SaaS platform to collect data
via a web survey from all NIH employees, contractors, trainees
and special volunteers about their experiences of harassment
and discrimination at NIH. The system will track response and
will provide a response dashboard that will be accessible by
authorized users at NIH. The response dashboard will indicate
the response rates to the survey by Institute and Center (IC).
Qualtrics has FedRAMP certification at a moderate impact level
that expires 4/1/2023

Describe the type of information the system will
collect, maintain (store), or share. (Subsequent
12
questions will identify if this information is PII and ask
about the specific data elements.)
Provide an overview of the system and describe the
13 information it will collect, maintain (store), or share,
either permanently or temporarily.
14 Does the system collect, maintain, use or share PII?

15

Indicate the type of PII that the system will collect or
maintain.

The system will maintain respondent name, NIH email address,
organizational code, NIH Enterprise Directory (NED) ID, and IC
in addition to their survey responses. To support
authentication, the systems assigns and stores personal
Respondent name, NIH email address, organizational code,
NED ID, and IC will be maintained in the system in order to
track response to the survey by IC. Demographic information
Yes
No

Accept
Reject

Accept
Reject
Accept
Reject
Accept
Reject

Social Security Number

Date of Birth

Name

Photographic Identifiers

Driver's License Number

Biometric Identifiers

Mother's Maiden Name

Vehicle Identifiers

E-Mail Address

Mailing Address

Phone Numbers

Medical Records Number

Medical Notes

Financial Account Info

Certificates

Legal Documents

Education Records

Device Identifiers

Military Status

Employment Status

Foreign Activities

Passport Number

Accept
Reject

Taxpayer ID
Institute or Center (IC)
Role at NIH (employee, contractor, trainee, volunteer)
Organizational code, PINs, Usernames, Passwords
NED ID
Race, Age, Length of Employment
Employees
Public Citizens
16

Indicate the categories of individuals about whom PII
is collected, maintained or shared.

Business Partners/Contacts (Federal, state, local agencies)

Accept

Vendors/Suppliers/Contractors

Reject

Patients
Other trainees and special volunteers

Page 2 of 11

Save
17 How many individuals' PII is in the system?

18 For what primary purpose is the PII used?

19

Describe the secondary uses for which the PII will be
used (e.g. testing, training or research)

Accept

10,000-49,999

Reject

Name, email address, IC and PIN are used to track survey
completion. Role at NIH is used to provide the proper survey
pathway for the respondent.
IC and role at NIH will be used in aggregate during analyses.

20 Describe the function of the SSN.

not applicable

20a Cite the legal authority to use the SSN.

not applicable

Are records on the system retrieved by one or more
PII data elements?
Published:

Identify the number and title of the Privacy Act
System of Records Notice (SORN) that is being used
22a
to cover the system or identify if a SORN is being
developed.

Reject
Accept
Reject
Accept
Reject

As covered under NIH SORN 09-25-0156, authority for this
system comes from the authorities regarding the
establishment of the National Institutes of Health, its general
Identify legal authorities governing information use authority to conduct and fund research and to provide training
21
and disclosure specific to the system and program.
assistance, and its general authority to maintain records in
connection with these and its other functions (42 U.S.C. 203,
241, 289l-1 and 44 U.S.C. 3101), and Section 301 and 493 of the
Public Health Service Act.
22

Accept

Accept
Reject

Yes

Accept

No

Reject

SORN 09-25-0156, Records of Participants in
Programs and Responses in Surveys Used to
Evaluate Programs of the Public Health Service

Published:

Published:
In Progress

Page 3 of 11

Save
Directly from an individual about whom the
information pertains
In-Person
Hard Copy: Mail/Fax
Email
Online
Other
Government Sources
23

Within the OPDIV
Other HHS OPDIV
State/Local/Tribal
Foreign
Other Federal Entities
Other

Identify the sources of PII in the system.

Accept
Reject

Non-Government Sources
Members of the Public
Commercial Data Broker
Public Media/Internet
Private Sector
Other
23a

Identify the OMB information collection approval
number and expiration date.

24 Is the PII shared with other organizations?
Describe the process in place to notify individuals
25 that their personal information will be collected. If
no prior notice is given, explain the reason.
26

Is the submission of PII by individuals voluntary or
mandatory?

OMB review underway
Yes

Accept

No

Reject

Information about the survey, including the privacy and use of
data, is provided to respondents via email when invited to take
the survey.

Accept

Voluntary

Accept

Mandatory

Reject

Describe the method for individuals to opt-out of the
collection or use of their PII. If there is no option to
Respondents choose whether to complete the web survey.
27
object to the information collection, provide a
Participation is completely voluntary.
reason.
Describe the process to notify and obtain consent
from the individuals whose PII is in the system when
major changes occur to the system (e.g., disclosure
28 and/or data uses have changed since the notice at
the time of original collection). Alternatively, describe
why they cannot be notified or have their consent
obtained.
Describe the process in place to resolve an
individual's concerns when they believe their PII has
29 been inappropriately obtained, used, or disclosed, or
that the PII is inaccurate. If no process exists, explain
why not.
Describe the process in place for periodic reviews of
PII contained in the system to ensure the data's
30
integrity, availability, accuracy and relevancy. If no
processes are in place, explain why not.

Completion and return of the survey is considered to be
consent to participate. No changes in disclosure or data use
will be permitted without explicit consent from each survey
respondent.

Reject

Accept
Reject

Accept
Reject

Respondents are provided with an email address they can
contact with any concerns or questions.

Accept

System functionality, security, and accuracy are tested during
system development and subsequently tested at regular
intervals throughout the survey period.

Accept

Reject

Reject

Page 4 of 11

Save

31

Identify who will have access to the PII in the system
and the reason why they require access.

Users

Westat staff will manage sending of
email invitations, review status of
survey completions, and respond to
emails to the Help Desk.

Administrators

Westat IT professionals will manage
the system and provide support.

Developers

Westat IT professionals will troubleshoot system problems.

Contractors

The project is conducted directly by
Westat on behalf of NIH.

Accept
Reject

Others
Describe the procedures in place to determine which Individuals are granted rights to the information in the system
by the project director, who determines need-to-know based
32 system users (administrators, developers,
on the kind of job the person is doing and the particular
contractors, etc.) may access PII.
requirements of the tasks assigned to that person.
Describe the methods in place to allow those with
33 access to PII to only access the minimum amount of
information necessary to perform their job.

User roles are defined and individuals are assigned to one or
more roles. These roles ensure that access privileges are
narrowly defined, and that only those staff members that need
certain types of access are granted that access. In addition to
limiting functions, physical access controls limit access to the
system.

Identify training and awareness provided to
personnel (system owners, managers, operators,
contractors and/or program managers) using the
34
system to make them aware of their responsibilities
for protecting the information being collected and
maintained.

The NIH Security Awareness Training course is used to satisfy
this requirement. According to NIH policy, all personnel who
use manage or operate NIH applications or systems must
attend complete security awareness training every year. There
are five categories of mandatory IT training (Information
Security, Counterintelligence, Privacy Awareness, Records
Management, and Emergency Preparedness). Training is
completed on the http://irtsectraining.nih.gov site with valid
NIH credentials.

Describe training system users receive (above and
35 beyond general security and privacy awareness
training).

Role-based security and privacy training is assigned as required
by agency policy and direction by the system owner. Key staff
participate in a yearly Contingency Planning and Incident
Response (CP/IR) training.

Do contracts include Federal Acquisition Regulation
36 and other appropriate clauses ensuring adherence to
privacy provisions and practices?

Accept
Reject

Accept
Reject

Accept
Reject

Accept
Reject

Yes

Accept

No

Reject

Page 5 of 11

Save

Describe the process and guidelines in place with
37 regard to the retention and destruction of PII. Cite
specific records retention schedules.

Records are retained and disposed of under the authority of
the NIH Records Control Schedule Item 06-202 (DAAGRS-2017-0007-0002).
Workforce and succession planning records. Records about
workforce planning and analysis, including succession
planning, developed in support of executive-level and other
agency planning initiatives. Includes planning and analysis
models, planning data, briefing materials, studies and surveys,
and lists of functions and staff at key locations. Destroy 3 years
after issuing each new plan, but longer retention is authorized
if required for business use.

Accept
Reject

The contract's schedule for data retention is as follows "The
disposition to be made of the Privacy Act records upon
completion of task order performance is to post the data in
Lexical where it will be maintained for five years. The
contractor will ask for, receive, and clean the data for the next
administration."
Administrative Controls: Administrators control account
request and approval; annual trainings for cybersecurity
education and awareness, incident reporting (IR), and
contingency planning (CP); and annual review of the IR and CP
plans. Procedures for onboarding and terminating staff.

Describe, briefly but with specificity, how the PII will
38 be secured in the system using administrative,
technical, and physical controls.

Technical Controls: Access to the information is controlled by
role-based authentication. All servers have been configured to
remove all unused applications and system files and all local
account access except when necessary to manage the system
and maintain integrity of data.

Accept
Reject

Physical Controls: The servers reside in the contractor Westat’s
data center located in Rockville Maryland where policies,
systems and procedures are in place to restrict access to and
safeguard the data centers such as the use of magnetic key
cards by all staff to access buildings and diesel-powered
backup generators support the continuous operation of the
data centers in case of long-term utility power failures.

REVIEWER QUESTIONS: The following section contains Reviewer Questions which are not to be filled out unless the user is an OPDIV
Senior Officer for Privacy.

Reviewer Questions
1

Are the questions on the PIA answered correctly, accurately, and completely?

Answer
Yes

Accept

No

Reject

Yes

Accept

No

Reject

Reviewer
Notes
2

Does the PIA appropriately communicate the purpose of PII in the system and is the purpose
justified by appropriate legal authorities?

Reviewer
Notes

Page 6 of 11

Save
Reviewer Questions
3

Do system owners demonstrate appropriate understanding of the impact of the PII in the
system and provide sufficient oversight to employees and contractors?

Answer
Yes

Accept

No

Reject

Yes

Accept

No

Reject

Yes

Accept

No

Reject

Yes

Accept

No

Reject

Yes

Accept

No

Reject

Yes

Accept

No

Reject

Yes

Accept

No

Reject

Yes

Accept

No

Reject

Yes

Accept

No

Reject

Yes

Accept

No

Reject

Reviewer
Notes
4

Does the PIA appropriately describe the PII quality and integrity of the data?

Reviewer
Notes
5

Is this a candidate for PII minimization?

Reviewer
Notes
6

Does the PIA accurately identify data retention procedures and records retention schedules?

Reviewer
Notes
7

Are the individuals whose PII is in the system provided appropriate participation?

Reviewer
Notes
8

Does the PIA raise any concerns about the security of the PII?

Reviewer
Notes
9

Is applicability of the Privacy Act captured correctly and is a SORN published or does it need
to be?

Reviewer
Notes
10

Is the PII appropriately limited for use internally and with third parties?

Reviewer
Notes
11

Does the PIA demonstrate compliance with all Web privacy requirements?

Reviewer
Notes
12

Were any changes made to the system because of the completion of this PIA?

Reviewer
Notes

Page 7 of 11

Save

General Comments

Digitally signed by

OPDIV Senior Official
for Privacy Signature

Celeste E.
Celeste E. Dade-vinson -S
2022.05.18 14:16:24
Dade-vinson -S Date:
-04'00'

HHS Senior
Agency Official
for Privacy

Third-Party Website Assessment PIA Form
v 1.47.4
Status

Form Number

Read Only

Question

Form Date

Read Only

Answer

1

OPDIV:

Read Only - OPDIV

2

TPWA Unique Identifier (UID):

Read Only - TPWA UID

3

TPWA Name:

Read Only - TPWA Name

4

Is this a new TPWA?

Yes
No

4a Please provide the reason for revision

5

Will the use of a third-party Website or application
create a new or modify an existing HHS/OPDIV
System of Records Notice (SORN) under the Privacy
Act?

5a

Indicate the SORN number (or identify plans to put
one in place.)

6

7

Does the third-party Website or application contain
Federal Records?

Accept

No

Reject

Yes

Accept

No

Reject

Yes

Accept

No

Reject

SORN Number:
If not published:

Will the use of a third-party Website or application
create an information collection subject to OMB
clearance under the Paperwork Reduction Act (PRA)?

Indicate the OMB approval number and approval
6a number expiration date (or describe the plans to
obtain OMB clearance.)

Yes

OMB Approval Number
Expiration Date
Explanation

Page 8 of 11

Save
POC Title
POC Name
8

Point of Contact (POC):

Accept

POC Organization

Reject

POC Email
POC Phone
9

Accept

Describe the specific purpose for the OPDIV use of
the third-party Website or application:

Have the third-party privacy policies been reviewed
10 to evaluate any risks and to determine whether the
Website or application is appropriate for OPDIV use?
Describe alternative means by which the public can
obtain comparable information or services if they
11
choose not to use the third-party Website or
application:
Does the third-party Website or application have
12 appropriate branding to distinguish the OPDIV
activities from those of nongovernmental actors?
13

How does the public navigate to the third party
Website or application from the OPIDIV?

13a

Please describe how the public navigate to the thirdparty website or application:

If the public navigate to the third-party website or
application via an external hyperlink, is there an alert
13b
to notify the public that they are being directed to a
nongovernmental Website?
Has the OPDIV Privacy Policy been updated to
14 describe the use of a third-party Website or
application?

Reject
Yes

Accept

No

Reject
Accept
Reject

Yes

Accept

No

Reject
Accept
Reject

Yes
No
Yes

Accept

No

Reject

Yes

Accept

No

Reject

14a Provide a hyperlink to the OPDIV Privacy Policy:
15

Is an OPDIV Privacy Notice posted on the third-party
Website or application?

Confirm that the Privacy Notice contains all of the
following elements: (i) An explanation that the
Website or application is not government-owned or
government-operated; (ii) An indication of whether
and how the OPDIV will maintain, use, or share PII
15a that becomes available; (iii) An explanation that by
using the third-party Website or application to
communicate with the OPDIV, individuals may be
providing nongovernmental third-parties with access
to PII; (iv) A link to the official OPDIV Website; and (v)
A link to the OPDIV Privacy Policy
Is the OPDIV's Privacy Notice prominently displayed
at all locations on the third-party Website or
15b
application where the public might make PII
available?

Yes
No

Yes
No

Page 9 of 11

Save
16

Is PII collected by the OPDIV from the third-party
Website or application?

Yes

Accept

No

Reject

17

Will the third-party Website or application make PII
available to the OPDIV?

Yes

Accept

No

Reject

Describe the PII that will be collected by the OPDIV
from the third-party Website or application and/or
the PII which the public could make available to the
18
OPDIV through the use of the third-party Website or
application and the intended or expected use of the
PII:
Describe the type of PII from the third-party Website
or application that will be shared, with whom the PII
19
will be shared, and the purpose of the information
sharing:

Accept
Reject

Accept
Reject

19a

If PII is shared, how are the risks of sharing PII
mitigated?

20

Will the PII from the third-party Website or
application be maintained by the OPDIV?

20a

If PII will be maintained, indicate how long the PII will
be maintained:

21

Describe how PII that is used or maintained will be
secured:

Accept

22

What other privacy risks exist and how will they be
mitigated?

Accept

Yes

Accept

No

Reject

Reject
Reject

REVIEWER QUESTIONS: The following section contains Reviewer Questions which are not to be filled out unless the user is an OPDIV
Senior Officer for Privacy.

Reviewer Questions
1

Answer
Yes

Accept

No

Reject

Is the TPWA compliant with all M-10-23 requirements, including appropriate branding and
alerts?

Yes

Accept

No

Reject

Has the OPDIV posted an updated privacy notice on the TPWA and does it contain the five
required elements?

Yes

Accept

No

Reject

Are the responses accurate and complete?

Reviewer
Notes
2
Reviewer
Notes
3
Reviewer
Notes

Page 10 of 11

Save
REVIEWER QUESTIONS: The following section contains Reviewer Questions which are not to be filled out unless the user is an OPDIV
Senior Officer for Privacy.

4

Does the PIA clearly identify PII made available and/or collected by the TPWA?

Yes

Accept

No

Reject

Yes

Accept

No

Reject

Reviewer
Notes
5

Is the handling of PII appropriate?

Reviewer
Notes
General
Comments

OPDIV Senior Official
for Privacy Signature

HHS Senior
Agency Official
for Privacy

Page 11 of 11