Pia

Save

Privacy Impact Assessment Form
v 1.21
Status

Form Number

Form Date

Question

Answer

1

OPDIV:

CDC

2

PIA Unique Identifier:

TBD

2a Name:

03/05/25

TIC Surveillance
General Support System (GSS)
Major Application

3

Minor Application (stand-alone)

The subject of this PIA is which of the following?

Minor Application (child)
Electronic Information Collection
Unknown

3a

Identify the Enterprise Performance Lifecycle Phase
of the system.

Initiation
Yes

3b Is this a FISMA-Reportable system?

4

Does the system include a Website or online
application available to and for the use of the general
public?

5

Identify the operator.

6

Point of Contact (POC):

7

Is this a new or existing system?

8

Does the system have Security Authorization (SA)?

No
Yes
No
Agency
Contractor
POC Title

Health Scientist

POC Name

Rebecca (Becky) Bitsko, PhD

POC Organization NCBDDD, Division of Human Dev
POC Email

dvk2@cdc.gov

POC Phone

404-498-3556
New
Existing
Yes
No

8b Planned Date of Security Authorization
Not Applicable

Page 1 of 10

Save

8c

Briefly explain why security authorization is not
required

Because the data is collected through a Cooperative
Agreement (CoAg), security authorization requirements do not
apply. Grantees will be using their own Research Electronic
Data Capture (REDCap) instance to collect the data and are
responsible for safeguarding the data collected.

10

Describe in further detail any changes to the system
that have occurred since the last PIA.

N/A

11 Describe the purpose of the system.

The purpose of this project is to conduct data collection on the
public health impact of Persistent Tic Disorders (PTD) including
Tourette syndrome (TS) among diverse populations of children,
adolescents, and young adults (i.e., aged 4 to 26 years)
identified in clinical settings. Individuals with PTD/TS and
caregivers of children and adolescents with PTD/TS will
complete an electronic survey using REDCap. A short clinical
assessment will be conducted and will be linked to the survey
data. Data will be collected at four sites and shared with CDC
through CDC's Secure Access Management System (SAMS).
CDC will combine the data into a single data set and will share
with the sites using SAMS.
NOTE: The questionnaire and data dictionary will be created
by CDC staff in REDCap and provided to the four CoAg sites to
be collected using the four sites REDCap platform, NOT the
CDC REDCap platform).
Demographic characteristics: age, birthdate, sex, race/
ethnicity, sexual orientation, disability status, parent/adult
education level, health insurance status/type of insurance,
household income, marital status of parent/adult, address
Clinical assessment of tics and impairment
Report of previous diagnoses of select mental disorders,
neurodevelopmental disorders, physical health conditions
Report of symptoms of anxiety, depression

Describe the type of information the system will
Healthcare use, transition of healthcare from pediatric to adult
collect, maintain (store), or share. (Subsequent
12
questions will identify if this information is PII and ask care, costs associated with healthcare, barriers to receiving
healthcare including costs
about the specific data elements.)
Suicidality (ideation and attempts), follow-up assessment if any
items endorsed
Employment, impacts of tic disorder on employment
Medications and behavioral treatments received for TIC and
mental disorders
Electronic Medical Records (EMR) data (date of birth, insurance
status, co-occurring disorders, TBD)

Page 2 of 10

Save
The tic surveillance system is designed to collect data on a
diverse population of children, adolescents, and young adults
(i.e., aged 4 to 26 years) with persistent tic disorders (PTD) and
Tourette syndrome (TS) identified in clinical settings. The data
will be used to inform education and outreach activities to
improve the health and well-being of individuals with PTD/TS.
Data elements collected include, demographic characteristics:
age, birthdate, sex, race/ethnicity, sexual orientation, disability
status, parent/adult education level, health insurance status/
type of insurance, household income, name, marital status of
parent/adult, address.
Clinical assessment of tics and impairment
Report of previous diagnoses of select mental disorders,
neurodevelopmental disorders, physical health conditions
Provide an overview of the system and describe the
13 information it will collect, maintain (store), or share,
either permanently or temporarily.

Report of symptoms of anxiety, depression
Healthcare use, transition of healthcare from pediatric to adult
care, costs associated with healthcare, barriers to receiving
healthcare including costs
Suicidality (ideation and attempts), follow-up assessment if any
items endorsed
Employment, impacts of tic disorder on employment
Medications and behavioral treatments received for TIC and
mental disorders
EMR data (date of birth, insurance status, co-occurring
disorders, TBD)
Data will be collected and managed using an externally hosted
REDCap platform; data will be shared with CDC via CDC Secure
Access Management System (SAMS).

14 Does the system collect, maintain, use or share PII?

Yes
No

Page 3 of 10

Save

Indicate the type of PII that the system will collect or
15
maintain.

Social Security Number

Date of Birth

Name

Photographic Identifiers

Driver's License Number

Biometric Identifiers

Mother's Maiden Name

Vehicle Identifiers

E-Mail Address

Mailing Address

Phone Numbers

Medical Records Number

Medical Notes

Financial Account Info

Certificates

Legal Documents

Education Records

Device Identifiers

Military Status

Employment Status

Foreign Activities

Passport Number

Taxpayer ID
Age; clinical assessment of
TICS and imparment

Sex/sexual orientation

Race/Ethnicity
Parent/adult education level;
Marital status of parent/
adult
Disability status; Health
insurance status/type of
insurance; household
income

Employees
Public Citizens
16

Business Partners/Contacts (Federal, state, local agencies)

Indicate the categories of individuals about whom PII
is collected, maintained or shared.

Vendors/Suppliers/Contractors
Patients
Other Diverse populations of children, adolescents, and
young adults p(i.e., aged 4 to 26 years) identified in

17 How many individuals' PII is in the system?

18 For what primary purpose is the PII used?

19

Describe the secondary uses for which the PII will be
used (e.g. testing, training or research)

500-4,999
-Date of birth is used to calculate participant age at the time
developmental assessments are administered.
-Address will be used for linking to census tract data.
-Name will be used for linking to the respondents' survey
information.
Geocoding and linkage

20 Describe the function of the SSN.

N/A; SSN is NOT being collected

20a Cite the legal authority to use the SSN.

N/A

21

Identify legal authorities governing information use Sections 301(a) and 317C of the Public Health Service Act, [42
and disclosure specific to the system and program.
U.S.C. Sections 241(a) and 247b-4, as amended]

Page 4 of 10

Save
22

Yes

Are records on the system retrieved by one or more
PII data elements?

No
Published:

Identify the number and title of the Privacy Act
System of Records Notice (SORN) that is being used
22a
to cover the system or identify if a SORN is being
developed.

Published:
Published:
In Progress
Directly from an individual about whom the
information pertains
In-Person
Hard Copy: Mail/Fax
Email
Online
Other
Government Sources

23

Within the OPDIV
Other HHS OPDIV
State/Local/Tribal
Foreign
Other Federal Entities
Other

Identify the sources of PII in the system.

Non-Government Sources
Members of the Public
Commercial Data Broker
Public Media/Internet
Private Sector
Other
23a

Identify the OMB information collection approval
number and expiration date.

24 Is the PII shared with other organizations?

In process.
Yes
No
Within HHS

Identify with whom the PII is shared or disclosed and
24a
for what purpose.

Other Federal
Agency/Agencies
State or Local
Agency/Agencies
Private Sector

Describe any agreements in place that authorizes the
information sharing or disclosure (e.g. Computer
24b Matching Agreement, Memorandum of
Understanding (MOU), or Information Sharing
Agreement (ISA)).

Page 5 of 10

Save
24c

Describe the procedures for accounting for
disclosures

Describe the process in place to notify individuals
25 that their personal information will be collected. If
no prior notice is given, explain the reason.

26

Is the submission of PII by individuals voluntary or
mandatory?

Participants will receive an information Sheet about the project
that includes the following text:
On the survey, we ask for your email address if you are
interested in receiving project updates in the future. You may
decline to be re-contacted now or at any time in the future.
All of the answers you provide will be kept private to the extent
allowed under federal laws [Privacy Act of 1974 (5 U.S.C. §
552a)]. These laws do not prevent the project staff from
reporting information needed for evaluating or auditing the
project.
We will assign your survey a number. Only certain project staff
will have access to your name and address information. None
of your (or your child’s) answers to survey questions will be
linked to your names or address. If you choose to provide your
email address on the survey, we will store your email address
separately from the rest of your survey responses. In reports,
your answers will be combined with the answers from
everyone else that took part in the survey.
All the completed surveys and clinical information will be
stored on a secure, password-protected server with limited
access by the project staff.
Voluntary
Mandatory

Describe the method for individuals to opt-out of the
collection or use of their PII. If there is no option to
27
object to the information collection, provide a
reason.

Participants may opt out by not completing the survey or by
contacting the project staff to indicate they wish to withdraw
from the survey/project. They are also told that they can skip
individual questions.

Describe the process to notify and obtain consent
from the individuals whose PII is in the system when
major changes occur to the system (e.g., disclosure
28 and/or data uses have changed since the notice at
the time of original collection). Alternatively, describe
why they cannot be notified or have their consent
obtained.

Participants will be contacted by Email, Phone, letter via Postal
Service Mail by the site Principal Investigators (PIs) using the
information in the REDCap database or information used for
initial recruitment, if there are major changes in the system to
how their Personally Identifiable Information (PII) has been
obtained.

Describe the process in place to resolve an
individual's concerns when they believe their PII has
29 been inappropriately obtained, used, or disclosed, or
that the PII is inaccurate. If no process exists, explain
why not.

Potential and participating individuals who have concerns
about the use/misuse/inaccuracy of their PII can contact their
local clinics project staff at the study site or study PI contact
information printed on the survey information sheet; and
request for their information to be corrected or withdrawn.
Participants in the study can request to be removed from the
study and have their PII removed/destroyed at any point.

Page 6 of 10

Save

Describe the process in place for periodic reviews of
PII contained in the system to ensure the data's
30
integrity, availability, accuracy and relevancy. If no
processes are in place, explain why not.

Address data will be reviewed annually as it is linked to census
tract data through Geospatial Research, Analysis, and Services
Program (GRASP). CDC will provide technical assistance to the
sites for data cleaning queries, including removal of PII
including date of birth, and review of open text fields. Sites will
be instructed to review these data for integrity, availability,
accuracy, and relevancy prior to removing from the shared
dataset. CDC will conduct data cleaning utilizing queries and
data analysis tools, as well as reviewing all data including PII for
integrity, availability, accuracy, and relevancy every 6 months.
GRASP will further review address data and provide feedback
on the accuracy of the data.
Users

CDC TIC Surveillance staff and grantees
perform data cleaning and removal.

Administrators
31

Identify who will have access to the PII in the system
and the reason why they require access.

Developers
Contractors

CDC TIC Surveillance staff and
grantees perform data cleaning and
Role-base Access Controls (RBAC) are in place to ensure the
Describe the procedures in place to determine which concept of "least privilege" is implemented for functional as
32 system users (administrators, developers,
well as security purposes. Information displayed to a particular
contractors, etc.) may access PII.
role is limited to necessary “need to know” information based
on a specific role’s required tasks throughout the study.
Others

Describe the methods in place to allow those with
33 access to PII to only access the minimum amount of
information necessary to perform their job.

CDC data manager and grantees will be provided access to log
into database modules containing PII only as necessary to
complete their job function. For those authorized, gaining
access will require secure login with password and user
credentials.

Identify training and awareness provided to
personnel (system owners, managers, operators,
contractors and/or program managers) using the
34
system to make them aware of their responsibilities
for protecting the information being collected and
maintained.

All personnel collecting and working with data will receive
confidentiality training, annually.

Describe training system users receive (above and
35 beyond general security and privacy awareness
training).

In addition to general security and privacy awareness, system
users receive confidentiality training specific to the tic
surveillance project. This training covers, but is not limited to,
the following areas of concern: restrictions on use of
information, enhanced protection of computerized files as part
of study implementation, dissemination of research results,
data sharing with other study partners, analytic data access
policies and procedures, instructions concerning
confidentiality procedures, procedures for traveling with
confidential study materials, loss of study materials containing
confidential data. In addition, personnel in specific roles
receive training and awareness related to those roles as
needed, e.g., computer system administrators and other IT
personnel receive training on computer system security,
annually.

Page 7 of 10

Save
Do contracts include Federal Acquisition Regulation
36 and other appropriate clauses ensuring adherence to
privacy provisions and practices?

Yes
No
Records are retained and disposed in accordance with the
Scientific and Research Project Records Control Schedule
NC1-90-78-1, Item 60.

Describe the process and guidelines in place with
37 regard to the retention and destruction of PII. Cite
specific records retention schedules.

At the end of the Tic surveillance project, the PII will be
retained to enable future contact with the participants. At the
conclusion of the overall project, all PII will be retained by CDC
for one year as per the CDC Scientific and Research Project
Records Control Schedule. The study period is defined to
include data analysis and publication. The end of the study
period will be considered to be 1 year after the final
manuscript from a tic surveillance data analysis is submitted for
publication. No identifiable information will be retained or
transferred to the National Archives.
Credentials are maintained in a separate system (e.g., Active
Directory, CDC SAMS) and not collected or maintained by this
system. The systems providing credentials is [REDCap and
SAMS].
Administrative Controls:
Include file back-up, encryption, least privilege, and training.

Describe, briefly but with specificity, how the PII will
38 be secured in the system using administrative,
technical, and physical controls.

Technical controls:
Grantees and CDC will utilize approval procedures that will
require all users of the data to request Role-based Access
Control (RBAC) and obtain approval from the individual(s) that
are managing access and transmitting the data. The users'
credential will be encrypted at the database level.
Physical Controls:
include ID Badges, Key Cards, and Closed Circuit TV (CCTV) for
servers. Computers are password protected, and if paper
documents are collected at the grantee site, the documents
will be stored in a secure/locked storage cabinet.

REVIEWER QUESTIONS: The following section contains Reviewer Questions which are not to be filled out unless the user is an OPDIV
Senior Officer for Privacy.

Reviewer Questions
1

Are the questions on the PIA answered correctly, accurately, and completely?

Answer
Yes
No

Reviewer
Notes
2

Does the PIA appropriately communicate the purpose of PII in the system and is the purpose
justified by appropriate legal authorities?

Yes
No

Reviewer
Notes

Page 8 of 10

Save
Reviewer Questions
3

Do system owners demonstrate appropriate understanding of the impact of the PII in the
system and provide sufficient oversight to employees and contractors?

Answer
Yes
No

Reviewer
Notes
4

Does the PIA appropriately describe the PII quality and integrity of the data?

Yes
No

Reviewer
Notes
5

Is this a candidate for PII minimization?

Yes
No

Reviewer
Notes
6

Does the PIA accurately identify data retention procedures and records retention schedules?

Yes
No

Reviewer
Notes
7

Are the individuals whose PII is in the system provided appropriate participation?

Yes
No

Reviewer
Notes
8

Does the PIA raise any concerns about the security of the PII?

Yes
No

Reviewer
Notes
9

Is applicability of the Privacy Act captured correctly and is a SORN published or does it need
to be?

Yes
No

Reviewer
Notes
10

Is the PII appropriately limited for use internally and with third parties?

Yes
No

Reviewer
Notes
11

Does the PIA demonstrate compliance with all Web privacy requirements?

Yes
No

Reviewer
Notes
12

Were any changes made to the system because of the completion of this PIA?

Yes
No

Reviewer
Notes

Page 9 of 10

Save

General Comments

OPDIV Senior Official
for Privacy Signature

Jarell
Oshodi -S

Digitally signed by Jarell
HHS Senior
Oshodi -S
Agency Official
Date: 2025.03.27
for Privacy
10:39:11 -04'00'

Page 10 of 10