Enterprise Privacy Policy Engine Cloud

OPDIV:

CMS

PIA Unique Identifier:

P-4766593-542686

Name:

Enterprise Privacy Policy Engine Cloud

The subject of this PIA is which of the following?

Major Application

Identify the Enterprise Performance Lifecycle Phase of the system.

Operate

Is this a FISMA-Reportable system?

Yes

Does the system include a Website or online application available to and for the use of the general public?

Yes

Identify the operator:

Contractor

Is this a new or existing system?

New

Does the system have Security Authorization (SA)?

No

Planned Date of Authorization

7/1/2023

Describe the type of information the system will collect, maintain (store), or share. (Subsequent questions will identify if this information is PII and ask about the specific data elements)

EPPEC collects name, address, phone number, email address, CMS User Enterprise Identity Management (EIDM) ID, Enterprise User Agreement (EUA) ID for those that are entering into a DUA with CMS or those who are overseeing a Data Use Agreement as a CMS employee.

No financial data is collected by EPPEC.

EPPEC collects name, address, phone number, email address and CMS User ID and password for those that are entering into a DUA with CMS or those who are overseeing a Data Use Agreement as a CMS employee. This information is required in order to grant the requested DUA.

Prior to disclosing PII data, CMS policy requires the requestor to submit a formal request for data that CMS must approve. The formal request consists of completing a DUA. The DUA includes the following information: requestor name, email address, phone number, mailing address. EPPEC Complies with the Federal Information Security Management Act (FISMA) by ensuring that the data is properly protected at all times.

Does the system collect, maintain, use or share PII?

Yes

Indicate the type of PII that the system will collect or maintain.

• Name

• E-Mail Address
• Phone Numbers
• Mailing Address
• Other - User ID and password

Indicate the categories of individuals about whom PII is collected, maintained or shared.

• Employees

• Business Partners/Contacts (Federal, state, local agencies)
• Vendors/Suppliers/Contractors
• Other - Research organization staff/personnel

How many individuals' PII in the system?

50,000-99,999

For what primary purpose is the PII used?

The PII data in EPPEC is used to track disclosures of CMS PII data through Data Use Agreements.  The PII data that is collected is contact information of the data user that receives the data, as well as, the CMS employee and contractor data authorizer that approves the disclosure.

Cite the legal authority to use the SSN.

n/a

Are records on the system retrieved by one or more PII data elements?

Yes

Identify the number and title of the Privacy Act System of Records (SORN) that is being used to cover the system or identify if a SORN is being developed.

HHS SORN: Records About Restricted Dataset Requestors, 09-90-1401

Identify the sources of PII in the system: Directly from an individual about whom the information pertains

• In-Person

• Online

• Hard Copy

• Email

Identify the sources of PII in the system: Government Sources

• Within the OPDIV

• Other HHS OPDIV
• State/Local/Tribal
• Other Federal Entities

Identify the sources of PII in the system: Non-Government Sources

• Commercial Data Broker

• Private Sector
• Other - Research organization staff/personnel

Is the PII shared with other organizations?

No

Before users are allowed to logon to EPPEC, they are required to select "I agree to the Terms & Conditions". This "I agree to the Terms & Conditions" button notifies the user of the following:

OMB No.0938-1236 | Expiration Date: 08/31/2025 | Paperwork Reduction Act Updated Departmental Standard Warning Banner for HHS Information Systems, Memo dated July 14, 2016. This warning banner provides privacy and security notices consistent with applicable federal laws, directives, and other federal guidance for accessing this Government system, which includes (1) this computer network, (2) all computers connected to this network, and (3) all devices and storage media attached to this network or to a computer on this network. 

This information system is provided for Government-authorized use only. Unauthorized or improper use of this system is prohibited and may result in disciplinary action and/or civil and criminal penalties.
 

Personal use of social media and networking sites on this system is limited as to not interfere with official work duties and is subject to monitoring. By using this system, you understand and consent to the following: The Government may monitor, record, and audit your usage, including usage of personal devices and email systems for official duties or to conduct HHS business. Therefore, you have no reasonable expectation of privacy regarding any communication or data transiting or stored on this system. At any time, and for any lawful Government purpose, the government may monitor, intercept, and search and seize any communication or data transiting or stored on this system.
 

Any communication or data transiting or stored on this system may be disclosed or used for any lawful Government purpose.

Is the submission of the PII by individuals voluntary or mandatory?

Voluntary

Describe the method for individuals to opt-out of the collection or use of their PII. If there is no option to object to the information collection, provide a reason.

Individuals do not have the choice to opt-out of the use or collection of their PII. There is no method for users to opt-out in the EPPEC system. Users are not allowed to log on and gain access to the system if they do not select the "I agree" button (to agree to terms) when signing on. The data in this system is based on the application’s business need for storing them in EPPEC system and is covered by the application’s SORN.

Describe the process to notify and obtain consent from the individuals whose PII is in the system when major changes occur to the system (e.g., disclosure and/or data uses have changes since the notice at the time of original collection). Alternatively, describe why they cannot be notified or have their consent obtained.

Individuals whose PII is in EPPEC are notified via individual emails if major changes were to occur in the system that change the use and/or disclosure of the PII.  

Describe the process in place to resolve an individual's concerns when they believe their PII has been inappropriately obtained, used, or disclosed, or that the PII is inaccurate. If no process exists, explain why not.

We would work with the EPPEC Chief Information Security Office (CISO) immediately if a user's PII is obtained, used or disclosed inappropriately. In the event that a user's PII has been obtained, used or disclosed inappropriately, the EPPEC team will notify the Security Officer or Director of Operations to report the incident to CMS within 1 hour. A notification will go out to the CMS Contracting Officer and the CMS IT Service Desk at 410-786-2580, 800-562-1963 or CMS_IT_Service-Desk@cms.hhs.gov. 

Any individual who has concerns should contact CMS through the Office for Civil Rights (OCR), which can be done by visiting https://www.hhs.gov/hipaa/filing-a-complaint/. Information about the ability to file a complaint is available at this same address. In the event that the Internet is not accessible, and you have questions about this topic, CMS can be reached by phone at 1-800-MEDICARE (1-800-633-4227). When calling, ask to speak to a customer support rep about Medicare’s Privacy Notice. TTY users may call 1-800-486-2048. Individuals who wish to file a complaint directly without access to the Internet may directly call OCR at 1-800-368-1019. TTY users may call 1-800-537-7697 to file their complaints.

Describe the process in place for periodic reviews of PII contained in the system to ensure the data's integrity, availability, accuracy and relevancy. If no processes are in place, explain why not.

Only authenticated CMS employee or contract support users of EPPEC are able to modify or destroy the PII within EPPEC. The EPPEC system has back up servers to ensure PII/requestor contact information is readily available. A yearly review process has been implemented where data users ensure that their DUA contact information is valid and accurate. Any outdated, unnecessary, irrelevant, and/or inaccurate PII is removed from the system during the annual review if not at the time of the contact information change such as an organization change, etc.

There’s periodic review of DUA data by (OEDA) Management team.  The team is in charge of validating inaccurate information to ensure accuracy of information.  EPPEC has a process for archiving and extending the DUA.

EPPEC has implemented segregation of roles based on the principle of least privilege. Only a few designated Administrators have access to the database.

Data is encrypted at rest and in transit thus ensuring data integrity. 

There are nightly and weekly system backups thus ensuring availability of data at all times. Old information is archived.

Identify who will have access to the PII in the system and the reason why they require access.

• Users: Needed in order to process data use agreement (DUA).  

• Administrators: Direct Contractors who access the system using CMS credentials. Access is needed to process data use agreements (DUA).
• Developers: Direct Contractors who access the system using CMS credentials. Access is needed in order to support back end system.
• Contractors: Direct Contractors who access the system using CMS credentials. Access is needed to process data use agreement (DUA).

Describe the methods in place to allow those with access to PII to only access the minimum amount of information necessary to perform their job.

User Roles have been created within the system that limit access to PII within the system based on a "need to know" basis.  A review of the roles and their access are conducted bi-weekly, monthly, and yearly to ensure that only the minimum PII necessary is accessed per job role.

Identifying training and awareness provided to personnel (system owners, managers, operators, contractors and/or program managers) using the system to make them aware of their responsibilities for protecting the information being collected and maintained.

All CMS users are required to take annual CMS Information Security and Privacy training that make them aware of these responsibilities.  External stakeholders agree to the CMS terms of use when accessing CMS systems via the Enterprise Portal and are obligated to provide appropriate training at the organizational level to be compliant.  

Describe training system users receive (above and beyond general security and privacy awareness training)

Any users that have specialized roles within CMS (executives, managers, ISSOs, database administrators, etc.) take role-based privacy and security training in accordance with the Federal Information Security Management Act (FISMA) of 2002 and 5 CFR 930, "Information Security Responsibilities for Employees Who Manage or Use Federal Information Systems."

Do contracts include Federal Acquisition Regulation and other appropriate clauses ensuring adherence to privacy provisions and practices?

Yes

Describe the process and guidelines in place with regard to the retention and destruction of PII. Cite specific records retention schedules.

EPPEC records will be held temporarily. They will be deleted when the related master file or database has been deleted per Disposition Authority: NARA’s General Record Schedule 3.1, Item 012 - Information technology development project
records: Special purpose computer programs and applications. Additionally, DUAs are required to be retained for 5 years after they are closed by the data user (Disposition Authority: N1-440-10-4, Item 1b).

Describe, briefly but with specificity, how the PII will be secured in the system using administrative, technical, and physical controls.

The PII within EPPEC is secured in the following ways:
 - Administrative controls include using IDM to create 
user credentials; and implementation of role-based 
access that restricts the activities of users to specific 
functions.
 - The technical controls include firewalls that prevent 
unauthorized access to the system, encrypted access 
to the application, anti-virus, and intrusion detection and 
prevention systems.
Note: EPPEC is hosted within AWS/batCAVE.

Does the website have a posted privacy notice?

Yes

Is the privacy policy available in a machine-readable format?

Yes

Does the website use web measurement and customization technology?

No

Does the website have any information or pages directed at children under the age of thirteen?

No

Does the website contain links to non-federal government website external to HHS?

No