Privacy Act; Notification of Intent to Establish a New Privacy Act System of Records; Disaster Information System (DIS)

AGENCY:

Office of the Chief Information Officer, HUD.

ACTION:

Notification of a New Privacy Act System of Records.

SUMMARY:

HUD proposes to establish a new record system to add to its inventory of systems of records subject to the Privacy Act of 1974 (5 U.S.C. 552a), as amended. The proposed new system of records is Disaster Information System (DIS). DIS will contain information on families who apply for and are determined by FEMA to be eligible to receive disaster housing assistance after a presidentially declared disaster. This record system will support the Disaster Housing Assistance Program (DHAP), which is a temporary rental housing assistance program established by an Interagency Agreement (IAA) between HUD and the U.S. Department of Homeland Security (DHS), Federal Emergency Management Agency (FEMA). DHAP will provide rent subsidies for HUD assisted individuals and families displaced by a presidentially declared disaster.

DATES:

Effective Date: This action shall be effective without further notice on September 17, 2009 unless comments are received that would result in a contrary determination.

Comments Due Date: September 17, 2009.

ADDRESSES:

Interested persons are invited to submit comments regarding this notice to the Rules Docket Clerk, Office of General Counsel, Department of Housing and Urban Development, 451 Seventh Street, SW., Washington, Room 10276, DC 20410. Communications should refer to the above docket number and title. A copy of each communication submitted will be available for public inspection and copying between 8 a.m. and 5 p.m. weekdays at the above address.

FOR FURTHER INFORMATION CONTACT:

For Privacy Act Inquiries: Office of the Chief Information Officer, contact Donna Robinson-Staton, Departmental Privacy Act Officer, Department of Housing and Urban Development, 451 Seventh Street, SW., Room 2256, Washington, DC 20410, Telephone Number (202) 402-8073. For program information: Jerry Armstrong, IT Division Director for Public and Indian Housing Information Management, Potomac Center, 550 Twelfth Street, SW., First Floor, Washington, DC 20410, Telephone Number, (202) 475-8742 or Dudley Ives, DIS Information Technology Manager, Potomac Center, 550 Twelfth Street, First Floor, SW., Washington, DC 20410, Telephone Number, (202) 475-8603. (These are not toll-free numbers.) A telecommunication device for hearing- and speech-impaired individuals (TTY) is available at 1-800-877-8339 (Federal Information Relay Service).

SUPPLEMENTARY INFORMATION:

Pursuant to the Privacy Act of 1974 (5 U.S.C. 552a), as amended, this notice is HUD's notification of its intent to establish a new system of records for its DIS. Title 5 U.S.C. 552a(e)(4) and (11) provide that the public be afforded a 30-day period in which to comment on the system of records, and require published notice of the existence and character of the system of records. The system report was submitted to the Office of Management and Budget (OMB), the Senate Committee on Governmental Affairs, and the House Committee on Government Reform pursuant to paragraph 4c of Appendix 1 to OMB Circular No. A-130, “Federal Agency Responsibilities for Maintaining Records About Individuals,” July 25, 1994; 59 FR 37914.

Authority: 5 U.S.C. 552a, 88 Stat. 1896; 42 U.S.C. 3535(d).

HUD/PIH-07

SYSTEM NAME:

Disaster Information System (DIS).

SYSTEM LOCATION:

DIS system servers are located in Charleston, WV; and access is enabled via a web application interface. The servers are maintained by HUD Information Technology Services (HITS) contractor, and HUD's information technology partners: Electronic Data Services (EDS) and Lockheed Martin.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

Families determined to be eligible for the disaster housing assistance program, which is administered by the Department of Housing and Urban Development and Public Housing Authorities.

CATEGORIES OF RECORDS IN THE SYSTEM:

Records consist of family composition details, income, and rent data obtained from FEMA and PHAs. More specifically, the system of records contains information such as names and social security numbers for individuals and family members; alien registration information; address and tenant unit numbers; financial data such as income, adjustments to income, tenant family composition characteristics such as family size, sex of family members, information about the family that would qualify them for certain adjustments or for admission to a project limited to a special population (e.g., elderly, handicapped, or disabled); relationships of members of the household to the head of household (e.g., spouse, child); preferences applicable to the family at admission; income status at admission; race and ethnicity of household members; unit characteristics such as number of bedrooms; geographic data obtained by the PHA.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

The Housing and Community Development Act of 1987 (42 U.S.C. 3543) and the Robert T. Stafford Disaster Relief and Emergency Assistance Act (42 U.S.C. 5133).

PURPOSE:

An applicant completes, or a FEMA representative assists in filling out, an application that determines an applicant's eligibility for disaster housing assistance. FEMA then completes the disaster housing application and validation process for determining a family's eligibility to receive disaster housing assistance. Under the Disaster Housing Assistance Program (DHAP), when an individual or family is determined by FEMA to be eligible, the required family and household data is then submitted to the HUD DIS. Once received, HUD will initiate the process for the Public Housing Agencies (PHA), the entities that administer DHAP to provide the housing assistance to the FEMA-determined eligible families. The following information is required by the disaster housing assistance program: (1) Names of all persons who will be living in the unit, social security numbers, their sex, date of birth, citizenship, and relationship to the family head; (2) FEMA disaster and registration number (3) Pre-disaster and current address and telephone numbers; (4) Family housing characteristics (e.g., number of bedrooms) or disability accommodation requirements; (5) Names, addresses, and taxpayer identification number for current landlords; and (6) rental payments and utility costs. DIS also allows PHAs to electronically submit information to HUD that is related to the administration of DHAP, including continued verification of eligibility and lease effective and end dates. It collects data for DHAP operations and provides capabilities for accurately tracking, monitoring, and reporting program activities and processes.

Additionally, as part of HUD's oversight responsibility, the collected data maintained in DIS is used to calculate the amount of subsidy authorized and disbursed to PHAs and to monitor the PHAs' overall performance and use of DHAP funds.

DIS is a flexible, scalable, web-enabled application that aids HUD and PHA staff to administer the disaster housing assistance program by: (a) Increasing the efficiency of delivering housing assistance benefits to disaster victims; (b) Detecting and resolving program eligibility problems; (c) Evaluating program effectiveness; (d) Improving program reporting; and (e) Eliminating the payment of duplicate disaster benefits. Records in DIS are subject to use in authorized and approved computer matching programs regulated under the Privacy Act of 1974, as amended.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND PURPOSES OF SUCH USES:

In addition to the uses cited in the section of this document titled “Purposes”, other routine uses may include:

1. To PHAs to verify the accuracy and completeness of tenant data used in verifying continued eligibility and the amount of disaster housing assistance. Any information shared back to the PHAs will pertain only to that PHA's operations and no other PHA's operations;

2. To PHAs to identify and resolve discrepancies in tenant data;

3. To the Department of Homeland Security (DHS), Federal Emergency Management Agency (FEMA) to identify duplicate rental housing assistance applicants and provide DHAP eligible family data updates and reports;

4. To the U.S. Department of Health and Human Services and U.S. Social Security Administration for computer matching to verify the accuracy and completeness of the data provided, to verify continued eligibility in DHAP, and to aid in the identification of family data error, fraud, and abuse in DHAP through HUD's income computer matching program;

5. To the Immigration and Naturalization Service for alien status verification;

6. To HUD or individuals under contract, grant or cooperative agreement to HUD to monitor PHA efforts and compliance requirements, facilitate technical assistance and for research and evaluation of national program outcomes; and

7. To individuals under contract to HUD or under contract to another agency with funds provided by HUD—for the preparation of studies and statistical reports directly related to the management of DHAP.

8. To the Office of Policy, Development and Research and future researchers selected by HUD to carry out the objectives of HUD's DHAP in aggregate form without individual identifiers—name, address, social security number— for the performance of research and statistical activities of the DHAP; and

9. Additional Disclosure for Purposes of Facilitating Responses and Remediation Efforts in the Event of a Data Breach. A record from a system of records maintained by this Department may be disclosed to appropriate agencies, entities, and persons when:

a. the Department suspects or has confirmed that the security or confidentiality of information in a system of records has been compromised;

b. the Department has determined that as a result of the suspected or confirmed compromise there is a risk of harm to economic or property interests, identity theft or fraud, or harm to the security or integrity of systems or programs (whether maintained by the Department or another agency or entity) that rely upon the compromised information; and,

c. the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with the Department's efforts to respond to the suspected or confirmed compromise and prevent, minimize, or remedy such harm.

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING, AND DISPOSING OF RECORDS IN THE SYSTEM:

STORAGE:

Records are stored manually in family case files in the PHAs and electronically in office automation equipment. Records are stored on HUD computer servers for access by headquarters and field offices, and by the public housing agencies via a web application interface. All of the DIS data is stored on HUD's servers. The disk and backup files are maintained by HUD's information technology partners—Electronic Data Services (EDS) and Lockheed Martin. The original (hard copy) files are stored in the originating PHA.

Irretrievability: Records are retrieved by an individual's SSN.

Safeguards: These are the measures used to protect the records from unauthorized access or disclosure:

1. The REAC-IT Web Access Secure SubSystem (WASS) provides audit logging for all system access via WASS's authentication of all users.

2. WASS provides authentication methods that meet National Institutes of Standards and Technology (NIST) requirements. Every user has a WASS ID and is authenticated via WASS.

3. The Inventory Management System (IMS) maintains a record of each DIS user's logons, logoffs, and logoff exceptions if any.

4. For each user, IMS system logs the number requests for web pages containing privacy data. The number of page view requests is tracked per page per session. The first and last timestamp of access for every privacy page is also recorded per session.

5. IMS system archives the user privileges data when a user is removed from the system or when the unmasked privacy data viewing privileges are modified.

6. Hard copy records are stored in lock file cabinets in rooms to which access is limited to those personnel who service the records.

7. Background screening, limited authorization and access with access limited to authorize personnel.

8. Prior to user modification and storing, DHAP makes an archive copy of the record. As it is a safeguard for retaining the original record.

RETENTION AND DISPOSAL:

Electronic records are maintained and destroyed according to the HUD Records Disposition Schedule 2225.6. Records are maintained for a period of three years.

SYSTEM MANAGERS(s) AND ADDRESSES:

Jerry Armstrong, IT Division Director for Public and Indian Housing Information Management, Potomac Center, 550 Twelfth Street, SW., First Floor, Washington, DC 20410, Telephone Number, (202) 475-8742 or Dudley Ives, DIS Information Technology Manager, Potomac Center, 550 Twelfth Street, First Floor, SW., Washington, DC 20410, Telephone Number, (202) 475-8603.

NOTIFICATION PROCEDURES:

For information, assistance, or inquiry about the existence of records, contact the Privacy Act Officer at the Department of Housing and Urban Development, 451 Seventh Street, SW., Room 2256, Washington, DC 20715. Written requests for access can establish proof of identity by a notarized statement or equivalent.

CONTESTING RECORD PROCEDURES:

Procedures for the amendment or correction of records and for applicants wanting to appeal initial agency determination appear in 24 CFR part 16. The disaster related information reported in DIS originates from the FEMA. If a participant of HUD's Disaster Housing Assistance Program disputes this information, he or she should contact FEMA directly or in writing to dispute erroneous information by fax ((800) 827-8112) or by mail (Post Office Box 10055, Hyattsville, Maryland 20782-7055).

RECORD SOURCE CATEGORIES:

DIS receives data from DHS/FEMA and HUD headquarters and field office staff. Public Housing Agencies (PHAs) routinely collect personal and income data from participants in and applicants for the Disaster Housing Assistance Program.

EXEMPTIONS FROM CERTAIN PROVISIONS OF THE ACT:

None.