Privacy Impact Assessment for the Claims Office Master Files
On this page:
- I. Data in the System
- II. Access to the Data
- III. Attributes of the Data
- IV. Maintenance of Administrative Controls
I. Data in the System
-
Generally describe what data/information will be collected in the system.
The data in the automated system include limited summary information about an individual's or company's debt with EPA, an individual's or company's claim against the EPA in tort, or an EPA employee's child support or commercial garnishment information. The garnishment module contains the amount of the garnishment and the payroll deduction. The Federal Claims Collection module contains the amount of the debt owed to EPA.
-
What are the sources and types of the information in the system?
The detailed sources of information remain in hard copy form. Hard copy files may include court orders relating to garnishments, payroll information, leave information, police reports on automobile accidents, medical and doctor's information related to personal injury claims, the amount of the claim. The automated system includes summarized information such as an individual's or EPA employee's name as the claimant or garnishee, the date of the claim, the type of garnishment, the amount of the payroll deduction for a garnishment, the amount of the debt owed to EPA, the amount of a tort claim against EPA or the amount of a request for a waiver of an EPA employee's debt to EPA. Significant due-dates are also entered in the automated system.
-
How will the data be used by the Agency?
The hard copy and automated system are used by the Agency's Claims Officer and his staff to decide claims that are filed against the EPA under certain statutes like the Federal Torts Claims Act and the Military Personnel and Civilian Employees' Claims Act. Garnishments are now managed by DFAS, but DFAS does not have access to the garnishment module. The automated system provides management information such as summary listings and case status.
-
Why is the information being collected? (Purpose)
Certain functions that are handled by the Agency under statutes such as the Federal Torts Claims Act and the waiver statute , 31 USC 5584, are delegated to the Agency Claims Officer for adjudication.
II. Access to the Data
-
Who will have access to the data/information in the system (internal and external parties)? If contractors, are the Federal Acquisition Regulations (FAR) clauses included in the contract (24.104 Contract clauses; 52.224-1 Privacy Act Notification; and 52.224-2 Privacy Act)?
Only attorneys and paraprofessionals working with the Claims Officer and his supervisor have access; the OGC system administrator also has access. No contractors have access.
-
What controls are in place to prevent the misuse of data by those having authorized access?
The summary electronic data may be accessed in the office and remotely using secure Lotus Notes access. Access is strictly limited, as noted above, to individuals on a need to know basis. Information in the automated system can only be veiwed on-screen using secure Lotus Notes access. The automated system excludes attachments to launch or files to download. The hard copy files contain the court orders, payroll, medical records, police reports, etc.
-
Do other systems share data or have access to data/information in this system? If yes, explain who will be responsible for protecting the privacy rights of the individuals affected by the interface? (i.e., System Administrators, System Developers, System Managers)
No.
-
Will other agencies, state or local governments share data/information or have access to data in this system? (Includes any entity external to EPA.)
No.
-
Do individuals have the opportunity to decline to provide information or to consent to particular uses of the information? If yes, how is notice given to the individual? (Privacy policies must clearly explain where the collection or sharing of certain information may be optional and provide users a mechanism to assert any preference to withhold information or prohibit secondary use.)
No, the information comes to the Claims Officer trough the submission of claims by individuals or EPA employees.
III. Attributes of the Data
-
Explain how the use of the data is both relevant and necessary to the purpose for which the system is being designed.
The hard copy information provides the Claims Officer with data necessary to adjudicate claims. The automated system generally provides management oversight of case status.
-
If data are being consolidated, what controls are in place to protect the data from unauthorized access or use? Explain.
Data is not consolidated.
-
If processes are being consolidated, are the proper controls remaining in place to protect the data and prevent unauthorized access? Explain.
Processes are not being consolidated.
-
How will data be retrieved? Can it be retrieved by personal identifier? If yes, explain. (A personal identifier is a name, Social Security Number, or other identifying symbol assigned to an individual, i.e. any identifier unique to an individual.)
Data in the electronic or hard copy file system can be retrieved by name, but it cannot be retrieved by social security number. Data can also be retrieved by claim or garnishment number that is assigned to the claim, waiver request, debt or garnishment.
-
Is the Web privacy policy machine readable? Where is the policy stated? (Machine readable technology enables visitors to easily identify privacy policies and make an informed choice about whether to conduct business with that site.)
The data are not accessable through the Web.
IV. Maintenance of Administrative Controls
-
Has a record control schedule been issued for the records in the system? If so, provide the schedule number. What are the retention periods for records in this system? What are the procedures for eliminating the records at the end of the retention period? (You may check with the record liaison officer (RLO) for your AA-ship, Tammy Boulware (Headquarters Records Officer) or Judy Hutt, Agency Privacy Act Officer, to determine if there is a retention schedule for the subject records.)
EPA 678 http://www.epa.gov/records/policy/schedule/sched/678.htm
-
While the data are retained in the system, what are the requirements for determining if the data are still sufficiently accurate, relevant, timely, and complete to ensure fairness in making determinations?
The claims are adjudicated only with the most current hard copy information submitted by the claimant or obtained by the Claims Officer.
-
Will this system provide the capability to identify, locate, and monitor individuals? If yes, explain.
No.
-
Does the system use any persistent tracking technologies?
No.
-
Under which System of Records (SOR) notice does the system operate? Provide the name of the system and its SOR number if applicable. For reference, please view this list of Agency SORs. (A SOR is any collection of records under the control of the Agency in which the data is retrieved by a personal identifier. The Privacy Act Officer will determine if a SOR is necessary for your system.)