2022-22103. Privacy Act of 1974; System of Records

AGENCY:

Office of the Assistant Secretary for Housing-Federal Housing Commissioner, HUD.

ACTION:

Notice of a modified system of records.

SUMMARY:

The Distributive Shares and Refund Subsystem (DSRS) serves as the Federal Housing Administration (FHA) repository for verifying mortgage insurance premium refunds and distributive share payments which are issued to eligible homeowners (mortgagors) who had an FHA mortgage insured loan. Pursuant to the provisions of the Privacy Act of 1974, as amended, the Department of Housing and Urban Development (HUD) is issuing a public notice of its intent to modify a system of records entitled “Distributive Shares and Refund Subsystem” (DSRS). This system of records is being revised to make clarifying changes within: System Location, System Manager, Record Authority for Maintenance of the System, Purpose of the System, Categories of Individuals Covered by the System, Categories of Records in the System, Records Source Categories, Routine Uses of Records Maintained in the System, Retention and Disposal of Records. The SORN modifications are outlined in the SORN SUPPLEMENTARY INFORMATION section.

DATES:

Comments will be accepted on or before November 14, 2022. The SORN becomes effective immediately, while the routine uses become effective after the comment period immediately upon publication except for the routine uses, which will become effective on the date following the end of the comment period unless comments are received which result in a contrary determination.

ADDRESSES:

You may submit comments, identified by docket number by one method:

Federal e-Rulemaking Portal: http://www.regulations.gov. Follow the instructions provided on that site to submit comments electronically.

Fax: [phone].

Email: [e-mail].

Mail: Attention: Privacy Office; LaDonne White, Chief Privacy Officer; The Executive Secretariat; 451 Seventh Street SW, Room 10139; Washington, DC 20410-0001.

Instructions: All submissions received must include the agency name and docket number for this rulemaking. All comments received will be posted without change to http://www.regulations.gov. including any personal information provided.

Docket: For access to the docket to read background documents or comments received go to http://www.regulations.gov.

FOR FURTHER INFORMATION CONTACT:

LaDonne White; 451 Seventh Street SW, Room 10139; Washington, DC 20410-0001; telephone number 202-708-3054 (this is not a toll-free number). Individuals who are hearing- or speech-impaired can dial 7-1-1 to access the Telecommunications Relay Service (TRS), which permits users to make text-based calls, including Text Telephone (TTY) and Speech to Speech (STS) calls. Individuals who require an alternative aid or service to communicate effectively with HUD should email the point of contact listed above and provide a brief description of their preferred method of communication.

SUPPLEMENTARY INFORMATION:

HUD, Single Family Insurance Operations Division, maintains the DSRS system. HUD is publishing this revised notice to establish a new and modified routine use and to reflect updated information in the sections being revised. The modification of the system of records will have no undue impact on the privacy of the individuals covered and updates made are explained below.

The following are updates since the previous SORN publication:

Security Classification: Added systems of record classification status.

System Location: Replaced former data center and HUD locations with new locations in Virginia, Mississippi, and Washington.

System Manager: Identified new system manager expected to operate this system of records.

Authority for Maintenance of the System: Updated with existing authorities that permit the maintenance of the systems records. Statutes and regulations are listed below.

Categories of Individuals Covered by the System: Reorganized this section to group and clarify individuals according to their system coverage. Updated to reflect the inclusion of records previously covered as “Third Party Representatives”.

Categories of Records in the System: Updated this section to clarify the individuals whose personal identifiable information is collected and reflect the inclusion of new and previously covered records entitled “Identification and Verification”.

Records Source Categories: Updated to cover all record sources for internal and external systems to HUD.

Routine Use of Records:

Added General Service Administration for purpose of supporting agency dispute resolution.

Updated routine uses for breach remediation efforts to extend agency data sharing when relevant for breach remediation efforts to appropriate agencies.

Readded a routine use for disclosure to the general public which had previously been placed in the section immediately preceding the routine use section.

Reorganized, incorporated, and updated routine uses previously applied through HUD's 2015 Routine Use Inventory publication as part of this system of records. See routine uses (C), (K), (L), and (M) for updates.

Records Retention and Disposition: Updated this section to describe current retention and disposal requirements.

Policy and Practice for Retrieval of Records: Updated to include minor changes and format.

Records Access, Contesting, and Notification Procedures: Updated to include Federal requirements and HUD office to which the individuals' request should be directed.

SYSTEM NAME AND NUMBER:

Distributive Shares and Refund Subsystem (DSRS) HUD/HOU-03.

SECURITY CLASSIFICATION:

Unclassified.

SYSTEM LOCATION:

National Center for Critical Information Processing and Storage, 9325 Cypress Loop Road, Stennis Space Center, MS 39529-0001; 250 Burlington Drive, Clarksville, VA 23927; and at the HUD Headquarter, 451 Seventh Street SW, Room 3238, Washington, DC 20410.

SYSTEM MANAGER(S):

Silas Vaughn, System Manager, Single Family Insurance Operations Division, HWAFS, Department of Housing and Urban Development, 451 Seventh Street SW, Ninth floor, Washington, DC 20410-0001 telephone number, 202-708-2438.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

Section 203(a) of the National Housing Act of 1934 (12 U.S.C. 1709(a)); 24 CFR 203.35. Section 7(d) of the Department of Housing and Urban Development Act of 1965 (12 U.S.C. 3535(d)); 24 CFR 5.210; 24 CFR 200.1101. The Housing Community Development Act of 1987, 42 U.S.C. 3543(a). The Debt Collection Act of 1982, Public Law 97-365.

PURPOSES OF THE SYSTEM:

DSRS maintains detailed records for single family non-claim terminated case activities to ensure that the proper homeowner associated with the FHA guaranteed loan is identified. Upon non-claim termination ( i.e., prepayment, assignment, assumption, or refinance), the borrower may be eligible for a refund of any unearned upfront mortgage insurance premium (UFMIP) paid at closing or a distributive share payment. The “ Does HUD Owe You a Refund? ” website is used in conjunction with DSRS to allow homeowners who have had an FHA endorsed mortgage determine if they are eligible for an upfront mortgage insurance premium refund or distributive share payment. In addition, DSRS utilizes the Premium Refund Application Upload web page component to provide another option for homeowners to securely send the required documents to HUD to complete the homeowner refund process. SFIOD staff can request disbursement of refunds due, and DSRS will certify that the requests are valid.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

Homeowners (Mortgagors) who had Federal Housing Administration (FHA) mortgage insured loans and may be eligible for a mortgage insurance premium refund or distributive share payment; Third Party Representatives who are sources of mortgagor information.

CATEGORIES OF RECORDS IN THE SYSTEM:

Full Name, Social Security Number (SSN), Date of Birth, Phone Number, Home Address, Email Address, Employer Identification Number, and User id, Related Premium Refund/Payment Correspondence (borrower name, address, email address, phone and fax number), Supporting Documentation (borrower identification and verification document copies): Birth, Death, Marriage, Religion, Naturalization, Citizenship Certificate, US Passport, Green Card, Change-of-Address, Drivers' license, Military, State, Federal ID, or similar identification, Bank, Mortgage, Credit Card, Tax, Utility, Doctor, Hospital Company Bill, Medicaid, Medicare Statement, Social Security Administration, Pension, Retirement Benefit Statement, Veteran Discharge or Separation Papers, Dependent, Medical, SSN Card, W-2, 1099, DD-214 form (for SSN verification purposes), Pay Statement, Vehicle, Voters Registration, Legal documents (mortgage, deed, will, loan, rental contracts, gender, name change) or similar document. Information on Supporting documents may include State were issued, SSN, Birthdate, Gender, Sex, Affiliation, Marital, Financial, Retirement, Pay, Employment, Medical, Account Number, and Address information.

RECORD SOURCE CATEGORIES:

Homeowners, third party businesses, and authorized representatives of the homeowners that complete the form application for premium refund. Internal and External data exchanges from the following systems:

Housing Office of Finance and Budget: Single Family Insurance System (SFIS) A43, The “ Does HUD Owe You a Refund? ” website, and Premium Refund Application Upload webpage.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND PURPOSES OF SUCH USES:

(A) To the National Archives and Records Administration, Office of Government Information Services (OGIS), to the extent necessary to fulfill its responsibilities in 5 U.S.C. 552(h), to review administrative agency policies, procedures, and compliance with the Freedom of Information Act (FOIA), and to facilitate OGIS's offering of mediation service to resolve disputes between persons making FOIA requests and administrative agencies.

(B) To a congressional office from the record of an individual, in response to an inquiry from the congressional office made at the request of that individual.

(C) To contractors, grantees, experts, consultants, Federal agencies, and non-Federal entities, including, but not limited to, State and local governments and other research institutions or their parties, and entities and their agents with whom HUD has a contract, service agreement, grant, cooperative agreement, or other agreement, for the purposes of statistical analysis and research in support of program operations, management, performance monitoring, evaluation, risk management, and policy development, or to otherwise support the Department's mission. Records under this routine use may not be used in whole or in part to make decisions that affect the rights, benefits, or privileges of specific individuals. The results of the matched information may not be disclosed in identifiable form.

(D) To contractors, grantees, experts, consultants and their agents, or others performing or working under a contract, service, grant, or cooperative agreement with HUD, when necessary to accomplish an agency function related to a system of records. Disclosure requirements are limited to only those data elements considered relevant to accomplishing an agency function.

(E) To authorized requesters or third-party tracers who request access to Upfront Mortgage Insurance Premiums homeowner refund and distributive share payment information, when such information is unavailable on HUD's FOIA reading room or Does HUD Owe You a Refund? websites. This information is releasable under FOIA. Third party release of this material may require authorized consent of the homeowner to whom the records belong and must adhere to all HUD procedures prior to release.

(F) To the U.S. Department of the Treasury for collection and disbursement of check transactions.

(G) To the general public when, after two-years of attempting to contact each unpaid mortgagor of their FHA insurance refund, the Department makes available a cumulative listing of any unpaid refund that remains unpaid. The information that will be disclosed includes eligible mortgagor(s) full name, last known address, refund amount, termination date, and FHA case number. This information is available to the public on HUD's refund database “ Does HUD Owe You A Refund? ” and “FOIA Mortgage Insurance State List Page.”

(H) To the recorders' offices for recording legal documents and responses to offsets ( i.e., child support) or other legal responses required during the servicing of the insured loan to allow HUD to release mortgage liens and respond to bankruptcies or deaths of mortgagors to protect the interest of the Secretary of HUD.

(I) To appropriate federal, state, local, tribal, or foreign governmental agencies or multilateral governmental organizations, with the approval of the Chief Privacy Officer, when HUD is aware of a need to use relevant data for purposes of testing new technology.

(J)(1) To another Federal agency or Federal entity when HUD determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (a) responding to a suspected or confirmed breach or (b) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.

(K) To appropriate agencies, entities, and persons when (a) HUD suspects or has confirmed that there has been a breach of the system of records; (b) HUD has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, HUD (including its information systems, programs, and operations), the Federal Government, or national security; and (c) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with HUD's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

(L) To appropriate Federal, State, local, tribal, or governmental agencies or multilateral governmental organizations responsible for investigating or prosecuting the violations of, or for enforcing or implementing, a statute, rule, regulation, order, or license, where HUD determines that the information would assist in the enforcement of civil or criminal laws, when such records, either alone or in conjunction with other information, indicate a violation or potential violation of law.

(M) To a court, magistrate, administrative tribunal, or arbitrator in the course of presenting evidence, including disclosures to opposing counsel or witnesses in the course of civil discovery, litigation, mediation, or settlement negotiations, or in connection with criminal law proceedings; when HUD determines that use of such records is relevant and necessary to the litigation and when any of the following is a party to the litigation or have an interest in such litigation: (1) HUD, or any component thereof; or (2) any HUD employee in his or her official capacity; or (3) any HUD employee in his or her individual capacity where HUD has agreed to represent the employee; or (4) the United States, or any agency thereof, where HUD determines that litigation is likely to affect HUD or any of its components.

(N) To any component of the Department of Justice or other Federal agency conducting litigation or in proceedings before any court, adjudicative, or administrative body, when HUD determines that the use of such records is relevant and necessary to the litigation and when any of the following is a party to the litigation or have an interest in such litigation: (1) HUD, or any component thereof; or (2) any HUD employee in his or her official capacity; or (3) any HUD employee in his or her individual capacity where the Department of Justice or agency conducting the litigation has agreed to represent the employee; or (4) the United States, or any agency thereof, where HUD determines that litigation is likely to affect HUD or any of its components

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:

Paper and electronic.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:

Records are retrieved by Name, SSN and Property Address.

POLICIES AND PRACTICIES FOR RETENTION AND DISPOSAL OF RECORDS:

(1) Payments and Disbursements files. Temporary. Destroy 6 years after final payment or cancellations, but longer retention is authorized if required for business use.

(2) System development/infrastructure project files. Temporary. Destroy 5 years after project is terminated, but longer retention is authorized if required for business use.

(3) System general technology management records. Temporary. Destroy 5 years after system is superseded by a new iteration, or is terminated, defunded, or no longer needed for agency/IT administrative purposes, but longer retention is authorized if required for business use.

(4) System technical documents. Temporary. Destroy 5 years after the project/activity/transaction is completed or superseded, or the associated system is terminated, or the associated data is migrated to a successor system, but longer retention is authorized if required for business use.

(5) System access records. Temporary. Destroy 6 years after password is altered or user account is terminated, but longer retention is authorized if required for business use.

(6) System backups and tape library records (Incremental backup files). Temporary. Destroy when second subsequent backup is verified as successful, or when no longer needed for system restoration, whichever is later.

(7) System backups and tape (full backup files). Temporary. Destroy when subsequent backup is verified as successful or when no longer needed for system restoration, whichever is later.

(8) System backup on master files. Temporary. Destroy when second subsequent backup is verified as successful or when no longer needed for system restoration, whichever is later.

(9) Premium Refund Application website search files. Temporary. Destroy upon verification of successful creation of the final document or file, or when no longer needed for business use, whichever is later.

(10) Premium Refund Application Upload page files. Temporary. Destroy upon verification of successful creation of the final document or file, or when no longer needed for business use, whichever is later.

(11) System input/output files. Temporary. Destroy upon verification of successful creation of the final document or file, or when no longer needed for business use, whichever is later.

(12) Paper Records and related technical documentation. Temporary. Destroy upon verification of successful creation of the final document or file, or when no longer needed for business use, whichever is later.

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:

Administrative Controls: Backups Secured Off-Site, Methods to Ensure Only Authorized Personnel Access to PII, Periodic Security Audits, and Regular Monitoring of User's Security Practices. Technical Controls: Encryption of Data at Rest, Firewall, Role-Based Access Controls, Virtual Private Network (VPN), Encryption of Data in Transit, Least Privilege Access, User Identification and Password, PIV Card, Intrusion Detection System (IDS).

Physical Safeguards: Combination locks, Key Cards, Security Guards, Identification badges, and all paper records that contain PII and sensitive information are locked in file rooms.

RECORD ACCESS PROCEDURES:

Individuals seeking notification of and access to their records in this system of records may submit a request in writing to the Department of Housing and Urban Development, Attn: FOIA Program Office, 451 7th Street SW, Suite 10139, Washington, DC 20410-0001. or by emailing [e-mail]. Individuals must furnish the following information for their records to be located:

1. Full name.

2. Signature.

3. The reason why the individual believes this system contains information about him/her.

4. The address to which the information should be sent.

CONTESTING RECORD PROCEDURES:

Same as the Notification Procedures above.

NOTIFICATION PROCEDURES:

Any person wanting to know whether this system of records contains information about him or her should contact the System Manager. Such person should provide his or her full name, position title and office location at the time the accommodation was requested, and a mailing address to which a response is to be sent.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:

None.

HISTORY:

DSRS SORN: 81 FR 22293 (April 15, 2016)

DSRS SORN: 72 FR 40890 (July 25, 2007)

LaDonne White,

Chief Privacy Officer, Office of Administration.