2018-03393. Privacy Act of 1974, System of Records; Notice: Comprehensive Servicing and Management System

AGENCY:

Office of Asset Management and Portfolio Oversight (OAMPO), HUD.

ACTION:

Notice of a new system of records.

SUMMARY:

In accordance with the Privacy Act of 1974, the Department of Housing and Urban Development (HUD), Office of Asset Management and Portfolio Oversight (OAMPO) provides public notice that it proposes to establish a new system, Department of Housing and Urban Development System of Records Titled, “Comprehensive Servicing and Monitoring System (CSMS) P085”.

DATES:

March 22, 2018.

Comments Due Date: March 22, 2018.

ADDRESSES:

You may submit comments, identified by docket number and title, by one of the following methods:

Federal e-Rulemaking Portal: http://www.regulations.gov. Follow the instructions provided on that site to submit comments electronically.

Fax: [phone].

Email: [e-mail].

Mail: Attention: Housing and Urban Development, Privacy Office; John Bravacos, The Executive Secretariat; 451 Seventh Street SW, Room 10139; Washington, DC 20410.

FOR FURTHER INFORMATION CONTACT:

For general questions please contact: John Bravacos, SAOP, Department of Housing and Urban Development, 451 Seventh Street SW, Washington, DC 20410; telephone number 202-708-1515 for privacy issues please contact: Senior Agency Official, John Bravacos.

SUPPLEMENTARY INFORMATION:

This system of records titled P085—Comprehensive Servicing and Monitoring System (CSMS), Department of Housing and Urban Development (HUD), Office of Asset Management and Portfolio Oversight (OAMPO). P-085-CSMS is operated by HUD's OAMPO, and includes personally identifiable information (PII) provided on or about families receiving rental housing assistance, multifamily property owners, multifamily vendors, and HUD employees who have system access, which information is retrieved by a name or unique identifier. CSMS, identified in HUD's Inventory of Systems as P085, supports the accounting and asset management functions for the Federal Housing Administration (FHA) an agency of the US Department of Housing and Urban Development. The system supports asset servicing and accounting for HUD held and HUD-owned multifamily assets and is a subsidiary ledger to the FHA general ledger. CSMS supports several management and accounting functions for these loans and properties, including financial recordkeeping, performance analysis, and status reporting for HUD's financial and business managers. CSMS is a proprietary system that maintains both Business Identifiable Information (BII) and PII.

This system of records incorporates Federal privacy requirements and HUD policy requirements. The Privacy Act provides certain safeguards for an individual against an invasion of personal privacy by requiring Federal agencies to protect records in an agency system of records from unauthorized disclosure, ensure that information is current for its intended use, and that adequate safeguards are provided to prevent misuse of such information. The notice reflects the Department's focus on industry best practices in protecting the personal privacy of the individuals covered by each system notification. This notice states the name and location of the record system, the authority for and manner of its operations, the categories of individuals it covers, the records it contains, the sources of the information for those records, the routine uses made of the records, and the system of records exemption types. In addition, the notice includes the business address of the HUD officials who will inform interested persons of the procedures whereby they may gain access to and/or request amendments to records pertaining to them. The routine uses that apply to this publication are reiterated based on past publication to clearly communicate the ways in which HUD continues to conduct some of its business practices. In accordance with 5 U.S.C. 552a(e)(4) and (11), HUD has provided a report of this new system to the Office of Management and Budget (OMB), the Senate Committee on Homeland Security and Governmental Affairs, and the House Committee on Oversight and Government Reform as instructed by OMB Circular No. A-108, “Federal Agencies Responsibilities for Review, Reporting, and Publication under the Privacy Act.”

SYSTEM NAME AND NUMBER

P085—COMPREHENSIVE SERVICING AND MONITORING SYSTEM (CSMS)

Security Classification:

UNCLASSIFIED, BUT SENSITIVE

System Location:

Department of Housing and Urban Development, 451 Seventh Street SW, Washington, DC 20410 or at the locations of the Business Service Provider/Contractor under contract with HUD.

System Manager(s):

Robert Iber, Department of Housing and Urban Development, Office of Asset Management and Portfolio Oversight, 451 Seventh Street SW, Washington, DC 20410, [phone].

Authority for Maintenance of the System:

HUD/FHA collects social security numbers during the FHA loan endorsement process and by request via IRS Form W-9 to update its records. Tenant information is collected by HUD contractors under the National Housing Act (12 U.S.C 1701 et seq.). CSMS provides servicing for loans acquired through the payment of an insurance claims under Housing Act Sections 202, 207, 223(f), 236, 221(d)(3), 221 (d)(4), 232, and 242. In addition, CSMS includes Mark to Market loans including Demonstration preservation programs from the Multifamily Assisted Housing Reform and Affordability Act of 1997 (MAHRA) (42 U.S.C. 1437f) and Demonstration preservation programs of the Office of Recapitalization (RECAP). CSMS collects and shares SSNs and PII externally with credit reporting agencies (pursuant to 5 U.S. Code 552a), banks (pursuant to Section 6109 of the Internal Revenue Code), and with the IRS (pursuant to Section 6109 of the Internal Revenue Code).

Purpose(s) of the System:

CSMS is a loan servicing, property management, and accounting system. The purpose of the system is to bill and collect funds owed to HUD/FHA, to provide program information about loan repayment and status, to manage investment of reserve for replace funds, to process and reimburse property managers or vendors for expenses incurred in managing multifamily properties owned by the Department, to track lease information for tenants living in HUD-owned properties, and to account for all transactions on this portfolio.

CSMS is a subsidiary ledger to the FHA's general ledger. CSMS provides servicing and accounting for multifamily loans acquired through the payment of an insurance claims under various Sections of the National Housing Act (12 U.S.C 1701 et seq.), including Sections 221(d)(3) and 221 (d)(4), 202, 207, 223(f), 232 and 242, 236, and loans from the Mark2Market and Demonstration preservation programs of the Office of Recapitalization (RECAP). CSMS also provides property management servicing and accounting for HUD-owned properties or mortgagees-in-possession for use by HUD and its property management contractor.

Categories of Individuals Covered by the System:

(e.g., all participants of certain HUD Rental Housing Assistance Programs, and/or HUD staff). CSMS collects, processes, and retains information from the following individuals:

• Families receiving Housing assistance from HUD-administered Multifamily programs administered by the Multifamily Property Disposition Division in Fort Worth, TX.
• Multifamily Property Owners established at the time that the FHA loan is executed.
• Vendors to ensure, preserve and protect the property, including but not limited to electricians, plumbers, landscape contractors, security services, advertisers, painters and foreclosure commissioners.
• HUD employees who have CSMS access for entering and tracking information.

Categories of Records in the System:

• Loan Servicing/Claims: Mortgagors/Borrowers and authorized contacts' names and addresses, Borrower's TIN/Social Security Numbers, phone numbers; email addresses; banking information (institutional information, routing, account numbers and account type); loan amounts (assigned balance, unpaid principal balance, face amount), interest rates, loan terms, and loan statuses; claim data (amount, expenses, interest paid by HUD, certificate of claim liability); payment and other financial account data such as loan balances, loan history, interest accrued, fees incurred, real estate property information, property taxes and insurance amounts, reserve for replacement escrow accounts and related invested escrows; accounting data including debits and credits to HUD accounts based on transaction events.
• Vendor Information: Service fees, late fees, and other billing data; collection history; expenses incurred for foreclosure and acquisition, protection and preservation, attorney fees, special assessments; disbursements for taxes, insurance, and any other miscellaneous disbursements; Mortgagee-in-Possession activity, appraisals, closing costs; asset sales, other loan termination data; UCC and filings by jurisdiction with due dates, filing costs, continuation data.
• HUD-Owned Property: Property names, addresses, authorized contacts names and addresses, phone numbers, email addresses; property financial account data such as income and expense; acquisition data; sale data, potential bidders, bid packages, closing activities; vendor/business partner (banking information, TIN/SSN number, routing, account numbers, small business identifier, and other socioeconomic data); accounting data including debits and credits to HUD accounts based on transaction events.
• HUD-Owned Property Tenant: Tenants' names, addresses, social security number, marital status, gender, family members; lease information, including rent, subsidies, fees, collections, history, and eviction status.
• Uniform Commercial Code (UCC)/202: Property names, addresses, authorized contacts' names and addresses, phone numbers, email addresses; loan maturity date; status; UCC filing by jurisdiction due dates, filing costs, continuation data.

Record Source Categories:

Records in the system are obtained through a variety of HUD/FHA loan documents, completed W-9 forms, investment account enrollment forms, and tenant lease records. Information is entered into the system by HUD/FHA staff or its contractors. This information is not received electronically from another system. The information is released by HUD for entry into CSMS.

Routine uses of records maintained in the system, including categories of users and the purposes of such uses. In addition to those disclosures generally permitted under 5 U.S.C. Section 552A(B) of the Privacy Act, all or a portion of the records or information contained in this system may be disclosed to authorized entities, as is determined to be relevant and necessary, outside the Department of Housing and Urban Development as a routine use pursuant to 5 U.S.C. 552A(B)(3), as follows:

1. To appropriate agencies, entities, and persons for disclosures which are compatible with the purpose for which the records in this system were collected, as set forth by Appendix I—HUD's Routine Use Inventory Notice published in the Federal Register (80 FR 81837-81840), as follows:

a. To the National Archives and Records Administration or to the General Services Administration for records having enough historical or other value to warrant continued preservation by the United States Government, or for inspection under Title 44 U.S.C. 2904 and 2906. Loan Servicing and HUD-Owned Property hard-copy documentation is provided.

b. To a congressional office from the record of an individual, in response to an inquiry from that congressional office made at the request of that individual. Loan Servicing/Claims, Vendor, HUD-Owned Property, HUD-Owned Property tenant, and UCC/202 information is provided as requested.

c. To contractors performing or working under a contract with HUD, when necessary to accomplish an agency function related to this system of records. Disclosure requirements are limited to only those data elements considered relevant to accomplishing an agency function. Individuals provided information under these routine use conditions are subject to Privacy Act requirements and disclosure limitations imposed on the Department. Loan Servicing/Claims, Vendor Information, HUD-Owned Property Information, HUD-Owned Property tenant, and UCC/202 is provided as requested.

d. To appropriate Federal, State, and local governments, or persons, pursuant to a showing of compelling circumstances affecting the health or safety or vital interest of an individual or data subject, including assisting such agencies or organizations in preventing the exposure to or transmission of a communicable or quarantinable disease, or to combat other significant public health threats, if upon such disclosure appropriate notice was transmitted to the last known address of such individual to identify the health threat or risk. To a consumer reporting agency, when trying to collect a claim owed on behalf of the Government, in accordance with 31 U.S.C. 3711(e). To Federal, State, and local agencies, their employees, and agents for the purpose of conducting computer matching programs as regulated by the Privacy Act of 1974, as amended (5 U.S.C. 552a).

e. To Federal agencies, non-Federal entities, their employees, and agents (including contractors, their agents or employees; employees or contractors of the agents or designated agents); or contractors, their employees or agents with whom HUD has a contract, service agreement, grant, cooperative agreement, or computer matching agreement for the purpose of: (1) Detection, prevention, and recovery of improper payments; (2) detection and prevention of fraud, waste, and abuse in major Federal programs administered by a Federal agency or non-Federal entity; (3) detection of fraud, waste, and abuse by individuals in their operations and programs, but only to the extent that the information shared is necessary and relevant to verify pre-award and prepayment requirements prior to the release of Federal funds, prevent and recover improper payments for services rendered under programs of HUD or of those Federal agencies and non-Federal entities to which HUD provides information under this routine use.

f. To contractors, grantees, experts, consultants, Federal agencies, and non-Federal entities, including, but not limited to, State and local governments and other research institutions or their parties, and entities and their agents with whom HUD has a contract, service agreement, grant, or cooperative agreement, when necessary to accomplish an agency function, related to a system of records, for the purposes of statistical analysis and research in support of program operations, management, performance monitoring, evaluation, risk management, and policy development, or to otherwise support the Department's mission. Records under this routine use may not be used in whole or in part to make decisions that affect the rights, benefits, or privileges of specific individuals. The results of the matched information may not be disclosed in identifiable form.

g. To a recipient who has provided the agency with advance, adequate written assurance that the record provided from the system of records will be used solely for statistical research or reporting purposes. Records under this condition will be disclosed or transferred in a form that does not identify an individual.

h. To contractors, grantees, experts, consultants and their agents, or others performing or working under a contract, service, grant, or cooperative agreement with HUD, when necessary to accomplish an agency function related to a system of records. Disclosure requirements are limited to only those data elements considered relevant to accomplishing an agency function. Individuals provided information under these routine use conditions are subject to Privacy Act requirements and disclosure limitations imposed on the Department.

i. To contractors, experts and consultants with whom HUD has a contract, service agreement, or other assignment of the Department, when necessary to utilize relevant data for the purpose of testing new technology and systems designed to enhance program operations and performance.

j. To appropriate Federal, State, local, tribal, or governmental agencies or multilateral governmental organizations responsible for investigating or prosecuting the violations of, or for enforcing or implementing, a statute, rule, regulation, order, or license, where HUD determines that the information would assist in the enforcement of civil or criminal laws. To third parties during the course of a law enforcement investigation, to the extent necessary to obtain information pertinent to the investigation, provided the disclosure of such information is appropriate to the proper performance of the official duties of the officer making the disclosure.

k. To a court, magistrate, administrative tribunal, or arbitrator in the course of presenting evidence, including disclosures to opposing counsel or witnesses in the course of civil discovery, litigation, mediation, or settlement negotiations; or in connection with criminal law proceedings; or in response to a subpoena or to a prosecution request when such records to be released are specifically approved by a court provided order. To appropriate Federal, State, local, tribal, or governmental agencies or multilateral governmental organizations responsible for investigating or prosecuting the violations of, or for enforcing or implementing, a statute, rule, regulation, order, or license, where HUD determines that the information would assist in the enforcement of civil or criminal laws. To third parties during the course of a law enforcement investigation to the extent necessary to obtain information pertinent to the investigation, provided disclosure is appropriate to the proper performance of the official duties of the officer making the disclosure.

To another agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity if the activity is authorized by law, and if the head of the agency or instrumentality has made a written request to the agency that maintains the record, specifying the particular portion desired and the law enforcement activity for which the record is sought.

l. To the Department of Justice (DOJ) when seeking legal advice for a HUD initiative or in response to DOJ's request for the information, after either HUD or DOJ determine that such information is relevant to DOJ's representatives of the United States or any other components in legal proceedings before a court or adjudicative body, provided that, in each case, the agency also determines prior to disclosure that disclosure of the records to DOJ is a use of the information contained in the records that is compatible with the purpose for which HUD collected the records. HUD on its own may disclose records in this system of records in legal proceedings before a court or administrative body after determining that the disclosure of the records to the court or administrative body is a use of the information contained in the records that is compatible with the purpose for which HUD collected the records.

To the IRS for reporting of payments, forgiveness of debt, and property sales under section 6109 of the Internal Revenue Code. A subset of Loan Servicing/Claims and Vendor Information is provided. To banks holding escrow monies for the purpose of establishing interest bearing accounts and reporting of interest payments to the IRS under section 6109 of the Internal Revenue Code. A subset of Loan Servicing/Claims data is provided. To credit reporting agencies for the purposed of reporting delinquencies under 5 U.S. Code 552a. A subset of Loan Servicing/Claims data is provided. To UCC filing organization for the purpose of filing UCC Article 9 secured party interest on behalf of HUD under the Uniform Commercial Code Article 9. A subset of Uniform Commercial Code (UCC)/202 data is provided.

To appropriate agencies, entities, and persons as necessary when:

1. HUD suspects or has confirmed that there has been a breach of the system of records;

2. HUD has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, HUD (including its information systems, programs, and operations), the Federal Government, or national security; and

3. The disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with HUD efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

4. To another Federal agency or Federal entity, when HUD determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in:

5. Responding to a suspected or confirmed breach or,

6. Preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.

Policies and Practices for Storage of Records:

Records in CSMS are stored electronically in a secure data center at the primary site in Silver Spring, MD and at a secure data center at the Disaster Recovery Site in Columbus, OH. Encrypted backup tapes are stored in a secure vault at an alternate storage site in Rockville, MD. Paper records are stored in locked file cabinets in limited access areas of a secure facility with 24 hour monitoring and other physical protection measures. Paper records are stored in a secure location and retrieved by staff according to their level of authorization.

Policies and Practices for Retrieval of Records:

Electronic records are retrieved via a variety of CSMS reports and data screens by authorized users of CSMS according to their level of authorization. The primary method of retrieval is Integrated Real Estate Management System (IREMS) id or FHA loan number.

Policies and Practices for Retention and Disposal of Records:

Record retention use and disposal practices are governed by 44 U.S.C. Chapter 33. On-line data is kept for the life of the system/contract, based on the contractual requirement to provide full loan histories. Backup and Recovery digital media are destroyed or otherwise rendered irrecoverable per NIST SP 800-88 Rev 1 “Guidelines for Media Sanitization.” Hard copy documents held by the contractor are retired per the Performance Work Statement and HUD Handbook 2225.6, Records Disposition Schedules and HUD Handbook 2228.2, General Records Schedules. The system contractor will purge the information at contract termination per the Transition-Out Plan.

Administrative, Technical, and Physical Safeguards:

Electronic records are maintained in secured areas within the system. Access is limited to authorized personnel with a need-to-know based on unique user credentials and confidential passwords. Physical entry by unauthorized person is restricted though the use of locks, guards, passwords, and/or other security measures. Policy and standard operating procedures are implemented and disseminated to system users to ensure records are safeguarded, including rules of behavior implementation.

Record Access Procedures:

For information, assistance, or inquiry about the existence of records, contact Marcus Smallwood, Acting, Chief Privacy Officer 451 Seventh Street SW, Room 10139, Washington, DC 20410, telephone number [phone]. When seeking records about yourself from this system of records or any other Housing and Urban Development (HUD) system of records, your request must conform with the Privacy Act regulations set forth in 24 CFR part 16. You must first verify your identity, meaning that you must provide your full name, address, and date and place of birth. You must sign your request, and your signature must either be notarized or submitted under 28 U.S.C.1746, a law that permits statements to be made under penalty of perjury as a substitute for notarization. In addition, your request should:

a. Explain why you believe HUD would have information on you.

b. Identify which Office of HUD you believe has the records about you.

c. Specify when you believe the records would have been created.

d. Provide any other information that will help the Freedom of Information Act (FOIA), staff determine which HUD office may have responsive records.

If your request is seeking records pertaining to another living individual, you must include a statement from that individual certifying their agreement for you to access their records. Without the above information, the HUD FOIA Office may not conduct an effective search, and your request may be denied due to lack of specificity or lack of compliance with regulations.

Contesting Record Procedures:

The Department's rules for contesting contents of records and appealing initial denials appear in 24 CFR part 16, Procedures for Inquiries. Additional assistance may be obtained by contacting John Bravacos, Senior Agency Official for Privacy, 451 Seventh Street SW, Room 10139, Washington, DC 20410, or the HUD Departmental Privacy Appeals Officers, Office of General Counsel, Department of Housing and Urban Development, 451 Seventh Street SW, Washington, DC 20410.

Notification Procedures:

Individuals seeking notification of and access to any record contained in this system of records, or seeking to contest its content, may submit a request in writing to the Privacy Office at the address provided above or to the component's FOIA Officer, whose contact information can be found at http://www.hud.gov/​foia under “contact.” If an individual believes more than one component maintains Privacy Act records concerning him or her the individual may submit the request to the Chief Privacy Officer, HUD, 451 Seventh Street SW, Room 10139, Washington, DC 20410.

Exemptions Promoulgated for the System:

None.

History:

None.

Dated: February 8, 2018.

John Bravacos,

Senior Agency Official for Privacy.