2018-10103. Privacy Act of 1974; System of Records Personnel Security Integrated Tracking System (PerSIST)

AGENCY:

Office of Chief Human Capital Officer, HUD.

ACTION:

Notice of a new system of records.

SUMMARY:

In accordance with the Privacy Act of 1974, The Department of Housing Urban and Development (HUD), Office of Chief Human Capital Officer (OCHCO) proposes to implement a new system of records titled Personnel Security Integrated Tracking System (PerSIST) in Fiscal Year 2018. PerSIST will replace the Department's legacy system, Personnel Security Files (PSF) henceforth, PSF will be decommissioned in Fiscal Year 2019. PerSIST is an enterprise personnel security case management system that automates activities associated with the tracking of personnel security investigations for HUD. PerSIST enables HUD's Personnel Security Division (PSD) staff to store and manage HUD personnel security information, manage the integrated workflow processes, manage activities, manage caseloads, and reporting capabilities relative to personnel security investigations. Records in the system are used to document and support decisions regarding the suitability, eligibility, and fitness of applicants for federal and contract employment to include: Students, interns, or volunteers to the extent that their duties require access to federal facilities, information, systems, or applications. Additionally, records may be used to document security violations, and supervisory actions taken. Information contained in PerSIST includes but is not limited to: Employment records, education history, credit history, subjects' previous addresses, names of friends, neighbors, and associates, selective service records, military history, citizenship, pre-employment waivers, Background Investigations (BI's), security clearances, Sensitive Compartmented Information (SCI) access, clearance receipts (reciprocity), reinvestigations, completion dates of various security checks, and adjudication status/notes and decisions.

DATES:

Applicable Date: This notice will become effective June 11, 2018.

ADDRESSES:

You may submit comments, identified by docket number by one of the following methods: Interested persons are invited to submit comments regarding this notice to the Rules Docket Clerk, Office of General Counsel, Department of Housing and Urban Development, 451 Seventh Street SW, Room 10276, Washington, DC 20410. Comments may be filed electronically by accessing: www.regulations.gov. Regulations.gov provides clear instructions on how to submit a public comment on a rule. Communications should refer to the above docket number and title. Faxed comments are not accepted. A copy of each communication submitted will be available for public inspection and copying between 8 a.m. and 5 p.m. weekdays at the above address.

Federal e-Rulemaking Portal: http://www.regulations.gov. Follow the instructions provided on that site to submit comments electronically.

Fax: [phone].

Email: [e-mail].

Mail: Attention: Privacy Office; [John Bravacos]; The Executive Secretariat; 451 Seventh Street SW, Room 10139; Washington, DC 20410.

Instructions: All submissions received must include the agency name and docket number for this rulemaking. All comments received will be posted without change to http://www.regulations.gov. including any personal information provided.

Docket: For access to the docket to read background documents or comments received go to http://www.regulations.gov.

FOR FURTHER INFORMATION CONTACT:

John Bravacos, Senior Agency Official for Privacy, at 451 7th Street SW, Room 10139; U.S. Department of Housing and Urban Development; Washington, DC 20410-0001; telephone number 202-708-3054 (this is not a toll-free number). Individuals who are hearing- or speech-impaired may access this telephone number via TTY by calling the Federal Relay Service at 800-877-8339 (this is a toll-free number).

SUPPLEMENTARY INFORMATION:

HUD is decommissioning its' legacy system of records titled Personnel Security Files (PSF) and replacing it with the Personnel Security Integrated Tracking System (PerSIST). PSF is an access based system that HUD has been utilizing since 2006. It requires manual processing and offers limited capabilities for data collection, file storage, file tracking, and file retrievals. The PSF system also lacks many capabilities needed to support HUD background security investigations such as multi-user access, workflow definition, workflow tracking, and the ability to interface with interagency systems such as the Office of Personnel Management Electronic Questionnaires for Investigations Processing (e-QIP) and Personnel Investigations Processing System (PIPS).

PII collected in PerSIST will remain consistent with data categories collected in PSF however, PerSIST reduces errors associated with manual entries, streamlines front-end/back-end data collection, offers the advance capabilities, takes advantage of the latest tools and technologies, and supports data exchange with both internal and external agency systems. PerSIST will allow HUD to realize process improvements, efficiencies and acquire the ability to capture data related to all aspects of pre-appointments, suitability determinations, and security clearance processing.

Additionally, PerSIST has the ability to leverage and share information with existing HUD systems and directly support these functions.

SYSTEM NAME AND NUMBER

Personnel Security Integrated System for Tracking (PerSIST); P315.

SECURITY CLASSIFICATION:

This system will not house any classified information.

SYSTEM LOCATION:

The PerSIST system is located at: The Department of Housing and Urban Development Headquarters, 451 Seventh Street SW, Room 2135, Washington, DC 20410.

Cloud Data Center location(s):

Production Hosting Data Center is located at 44470 Chilum Pl., Ashburn, VA 20147.

Backup Data Center is located at 180 Peachtree St. NW, Atlanta, GA 30303.

SYSTEM MANAGER(S):

Felicia Purifoy, Director of Human Capital Services, 451 7th Street SW, Room 2272B; U.S. Department of Housing and Urban Development; Washington, DC 20410-0001, telephone number 202-402-2256.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

Relative to the purpose of your investigation, the U.S. government is authorized to request this information under Executive Orders: 10865, 12333, 12356, and 13764. Sections 3301 and 9101, of title 5, U.S. Code; section 2165 of title 42, U.S. Code; sections 781 to 887 of title 50, U.S. Code; parts 5, 732, and 736 of title 5, Code of Federal Regulations; and Homeland Security Presidential Directive (HSPD) 12, Policy for a Common Identification Standard for Federal Employees and Contractors, August 21, 2004. Forms: SF-85, SF-85P, SF-86, SF-87. Amending the civil service rules, Executive Order 13488, and Executive Order 13467 to Modernize the Executive Branch governance structure and processes for security clearances, suitability and fitness for employment, and credentialing and related matters.

PURPOSES OF THE SYSTEM:

Records in the system are used to document and support decisions regarding the suitability, eligibility, and fitness for services of applicants for federal employment and contract positions to include students, interns, or volunteers to the extent that their duties require access to federal facilities, information, systems, or applications. Additionally, records may be used to document security violations, and supervisory actions taken.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

Data will be collected from HUD Employees, Applicants for new hire, Contractors, Students, Interns, or volunteers to the extent that their duties require access to federal facilities, information, systems, or applications.

CATEGORIES OF RECORDS IN THE SYSTEM:

Data will be collected on all individuals who are being considered for employment i.e. employees, new hires, contractors, student interns, volunteers or access to HUD facilities, systems, or applications:

• Full Name,
• former names,
• date of birth,
• birth place,
• Social Security number,
• Home address,
• phone numbers,
• employment history,
• residential history,
• education and degrees earned,
• names of associates,
• references and their contact information,
• citizenship,
• names of relatives,
• birthdates and birth places of relatives,
• citizenship of relatives,
• Names of relatives who work for the Federal government,
• criminal history,
• mental health history,
• History of drug use,
• Financial information,
• fingerprints,
• summary report of investigation,
• results of suitability decisions,
• level of security clearance(s) held,
• date of issuance of security clearance,
• requests for appeal,
• witness statements,
• investigator's notes,
• Tax return information,
• credit reports,
• security violations,
• circumstances of violation, and agency action taken.

RECORD SOURCE CATEGORIES:

1. OPM e-QIP-OMP will provide a conduit for applicants to collect a full disclosure of PII (reference list of PII collected under sec. Categories of Records in the System) through the Electronic Questionnaire for Investigations (e-QIP). e-QIP is an electronic form that is downloaded by the applicant/employee; the applicant/employee populates the form and the information is transferred to HUD via an encrypted file transfer, e-QIP records an applicant record in PerSIST system upon the applicants' completion. Government- created general service forms, and HUD forms.

2. OF-306, Declaration for Federal Employment—This document collects Name, SSN, DOB, POB, Citizenship, Responses to Criminal, Financial, Employment, Military status.

3. HUD Personal Identity Verification Sheet—This document collects Name, SSN, DOB, POB, Citizenship, Phone Number, Address, Email Address.

4. Data Facts (Vendor)—HUD collects PII associated with applicants' credit history through third party vendor to include: Name, Aliases, SSN (partial), DOB (partial), credit history; and Credit history information collected from TransUnion, Equifax, and Experian.

5. HUD Fair Credit Reporting Act—Collects applicant name, SSN, and signature for acknowledgement to collect Credit info. on this form.

6. General Services Administration (GSA) USAccess Criminal History Results—Collects information on applicants' national criminal history.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND PURPOSES OF SUCH USES:

In addition to those disclosures generally permitted under 5 U.S.C. 552a(b) and to appropriate agencies, entities, and persons for disclosures compatible with the purpose for which the records in this system were collected as set forth by Appendix I—HUD's Routine Use Inventory Notice, 80 FR 81837 (December 31, 2015), all or a portion of the records or information contained in this system may be disclosed outside HUD as a routine use pursuant to 5 U.S.C. 552a(b)(3) as follows:

1. To the National Archives and Records Administration, Office of Government Information Services (OGIS), to the extent necessary to fulfill its responsibilities in 5 U.S.C. 552(h), to review administrative agency policies, procedures and compliance with the Freedom of Information Act (FOIA), and to facilitate OGIS' offering of mediation services to resolve disputes between persons making FOIA requests and administrative agencies.

2. To the Department of Justice when: (a) The agency or any component thereof; or (b) Any employee of the agency in his or her official capacity; (c) Any employee of the agency in his or her individual capacity where agency or the Department of Justice has agreed to represent the employee; or (d) The United States Government, is a party to litigation or has an interest in such litigation, and by careful review, the agency determines that the records are both relevant and necessary to the litigation and the use of such records by DOJ is therefore deemed by the agency to be for a purpose compatible with the purpose for which the agency collected the records.

3. To the court or adjudicative body in proceedings when:

(a) The agency or any component thereof; (b) Any employee of the agency in his or her official capacity; (c) Any employee of the agency in his or her individual capacity where agency or the Department of Justice has agreed to represent the employee; or (d) The United States Government, is a party to litigation or has an interest in such litigation, and by careful review, the agency determines that the records are both relevant and necessary to the litigation and the use of such records is therefore deemed by the agency to be for a purpose that is compatible with the purpose for which the agency collected the records.

4. Except as noted on Forms SF-85, 85-P, and 86, when a record on its face, or in conjunction with other records, made to the appropriate public authority, whether Federal, foreign, State, local, or tribal, or otherwise, enforcing or implementing the statute, or rule, regulation, or order issued pursuant thereto, if the information disclosed is relevant to any enforcement, regulatory, investigative or prosecutorial responsibility of the receiving entity.

5. To a Member of Congress or to a Congressional staff member in response to an inquiry of the Congressional office made at the written request of the constituent about whom the record is maintained.

6. To HUD contractors, grantees, or volunteers who have been engaged to assist the agency in the performance of a contract service, grant, cooperative agreement, or other activity related to this system of records and who need to have access to the records to perform their activity. Recipients shall be required to comply with the requirements of the Privacy Act of 1974, as amended, 5 U.S.C. 552a.

7. To any source or potential source from which information is requested during an investigation concerning the retention of an employee or other personnel action (other than hiring), or the retention of a security clearance, contract, grant, license, or other benefit, to the extent necessary to identify the individual, inform the source of the nature and purpose of the investigation, and to identify the type of information requested.

8. To a Federal, State, local, foreign, or tribal or other public authority the fact that this system of records contains information relevant to the retention of an employee, the retention of a security clearance, the letting of a contract, or the issuance or retention of a license, grant, or other benefit. The other agency or licensing organization may then make a request supported by the written consent of the individual for the entire record if it so chooses. No disclosure will be made unless the information has been determined to be sufficiently reliable to support a referral to another office within the agency or to another Federal agency for criminal, civil, administrative personnel or regulatory action.

9. To the news media or the public, information the disclosure of which would be in the public interest and which would not constitute an unwarranted invasion of personal privacy, consistent with Freedom of Information Act standards.

10. To a Federal, State, or local agency, or other appropriate entities or individuals, or through established liaison channels to selected foreign governments, in order to enable an intelligence agency to carry out its responsibilities under the National Security Act of 1947 as amended, the CIA Act of 1949 as amended, Executive Order 12333 or any successor order, applicable national security directives, or classified implementing procedures with 54836 Federal Register/Vol. 71, No. 181/Tuesday, September 19, 2006/Notices approved by the Attorney General and promulgated pursuant to such statutes, orders or directives.

1. To appropriate agencies, entities, and persons when (1) HUD suspects or has confirmed that there has been a breach of the system of records, (2) HUD has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, HUD (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with HUD's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

2. To another Federal agency entity, when HUD determines that information from the system of records is reasonable necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:

Comprehensive electronic records are maintained by the Personnel Security Division and stored in the PerSIST electronic database. Access to the records is restricted to those with specific roles in the Personal Identity Verification (PIV) process. Retrieval of electronic records will require a system name or social security number query to produce records of an employee, contractor, student, intern, or volunteer.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:

Prior to decommissioning, existing records maintained in PSF will undergo a data quality review and migration to PerSIST. HUD's standard protocol for transmitting secure data is via a secure File Transfer Protocol (FTP). The FTP is a method of transferring data files from one computer to another over a network.

Comprehensive records are retained and disposed of in accordance with General Records Schedule 5.6 items: 180,181 under Disposition Authority DAA-GRS-2017-0006-0025, approved by the National Archives and Records Administration(NARA). Records regarding individuals with security clearances and other clearances for access to Government facilities or to sensitive data, created to support initial favorable eligibility determinations, periodic reinvestigations, or to implement a continuous evaluation program will be destroyed 5 years after the employee or contractor relationship ends, however longer retention is authorized if required for business use.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:

For Paper Records: Comprehensive paper records are maintained and locked in metal file cabinets and stored in secured rooms within HUD Headquarters, Personnel Security Division.

For Electronic Records: Comprehensive electronic records are maintained within the PerSIST system and stored on a cloud based software server and operating system that resides in a Federal Risk and Authorization Management Program (FedRAMP) and Federal Information Security Management Act (FISMA) Moderate dedicated hosting environment.

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:

For Paper Records: Comprehensive paper records are kept in locked metal file cabinets in locked rooms in HUD Headquarters, in the Personnel Security Division which is the office responsible for suitability determinations. Access to the records is limited to those employees who have a need for them in the performance of their official duties.

For Electronic Records: Comprehensive electronic records are kept in the Personnel Security Division. Access to the records are restricted to those with specific roles in the Personal Identity Verification (PIV) process, requires access to background investigation forms to perform their duties, and who have been given a password to access applicable file within the system including background investigation records. An electronic audit trail is maintained within system and reviewed periodically to identify and track authorized/unauthorized access. Persons given roles in the PIV process must complete training specific to their roles to ensure they are knowledgeable with regards to handling and safeguarding individually identifiable information.

For Electronic Records (cloud based): Comprehensive electronic records are secured and maintained on a cloud based software server and operating system that resides in Federal Risk and Authorization Management Program (FedRAMP) and Federal Information Security Management Act (FISMA) Moderate dedicated hosting environment. All data located in the cloud based server is firewalled and encrypted at rest and in transit. The security mechanisms for handing data at rest and in transit are in accordance with HUD encryption standards.

RECORD ACCESS PROCEDURES:

For information, assistance, or inquiry about records, contact John Bravacos, Senior Agency Official for Privacy, at 451 7th Street SW, Room 10139, U.S. Department of Housing and Urban Development, Washington, DC 20410-0001, telephone number 202-708-3054 (this is not a toll-free number). When seeking records about yourself from this system of records or any other Housing and Urban Development (HUD) system of records, your request must conform with the Privacy Act regulations set forth in 24 CFR part 16. You must first verify your identity, meaning that you must provide your full name, address, and date and place of birth. You must sign your request, and your signature must either be notarized or submitted under 28 U.S.C. 1746, a law that permits statements to be made, under penalty of perjury, as a substitute for notarization. In addition, your request should:

a. Explain why you believe HUD would have information on you.

b. Identify which Office of HUD you believe has the records about you.

c. Specify when you believe the records would have been created.

d. Provide any other information that will help the Freedom of Information Act (FOIA) staff determine which HUD office may have responsive records.

If your request is seeking records pertaining to another living individual, you must include a statement from that individual certifying their agreement for you to access their records. Without the above information, the HUD FOIA Office may not conduct an effective search, and your request may be denied due to lack of specificity or lack of compliance with regulations.

CONTESTING RECORD PROCEDURES:

The Department's rules for contesting contents of records and appealing initial denials appear in 24 CFR part 16, Procedures for Inquiries. Additional assistance may be obtained by contacting John Bravacos, Senior Agency Official for Privacy, at 451 7th Street SW, Room 10139; U.S. Department of Housing and Urban Development, Washington, DC 20410-0001, or the HUD Departmental Privacy Appeals Officers, Office of General Counsel, U.S. Department of Housing and Urban Development, 451 7th Street SW, Washington, DC 20410-0001.

NOTIFICATION PROCEDURES:

Individuals seeking notification of and access to any record contained in this system of records, or seeking to contest its content, may submit a request in writing to the component's FOIA Officer, whose contact information can be found at http://www.hud.gov/​foia under “contact.” If an individual believes more than one component maintains Privacy Act records concerning him or her, the individual may submit the request to the Chief Privacy Officer, HUD, 451 Seventh Street SW, Room 10139, Washington, DC 20410.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:

None.

HISTORY:

The PerSIST system replaces the legacy Personnel Security Files 2006.

Dated: April 19, 2018.

John Bravacos,

Senior Agency Official for Privacy.