2023-14789. Privacy Act of 1974; System of Records

AGENCY:

Office of Administration, HUD.

ACTION:

Notice of a new system of records.

SUMMARY:

Pursuant to the provisions of the Privacy Act of 1974, as amended, the Department of the Housing and Urban Development (HUD) is issuing a public notice of its intent to create the Office of PIH Privacy Act system of records, One Stop Customer Service. One Stop Customer Service (OSCS) is a stand-alone service management application. It is used by Real Estate Assessment Center Public and Indian Housing (REAC–PIH) Technical Assistance Center (TAC) to document the following from callers: Inquiries, comments & complaints and Answers pertaining to HUD programs that are provided to the callers. The purpose of OSCS is to serve as a central location for documenting information provided to callers relative to their inquiries, comments & complaints.

DATES:

Comments will be accepted on or before August 11, 2023. This proposed action will be effective on the date following the end of the comment period unless comments are received which result in a contrary determination.

ADDRESSES:

You may submit comments, identified by docket number by one of the following methods:

Federal e-Rulemaking Portal: http://www.regulations.gov. Follow the instructions provided on that site to submit comments electronically.

Fax: [phone].

Email: [e-mail].

Mail: Attention: Privacy Office; LaDonne White, Chief Privacy Officer; The Executive Secretariat; 451 Seventh Street SW, Room 10139; Washington, DC 20410–0001.

Instructions: All submissions received must include the agency name and docket number for this rulemaking. All comments received will be posted without change to http://www.regulations.gov. including any personal information provided.

Docket: For access to the docket to read background documents or comments received go to http://www.regulations.gov.

FOR FURTHER INFORMATION CONTACT:

LaDonne White; 451 Seventh Street SW, Room 10139; Washington, DC 20410–0001; telephone number 202–708–3054 (this is not a toll-free number). HUD welcomes and is prepared to receive calls from individuals who are deaf or hard of hearing, as well as individuals with speech or communication disabilities. To learn more about how to make an accessible telephone call, please visit: https://www.fcc.gov/​consumers/​guides/​telecommunications-relay-service-trs.

SUPPLEMENTARY INFORMATION:

The main objective of the TAC One Stop Customer Service (OSCS) Salesforce CRM (Customer Relationship Management) new System is to assist HUD in meeting its mission by providing improved customer accessibility to HUD-developed knowledge materials and support the REAC, specifically in the TAC processing of inbound inquiries regarding HUD Program Area products and services, federal regulations, business and program protocols, processes and procedures, technical questions, HUD Secured Systems access and security systems administration issues to support 400,000 internal and external users of HUD's Secure Systems applications.

The TAC also receives questions from the public and provides reference and referral services to respond to requests for information, from Departmental stakeholders and business partners, including Public Housing Agencies, Tribally Designated Housing Entities, Public and Indian Housing residents/resident entities, Housing program participants, HUD staff and other Federal, state and local government officials and employees. Given the need of all Federal agencies to do more with scarce program funds, the TAC provides HUD with the capabilities needed for a customer-service oriented Multi Channel Contact Management Center and the pathway to insuring cost-effective, high-quality customer service support requirements into the future.

SYSTEM NAME AND NUMBER:

One Stop Customer Service (OSCS). HUD–PIH 03.

SECURITY CLASSIFICATION:

Unclassified.

SYSTEM LOCATION:

The files are maintained at the following locations: Department of Housing and Urban Development, 451 Seventh Street SW, Washington, DC 20410.

SYSTEM MANAGER(S):

Office of Public and Indian Housing (PIH), Ashley Leia Sheriff, Deputy Assistant Secretary, Real Estate Assessment Center, 550 12th Street SW, Suite 100, Washington, DC 20410. 202–402–4162.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

Section 2 of The Department of Housing and Urban Development Act of 1965, 42 U.S.C. 3531, which establishes the Department “to encourage the solution of problems of housing [and] urban development . . . and to provide for full and appropriate consideration, at the national level, of the needs and interests of the Nation's communities and of the people who live and work in them.” This system is also authorized by Executive Order 12160 and the Housing and Community Development Act of 1974, Public Law 93–383.

PURPOSES OF THE SYSTEM:

The Department of Housing and Urban Development (HUD), Office of PIH maintains the “One Stop Customer Service” system of records. The purpose of OSCS is to serve as a central location for documenting information provided to callers relative to their inquiries, comments & complaints. Real Estate Assessment Center (REAC) Technical Assistance Center (TAC) business area is a multi-channel inquiry operation that supports HUD programs and activities under many Departmental offices, responding to approximately 150,000 inquiries annually from a broad range of internal and external HUD business partners and program participants. The TAC has been developed to be the Customer Service for REAC business areas, the primary customer-facing organization to program area business partners and participants in the offices of Multi-Family Housing and Public and Indian Housing (REAC–TAC) The information collected by OSCS assists is used for developing reports and trend analysis to ascertain the level of customer service provided to HUD clients.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

The TAC supports/serves the following types of Departmental business partners and general public individuals. Government (Local, state and federal entities), Public Housing Authority (Administrators, employees & residents), Real Property Owners (Multi-family Housing program participants), Other Real Estate Professionals (Appraisers, Investors, Real Estate CSRs, Property Inspectors) and Mortgage Banking Institutions.

CATEGORIES OF RECORDS IN THE SYSTEM:

Records consist of the following information. Callers Full Name, Property or Home Address, Telephone & Fax Number (if available), Email Address, User ID.

RECORD SOURCE CATEGORIES:

OSCS receives the data from HUD assisted housing residents, Independent Public Accountants, Contracted property inspectors for HUD assisted housing and Citizens through Phone, Webform, Email, Live Chat, Mail and Fax Communications.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND PURPOSES OF SUCH USES:

(1) To a congressional office from the record of an individual, in response to an inquiry from the congressional office made at the request of that individual.

(2) To the National Archives and Records Administration, Office of Government Information Services (OGIS), to the extent necessary to fulfill its responsibilities in 5 U.S.C. 552(h), to review administrative agency policies, procedures and compliance with the Freedom of Information Act (FOIA), and to facilitate OGIS' offering of mediation services to resolve disputes between persons making FOIA requests and administrative agencies.

(3) To Federal agencies, non-Federal entities, their employees, and agents (including contractors, their agents or employees; employees or contractors of the agents or designated agents); or contractors, their employees or agents with whom HUD has a contract, service agreement, grant, cooperative agreement, or computer matching agreement for the purpose of: (1) detection, prevention, and recovery of improper payments; (2) detection and prevention of fraud, waste, and abuse in major Federal programs administered by a Federal agency or non-Federal entity; (3) detection of fraud, waste, and abuse by individuals in their operations and programs; (4) for the purpose of establishing or verifying the eligibility of, or continuing compliance with statutory and regulatory requirements by, applicants for, recipients or beneficiaries of, participants in, or providers of services with respect to, cash or in-kind assistance or payments under Federal benefits programs or recouping payments or delinquent debts under such Federal benefits programs. Records under this routine use may be disclosed only to the extent that the information shared is necessary and relevant to verify pre-award and prepayment requirements prior to the release of Federal funds or to prevent and recover improper payments for services rendered under programs of HUD or of those Federal agencies and non-Federal entities to which HUD provides information under this routine use.

(4) To contractors, grantees, experts, consultants and their agents, or others performing or working under a contract, service, grant, cooperative agreement, or other agreement with HUD, when necessary to accomplish an agency function related to a system of records. Disclosure requirements are limited to only those data elements considered relevant to accomplishing an agency function. Contractors provided information under these routine use conditions are subject to Privacy Act requirements and disclosure limitations imposed on the Department. HUD staff and contractor personnel who handle the tiered production support for OSCS collect contact information so that they can process the exchange and if need be, escalate the issue within the support center to more specialized technicians.

(5) To contractors, experts and consultants with whom HUD has a contract, service agreement, or other assignment of the Department, when necessary to utilize relevant data for the purpose of testing new technology and systems designed to enhance program operations and performance.

(6) To appropriate agencies, entities, and persons when (1) HUD suspects or has confirmed that there has been a breached of the system of records, (2) HUD has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, (including its information systems, programs, and operations), the Federal Government, or national security; (3) and the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with HUD's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

(7) To another Federal agency or Federal entity, when HUD determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.

(8) To appropriate Federal, State, local, tribal, or other governmental agencies or multilateral governmental organizations responsible for investigating or prosecuting the violations of, or for enforcing or implementing, a statute, rule, regulation, order, or license, where HUD determines that the information would assist in the enforcement of civil or criminal laws and when such records, either alone or in conjunction with other information, indicate a violation or potential violation of law.

(9) To a court, magistrate, administrative tribunal, or arbitrator in the course of presenting evidence, including disclosures to opposing counsel or witnesses in the course of civil discovery, litigation, mediation, or settlement negotiations, or in connection with criminal law proceedings; when HUD determines that use of such records is relevant and necessary to the litigation and when any of the following is a party to the litigation or have an interest in such litigation: (1) HUD, or any component thereof; or (2) any HUD employee in his or her official capacity; or (3) any HUD employee in his or her individual capacity where HUD has agreed to represent the employee; or (4) the United States, or any agency thereof, where HUD determines that litigation is likely to affect HUD or any of its components.

(10) To any component of the Department of Justice or other Federal agency conducting litigation or in proceedings before any court, adjudicative, or administrative body, when HUD determines that the use of such records is relevant and necessary to the litigation and when any of the following is a party to the litigation or have an interest in such litigation: (1) HUD, or any component thereof; or (2) any HUD employee in his or her official capacity; or (3) any HUD employee in his or her individual capacity where the Department of Justice or agency conducting the litigation has agreed to represent the employee; or (4) the United States, or any agency thereof, where HUD determines that litigation is likely to affect HUD or any of its components.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:

Electronic records.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:

Individual name, email address, User ID, phone number.

POLICIES AND PRACTICIES FOR RETENTION AND DISPOSAL OF RECORDS:

GRS 5.2, item 10, Transitory records. The system's Disposition Instructions: Temporary. Destroy when no longer needed for business use, or according to agency predetermined period or business rule. Disposition Authority is: DAA–GRS–2017–0003–0001.

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:

One Stop Customer Service (OSCS) system implements on Salesforce Service Cloud on the Government Cloud Plus, which is a FedRamp approved platform. The Salesforce Government Cloud Plus was granted a Provisional Authority to Operate (P–ATO) by the FedRAMP Joint Authorization Board (JAB) for both Software as a Service (SaaS) and Platform as a Service (PaaS), consistent with the FedRAMP High control baseline. Testing was performed by an independent, third-party assessment organization (3PAO).

To obtain compliance with FedRAMP, Salesforce conducted security assessment and authorization activities in accordance with FedRAMP guidance and NIST SP 800–37. As part of this process Salesforce documented a System Security Plan (SSP) for the Salesforce Government Cloud Plus service offering. The SSP is developed in accordance with NIST SP 800–18. The SSP identifies control implementations for the Salesforce Government Cloud Plus and in-scope customer facing products according to the FedRAMP High baseline. A security assessment of the information system was conducted by a 3PAO in accordance with FedRAMP High requirements. The security assessment testing determined the adequacy of the management, operational, and technical security controls used to protect the confidentiality, integrity, and availability of Salesforce's Government Cloud Plus service offering and the Customer Data it stores, transmits and processes.

To maintain compliance with FedRAMP, Salesforce conducts continuous monitoring, which includes ongoing technical vulnerability detection, remediation of open compliance related findings, and at least annual independent assessment of security controls by a 3PAO.

Safeguards for unauthorized access to records is protected through role-based security for authorized users to have access only to the data to do their job they need as well as authentication into the system goes through HUD Active Directory Single Sign On to ensure proper identification of authorizing user. All server, security, storage, backup, and infrastructure equipment are monitored, restricted to only those with a need-to-have system access, including being secured by administrative password and authentication methods. Records in the system are electronic and stored on the FEDRAMP Salesforce Government Cloud. Only authorized users OSCS employees, contractors and have access to the records through the Salesforce SAAS web application and customers only have access to their data via Salesforce web portal. HUD's information technology partners in the Office of the Chief Information Officer (OCIO), Salesforce maintain the backups files of OSCS. Records are stored on secure servers administered by Salesforce. User's access, updates access, read-only access, and approval access based on the user's role and security access level. Further, all systems users must agree to abide by all HUD policies and federal laws and regulations.

RECORD ACCESS PROCEDURES:

Individuals requesting records of themselves should address written inquiries to the Department of Housing and Urban Development, 451 7th Street SW, Washington, DC 20410–0001. For verification, individuals should provide their full name, current address, and telephone number. In addition, the requester must provide either a notarized statement or an unsworn declaration made under 24 CFR 16.4.

CONTESTING RECORD PROCEDURES:

The HUD rule for contesting the content of any record pertaining to the individual by the individual concerned is published in 24 CFR 16.8 or may be obtained from the system manager.

NOTIFICATION PROCEDURES:

Individuals requesting notification of records of themselves should address written inquiries to the Department of Housing and Urban Development, 451 7th Street SW, Washington, DC 20410–0001. For verification purposes, individuals should provide their full name, office or organization where assigned, if applicable, and current address and telephone number. In addition, the requester must provide either a notarized statement or an unsworn declaration made under 24 CFR 16.4.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:

None.

HISTORY:

N/A.

LaDonne White,

Chief Privacy Officer, Office of Administration.